@pegma/knowledge-base-application 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pegma
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,141 @@
-# Temporary Holding Version
+# @pegma/knowledge-base-application
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+This unpublished KB-02/KB-03 source package composes contracts/core with
+host-supplied Storage Core, Authorization Core, Audit, and a clock. Source
+implementation and repository gates determine task completion; neither this
+package nor local tests establish a live host or production readiness.
+
+The [declared layout](https://github.com/pegma-dev/knowledge-base/blob/main/docs/COLLECTIONS.md) records the agreement made
+before durable operations. [Host composition](https://github.com/pegma-dev/knowledge-base/blob/main/docs/HOST_COMPOSITION.md) describes the host
+authentication, current-resource authorization, verified-evidence, and privacy
+boundaries. [Retrieval](https://github.com/pegma-dev/knowledge-base/blob/main/docs/RETRIEVAL.md)
+documents bounded lexical lookup, authoritative confirmation, citations, and
+repair. The optional `@pegma/knowledge-base-mcp` package adds HTTP/MCP adapters
+over this API; it supplies no login or token issuer. Real-host acceptance and
+production activation remain separately gated.
+
+GitHub links in this unpublished README track development `main`; they are
+not frozen version documentation. KB-05 release preparation must pin those
+references to verified release source before first publication.
+
+The application API owns authorized commands, application-generation CAS,
+bounded immutable revision/evidence history, exact review/publication,
+transactional Audit/receipts/causal jobs, bounded retrieval/repair, and safe
+published-content DTOs.
+Collections own audience policy; articles inherit it without per-article ACLs.
+Role models, token issuance, sessions, HTTP, provider SDKs, arbitrary URL
+fetching, code execution, and a new database are outside this package.
+
+Passing evidence requires a host-authenticated verifier receipt bound to the
+exact submitted evidence. Echoing caller-supplied `passed`, runner identity,
+or an attestation object does not establish proof. Command replay likewise
+rechecks current permission and resource authority before returning a result.
+Never expose raw aggregates or private evidence/source references to customers
+or a support model.
+
+## Composition and commands
+
+`createKnowledgeBaseApplication` takes `store` and `clock`, with optional
+`limits`, `evidenceVerifier`, `privateSources`, and nested `retrieval` settings.
+Hosts authenticate callers
+and resolve current scoped `AccessContext` values. The
+[public types](https://github.com/pegma-dev/knowledge-base/blob/main/packages/application/src/types.ts) define commands and purpose-specific results;
+the package owns no HTTP routes or credentials.
+
+Creates use `expectedGeneration: 0`; later mutations use exact application
+generation, which also advances for evidence/review/provenance changes.
+Content revision advances only when content changes. All mutation inputs
+include a stable `commandId` and observability `correlationId`. The service
+derives actor/time from the trusted context and clock.
+
+Collection/validation/governance commands establish private defaults, current
+validation requirements, staging applicability, and trusted attesters. Article
+commands create/update drafts, submit verified evidence and review, publish an
+exact `ReviewSnapshot`, reject, retire, set private provenance, or revoke an
+exact historical proof. The snapshot includes the core approval binding plus
+article/source/governance generations.
+
+`CommandResult` returns `{ value, replayed }`, where `value` is a bounded
+historical acknowledgement. It contains no body/evidence/provenance. Replay
+rechecks current operation/resource authority, conflicts on changed semantic
+input, and does not claim the historical result is currently servable.
+
+## Reads and trust
+
+`getDraft`, `getEvidence`, `getProvenance`, and `getReview` have distinct
+permissions and DTOs. Private references additionally require current source
+resource authorization. `getValidationRequirements` gives authorized authors
+current kind-specific checks, policy reference, and staging build without
+disclosing trusted attester IDs. `getPublishedArticle` is a portal-safe keyed read:
+it checks the published collection's current portal audience and returns only
+approved content/safe metadata. It is not KB-03 search or bot-only retrieval.
+
+`EvidenceVerifier.verify` authenticates an opaque receipt against the entire
+submission, authenticated actor, exact article, and governance configuration.
+It returns trusted attestation facts or null. A missing verifier fails closed.
+`PrivateSourcesVerifier.canRead` controls private reference disclosure;
+`canPublish` and `isCurrent` independently attest source eligibility without
+making source tickets readable to customers. Missing required gates fail
+closed for nonempty source snapshots.
+
+An existing publication retains its own review/source snapshot and exact
+historical proof references while a new draft is prepared. Replacing current
+evidence does not revoke an old proof; explicit revocation holds an affected
+publication and clears pending review. Current reads reject stale governance
+or source authority. Retained evidence freshness is checked at the recorded
+approval time; later aging alone does not expire an approved guide. New review
+and publication use current time, while current policy/source eligibility,
+proof availability, and revocation remain live checks. Article CAS cannot
+globally fence separate collection/
+validation-policy partitions.
+
+## Bounded retrieval and repair
+
+`listPortalCollections` and `searchPublishedArticles` require current portal
+authority. `retrieveAnswerSources` and `confirmAnswerSources` use the effective
+customer's `articleRead`, `botRead`, independent bot audience, and exact product
+applicability. Read results report `results` or `no_result`, never candidate
+totals. Titles, snippets, content, and citations come from freshly confirmed
+publications rather than index text. Bot-only citations have a safe label;
+`portalArticle` appears only when that customer can also browse the article.
+
+The default lexical projection uses approved titles, summaries, and tags, not
+body text. Requests use only bounded keyed reads. Optional
+`retrieval.candidateAdapter` hints remain untrusted; the host adapter must
+report all physical work, including empty pages and discarded rows.
+Adapters may match approved body text/synonyms with zero metadata overlap;
+bounded preselection preserves their order, and confirmed metadata scores
+rank results with adapter-order ties. Hosts own relevance evaluation and
+provider data controls; current publication checks remain mandatory.
+`retrieval.tokenCounter` is a trusted local counter over the complete
+`serializedSources` returned with `sourceTokens`. Retrieval fits the largest
+ranked prefix of whole articles within aggregate byte/token budgets with a
+positive local count; reconfirmation is exact and all-or-nothing.
+`retrieval.limits` can only lower fixed component ceilings.
+See [retrieval](https://github.com/pegma-dev/knowledge-base/blob/main/docs/RETRIEVAL.md)
+for the exact API, limits, authority/reference fences, and evaluation boundary.
+
+`repairArticleIndex`, `repairRetrievalPage`, and `getArticleIndexStatus` require
+`indexManage`. Only maintenance performs bounded physical scans with opaque
+cursors. Pending/blocked status remains visible until repair converges;
+`ready` with `indexed: false` means a converged withdrawal. Projection cleanup
+may lag retirement/revocation, but current authority checks still reject
+ineligible publications. The host owns scheduling and recovery.
+
+## Storage and limits
+
+All accepted head changes, immutable rows, generic Audit actions, receipts, and
+causal jobs share one resource partition in `knowledge-base.records.v1`.
+Native flat chunk properties keep bounded rows compatible with the host's
+store adapter. The application separately bounds physical rows, encoded bytes,
+history, transaction work, retries, and control reserve. Read the
+[layout limits](https://github.com/pegma-dev/knowledge-base/blob/main/docs/COLLECTIONS.md#physical-representation-and-hard-bounds)
+before changing admission or retention; these are component safety bounds,
+not measured host throughput. No private persistence or parallel audit log is
+implemented here.
+
+Merging source does not publish a package. Hosts must wait for the exact public
+release and normal release/host activation gates. See
+[release operations](https://github.com/pegma-dev/knowledge-base/blob/main/docs/RELEASING.md).
+
+Built in the open by RetireGolden, LLC.

package/dist/articles.d.ts

@@ -0,0 +1,10 @@
+import type { KnowledgeRepository } from "./repository.js";
+import type { KnowledgeBaseApplication, KnowledgeBaseServiceOptions } from "./types.js";
+type ArticleMethods = Pick<KnowledgeBaseApplication, "createDraft" | "updateDraft" | "submitEvidence" | "submitForReview" | "publishArticle" | "rejectReview" | "retireArticle" | "setProvenance" | "revokeEvidence">;
+/**
+ * Instance-wide staff authoring permissions are explicit. Portal/bot audience
+ * authorization is applied by the separate safe-read services.
+ */
+export declare function createArticleServices(repository: KnowledgeRepository, options: KnowledgeBaseServiceOptions): ArticleMethods;
+export {};
+//# sourceMappingURL=articles.d.ts.map

package/dist/articles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"articles.d.ts","sourceRoot":"","sources":["../src/articles.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iBAAiB,CAAC;AAWzB,OAAO,KAAK,EAIV,wBAAwB,EACxB,2BAA2B,EAI5B,MAAM,YAAY,CAAC;AAEpB,KAAK,cAAc,GAAG,IAAI,CACxB,wBAAwB,EACtB,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,eAAe,GACf,eAAe,GACf,gBAAgB,CACnB,CAAC;AAoLF;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,2BAA2B,GACnC,cAAc,CAogBhB"}

package/dist/articles.js

@@ -0,0 +1,454 @@
+import { knowledgePermissions, } from "@pegma/knowledge-base-contracts";
+import { createArticle, KnowledgeBaseError, publishArticle as publishCoreArticle, recordEvidence, rejectReview as rejectCoreReview, retireArticle as retireCoreArticle, reviseArticle, submitForReview as submitCoreReview, } from "@pegma/knowledge-base-core";
+import { KnowledgeBaseNotFoundError, KnowledgeBasePrerequisiteError, requirePermission, } from "./errors.js";
+import { loadGovernanceContext } from "./governance.js";
+import { maximumRecordNativeBytes } from "./records.js";
+import { canonicalJson, fingerprint, RepositoryCapacityError, RepositoryConflictError, RepositoryIntegrityError, requireGeneration, requireIdentifier, snapshotData, } from "./storage-helpers.js";
+const commandFields = [
+    "commandId",
+    "correlationId",
+    "expectedGeneration",
+    "articleId",
+];
+const maximumSourceReferences = 32;
+function boundedText(value, field, maximum = 1_000) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > maximum ||
+        value.trim() !== value ||
+        /[\u0000-\u001f\u007f]/u.test(value))
+        throw new TypeError(field + " must be bounded nonempty text");
+}
+function allowedFields(value, allowed, field) {
+    if (value === null ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        Object.keys(value).some((key) => !allowed.includes(key)))
+        throw new TypeError(field + " contains unsupported fields");
+}
+function commandSnapshot(access, input, permission, extra) {
+    const caller = snapshotData(access);
+    requirePermission(caller, permission);
+    const encoded = canonicalJson(input);
+    if (new TextEncoder().encode(encoded).byteLength > maximumRecordNativeBytes) {
+        throw new RepositoryCapacityError("command_bytes");
+    }
+    const command = JSON.parse(encoded);
+    allowedFields(command, [...commandFields, ...extra], "command");
+    requireIdentifier(caller.principalId, "principalId");
+    requireIdentifier(command.articleId, "articleId");
+    requireIdentifier(command.commandId, "commandId");
+    requireIdentifier(command.correlationId, "correlationId");
+    requireGeneration(command.expectedGeneration);
+    return { access: caller, input: command };
+}
+function requireArticle(current) {
+    if (current === null)
+        throw new KnowledgeBaseNotFoundError("article");
+    return current;
+}
+function nextState(current) {
+    const { generation: _generation, ...next } = current;
+    return next;
+}
+function withoutPendingReview(current) {
+    const { review: _review, ...next } = nextState(current);
+    return {
+        ...next,
+        article: current.article.state === "in-review"
+            ? rejectCoreReview(current.article, current.article.current.number)
+            : current.article,
+    };
+}
+function acknowledgement(result) {
+    return {
+        value: {
+            id: result.value.article.id,
+            generation: result.value.generation,
+            articleRevision: result.value.article.current.number,
+            state: result.value.article.state,
+            contentHash: result.value.article.current.contentHash,
+        },
+        replayed: result.replayed,
+    };
+}
+function validateReferences(references) {
+    if (!Array.isArray(references) ||
+        references.length > maximumSourceReferences) {
+        throw new RepositoryCapacityError("source_references");
+    }
+    const ids = new Set();
+    for (const reference of references) {
+        allowedFields(reference, ["id", "system", "resourceId", "version"], "source reference");
+        for (const [field, value] of Object.entries(reference)) {
+            boundedText(value, "source." + field, 200);
+            if (value.includes("://"))
+                throw new TypeError("Source references must use opaque identifiers");
+        }
+        for (const field of ["id", "system", "resourceId", "version"]) {
+            requireIdentifier(reference[field], "source." + field);
+        }
+        if (ids.has(reference.id))
+            throw new TypeError("Source reference ids must be unique");
+        ids.add(reference.id);
+    }
+}
+async function sourceSnapshot(generation, references) {
+    requireGeneration(generation, 1);
+    validateReferences(references);
+    const fields = { generation, references: snapshotData(references) };
+    return { ...fields, hash: await fingerprint(fields) };
+}
+async function verifySourceSnapshot(snapshot) {
+    requireGeneration(snapshot.generation, 1);
+    validateReferences(snapshot.references);
+    if (snapshot.hash !==
+        (await fingerprint({
+            generation: snapshot.generation,
+            references: snapshot.references,
+        })))
+        throw new RepositoryIntegrityError();
+}
+function rejectRevokedCurrentEvidence(current) {
+    if (current.revokedEvidence.some((revocation) => revocation.articleRevision === current.article.current.number &&
+        current.article.evidence.some((evidence) => evidence.id === revocation.id &&
+            evidence.version === revocation.version &&
+            evidence.hash === revocation.hash))) {
+        throw new KnowledgeBaseError("evidence", "evidence", "Current evidence has been revoked");
+    }
+}
+/**
+ * Instance-wide staff authoring permissions are explicit. Portal/bot audience
+ * authorization is applied by the separate safe-read services.
+ */
+export function createArticleServices(repository, options) {
+    async function sourcesEligible(article, snapshot) {
+        await verifySourceSnapshot(snapshot);
+        if (snapshot.references.length === 0)
+            return;
+        const verifier = options.privateSources;
+        if (typeof verifier?.canPublish !== "function" ||
+            typeof verifier.isCurrent !== "function")
+            throw new KnowledgeBasePrerequisiteError("private-source-verifier");
+        try {
+            const request = {
+                article: snapshotData(article),
+                snapshot: snapshotData(snapshot),
+            };
+            if ((await verifier.isCurrent(snapshotData(request))) !== true ||
+                (await verifier.canPublish(snapshotData(request))) !== true) {
+                throw new KnowledgeBasePrerequisiteError("source-eligibility");
+            }
+        }
+        catch {
+            throw new KnowledgeBasePrerequisiteError("source-eligibility");
+        }
+    }
+    async function requireSourceAccess(access, articleId, references) {
+        validateReferences(references);
+        if (references.length === 0)
+            return;
+        const verifier = options.privateSources;
+        if (typeof verifier?.canRead !== "function") {
+            throw new KnowledgeBasePrerequisiteError("private-source-verifier");
+        }
+        for (const reference of references) {
+            try {
+                if ((await verifier.canRead({
+                    access: snapshotData(access),
+                    articleId,
+                    reference: snapshotData(reference),
+                })) !== true)
+                    throw new KnowledgeBasePrerequisiteError("source-access");
+            }
+            catch {
+                throw new KnowledgeBasePrerequisiteError("source-access");
+            }
+        }
+    }
+    async function execute(access, input, permission, operation, extraFields, decide, control = false, create = false) {
+        const request = commandSnapshot(access, input, permission, extraFields);
+        if (create
+            ? request.input.expectedGeneration !== 0
+            : request.input.expectedGeneration < 1) {
+            throw new RepositoryConflictError();
+        }
+        const command = {
+            commandId: request.input.commandId,
+            correlationId: request.input.correlationId,
+            actorId: request.access.principalId,
+            operation,
+            fingerprint: await fingerprint({
+                actorId: request.access.principalId,
+                operation,
+                payload: Object.fromEntries(Object.entries(request.input).filter(([field]) => field !== "commandId" && field !== "correlationId")),
+            }),
+            occurredAt: options.clock.now(),
+        };
+        const result = await repository.executeArticle({
+            id: request.input.articleId,
+            expectedGeneration: request.input.expectedGeneration,
+            command,
+            control,
+            recheck: async (current) => {
+                requirePermission(request.access, permission);
+                if (!create)
+                    requireArticle(current);
+                // Authoring is instance-wide, but an ordinary operation/replay still
+                // confirms its current collection exists. Safety withdrawals do not
+                // depend on unrelated collection/provider configuration being healthy.
+                if (current !== null && !control) {
+                    const collection = await repository.readCollectionVersioned(current.article.current.collectionId);
+                    if (collection === null)
+                        throw new KnowledgeBaseNotFoundError("collection");
+                }
+            },
+            decide: async (current, generation) => decide(current, generation, request.input, request.access),
+        });
+        return acknowledgement(result);
+    }
+    return {
+        createDraft(access, input) {
+            return execute(access, input, knowledgePermissions.draftWrite, "article.create", ["collectionId", "draft"], async (current, _generation, command, caller) => {
+                if (current !== null)
+                    throw new RepositoryConflictError();
+                requireIdentifier(command.collectionId, "collectionId");
+                const governance = await loadGovernanceContext(repository, command.collectionId, options.clock.now());
+                const article = await createArticle({
+                    id: command.articleId,
+                    draft: command.draft,
+                    context: { ...governance.context, actorId: caller.principalId },
+                });
+                return {
+                    next: {
+                        article,
+                        provenance: await sourceSnapshot(1, []),
+                        publicationHeld: false,
+                        revokedEvidence: [],
+                    },
+                };
+            }, false, true);
+        },
+        updateDraft(access, input) {
+            return execute(access, input, knowledgePermissions.draftWrite, "article.update", ["collectionId", "draft"], async (current, _generation, command, caller) => {
+                const stored = requireArticle(current);
+                requireIdentifier(command.collectionId, "collectionId");
+                const governance = await loadGovernanceContext(repository, command.collectionId, options.clock.now());
+                const article = await reviseArticle(stored.article, {
+                    expectedRevision: stored.article.current.number,
+                    draft: command.draft,
+                    context: { ...governance.context, actorId: caller.principalId },
+                });
+                return { next: { ...withoutPendingReview(stored), article } };
+            });
+        },
+        submitEvidence(access, input) {
+            return execute(access, input, knowledgePermissions.evidenceSubmit, "article.evidence.submit", ["evidence", "receipt"], async (current, _generation, command, caller) => {
+                const stored = requireArticle(current);
+                boundedText(command.receipt, "receipt", 8_192);
+                allowedFields(command.evidence, [
+                    "id",
+                    "articleId",
+                    "articleRevision",
+                    "contentHash",
+                    "validationPolicy",
+                    "checkId",
+                    "testKind",
+                    "applicability",
+                    "stagingBuildId",
+                    "steps",
+                    "result",
+                    "executedAt",
+                    "runnerId",
+                    "artifacts",
+                ], "evidence submission");
+                const verifier = options.evidenceVerifier;
+                if (typeof verifier?.verify !== "function") {
+                    throw new KnowledgeBasePrerequisiteError("evidence-verifier");
+                }
+                const before = await loadGovernanceContext(repository, stored.article.current.collectionId, options.clock.now());
+                const collection = await repository.readCollectionVersioned(stored.article.current.collectionId);
+                if (collection?.value.configuration === undefined) {
+                    throw new KnowledgeBasePrerequisiteError("governance-configuration");
+                }
+                let attestation;
+                try {
+                    const verified = await verifier.verify({
+                        access: snapshotData(caller),
+                        article: snapshotData(stored.article.current),
+                        submission: snapshotData(command.evidence),
+                        receipt: command.receipt,
+                        configuration: snapshotData(collection.value.configuration),
+                    });
+                    attestation =
+                        verified === null || verified === undefined
+                            ? null
+                            : snapshotData(verified);
+                }
+                catch {
+                    throw new KnowledgeBasePrerequisiteError("evidence-verifier");
+                }
+                if (attestation === null || attestation === undefined) {
+                    throw new KnowledgeBasePrerequisiteError("evidence-verifier");
+                }
+                const after = await loadGovernanceContext(repository, stored.article.current.collectionId, options.clock.now());
+                if (before.governanceGeneration !== after.governanceGeneration ||
+                    before.validationGeneration !== after.validationGeneration ||
+                    collection.value.generation !== before.governanceGeneration)
+                    throw new RepositoryConflictError();
+                const article = await recordEvidence(stored.article, {
+                    evidence: command.evidence,
+                    attestation,
+                    context: after.context,
+                });
+                return { next: { ...withoutPendingReview(stored), article } };
+            });
+        },
+        submitForReview(access, input) {
+            return execute(access, input, knowledgePermissions.reviewSubmit, "article.review.submit", [], async (current, generation) => {
+                const stored = requireArticle(current);
+                rejectRevokedCurrentEvidence(stored);
+                const before = await loadGovernanceContext(repository, stored.article.current.collectionId, options.clock.now());
+                await sourcesEligible(stored.article.current, stored.provenance);
+                const after = await loadGovernanceContext(repository, stored.article.current.collectionId, options.clock.now());
+                if (before.governanceGeneration !== after.governanceGeneration ||
+                    before.validationGeneration !== after.validationGeneration)
+                    throw new RepositoryConflictError();
+                const article = await submitCoreReview(stored.article, {
+                    expectedRevision: stored.article.current.number,
+                    context: after.context,
+                });
+                if (article.review === undefined)
+                    throw new RepositoryIntegrityError();
+                const review = {
+                    articleGeneration: generation,
+                    binding: article.review,
+                    sourceSnapshotHash: stored.provenance.hash,
+                    sourceGeneration: stored.provenance.generation,
+                    governanceGeneration: after.governanceGeneration,
+                };
+                return { next: { ...nextState(stored), article, review } };
+            });
+        },
+        publishArticle(access, input) {
+            return execute(access, input, knowledgePermissions.publish, "article.publish", ["review"], async (current, _generation, command, caller) => {
+                const stored = requireArticle(current);
+                rejectRevokedCurrentEvidence(stored);
+                if (stored.review === undefined ||
+                    stored.review.articleGeneration !== stored.generation ||
+                    canonicalJson(stored.review) !== canonicalJson(command.review) ||
+                    stored.review.sourceGeneration !== stored.provenance.generation ||
+                    stored.review.sourceSnapshotHash !== stored.provenance.hash)
+                    throw new RepositoryConflictError();
+                const before = await loadGovernanceContext(repository, stored.article.current.collectionId, options.clock.now());
+                if (before.governanceGeneration !== stored.review.governanceGeneration) {
+                    throw new RepositoryConflictError();
+                }
+                await sourcesEligible(stored.article.current, stored.provenance);
+                const after = await loadGovernanceContext(repository, stored.article.current.collectionId, options.clock.now());
+                if (before.governanceGeneration !== after.governanceGeneration ||
+                    before.validationGeneration !== after.validationGeneration)
+                    throw new RepositoryConflictError();
+                const article = await publishCoreArticle(stored.article, {
+                    expectedRevision: stored.article.current.number,
+                    binding: stored.review.binding,
+                    reviewerId: caller.principalId,
+                    context: after.context,
+                });
+                return {
+                    next: {
+                        ...withoutPendingReview(stored),
+                        article,
+                        publicationHeld: false,
+                        publishedProvenance: stored.provenance,
+                        publicationReview: stored.review,
+                    },
+                };
+            });
+        },
+        rejectReview(access, input) {
+            return execute(access, input, knowledgePermissions.review, "article.review.reject", ["reason"], async (current, _generation, command) => {
+                const stored = requireArticle(current);
+                boundedText(command.reason, "reason");
+                const article = rejectCoreReview(stored.article, stored.article.current.number);
+                return {
+                    next: { ...withoutPendingReview(stored), article },
+                    auditDetails: { reason: command.reason },
+                };
+            });
+        },
+        retireArticle(access, input) {
+            return execute(access, input, knowledgePermissions.retire, "article.retire", [], async (current) => {
+                const stored = requireArticle(current);
+                const { publishedProvenance: _publishedProvenance, publicationReview: _publicationReview, ...rest } = withoutPendingReview(stored);
+                return {
+                    next: {
+                        ...rest,
+                        article: retireCoreArticle(stored.article, stored.article.current.number),
+                        publicationHeld: true,
+                    },
+                };
+            }, true);
+        },
+        setProvenance(access, input) {
+            return execute(access, input, knowledgePermissions.provenanceWrite, "article.provenance.set", ["references"], async (current, _generation, command, caller) => {
+                const stored = requireArticle(current);
+                await requireSourceAccess(caller, command.articleId, command.references);
+                const provenance = await sourceSnapshot(stored.provenance.generation + 1, command.references);
+                return { next: { ...withoutPendingReview(stored), provenance } };
+            });
+        },
+        revokeEvidence(access, input) {
+            return execute(access, input, knowledgePermissions.evidenceRevoke, "article.evidence.revoke", [
+                "articleRevision",
+                "evidenceId",
+                "evidenceVersion",
+                "evidenceHash",
+                "reason",
+            ], async (current, _generation, command, caller) => {
+                const stored = requireArticle(current);
+                requireGeneration(command.articleRevision, 1);
+                requireGeneration(command.evidenceVersion, 1);
+                requireIdentifier(command.evidenceId, "evidenceId");
+                boundedText(command.reason, "reason");
+                if (!/^[a-f0-9]{64}$/u.test(command.evidenceHash))
+                    throw new TypeError("Evidence hash must be SHA-256");
+                const evidence = await repository.getEvidenceVersion(command.articleId, command.articleRevision, command.evidenceId, command.evidenceVersion);
+                if (evidence === null || evidence.hash !== command.evidenceHash) {
+                    throw new KnowledgeBaseNotFoundError("evidence");
+                }
+                if (stored.revokedEvidence.some((marker) => marker.hash === evidence.hash)) {
+                    throw new RepositoryConflictError();
+                }
+                const revocation = {
+                    articleRevision: evidence.articleRevision,
+                    id: evidence.id,
+                    version: evidence.version,
+                    hash: evidence.hash,
+                    reason: command.reason,
+                    revokedBy: caller.principalId,
+                    revokedAt: options.clock.now(),
+                };
+                const published = stored.article.published;
+                const referencesPublished = published !== undefined &&
+                    published.revision.number === evidence.articleRevision &&
+                    published.approval.binding.evidence.some((binding) => binding.id === evidence.id &&
+                        binding.version === evidence.version &&
+                        binding.hash === evidence.hash);
+                return {
+                    next: {
+                        ...withoutPendingReview(stored),
+                        publicationHeld: stored.publicationHeld || referencesPublished,
+                        revokedEvidence: [...stored.revokedEvidence, revocation],
+                    },
+                    auditDetails: {
+                        evidenceId: evidence.id,
+                        evidenceVersion: evidence.version,
+                        reason: command.reason,
+                    },
+                };
+            }, true);
+        },
+    };
+}
+//# sourceMappingURL=articles.js.map