@noodleseed/one 0.122.0 → 0.124.0

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Noodle-side Google identities for the managed knowledge tier (ADR 0202 as amended): the
+ * Cloud Run runtime's ADC token impersonates the three least-privilege service accounts
+ * (provisioning is operator-only and never wired here; publication and search are). REST only —
+ * Apache packages never depend on `@google-cloud/*` — and tokens are cached until near expiry.
+ */
+import type { GoogleAccessTokenProvider } from '@noodle-borg/knowledge';
+/** The Cloud Run / GCE runtime identity via the metadata server (ADC). */
+export declare function metadataServiceTokenProvider(fetchImpl?: typeof fetch): GoogleAccessTokenProvider;
+/**
+ * Impersonate one least-privilege service account from a base identity that holds
+ * `roles/iam.serviceAccountTokenCreator` on it.
+ */
+export declare function impersonatedTokenProvider(base: GoogleAccessTokenProvider, serviceAccountEmail: string, fetchImpl?: typeof fetch): GoogleAccessTokenProvider;
+//# sourceMappingURL=google-identity.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-identity.d.ts","sourceRoot":"","sources":["../src/google-identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAYxE,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,KAAa,GAC9B,yBAAyB,CAgB3B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,yBAAyB,EAC/B,mBAAmB,EAAE,MAAM,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,yBAAyB,CA0B3B"}

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.js

@@ -0,0 +1,50 @@
+const METADATA_TOKEN_URL = 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token';
+const IAM_CREDENTIALS_ROOT = 'https://iamcredentials.googleapis.com/v1';
+const EXPIRY_SKEW_MS = 5 * 60 * 1000;
+/** The Cloud Run / GCE runtime identity via the metadata server (ADC). */
+export function metadataServiceTokenProvider(fetchImpl = fetch) {
+    let cached;
+    return async () => {
+        if (cached !== undefined && Date.now() < cached.expiresAt - EXPIRY_SKEW_MS) {
+            return cached.token;
+        }
+        const response = await fetchImpl(METADATA_TOKEN_URL, {
+            headers: { 'Metadata-Flavor': 'Google' },
+        });
+        if (!response.ok) {
+            throw new Error(`metadata token request returned HTTP ${response.status}`);
+        }
+        const body = (await response.json());
+        cached = { token: body.access_token, expiresAt: Date.now() + body.expires_in * 1000 };
+        return cached.token;
+    };
+}
+/**
+ * Impersonate one least-privilege service account from a base identity that holds
+ * `roles/iam.serviceAccountTokenCreator` on it.
+ */
+export function impersonatedTokenProvider(base, serviceAccountEmail, fetchImpl = fetch) {
+    let cached;
+    return async () => {
+        if (cached !== undefined && Date.now() < cached.expiresAt - EXPIRY_SKEW_MS) {
+            return cached.token;
+        }
+        const baseToken = await base();
+        const response = await fetchImpl(`${IAM_CREDENTIALS_ROOT}/projects/-/serviceAccounts/${encodeURIComponent(serviceAccountEmail)}:generateAccessToken`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${baseToken}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({ scope: ['https://www.googleapis.com/auth/cloud-platform'] }),
+        });
+        if (!response.ok) {
+            // Attributable without detail: the account and status only, never a response body.
+            throw new Error(`impersonation of ${serviceAccountEmail} returned HTTP ${response.status}`);
+        }
+        const body = (await response.json());
+        cached = { token: body.accessToken, expiresAt: Date.parse(body.expireTime) };
+        return cached.token;
+    };
+}
+//# sourceMappingURL=google-identity.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/google-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-identity.js","sourceRoot":"","sources":["../src/google-identity.ts"],"names":[],"mappings":"AAQA,MAAM,kBAAkB,GACtB,4FAA4F,CAAC;AAC/F,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAOrC,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAC1C,YAA0B,KAAK;IAE/B,IAAI,MAA+B,CAAC;IACpC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;YACnD,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;QACrF,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QACtF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAA+B,EAC/B,mBAA2B,EAC3B,YAA0B,KAAK;IAE/B,IAAI,MAA+B,CAAC;IACpC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,oBAAoB,+BAA+B,kBAAkB,CAAC,mBAAmB,CAAC,sBAAsB,EACnH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,SAAS,EAAE;gBACpC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE,CAAC;SACpF,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,mFAAmF;YACnF,MAAM,IAAI,KAAK,CAAC,oBAAoB,mBAAmB,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgD,CAAC;QACpF,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/http.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Minimal HTTP plumbing for knowledge route handlers. Byte-compatible with the service's
+ * wire behavior but deliberately independent of it — a module package never imports the
+ * service (the feedback-operations precedent).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
+export declare function readBody(req: IncomingMessage, maxBytes: number): Promise<{
+    ok: true;
+    body: Buffer;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+}>;
+//# sourceMappingURL=http.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGjF;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAYpF"}

package/node_modules/@noodle-borg/knowledge-operations/dist/http.js

@@ -0,0 +1,18 @@
+export function sendJson(res, status, body) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(body));
+}
+export async function readBody(req, maxBytes) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > maxBytes) {
+            return { ok: false, status: 413, error: `request body exceeds ${maxBytes} bytes` };
+        }
+        chunks.push(buffer);
+    }
+    return { ok: true, body: Buffer.concat(chunks) };
+}
+//# sourceMappingURL=http.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC7E,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,QAAQ,QAAQ,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AACnD,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Knowledge control-plane orchestration (ADR 0202 as amended). The service composes these
+ * behind its thin dispatch; the CLI never imports this package.
+ */
+export { type StringSecretBox, secretBoxDocumentCodec } from './codec.js';
+export { dispatchKnowledgeRequest, type KnowledgeDispatchDeps } from './dispatch.js';
+export { createKnowledgeSearchExecutor, type KnowledgeSearchComponent, type KnowledgeSearchExecutor, type KnowledgeSearchExecutorDeps, type KnowledgeSearchRequest, } from './executor.js';
+export { impersonatedTokenProvider, metadataServiceTokenProvider, } from './google-identity.js';
+export { readBody, sendJson } from './http.js';
+export { type ManagedGoogleKnowledge, managedGoogleFromEnv, managedSiteProvisioned, managedSiteSearchFor, } from './managed-google.js';
+export { type KnowledgeRouteRef, parseKnowledgePath } from './paths.js';
+export { createKnowledgeDeployHooks, type KnowledgeDeployFailure, type KnowledgeDeployHooks, KnowledgePublicationError, type KnowledgePublicationPlan, withKnowledgePublication, } from './publication.js';
+export { handleKnowledgeDocumentUpload, handleKnowledgePreflight, type KnowledgeRouteDeps, type KnowledgeTenantRef, knowledgeEnableCommand, knowledgeTenantKey, } from './routes.js';
+export { type BoundKnowledgeSearchPort, bindKnowledgeSearchPort, type KnowledgeSearchPortFactory, knowledgeSearchPortFactory, } from './search-port.js';
+export { budgetCeilingsResolver, buildKnowledgeRouteDeps, createPostgresKnowledgeStores, defaultKnowledgeStores, type KnowledgeServiceStores, wireKnowledge, } from './service-wiring.js';
+export { InMemoryKnowledgeStagingStore, type KnowledgeStagingStore, PostgresKnowledgeStagingStore, STAGING_TTL_MS, } from './staging-store.js';
+export { handleKnowledgeList, handleKnowledgeStatus, type KnowledgeStatusDeps, } from './status-routes.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,6BAA6B,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,wBAAwB,EAC7B,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,6BAA6B,EAC7B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/index.js

@@ -0,0 +1,18 @@
+/**
+ * Knowledge control-plane orchestration (ADR 0202 as amended). The service composes these
+ * behind its thin dispatch; the CLI never imports this package.
+ */
+export { secretBoxDocumentCodec } from './codec.js';
+export { dispatchKnowledgeRequest } from './dispatch.js';
+export { createKnowledgeSearchExecutor, } from './executor.js';
+export { impersonatedTokenProvider, metadataServiceTokenProvider, } from './google-identity.js';
+export { readBody, sendJson } from './http.js';
+export { managedGoogleFromEnv, managedSiteProvisioned, managedSiteSearchFor, } from './managed-google.js';
+export { parseKnowledgePath } from './paths.js';
+export { createKnowledgeDeployHooks, KnowledgePublicationError, withKnowledgePublication, } from './publication.js';
+export { handleKnowledgeDocumentUpload, handleKnowledgePreflight, knowledgeEnableCommand, knowledgeTenantKey, } from './routes.js';
+export { bindKnowledgeSearchPort, knowledgeSearchPortFactory, } from './search-port.js';
+export { budgetCeilingsResolver, buildKnowledgeRouteDeps, createPostgresKnowledgeStores, defaultKnowledgeStores, wireKnowledge, } from './service-wiring.js';
+export { InMemoryKnowledgeStagingStore, PostgresKnowledgeStagingStore, STAGING_TTL_MS, } from './staging-store.js';
+export { handleKnowledgeList, handleKnowledgeStatus, } from './status-routes.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAwB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAA8B,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,6BAA6B,GAK9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAEL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA0B,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EACL,0BAA0B,EAG1B,yBAAyB,EAEzB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EAGxB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,uBAAuB,EAEvB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EAEtB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,6BAA6B,EAE7B,6BAA6B,EAC7B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,oBAAoB,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Managed-bundled Google wiring (ADR 0202 as amended): resolve the Noodle-owned project and the
+ * two runtime-reachable identities (publication, search) from service environment, bind the
+ * sites-half adapter per tenant scope, and answer the honest site-provisioning question. The
+ * provisioning identity is deliberately unreachable from here — it exists only for the
+ * operator-run `scripts/knowledge-gcp-provision.mjs`.
+ */
+import { type GoogleAccessTokenProvider, type SiteSearch } from '@noodle-borg/knowledge';
+import type { KnowledgeTenantRef } from './routes.js';
+export interface ManagedGoogleKnowledge {
+    readonly project: string;
+    readonly location: string;
+    /** Reaches the deploy path only. */
+    readonly publicationTokens: GoogleAccessTokenProvider;
+    /** The only identity runtime execution may reach (ADR 0202 D9). */
+    readonly searchTokens: GoogleAccessTokenProvider;
+}
+/**
+ * Environment contract (set on the hosted service):
+ * `NOODLE_KNOWLEDGE_GCP_PROJECT` (required to enable the managed sites tier),
+ * `NOODLE_KNOWLEDGE_GCP_LOCATION` (default `global`),
+ * `NOODLE_KNOWLEDGE_PUBLICATION_SA` / `NOODLE_KNOWLEDGE_SEARCH_SA` (default the
+ * `knowledge-publication@` / `knowledge-search@` accounts in the project).
+ */
+export declare function managedGoogleFromEnv(env: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): ManagedGoogleKnowledge | undefined;
+export declare function managedSiteSearchFor(google: ManagedGoogleKnowledge, tenant: KnowledgeTenantRef): SiteSearch;
+/** Does the tenant's WEBSITE data store exist? Read with the search identity (viewer). */
+export declare function managedSiteProvisioned(google: ManagedGoogleKnowledge, tenant: KnowledgeTenantRef, fetchImpl?: typeof fetch): Promise<boolean>;
+//# sourceMappingURL=managed-google.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-google.d.ts","sourceRoot":"","sources":["../src/managed-google.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAEL,KAAK,yBAAyB,EAG9B,KAAK,UAAU,EAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;IACtD,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,GAAE,OAAO,KAAa,GAC9B,sBAAsB,GAAG,SAAS,CAgBpC;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,GACzB,UAAU,CAOZ;AAED,0FAA0F;AAC1F,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,EAC1B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.js

@@ -0,0 +1,53 @@
+/**
+ * Managed-bundled Google wiring (ADR 0202 as amended): resolve the Noodle-owned project and the
+ * two runtime-reachable identities (publication, search) from service environment, bind the
+ * sites-half adapter per tenant scope, and answer the honest site-provisioning question. The
+ * provisioning identity is deliberately unreachable from here — it exists only for the
+ * operator-run `scripts/knowledge-gcp-provision.mjs`.
+ */
+import { GOOGLE_SITE_COMPONENT, GoogleAgentSearchSites, googleDataStoreId, } from '@noodle-borg/knowledge';
+import { impersonatedTokenProvider, metadataServiceTokenProvider } from './google-identity.js';
+/**
+ * Environment contract (set on the hosted service):
+ * `NOODLE_KNOWLEDGE_GCP_PROJECT` (required to enable the managed sites tier),
+ * `NOODLE_KNOWLEDGE_GCP_LOCATION` (default `global`),
+ * `NOODLE_KNOWLEDGE_PUBLICATION_SA` / `NOODLE_KNOWLEDGE_SEARCH_SA` (default the
+ * `knowledge-publication@` / `knowledge-search@` accounts in the project).
+ */
+export function managedGoogleFromEnv(env, fetchImpl = fetch) {
+    const project = env.NOODLE_KNOWLEDGE_GCP_PROJECT;
+    if (project === undefined || project === '')
+        return undefined;
+    const location = env.NOODLE_KNOWLEDGE_GCP_LOCATION ?? 'global';
+    const base = metadataServiceTokenProvider(fetchImpl);
+    const publication = env.NOODLE_KNOWLEDGE_PUBLICATION_SA ??
+        `knowledge-publication@${project}.iam.gserviceaccount.com`;
+    const search = env.NOODLE_KNOWLEDGE_SEARCH_SA ?? `knowledge-search@${project}.iam.gserviceaccount.com`;
+    return {
+        project,
+        location,
+        publicationTokens: impersonatedTokenProvider(base, publication, fetchImpl),
+        searchTokens: impersonatedTokenProvider(base, search, fetchImpl),
+    };
+}
+export function managedSiteSearchFor(google, tenant) {
+    return new GoogleAgentSearchSites({
+        project: google.project,
+        location: google.location,
+        tokenProvider: google.searchTokens,
+        scope: { org: tenant.org, app: tenant.app, env: tenant.env },
+    });
+}
+/** Does the tenant's WEBSITE data store exist? Read with the search identity (viewer). */
+export async function managedSiteProvisioned(google, tenant, fetchImpl = fetch) {
+    const id = googleDataStoreId({ org: tenant.org, app: tenant.app, env: tenant.env }, GOOGLE_SITE_COMPONENT);
+    const token = await google.searchTokens();
+    const response = await fetchImpl(`https://discoveryengine.googleapis.com/v1/projects/${google.project}/locations/${google.location}/collections/default_collection/dataStores/${id}`, { headers: { authorization: `Bearer ${token}` } });
+    if (response.status === 404)
+        return false;
+    if (!response.ok) {
+        throw new Error(`site datastore check for ${id} returned HTTP ${response.status}`);
+    }
+    return true;
+}
+//# sourceMappingURL=managed-google.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/managed-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-google.js","sourceRoot":"","sources":["../src/managed-google.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EAErB,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAY/F;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAsB,EACtB,YAA0B,KAAK;IAE/B,MAAM,OAAO,GAAG,GAAG,CAAC,4BAA4B,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,6BAA6B,IAAI,QAAQ,CAAC;IAC/D,MAAM,IAAI,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,WAAW,GACf,GAAG,CAAC,+BAA+B;QACnC,yBAAyB,OAAO,0BAA0B,CAAC;IAC7D,MAAM,MAAM,GACV,GAAG,CAAC,0BAA0B,IAAI,oBAAoB,OAAO,0BAA0B,CAAC;IAC1F,OAAO;QACL,OAAO;QACP,QAAQ;QACR,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC;QAC1E,YAAY,EAAE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAA8B,EAC9B,MAA0B;IAE1B,OAAO,IAAI,sBAAsB,CAAC;QAChC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAA8B,EAC9B,MAA0B,EAC1B,YAA0B,KAAK;IAE/B,MAAM,EAAE,GAAG,iBAAiB,CAC1B,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACrD,qBAAqB,CACtB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,sDAAsD,MAAM,CAAC,OAAO,cAAc,MAAM,CAAC,QAAQ,8CAA8C,EAAE,EAAE,EACnJ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Knowledge route path parsing, owned here so the service keeps only a thin dispatch.
+ */
+import type { KnowledgeTenantRef } from './routes.js';
+export type KnowledgeRouteRef = {
+    readonly kind: 'preflight';
+    readonly tenant: KnowledgeTenantRef;
+} | {
+    readonly kind: 'document';
+    readonly tenant: KnowledgeTenantRef;
+    readonly sha256: string;
+} | {
+    readonly kind: 'list';
+    readonly tenant: KnowledgeTenantRef;
+} | {
+    readonly kind: 'status';
+    readonly tenant: KnowledgeTenantRef;
+    readonly component: string;
+};
+export declare function parseKnowledgePath(pathname: string): KnowledgeRouteRef | undefined;
+//# sourceMappingURL=paths.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAQjG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAkClF"}

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.js

@@ -0,0 +1,28 @@
+const PREFLIGHT = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge\/preflight$/;
+const DOCUMENT = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge\/documents\/([^/]+)$/;
+const LIST = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge$/;
+const STATUS = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/knowledge\/([^/]+)\/status$/;
+export function parseKnowledgePath(pathname) {
+    const preflight = PREFLIGHT.exec(pathname);
+    if (preflight !== null) {
+        const [, org, app, env] = preflight;
+        return { kind: 'preflight', tenant: { org, app, env } };
+    }
+    const list = LIST.exec(pathname);
+    if (list !== null) {
+        const [, org, app, env] = list;
+        return { kind: 'list', tenant: { org, app, env } };
+    }
+    const status = STATUS.exec(pathname);
+    if (status !== null) {
+        const [, org, app, env, component] = status;
+        return { kind: 'status', tenant: { org, app, env }, component };
+    }
+    const document = DOCUMENT.exec(pathname);
+    if (document !== null) {
+        const [, org, app, env, sha256] = document;
+        return { kind: 'document', tenant: { org, app, env }, sha256 };
+    }
+    return undefined;
+}
+//# sourceMappingURL=paths.js.map

package/node_modules/@noodle-borg/knowledge-operations/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAWA,MAAM,SAAS,GAAG,2EAA2E,CAAC;AAC9F,MAAM,QAAQ,GACZ,oFAAoF,CAAC;AACvF,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAC9E,MAAM,MAAM,GAAG,iFAAiF,CAAC;AAEjG,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,SAAwD,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAmD,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,MAMpC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,QAMjC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/node_modules/@noodle-borg/knowledge-operations/dist/publication.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The deploy-coupled knowledge publication transaction (ADR 0202): lease → resolve bytes or
+ * reuse → stage (bundled index + revision + durable sealed text) → verify a positive filtered
+ * query → activate + pin, paired with the caller's artifact persistence. Any failure retains
+ * the previous artifact + revision pair; retry is idempotent by content hash.
+ */
+import { type CompiledKnowledgeComponent, type KnowledgeScope, type SearchHit, type SearchRequest } from '@noodle-borg/knowledge';
+import { type KnowledgeTenantRef } from './routes.js';
+import type { KnowledgeServiceStores } from './service-wiring.js';
+export interface KnowledgeDeployFailure {
+    readonly code: string;
+    readonly path: string;
+    readonly message: string;
+}
+/** Structured publication failure the registry maps onto its deploy error shape. */
+export declare class KnowledgePublicationError extends Error {
+    readonly errors: readonly KnowledgeDeployFailure[];
+    constructor(errors: readonly KnowledgeDeployFailure[]);
+}
+interface PlannedComponent {
+    readonly component: CompiledKnowledgeComponent;
+    readonly scope: KnowledgeScope;
+    readonly revisionId: string;
+    readonly previousRevisionId?: string;
+    readonly lease: {
+        readonly scopeKey: string;
+        readonly leaseId: string;
+    };
+}
+export interface KnowledgePublicationPlan {
+    readonly components: readonly PlannedComponent[];
+}
+export interface KnowledgeDeployHooks {
+    publish(tenant: KnowledgeTenantRef, deploymentId: string, components: readonly CompiledKnowledgeComponent[]): Promise<KnowledgePublicationPlan>;
+    activate(plan: KnowledgePublicationPlan, deploymentId: string): Promise<void>;
+    /** Re-activate the previous revisions after a persistence failure. */
+    compensate(plan: KnowledgePublicationPlan, deploymentId: string): Promise<void>;
+    /** Release leases; always runs, success or failure. */
+    finish(plan: KnowledgePublicationPlan): Promise<void>;
+    /** Reselect every revision the deployment pinned; the bundled index rebuilds lazily. */
+    rollback(deploymentId: string): Promise<void>;
+    /** Search the active document revision, rebuilding the bundled index when stale. */
+    searchDocuments(scope: KnowledgeScope, componentName: string, request: SearchRequest): Promise<readonly SearchHit[]>;
+    /** Throttled GC: expired staging entries and unreferenced revisions. */
+    sweep(): Promise<void>;
+}
+export declare function createKnowledgeDeployHooks(stores: KnowledgeServiceStores, options: {
+    readonly knowledgeEnabled: (tenant: KnowledgeTenantRef) => Promise<boolean>;
+    /** Managed site datastore existence; when bound, a site() deploy fails before activation. */
+    readonly siteProvisioned?: (tenant: KnowledgeTenantRef) => Promise<boolean>;
+    readonly now?: () => Date;
+}): KnowledgeDeployHooks;
+/**
+ * Wrap the caller's persistence step in the full publication transaction. The order is the
+ * ADR 0202 pairing: stage + verify + activate the revision, persist the artifact, and on a
+ * persistence failure re-activate the previous revision so the retained pair stays coherent.
+ */
+export declare function withKnowledgePublication<T>(hooks: KnowledgeDeployHooks | undefined, tenant: KnowledgeTenantRef, deploymentId: string, components: readonly CompiledKnowledgeComponent[] | undefined, persist: () => Promise<T>): Promise<T>;
+export {};
+//# sourceMappingURL=publication.d.ts.map

package/node_modules/@noodle-borg/knowledge-operations/dist/publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.d.ts","sourceRoot":"","sources":["../src/publication.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,KAAK,0BAA0B,EAK/B,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,aAAa,EAEnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,kBAAkB,EAA8C,MAAM,aAAa,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,oFAAoF;AACpF,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAC;gBAEvC,MAAM,EAAE,SAAS,sBAAsB,EAAE;CAKtD;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CACL,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,SAAS,0BAA0B,EAAE,GAChD,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sEAAsE;IACtE,UAAU,CAAC,IAAI,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,uDAAuD;IACvD,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,wFAAwF;IACxF,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,oFAAoF;IACpF,eAAe,CACb,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACjC,wEAAwE;IACxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAOD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE;IACP,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B,GACA,oBAAoB,CAyNtB;AAMD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,KAAK,EAAE,oBAAoB,GAAG,SAAS,EACvC,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,EAC7D,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,CAAC,CAAC,CAgBZ"}

package/node_modules/@noodle-borg/knowledge-operations/dist/publication.js

@@ -0,0 +1,230 @@
+/**
+ * The deploy-coupled knowledge publication transaction (ADR 0202): lease → resolve bytes or
+ * reuse → stage (bundled index + revision + durable sealed text) → verify a positive filtered
+ * query → activate + pin, paired with the caller's artifact persistence. Any failure retains
+ * the previous artifact + revision pair; retry is idempotent by content hash.
+ */
+import { Bm25KnowledgeIndex, documentsContentHash, identityDocumentTextCodec, KnowledgeError, } from '@noodle-borg/knowledge';
+import { knowledgeEnableCommand, knowledgeTenantKey } from './routes.js';
+/** Structured publication failure the registry maps onto its deploy error shape. */
+export class KnowledgePublicationError extends Error {
+    errors;
+    constructor(errors) {
+        super(errors[0]?.message ?? 'knowledge publication failed');
+        this.name = 'KnowledgePublicationError';
+        this.errors = errors;
+    }
+}
+/** How long a cached active-revision check may serve before re-reading the durable store. */
+const ACTIVE_REVISION_TTL_MS = 5_000;
+/** Deploy-piggybacked GC cadence (the archive-sweeper pattern). */
+const SWEEP_INTERVAL_MS = 10 * 60 * 1000;
+export function createKnowledgeDeployHooks(stores, options) {
+    const index = new Bm25KnowledgeIndex();
+    const codec = stores.codec ?? identityDocumentTextCodec;
+    const now = options.now ?? (() => new Date());
+    const activeChecks = new Map();
+    let lastSweep = 0;
+    /** Staged text for a component, from durable revision text or transient staging. */
+    async function resolveDocuments(tenant, component, existingRevisionId) {
+        if (existingRevisionId !== undefined) {
+            try {
+                return [...(await stores.revisionStore.documents(existingRevisionId))];
+            }
+            catch {
+                // Reused revision without durable text (staged pre-migration or interrupted) — fall
+                // back to transient staging below.
+            }
+        }
+        const tenantKey = knowledgeTenantKey(tenant);
+        const documents = [];
+        for (const descriptor of component.documents) {
+            const sealed = await stores.staging.get(tenantKey, descriptor.sha256);
+            if (sealed === undefined) {
+                throw new KnowledgePublicationError([
+                    {
+                        code: 'knowledge_documents_missing',
+                        path: `knowledge.${component.name}.${descriptor.path}`,
+                        message: `knowledge document ${descriptor.path} has no staged bytes; ` +
+                            `run noodle deploy again to re-upload (retry is idempotent)`,
+                    },
+                ]);
+            }
+            documents.push({
+                descriptor: {
+                    path: descriptor.path,
+                    title: descriptor.title,
+                    ...(descriptor.sourceUrl !== undefined ? { sourceUrl: descriptor.sourceUrl } : {}),
+                    sha256: descriptor.sha256,
+                    bytes: descriptor.bytes,
+                },
+                text: (await codec.open(sealed)).toString('utf8'),
+            });
+        }
+        return documents;
+    }
+    /** Make sure the in-process index holds and activates the given revision. */
+    async function rebuildIndex(scope, componentName, revisionId) {
+        const current = await index.activeRevision(scope, componentName);
+        if (current?.revisionId === revisionId)
+            return;
+        const documents = await stores.revisionStore.documents(revisionId);
+        const staged = await index.stage(scope, componentName, documents);
+        if (staged.revisionId !== revisionId) {
+            throw new KnowledgeError('store', `rebuilt index revision ${staged.revisionId} does not match stored ${revisionId}`);
+        }
+        await index.activate(revisionId);
+    }
+    const hooks = {
+        async publish(tenant, deploymentId, components) {
+            const withDocuments = components.filter((component) => component.documents.length > 0);
+            if (components.length > 0 && !(await options.knowledgeEnabled(tenant))) {
+                throw new KnowledgePublicationError([
+                    {
+                        code: 'knowledge_not_enabled',
+                        path: 'knowledge',
+                        message: `knowledge is not enabled for this org/app/env; run: ${knowledgeEnableCommand(tenant)}`,
+                    },
+                ]);
+            }
+            const withSites = components.filter((component) => component.sites.length > 0);
+            if (withSites.length > 0 && options.siteProvisioned !== undefined) {
+                if (!(await options.siteProvisioned(tenant))) {
+                    throw new KnowledgePublicationError(withSites.map((component) => ({
+                        code: 'knowledge_site_not_provisioned',
+                        path: `knowledge.${component.name}`,
+                        message: `the managed site datastore for this tenant does not exist yet; an operator must ` +
+                            `run scripts/knowledge-gcp-provision.mjs --tenant ${tenant.org}/${tenant.app}/${tenant.env}, ` +
+                            `then check noodle knowledge status ${component.name}`,
+                    })));
+                }
+            }
+            const planned = [];
+            try {
+                for (const component of withDocuments) {
+                    const scope = { org: tenant.org, app: tenant.app, env: tenant.env };
+                    const lease = await stores.revisionStore.acquireLease(scope, component.name, deploymentId);
+                    const contentHash = documentsContentHash(component.documents.map((document) => document.sha256));
+                    const previous = await stores.revisionStore.active(scope, component.name);
+                    const reused = await stores.revisionStore.findByContentHash(scope, component.name, contentHash);
+                    const documents = await resolveDocuments(tenant, component, reused?.revisionId);
+                    const staged = await index.stage(scope, component.name, documents);
+                    const revision = reused ?? staged;
+                    await stores.revisionStore.stage({
+                        scope,
+                        componentName: component.name,
+                        contentHash,
+                        revision,
+                    });
+                    const verified = await index.verify(staged.revisionId, {
+                        audience: 'public',
+                        revision: staged.revisionId,
+                    });
+                    if (!verified) {
+                        throw new KnowledgePublicationError([
+                            {
+                                code: 'knowledge_verification_failed',
+                                path: `knowledge.${component.name}`,
+                                message: `knowledge component ${component.name} failed its positive filtered verification query`,
+                            },
+                        ]);
+                    }
+                    await stores.revisionStore.stageDocuments(revision.revisionId, documents);
+                    planned.push({
+                        component,
+                        scope,
+                        revisionId: revision.revisionId,
+                        ...(previous !== undefined ? { previousRevisionId: previous.revisionId } : {}),
+                        lease,
+                    });
+                }
+            }
+            catch (error) {
+                await hooks.finish({ components: planned });
+                throw error;
+            }
+            return { components: planned };
+        },
+        async activate(plan, deploymentId) {
+            for (const planned of plan.components) {
+                await stores.revisionStore.activate(planned.scope, planned.component.name, planned.revisionId, deploymentId);
+                await rebuildIndex(planned.scope, planned.component.name, planned.revisionId);
+                activeChecks.delete(knowledgeScopeCacheKey(planned.scope, planned.component.name));
+            }
+        },
+        async compensate(plan, deploymentId) {
+            for (const planned of plan.components) {
+                if (planned.previousRevisionId === undefined)
+                    continue;
+                // Pinning the previous revision to the failed deployment id is harmless: the record
+                // never persisted, and the pin only widens GC protection of the retained revision.
+                await stores.revisionStore.activate(planned.scope, planned.component.name, planned.previousRevisionId, deploymentId);
+                activeChecks.delete(knowledgeScopeCacheKey(planned.scope, planned.component.name));
+            }
+        },
+        async finish(plan) {
+            for (const planned of plan.components) {
+                await stores.revisionStore.releaseLease(planned.lease);
+            }
+        },
+        async rollback(deploymentId) {
+            const restored = await stores.revisionStore.rollback(deploymentId);
+            for (const revision of restored) {
+                activeChecks.delete(knowledgeScopeCacheKey(revision.scope, revision.componentName));
+            }
+        },
+        async searchDocuments(scope, componentName, request) {
+            const cacheKey = knowledgeScopeCacheKey(scope, componentName);
+            const cached = activeChecks.get(cacheKey);
+            let revisionId;
+            if (cached !== undefined && now().getTime() - cached.checkedAt <= ACTIVE_REVISION_TTL_MS) {
+                revisionId = cached.revisionId;
+            }
+            else {
+                revisionId = (await stores.revisionStore.active(scope, componentName))?.revisionId;
+                activeChecks.set(cacheKey, { revisionId, checkedAt: now().getTime() });
+            }
+            if (revisionId === undefined)
+                return [];
+            await rebuildIndex(scope, componentName, revisionId);
+            return index.search(scope, componentName, request);
+        },
+        async sweep() {
+            const at = now().getTime();
+            if (at - lastSweep < SWEEP_INTERVAL_MS)
+                return;
+            lastSweep = at;
+            await stores.staging.sweepExpired();
+            await stores.revisionStore.collectGarbage();
+        },
+    };
+    return hooks;
+}
+function knowledgeScopeCacheKey(scope, componentName) {
+    return `${scope.org}/${scope.app}/${scope.env}#${componentName}`;
+}
+/**
+ * Wrap the caller's persistence step in the full publication transaction. The order is the
+ * ADR 0202 pairing: stage + verify + activate the revision, persist the artifact, and on a
+ * persistence failure re-activate the previous revision so the retained pair stays coherent.
+ */
+export async function withKnowledgePublication(hooks, tenant, deploymentId, components, persist) {
+    if (hooks === undefined || components === undefined || components.length === 0) {
+        return persist();
+    }
+    const plan = await hooks.publish(tenant, deploymentId, components);
+    try {
+        await hooks.activate(plan, deploymentId);
+        const result = await persist();
+        void hooks.sweep().catch(() => undefined);
+        return result;
+    }
+    catch (error) {
+        await hooks.compensate(plan, deploymentId).catch(() => undefined);
+        throw error;
+    }
+    finally {
+        await hooks.finish(plan);
+    }
+}
+//# sourceMappingURL=publication.js.map