@stackfactor/client-api 1.19.3 → 1.20.1

package/dist/cjs/lib/knowledgeBase.js

@@ -1,1234 +1,37 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.listSourceMappings = exports.dismissAllArtifacts = exports.dismissArtifact = exports.retireArtifact = exports.regenerateArtifact = exports.decideContradiction = exports.listContradictions = exports.regenerateGenerated = exports.rejectGenerated = exports.editApproveGenerated = exports.approveGenerated = exports.listGeneratedReview = exports.deleteQuarantine = exports.reingestQuarantine = exports.decideQuarantine = exports.releaseQuarantine = exports.listReleased = exports.listQuarantine = exports.getReviewOverview = exports.rightToBeForgotten = exports.updateComplianceProfile = exports.getComplianceProfile = exports.updateRedactionPolicy = exports.getRedactionPolicy = exports.revokeAccess = exports.grantAccess = exports.listAccess = exports.deleteDocument = exports.groupMicroSkills = exports.getMicroSkillGrouping = exports.listMicroSkills = exports.getSkillSuggestions = exports.getSkillCoverage = exports.setSkillMappings = exports.listSkills = exports.getDocumentImage = exports.getDocument = exports.listDocuments = exports.testSource = exports.reprocessSource = exports.syncSource = exports.deleteSource = exports.updateSource = exports.addSource = exports.listSourceConnectors = exports.deleteKnowledgeBase = exports.updateKnowledgeBase = exports.getKnowledgeBase = exports.createKnowledgeBase = exports.listKnowledgeBases = void 0;
-exports.resolveSourceMappings = exports.updateSourceMapping = void 0;
-const axiosClient_js_1 = require("./axiosClient.js");
-// ── Knowledge Base CRUD ───────────────────────────────────────────────────────
-/**
- * List the knowledge bases the caller can see.
- * GET /api/v1/knowledge-base
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listKnowledgeBases = (authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listKnowledgeBases = listKnowledgeBases;
-/**
- * Create a knowledge base (the creator becomes owner automatically). Requires the
- * global CREATE_KNOWLEDGE_BASE capability.
- * POST /api/v1/knowledge-base
- * @param {KnowledgeBaseInput} data KB metadata (at minimum `name`)
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const createKnowledgeBase = (data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base`, data, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.createKnowledgeBase = createKnowledgeBase;
-/**
- * Get a single knowledge base (plus stats).
- * GET /api/v1/knowledge-base/:id
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const getKnowledgeBase = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getKnowledgeBase = getKnowledgeBase;
-/**
- * Update a knowledge base's metadata. Owner or editor only. Does not touch
- * `access[]`, `sources`, or `createdBy` — those have their own gated flows.
- * PUT /api/v1/knowledge-base/:id
- * @param {String} id The knowledge base id
- * @param {KnowledgeBaseInput} data The fields to update
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const updateKnowledgeBase = (id, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.put(`/api/v1/knowledge-base/${id}`, data, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.updateKnowledgeBase = updateKnowledgeBase;
-/**
- * Delete a knowledge base (cascades to its chunks). Owner only.
- * DELETE /api/v1/knowledge-base/:id
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const deleteKnowledgeBase = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.delete(`/api/v1/knowledge-base/${id}`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.deleteKnowledgeBase = deleteKnowledgeBase;
-// ── Source Management ─────────────────────────────────────────────────────────
-/**
- * List the available KB_SOURCE_CONNECTOR integrations (enabled integrations +
- * capability manifests for the source-creation form).
- * GET /api/v1/knowledge-base/source-connectors
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listSourceConnectors = (authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/source-connectors`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listSourceConnectors = listSourceConnectors;
 //
-// Between `listSourceConnectors` and `addSource` sit three calls that act on the
-// CONNECTOR itself rather than on a knowledge base — asking it what it accepts,
-// how the user signs in, and how much data is behind the resulting credentials.
-// Those live in the `knowledgeBaseSourceConnectors` module (they take a
-// connection id, not a KB id, and are mounted under
-// /api/v1/exceed/knowledgebasesourceconnectors).
+// Knowledge Base management operations.
 //
-/**
- * Add a source to a knowledge base (`integrationId` + credentials +
- * `syncFrequencyDays`, default 7). Publishes a kb-source-event (changeType="add").
- * POST /api/v1/knowledge-base/:id/sources
- * @param {String} id The knowledge base id
- * @param {object} source The source configuration
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const addSource = (id, source, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/sources`, source, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.addSource = addSource;
-/**
- * Update a knowledge base source. Publishes a kb-source-event per changed source.
- * PUT /api/v1/knowledge-base/:id/sources/:sourceId
- * @param {String} id The knowledge base id
- * @param {String} sourceId The source id
- * @param {object} source The updated source configuration
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const updateSource = (id, sourceId, source, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.put(`/api/v1/knowledge-base/${id}/sources/${sourceId}`, source, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.updateSource = updateSource;
-/**
- * Remove a source from a knowledge base. Publishes a kb-source-event
- * (changeType="delete").
- * DELETE /api/v1/knowledge-base/:id/sources/:sourceId
- * @param {String} id The knowledge base id
- * @param {String} sourceId The source id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const deleteSource = (id, sourceId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.delete(`/api/v1/knowledge-base/${id}/sources/${sourceId}`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.deleteSource = deleteSource;
-/**
- * Trigger a manual re-sync of a source. Publishes a kb-source-event
- * (changeType="update", trigger="manual_sync").
- * POST /api/v1/knowledge-base/:id/sources/:sourceId/sync
- * @param {String} id The knowledge base id
- * @param {String} sourceId The source id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const syncSource = (id, sourceId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/sources/${sourceId}/sync`, {}, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.syncSource = syncSource;
-/**
- * Process every processed document of a source again — classification, labels,
- * chunks and embeddings redone — on a run of the source. Quarantined and blocked
- * documents are left as they are. A run starts now, or a follow-up run is owed
- * while one is outstanding (trigger="reprocess").
- * POST /api/v1/knowledge-base/:id/sources/:sourceId/reprocess
- * @param {String} id The knowledge base id
- * @param {String} sourceId The source id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>} { ok, documents, correlationId, started }: how many
- *   documents were marked, the run, and whether it started now
- */
-const reprocessSource = (id, sourceId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/sources/${sourceId}/reprocess`, {}, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.reprocessSource = reprocessSource;
-/**
- * Test a source's connector credentials (dispatches TEST_CONNECTION).
- * POST /api/v1/knowledge-base/:id/sources/:sourceId/test
- * @param {String} id The knowledge base id
- * @param {String} sourceId The source id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const testSource = (id, sourceId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/sources/${sourceId}/test`, {}, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.testSource = testSource;
-// ── Document Management ───────────────────────────────────────────────────────
-/**
- * List a knowledge base's documents (paginated, with status + lastSync). There is
- * no upload endpoint — documents are only ingested via configured sources.
- * GET /api/v1/knowledge-base/:id/documents
- * @param {String} id The knowledge base id
- * @param {DocumentListParams} params Optional pagination / status filters
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listDocuments = (id, params, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/documents`, {
-            headers: { authorization: authToken },
-            params: params,
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listDocuments = listDocuments;
-/**
- * Get one knowledge base document and what the RAG holds for it: its chunks,
- * after redaction, in order (the first 1000; `truncated` says when there are
- * more). No chunks while the document is not processed, or is held for review
- * or blocked. Needs the knowledge base access search needs, and the
- * document's own source permissions (403); 404 when either is missing.
- * GET /api/v1/knowledge-base/:id/documents/:docId
- * @param {String} id The knowledge base id
- * @param {String} docId The document id
- * @param {String} authToken Authentication token
- * @returns {Promise<KnowledgeBaseDocumentContent>}
- */
-const getDocument = (id, docId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/documents/${docId}`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getDocument = getDocument;
-/**
- * Get the picture of one image passage (chunk) of a knowledge base document,
- * for the document's page: a chunk `getDocument` answered with `hasImage`.
- * Its preview unless `size` is "full", which is the stored original (often
- * several MB: ask for it only to show the picture full size). The same access
- * as `getDocument` applies (403), and only while its chunks are shown; 404
- * when the passage has no picture to show. Answered `private, no-cache`, so
- * the platform judges access each time it is asked.
- * GET /api/v1/knowledge-base/:id/documents/:docId/chunks/:chunkId/image[?size=full]
- * @param {String} id The knowledge base id
- * @param {String} docId The document id
- * @param {String} chunkId The image chunk id
- * @param {String} authToken Authentication token
- * @param {DocumentImageSize} size Optional: "full" for the stored original;
- *   the preview otherwise
- * @returns {Promise<Blob>} The picture, typed by what it is: the preview is
- *   WebP, or the original's own type when no preview could be made; the full
- *   picture is the original's type
- */
-const getDocumentImage = (id, docId, chunkId, authToken, size) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/documents/${docId}/chunks/${chunkId}/image`, {
-            headers: { authorization: authToken },
-            responseType: "blob",
-            ...(size ? { params: { size } } : {}),
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getDocumentImage = getDocumentImage;
-/**
- * List the skills a knowledge base's content was labelled with, across its
- * processed documents, most named first: `{ items, total, limit }`, each item
- * `{ name, nameNormalized, scope, proficiencyLevels, documentCount }`, where
- * `scope` is "organization", "general" or null (labelled before skills had one).
- * GET /api/v1/knowledge-base/:id/skills
- * @param {String} id The knowledge base id
- * @param {SkillListParams} params Optional limit
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listSkills = (id, params, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/skills`, {
-            headers: { authorization: authToken },
-            params: params,
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listSkills = listSkills;
-/**
- * Set how a knowledge base's skills are named, and rename them on every
- * document and chunk already labelled; every document labelled later takes
- * them too. The mappings replace the ones before; an empty list gives back
- * every skill as labelling named it. Owner or editor only; refused while a sync
- * of one of its sources is under way (409) and for mappings that do not hold —
- * a skill mapped twice, or mappings that lead a skill back to itself (400).
- * PUT /api/v1/knowledge-base/:id/skill-mappings
- * @param {String} id The knowledge base id
- * @param {SkillMapping[]} skillMappings The mappings, `[{ from, to }]`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>} { knowledgeBase, documents, chunks }: the knowledge
- *   base with the mappings as stored, and how many documents and chunks were
- *   rewritten
- */
-const setSkillMappings = (id, skillMappings, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.put(`/api/v1/knowledge-base/${id}/skill-mappings`, { skillMappings }, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.setSkillMappings = setSkillMappings;
-/**
- * What the knowledge bases the caller can open hold about one skill: how many
- * of their documents name it (any spelling, under the names set with Edit
- * skill names), in which knowledge bases, and the microskills their passages
- * cover. The skill and skill template Additional Information dialogs ask it
- * before they offer StackFactor as a data source. Only what the caller may
- * open counts: their role on each knowledge base and each document's source
- * permissions decide. Requires VIEW_KNOWLEDGE_BASE; the name must be 1 to 200
- * characters (400 otherwise).
- * GET /api/v1/knowledge-base/skill-coverage
- * @param {String} skill The skill's or skill template's name
- * @param {String} authToken Authentication token
- * @returns {Promise<SkillCoverage>}
- */
-const getSkillCoverage = (skill, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/skill-coverage`, {
-            headers: { authorization: authToken },
-            params: { skill },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getSkillCoverage = getSkillCoverage;
-/**
- * The skill names the knowledge bases the caller can open suggest while a
- * skill's or skill template's name is typed: the skills their documents were
- * classified with whose name has a word starting with what was typed, in any
- * spelling ("gov" suggests "AI Governance"), one per skill, most documents
- * first. Only what the caller may open counts, as for `getSkillCoverage`.
- * Fewer than 2 characters to match answer no suggestions. Requires
- * VIEW_KNOWLEDGE_BASE; `q` is at most 200 characters (400 otherwise).
- * GET /api/v1/knowledge-base/skill-suggestions
- * @param {String} q What was typed
- * @param {SkillSuggestionParams} params Optional limit, catalog and the id of
- *   the skill or skill template being edited
- * @param {String} authToken Authentication token
- * @returns {Promise<SkillSuggestion[]>}
- */
-const getSkillSuggestions = (q, params, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/skill-suggestions`, {
-            headers: { authorization: authToken },
-            params: { ...params, q },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getSkillSuggestions = getSkillSuggestions;
-/**
- * One of a knowledge base's skills, opened on its page: its microskills, as
- * grouped, each with how many passages teach it, most first, and where the
- * knowledge base's grouping stands (`grouping`). Any spelling of the skill
- * matches. Requires VIEW_KNOWLEDGE_BASE and a role on the knowledge base; the
- * name must be 1 to 200 characters (400 otherwise).
- * GET /api/v1/knowledge-base/:id/skills/micro-skills
- * @param {String} id The knowledge base id
- * @param {String} skill The skill's name
- * @param {String} authToken Authentication token
- * @returns {Promise<KnowledgeBaseMicroSkills>}
- */
-const listMicroSkills = (id, skill, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/skills/micro-skills`, {
-            headers: { authorization: authToken },
-            params: { skill },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listMicroSkills = listMicroSkills;
-/**
- * Where a knowledge base's microskill grouping stands: queued, running or
- * idle, and when the last one ended. What a page polls while a grouping is
- * under way, rather than `listMicroSkills`: the platform reads the knowledge
- * base and nothing else. Requires VIEW_KNOWLEDGE_BASE and a role on the
- * knowledge base.
- * GET /api/v1/knowledge-base/:id/skills/micro-skills/grouping
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<KnowledgeBaseMicroSkillGrouping>}
- */
-const getMicroSkillGrouping = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/skills/micro-skills/grouping`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getMicroSkillGrouping = getMicroSkillGrouping;
-/**
- * Group now: groups the knowledge base's skills' passage tags into their
- * microskills, in the background. Owner or editor only, as setting how its
- * skills are named (403 otherwise; 404 for no such knowledge base). Asked
- * while a grouping runs, nothing more is asked: the answer is that it is
- * running. `getMicroSkillGrouping` says when it is done (no longer queued or
- * running). The skills whose grouping failed are sent again now.
- * POST /api/v1/knowledge-base/:id/skills/micro-skills/group
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<KnowledgeBaseMicroSkillGrouping>} Where the grouping
- *   stands: queued or running, and when the last one ended
- */
-const groupMicroSkills = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/skills/micro-skills/group`, {}, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.groupMicroSkills = groupMicroSkills;
-/**
- * Delete a single document (cascades to chunks + S3 images + dependent entity
- * flags).
- * DELETE /api/v1/knowledge-base/:id/documents/:docId
- * @param {String} id The knowledge base id
- * @param {String} docId The document id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const deleteDocument = (id, docId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.delete(`/api/v1/knowledge-base/${id}/documents/${docId}`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.deleteDocument = deleteDocument;
-// ── KB Access Management (owner only) ─────────────────────────────────────────
-/**
- * List a knowledge base's access entries.
- * GET /api/v1/knowledge-base/:id/access
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listAccess = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/access`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listAccess = listAccess;
-/**
- * Grant (upsert) an access entry. Owner only. Access is keyed by
- * `(subjectType, subjectId)`, so re-granting a subject that already has an entry
- * updates its role — there is no separate "update role" endpoint.
- * POST /api/v1/knowledge-base/:id/access
- * @param {String} id The knowledge base id
- * @param {AccessEntryInput} entry The `{ subjectType, subjectId, role }` grant
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const grantAccess = (id, entry, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/access`, entry, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.grantAccess = grantAccess;
-/**
- * Revoke a subject's access. Owner only. Keyed by `(subjectType, subjectId)` — the
- * same composite key `grantAccess` upserts on. The backend refuses to remove the
- * last owner.
- * DELETE /api/v1/knowledge-base/:id/access
- * @param {String} id The knowledge base id
- * @param {String} subjectType One of `KNOWLEDGE_BASE.SUBJECT_TYPE`
- * @param {String} subjectId The subject whose access is revoked
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const revokeAccess = (id, subjectType, subjectId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.delete(`/api/v1/knowledge-base/${id}/access`, {
-            headers: { authorization: authToken },
-            data: { subjectType: subjectType, subjectId: subjectId },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.revokeAccess = revokeAccess;
-// ── Compliance + Redaction Configuration ──────────────────────────────────────
-/**
- * Read a knowledge base's redaction policy.
- * GET /api/v1/knowledge-base/:id/redaction-policy
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const getRedactionPolicy = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/redaction-policy`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getRedactionPolicy = getRedactionPolicy;
-/**
- * Set a knowledge base's per-KB redaction behavior + DLP provider.
- * PUT /api/v1/knowledge-base/:id/redaction-policy
- * @param {String} id The knowledge base id
- * @param {object} policy The redaction policy
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const updateRedactionPolicy = (id, policy, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.put(`/api/v1/knowledge-base/${id}/redaction-policy`, policy, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.updateRedactionPolicy = updateRedactionPolicy;
-/**
- * Read the tenant's compliance profile (admin only). Governs which RAG processors
- * a KB may route to (e.g. HIPAA tenants → BAA-eligible processors only).
- * GET /api/v1/tenants/compliance-profile
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const getComplianceProfile = (authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/tenants/compliance-profile`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getComplianceProfile = getComplianceProfile;
-/**
- * Update the tenant's compliance profile (admin only; not exposed via the KB UI).
- * PUT /api/v1/tenants/compliance-profile
- * @param {object} profile The compliance profile
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const updateComplianceProfile = (profile, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.put(`/api/v1/tenants/compliance-profile`, profile, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.updateComplianceProfile = updateComplianceProfile;
-/**
- * Trigger a GDPR subject-purge ("right to be forgotten"; admin only).
- * POST /api/v1/compliance/right-to-be-forgotten
- * @param {object} data The subject-purge request
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const rightToBeForgotten = (data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/compliance/right-to-be-forgotten`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.rightToBeForgotten = rightToBeForgotten;
-// ── Review Center — overview ──────────────────────────────────────────────────
-/**
- * Overview of all Review Center streams + counts for a knowledge base.
- * GET /api/v1/knowledge-base/:id/review
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const getReviewOverview = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/review`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.getReviewOverview = getReviewOverview;
-// ── Review Center — Stream 1: Quarantine release ──────────────────────────────
-/**
- * List QUARANTINED documents (Review Center stream 1).
- * GET /api/v1/knowledge-base/:id/review/quarantine
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listQuarantine = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/review/quarantine`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listQuarantine = listQuarantine;
-/**
- * List the documents released from review (Review Center stream 1): every one
- * released and not held again since, the newest release first, each with
- * `quarantineReleasedAt` and `quarantineReleasedByName` (who released it, or
- * null). Requires RELEASE_QUARANTINE + owner|editor, as the held list does.
- * GET /api/v1/knowledge-base/:id/review/quarantine?state=released
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listReleased = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/review/quarantine`, { headers: { authorization: authToken }, params: { state: "released" } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listReleased = listReleased;
-/**
- * Release a quarantined document. Requires RELEASE_QUARANTINE + owner|editor.
- * POST /api/v1/knowledge-base/:id/review/quarantine/:docId/release
- * @param {String} id The knowledge base id
- * @param {String} docId The document id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const releaseQuarantine = (id, docId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/quarantine/${docId}/release`, {}, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.releaseQuarantine = releaseQuarantine;
-/**
- * Apply a reviewer's decisions to many held documents at once: release each
- * named document back through ingestion, keep it in quarantine as reviewed, or
- * block it from the knowledge base. One run per source released into is asked
- * for, never one per document. Requires RELEASE_QUARANTINE + owner|editor.
- * POST /api/v1/knowledge-base/:id/review/quarantine/decisions
- * @param {String} id The knowledge base id
- * @param {Array<{documentId: string, decision: "release"|"quarantine"|"block", reason?: string}>} decisions One decision per document, at most 500
- * @param {String} authToken Authentication token
- * @returns {Promise<object>} `{ results: [{ documentId, decision, outcome }], runs: [{ sourceId, correlationId, started }] }`
- */
-const decideQuarantine = (id, decisions, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/quarantine/decisions`, { decisions }, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.decideQuarantine = decideQuarantine;
-/**
- * Re-ingest a quarantined document (optionally with an updated redaction policy).
- * Publishes a kb-source-event (trigger="quarantine_re_ingest"). Requires
- * RELEASE_QUARANTINE + owner.
- * POST /api/v1/knowledge-base/:id/review/quarantine/:docId/re-ingest
- * @param {String} id The knowledge base id
- * @param {String} docId The document id
- * @param {object} data Optional body, e.g. `{ updatedRedactionPolicy }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const reingestQuarantine = (id, docId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/quarantine/${docId}/re-ingest`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.reingestQuarantine = reingestQuarantine;
-/**
- * Delete a quarantined document. Requires RELEASE_QUARANTINE + owner.
- * POST /api/v1/knowledge-base/:id/review/quarantine/:docId/delete
- * @param {String} id The knowledge base id
- * @param {String} docId The document id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const deleteQuarantine = (id, docId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/quarantine/${docId}/delete`, {}, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.deleteQuarantine = deleteQuarantine;
-// ── Review Center — Stream 2: Generated content review ────────────────────────
-/**
- * List generated artifacts awaiting review (needsReview=true).
- * Requires GENERATE_FROM_KB + owner|editor.
- * GET /api/v1/knowledge-base/:id/review/generated
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listGeneratedReview = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/review/generated`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listGeneratedReview = listGeneratedReview;
-/**
- * Approve a generated artifact. Requires GENERATE_FROM_KB + owner|editor.
- * POST /api/v1/knowledge-base/:id/review/generated/:entityId/approve
- * @param {String} id The knowledge base id
- * @param {String} entityId The artifact/entity id
- * @param {object} data Body `{ entityType, notes? }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const approveGenerated = (id, entityId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/generated/${entityId}/approve`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.approveGenerated = approveGenerated;
-/**
- * Approve a generated artifact with edits.
- * Requires GENERATE_FROM_KB + owner|editor.
- * POST /api/v1/knowledge-base/:id/review/generated/:entityId/edit-approve
- * @param {String} id The knowledge base id
- * @param {String} entityId The artifact/entity id
- * @param {object} data Body `{ entityType, edits, notes? }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const editApproveGenerated = (id, entityId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/generated/${entityId}/edit-approve`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.editApproveGenerated = editApproveGenerated;
-/**
- * Reject a generated artifact. Requires GENERATE_FROM_KB + owner|editor.
- * POST /api/v1/knowledge-base/:id/review/generated/:entityId/reject
- * @param {String} id The knowledge base id
- * @param {String} entityId The artifact/entity id
- * @param {object} data Body `{ entityType, reason }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const rejectGenerated = (id, entityId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/generated/${entityId}/reject`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.rejectGenerated = rejectGenerated;
-/**
- * Regenerate a generated artifact using current chunks.
- * Requires GENERATE_FROM_KB + owner|editor.
- * POST /api/v1/knowledge-base/:id/review/generated/:entityId/regenerate
- * @param {String} id The knowledge base id
- * @param {String} entityId The artifact/entity id
- * @param {object} data Body `{ entityType, regenerationHints? }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const regenerateGenerated = (id, entityId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/generated/${entityId}/regenerate`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.regenerateGenerated = regenerateGenerated;
-// ── Review Center — Stream 3: Contradiction flags ─────────────────────────────
-/**
- * List chunks with non-empty contradictionFlags[].
- * Requires GENERATE_FROM_KB + owner|editor.
- * GET /api/v1/knowledge-base/:id/review/contradictions
- * @param {String} id The knowledge base id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listContradictions = (id, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/knowledge-base/${id}/review/contradictions`, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listContradictions = listContradictions;
-/**
- * Decide a contradiction between two chunks.
- * Requires GENERATE_FROM_KB + owner|editor.
- * POST /api/v1/knowledge-base/:id/review/contradictions/:chunkId/decide
- * @param {String} id The knowledge base id
- * @param {String} chunkId The chunk id carrying the contradiction flag
- * @param {object} data Body `{ decision, otherChunkId, notes }` — `decision` is one
- *   of `KNOWLEDGE_BASE.CONTRADICTION_DECISION`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const decideContradiction = (id, chunkId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/knowledge-base/${id}/review/contradictions/${chunkId}/decide`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.decideContradiction = decideContradiction;
-// ── Out-of-Sync Notification Actions ──────────────────────────────────────────
-// (design §14 / §14A — surfaced as notifications, acted on per-artifact.
-//  Requires GENERATE_FROM_KB + owner|editor on the KB.)
-/**
- * Regenerate a stale artifact from a notification using current chunks.
- * POST /api/v1/notifications/:notificationId/artifacts/:artifactId/regenerate
- * @param {String} notificationId The notification id
- * @param {String} artifactId The artifact id
- * @param {object} data Body `{ entityType }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const regenerateArtifact = (notificationId, artifactId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/notifications/${notificationId}/artifacts/${artifactId}/regenerate`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.regenerateArtifact = regenerateArtifact;
-/**
- * Retire (soft-delete) a stale artifact from a notification.
- * POST /api/v1/notifications/:notificationId/artifacts/:artifactId/retire
- * @param {String} notificationId The notification id
- * @param {String} artifactId The artifact id
- * @param {object} data Body `{ entityType }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const retireArtifact = (notificationId, artifactId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/notifications/${notificationId}/artifacts/${artifactId}/retire`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.retireArtifact = retireArtifact;
-/**
- * Dismiss a stale-artifact flag (mark the staleness acceptable).
- * POST /api/v1/notifications/:notificationId/artifacts/:artifactId/dismiss
- * @param {String} notificationId The notification id
- * @param {String} artifactId The artifact id
- * @param {object} data Body `{ entityType, reason? }`
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const dismissArtifact = (notificationId, artifactId, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/notifications/${notificationId}/artifacts/${artifactId}/dismiss`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.dismissArtifact = dismissArtifact;
-/**
- * Dismiss an entire out-of-sync notification (all artifacts).
- * POST /api/v1/notifications/:notificationId/dismiss-all
- * @param {String} notificationId The notification id
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const dismissAllArtifacts = (notificationId, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/notifications/${notificationId}/dismiss-all`, {}, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.dismissAllArtifacts = dismissAllArtifacts;
-// ── Identity Mapping ──────────────────────────────────────────────────────────
-// (design §14 — maps source-side principals to tenant users for KB source ACLs.)
-/**
- * List the current user's source-side identities.
- * GET /api/v1/identity/source-mappings
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const listSourceMappings = (authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.get(`/api/v1/identity/source-mappings`, {
-            headers: { authorization: authToken },
-        });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.listSourceMappings = listSourceMappings;
-/**
- * Tenant-admin override for a user's source identity mapping.
- * PUT /api/v1/identity/source-mappings/:sourceType
- * @param {String} sourceType The source type key
- * @param {object} data The mapping override
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const updateSourceMapping = (sourceType, data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.put(`/api/v1/identity/source-mappings/${sourceType}`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
-};
-exports.updateSourceMapping = updateSourceMapping;
-/**
- * Bulk-resolve source principal IDs → tenant users (internal / service-to-service).
- * POST /api/v1/identity/source-mappings/resolve
- * @param {object} data Body carrying the principal IDs to resolve
- * @param {String} authToken Authentication token
- * @returns {Promise<object>}
- */
-const resolveSourceMappings = (data, authToken) => {
-    return new Promise((resolve, reject) => {
-        const request = axiosClient_js_1.client.post(`/api/v1/identity/source-mappings/resolve`, data, { headers: { authorization: authToken } });
-        request
-            .then((response) => {
-            resolve(response.data);
-        })
-            .catch((error) => {
-            reject(error);
-        });
-    });
+// Thin client wrappers over the user-facing KB *management* endpoints
+// (design §14 — "KB management endpoints ... remain user-facing; they configure
+// the KB, they don't perform RAG"). RAG retrieval / Q&A / generation are
+// internal-only and intentionally NOT exposed here.
+//
+// Sections mirror design §14: CRUD · Sources · Documents · Access · Compliance &
+// Redaction · Review Center (3 streams) · Out-of-Sync Notification Actions ·
+// Identity Mapping.
+//
+// The operations live in `./knowledgeBase/`, one module per area; this file
+// re-exports all of them so every import path and name stays as it was.
+//
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
-exports.resolveSourceMappings = resolveSourceMappings;
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./knowledgeBase/knowledgeBases.js"), exports);
+__exportStar(require("./knowledgeBase/sources.js"), exports);
+__exportStar(require("./knowledgeBase/documents.js"), exports);
+__exportStar(require("./knowledgeBase/skills.js"), exports);
+__exportStar(require("./knowledgeBase/review.js"), exports);
 //# sourceMappingURL=knowledgeBase.js.map