@warmdrift/kgauto-compiler 2.0.0-alpha.6 → 2.0.0-alpha.60

package/README.md

@@ -89,6 +89,101 @@ await record({
 });
 ```
 
+### `probeShadow()` — measure a swap candidate from an AI-SDK route (alpha.48)
+
+`call()` runs a full-IR shadow probe internally (`shadowProbe` option). AI-SDK consumers who drive `streamText()` themselves never call `call()`, so they reach the same probe via the standalone `probeShadow()` export — fire it from `onFinish`, passing the served leg you already have, wrapped in `waitUntil()`/`after()` so it never blocks the response.
+
+```ts
+import { probeShadow, configureBrain } from '@warmdrift/kgauto-compiler';
+import { after } from 'next/server'; // or the platform's waitUntil()
+
+configureBrain({ endpoint: 'https://your-app.com/api/kgauto/v2', apiKey: '...' });
+
+const t0 = Date.now();
+const result = streamText({
+  model, system, messages,
+  onFinish: ({ text, usage }) => {
+    after(() => probeShadow(ir, {
+      served: {
+        model: servedModelId,
+        responseText: text,
+        tokensIn: usage.promptTokens,
+        tokensOut: usage.completionTokens,
+        latencyMs: Date.now() - t0,
+      },
+      candidates: ['deepseek-v4-pro'], // what you'd consider swapping to
+      sampleRate: 0.05,                // pin 1 for a dogfood window
+    }));
+  },
+});
+```
+
+kgauto runs each candidate on the **same IR** and persists a `probe_outcomes` row (`replay_source='inline-full-ir'`, `prompt_fidelity=1.0`, both latency legs). Phase 1 is `judge:'off'` — rows accumulate for an offline verdict rollup; inline Opus judging is Phase 2. Fire-and-forget: never throws into your `onFinish`.
+
+#### Sync-mode latency protection (`call()` + `BrainConfig.sync`)
+
+A `probeShadow()` consumer fires from `after()`, so the probe is always off the user-facing path — slow candidates are fine there (it's the right place to evaluate a slow reasoner). But a **`call()`-inline** consumer that sets `BrainConfig.sync: true` (PB-class Edge routes, so the brain write reliably lands before teardown — L-086) *awaits* the probe, putting the candidate's latency on the user's critical path. A `latency_tier='slow'` candidate (deepseek-v4-pro ~78–84s) then blows the route's time budget and the user sees an empty response. Two knobs on `shadowProbe` protect the sync path — **both are no-ops off the critical path** (non-sync `call()` and every `probeShadow()` consumer):
+
+```ts
+await call(ir, {
+  shadowProbe: {
+    candidates: ['deepseek-v4-pro'],
+    sampleRate: 1,
+    maxLatencyMs: 15000,        // default 15000. Sync-mode budget: if the probe
+                                // overruns, abort the candidate, return the served
+                                // response NOW, record outcome='aborted_latency_budget'.
+    skipSlowTierInSync: true,   // default true. Don't even START a latency_tier='slow'
+                                // candidate inline; record outcome='skipped_slow_tier_sync'.
+  },
+});
+```
+
+Aborted/skipped probes write a **diagnostic** `probe_outcomes` row (`outcome != 'completed'`, no candidate response, no verdict) so the offline rollup can tell "tried but too slow" from "never armed." A verdict rollup must filter `outcome='completed'`.
+
+**The deeper rule: inline shadow-probe = FAST candidates only.** To evaluate a *slow* reasoner, use the offline/async probe path (the Phase-2 batch direction, off the response entirely) or `probeShadow()` from `after()` — never the inline sync probe.
+
+## Structured advisories API (alpha.29+)
+
+kgauto's compile-time advisories (`caching-off-on-claude`, `tool-bloat`,
+`archetype-perf-floor-breach`, etc.) used to vanish after the consumer read
+the compile result. alpha.29 ships a structured query + resolution surface
+so Admin UIs can render "what's open right now?" without log-scraping.
+
+```ts
+import {
+  getActionableAdvisories,
+  markAdvisoryResolved,
+} from '@warmdrift/kgauto-compiler';
+
+// Query open advisories for this app
+const open = await getActionableAdvisories({
+  appId: 'playbacksam',
+  brainEndpoint: process.env.KGAUTO_BRAIN_ENDPOINT!,
+  brainJwt: process.env.KGAUTO_BRAIN_JWT!,
+  brainAnonKey: process.env.KGAUTO_BRAIN_ANON_KEY!,
+});
+
+for (const a of open) {
+  console.log(`[${a.severity}] ${a.rule} — ${a.observationCount} firings since ${a.openedAt}`);
+  console.log(`  ${a.message}`);
+  if (a.suggestedFix?.docsLink) console.log(`  ↳ ${a.suggestedFix.docsLink}`);
+}
+
+// After the operator fixes the issue, mark it resolved:
+const r = await markAdvisoryResolved({
+  id: open[0].id,
+  resolutionNote: 'wired historyCachePolicy in compile() — PR #99',
+  brainEndpoint: process.env.KGAUTO_BRAIN_ENDPOINT!,
+  brainJwt: process.env.KGAUTO_BRAIN_JWT!,
+  brainAnonKey: process.env.KGAUTO_BRAIN_ANON_KEY!,
+});
+if (!r.ok) console.error(r.reason);
+```
+
+The view enforces server-side auto-resolution: advisories with no firing
+in the last 14 days flip to `status='resolved'` automatically; the next
+firing reopens the rule with a fresh stable `id`.
+
 ## Architecture
 
 ```

package/dist/brain-proxy.d.mts

@@ -0,0 +1,113 @@
+/**
+ * `@warmdrift/kgauto-compiler/brain-proxy` — consumer brain-forward factory.
+ *
+ * ## Why this exists (the 4-consumer silent-drop class, 2026-07-06 s62)
+ *
+ * The library's `record()` / `recordOutcome()` / `recordShadowProbe()` /
+ * advisory paths all POST to a consumer-hosted proxy that forwards the row to
+ * the shared Supabase brain (the consumer holds the service-role key; kgauto's
+ * library never sees it). Every consumer hand-rolled that proxy layer — and a
+ * 4-consumer audit found every one silently broken in a *different* shape:
+ *
+ *   - tt-intelligence: middleware blocked 2 of 3 routes — server-to-server
+ *     POSTs 307-redirected to /login (missing public-path allowlist entry).
+ *   - inspire-central: the `/outcomes` proxy carried a column whitelist frozen
+ *     at alpha.7 that stripped `fell_over_from` / `fallback_reason`
+ *     (migration 018 columns) — Glass-Box fallback telemetry silently NULL.
+ *   - playbacksam: the `/probe_outcomes` whitelist would strip alpha.53's
+ *     `error_class` — every future migration column drops on the floor.
+ *   - global-expansion: mounted 1 of 4 routes — advisory POSTs 404 silently.
+ *
+ * Same L-142 / L-117 silent-drop family, four independent shapes, all in the
+ * layer consumers hand-roll. This factory kills the *class*: kgauto owns the
+ * forward handler, the consumer mounts ONE catch-all route. No column
+ * whitelist — the body is forwarded verbatim (`{ ...body }`), so any future
+ * migration column passes through untouched. One middleware/public-path entry
+ * (`/api/kgauto/v2/`) covers all four segments, which structurally prevents
+ * the tt-intel middleware-drift failure.
+ *
+ * ## Mounting recipes
+ *
+ * ### (a) Next.js app-router catch-all — ONE file, ONE middleware entry
+ *
+ *   // app/api/kgauto/v2/[segment]/route.ts
+ *   import { createBrainForwardRoutes } from '@warmdrift/kgauto-compiler/brain-proxy';
+ *   const routes = createBrainForwardRoutes({
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *     brainUrl:     process.env.KGAUTO_BRAIN_URL!,      // https://xxxx.supabase.co
+ *     serviceKey:   process.env.KGAUTO_BRAIN_SERVICE_KEY!,
+ *   });
+ *   export const POST = (req: Request, { params }: { params: { segment: string } }) =>
+ *     routes.handle(req, params.segment);
+ *
+ *   // middleware.ts — ONE public-path entry covers ALL four segments.
+ *   // This is the structural fix for the tt-intel drift: you cannot mount
+ *   // 3-of-4 routes and forget the 4th, because the catch-all is one file
+ *   // and the allowlist is one prefix.
+ *   const PUBLIC_PATHS = [ ...  '/api/kgauto/v2/' ];
+ *
+ * ### (b) Plain Vercel edge function, per segment
+ *
+ *   // api/kgauto/probe_outcomes.ts
+ *   export const config = { runtime: 'edge' };
+ *   const routes = createBrainForwardRoutes({ ...  });
+ *   export default (req: Request) => routes.handle(req, 'probe_outcomes');
+ *
+ * The library appends the segment path to the consumer's `endpoint`, so the
+ * consumer's `KGAUTO_V2_BRAIN_URL` (the value passed to `configureBrain`)
+ * must be the base that resolves to `.../api/kgauto/v2` — i.e. the last path
+ * segment of each library POST (`outcomes`, `probe_outcomes`, …) is what
+ * `handle()` receives as `segment`.
+ *
+ * ## Prefer-header relay (alpha.56)
+ *
+ * `record()` sends `Prefer: return=representation` on its `/outcomes` POST and
+ * parses the inserted row id from the PROXY's response to fire the secondary
+ * `compile_outcome_advisories` POST. alpha.54/.55 hardcoded
+ * `Prefer: return=minimal` toward the brain and returned `{ok:true}` — so the
+ * id-parse found nothing and the advisory secondary silently never fired for
+ * factory-mounted consumers (PB + GE convergent finding, 2026-07-06). The
+ * factory now honors a caller `Prefer: return=representation` header: it is
+ * forwarded to the brain and the brain's response body (the inserted row(s))
+ * is relayed verbatim on success. Callers that don't send the header keep the
+ * `return=minimal` + `{ok:true}` behavior.
+ *
+ * ## Quality-segment handle resolution (alpha.55)
+ *
+ * `recordOutcome()` sends `outcome_id` as `CompileResult.handle` (a string),
+ * but `compile_outcome_quality.outcome_id` is a BIGINT FK →
+ * `compile_outcomes(id)`. A verbatim forward would 400 every handle-shaped
+ * verdict (tt-intel + IC convergent finding, 2026-07-06). On the
+ * `compile_outcome_quality` segment the factory resolves non-numeric
+ * `outcome_id` values to their BIGINT row ids via
+ * `compile_outcomes?handle=eq.<v>` (latest row wins) before forwarding.
+ * Numeric ids pass through untouched; an unresolvable handle returns
+ * `404 handle_not_found` so the library's route-404 observability names the
+ * failure instead of the brain's opaque FK error.
+ */
+interface BrainForwardConfig {
+    /** Bearer token consumers' callers must present (usually KGAUTO_INGEST_SECRET). */
+    ingestSecret: string;
+    /** Brain Supabase project URL (e.g. https://xxxx.supabase.co). */
+    brainUrl: string;
+    /** Brain service-role key (server-side only). */
+    serviceKey: string;
+    /** Optional fetch impl for tests. */
+    fetchImpl?: typeof fetch;
+}
+interface BrainForwardRoutes {
+    /**
+     * Web-standard handler. `segment` is the last path segment of the library's
+     * POST URL (e.g. 'outcomes', 'probe_outcomes'). In a Next.js catch-all this
+     * is `params.segment`. Never throws — every error path returns a `Response`.
+     */
+    handle(req: Request, segment: string): Promise<Response>;
+    /**
+     * The path segments this factory serves. Consumers can use it for route
+     * generation, allowlist construction, or tests.
+     */
+    segments: readonly string[];
+}
+declare function createBrainForwardRoutes(config: BrainForwardConfig): BrainForwardRoutes;
+
+export { type BrainForwardConfig, type BrainForwardRoutes, createBrainForwardRoutes };

package/dist/brain-proxy.d.ts

@@ -0,0 +1,113 @@
+/**
+ * `@warmdrift/kgauto-compiler/brain-proxy` — consumer brain-forward factory.
+ *
+ * ## Why this exists (the 4-consumer silent-drop class, 2026-07-06 s62)
+ *
+ * The library's `record()` / `recordOutcome()` / `recordShadowProbe()` /
+ * advisory paths all POST to a consumer-hosted proxy that forwards the row to
+ * the shared Supabase brain (the consumer holds the service-role key; kgauto's
+ * library never sees it). Every consumer hand-rolled that proxy layer — and a
+ * 4-consumer audit found every one silently broken in a *different* shape:
+ *
+ *   - tt-intelligence: middleware blocked 2 of 3 routes — server-to-server
+ *     POSTs 307-redirected to /login (missing public-path allowlist entry).
+ *   - inspire-central: the `/outcomes` proxy carried a column whitelist frozen
+ *     at alpha.7 that stripped `fell_over_from` / `fallback_reason`
+ *     (migration 018 columns) — Glass-Box fallback telemetry silently NULL.
+ *   - playbacksam: the `/probe_outcomes` whitelist would strip alpha.53's
+ *     `error_class` — every future migration column drops on the floor.
+ *   - global-expansion: mounted 1 of 4 routes — advisory POSTs 404 silently.
+ *
+ * Same L-142 / L-117 silent-drop family, four independent shapes, all in the
+ * layer consumers hand-roll. This factory kills the *class*: kgauto owns the
+ * forward handler, the consumer mounts ONE catch-all route. No column
+ * whitelist — the body is forwarded verbatim (`{ ...body }`), so any future
+ * migration column passes through untouched. One middleware/public-path entry
+ * (`/api/kgauto/v2/`) covers all four segments, which structurally prevents
+ * the tt-intel middleware-drift failure.
+ *
+ * ## Mounting recipes
+ *
+ * ### (a) Next.js app-router catch-all — ONE file, ONE middleware entry
+ *
+ *   // app/api/kgauto/v2/[segment]/route.ts
+ *   import { createBrainForwardRoutes } from '@warmdrift/kgauto-compiler/brain-proxy';
+ *   const routes = createBrainForwardRoutes({
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *     brainUrl:     process.env.KGAUTO_BRAIN_URL!,      // https://xxxx.supabase.co
+ *     serviceKey:   process.env.KGAUTO_BRAIN_SERVICE_KEY!,
+ *   });
+ *   export const POST = (req: Request, { params }: { params: { segment: string } }) =>
+ *     routes.handle(req, params.segment);
+ *
+ *   // middleware.ts — ONE public-path entry covers ALL four segments.
+ *   // This is the structural fix for the tt-intel drift: you cannot mount
+ *   // 3-of-4 routes and forget the 4th, because the catch-all is one file
+ *   // and the allowlist is one prefix.
+ *   const PUBLIC_PATHS = [ ...  '/api/kgauto/v2/' ];
+ *
+ * ### (b) Plain Vercel edge function, per segment
+ *
+ *   // api/kgauto/probe_outcomes.ts
+ *   export const config = { runtime: 'edge' };
+ *   const routes = createBrainForwardRoutes({ ...  });
+ *   export default (req: Request) => routes.handle(req, 'probe_outcomes');
+ *
+ * The library appends the segment path to the consumer's `endpoint`, so the
+ * consumer's `KGAUTO_V2_BRAIN_URL` (the value passed to `configureBrain`)
+ * must be the base that resolves to `.../api/kgauto/v2` — i.e. the last path
+ * segment of each library POST (`outcomes`, `probe_outcomes`, …) is what
+ * `handle()` receives as `segment`.
+ *
+ * ## Prefer-header relay (alpha.56)
+ *
+ * `record()` sends `Prefer: return=representation` on its `/outcomes` POST and
+ * parses the inserted row id from the PROXY's response to fire the secondary
+ * `compile_outcome_advisories` POST. alpha.54/.55 hardcoded
+ * `Prefer: return=minimal` toward the brain and returned `{ok:true}` — so the
+ * id-parse found nothing and the advisory secondary silently never fired for
+ * factory-mounted consumers (PB + GE convergent finding, 2026-07-06). The
+ * factory now honors a caller `Prefer: return=representation` header: it is
+ * forwarded to the brain and the brain's response body (the inserted row(s))
+ * is relayed verbatim on success. Callers that don't send the header keep the
+ * `return=minimal` + `{ok:true}` behavior.
+ *
+ * ## Quality-segment handle resolution (alpha.55)
+ *
+ * `recordOutcome()` sends `outcome_id` as `CompileResult.handle` (a string),
+ * but `compile_outcome_quality.outcome_id` is a BIGINT FK →
+ * `compile_outcomes(id)`. A verbatim forward would 400 every handle-shaped
+ * verdict (tt-intel + IC convergent finding, 2026-07-06). On the
+ * `compile_outcome_quality` segment the factory resolves non-numeric
+ * `outcome_id` values to their BIGINT row ids via
+ * `compile_outcomes?handle=eq.<v>` (latest row wins) before forwarding.
+ * Numeric ids pass through untouched; an unresolvable handle returns
+ * `404 handle_not_found` so the library's route-404 observability names the
+ * failure instead of the brain's opaque FK error.
+ */
+interface BrainForwardConfig {
+    /** Bearer token consumers' callers must present (usually KGAUTO_INGEST_SECRET). */
+    ingestSecret: string;
+    /** Brain Supabase project URL (e.g. https://xxxx.supabase.co). */
+    brainUrl: string;
+    /** Brain service-role key (server-side only). */
+    serviceKey: string;
+    /** Optional fetch impl for tests. */
+    fetchImpl?: typeof fetch;
+}
+interface BrainForwardRoutes {
+    /**
+     * Web-standard handler. `segment` is the last path segment of the library's
+     * POST URL (e.g. 'outcomes', 'probe_outcomes'). In a Next.js catch-all this
+     * is `params.segment`. Never throws — every error path returns a `Response`.
+     */
+    handle(req: Request, segment: string): Promise<Response>;
+    /**
+     * The path segments this factory serves. Consumers can use it for route
+     * generation, allowlist construction, or tests.
+     */
+    segments: readonly string[];
+}
+declare function createBrainForwardRoutes(config: BrainForwardConfig): BrainForwardRoutes;
+
+export { type BrainForwardConfig, type BrainForwardRoutes, createBrainForwardRoutes };

package/dist/brain-proxy.js

@@ -0,0 +1,189 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/brain-proxy.ts
+var brain_proxy_exports = {};
+__export(brain_proxy_exports, {
+  createBrainForwardRoutes: () => createBrainForwardRoutes
+});
+module.exports = __toCommonJS(brain_proxy_exports);
+var SEGMENT_TO_TABLE = {
+  outcomes: "compile_outcomes",
+  compile_outcome_advisories: "compile_outcome_advisories",
+  compile_outcome_quality: "compile_outcome_quality",
+  probe_outcomes: "probe_outcomes"
+};
+var KNOWN_SEGMENTS = Object.keys(SEGMENT_TO_TABLE);
+var JSON_HEADERS = { "Content-Type": "application/json" };
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function bearerOf(req) {
+  const header = req.headers.get("Authorization") ?? "";
+  const match = /^Bearer\s+(.+)$/i.exec(header);
+  return match?.[1]?.trim() ?? "";
+}
+function requireString(name, value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`createBrainForwardRoutes: ${name} is required`);
+  }
+  return value;
+}
+function isNumericOutcomeId(value) {
+  return typeof value === "number" || typeof value === "string" && /^\d+$/.test(value);
+}
+function createBrainForwardRoutes(config) {
+  const ingestSecret = requireString("ingestSecret", config.ingestSecret);
+  const brainUrl = requireString("brainUrl", config.brainUrl).replace(/\/+$/, "");
+  const serviceKey = requireString("serviceKey", config.serviceKey);
+  const fetchFn = config.fetchImpl ?? fetch;
+  async function resolveQualityOutcomeIds(body) {
+    const rows = Array.isArray(body) ? body : [body];
+    const handles = [
+      ...new Set(
+        rows.map((r) => r?.outcome_id).filter(
+          (v) => typeof v === "string" && !isNumericOutcomeId(v)
+        )
+      )
+    ];
+    if (handles.length === 0) return body;
+    const list = handles.map((h) => `"${h.replace(/"/g, "")}"`).join(",");
+    const url = `${brainUrl}/rest/v1/compile_outcomes?select=id,handle&handle=in.(${encodeURIComponent(list)})&order=id.desc`;
+    let idByHandle;
+    try {
+      const res = await fetchFn(url, {
+        headers: { apikey: serviceKey, Authorization: `Bearer ${serviceKey}` }
+      });
+      if (!res.ok) {
+        const text = await res.text().catch(() => "<no body>");
+        return jsonResponse(502, {
+          error: "handle-resolution-failed",
+          table: "compile_outcome_quality",
+          status: res.status,
+          detail: text
+        });
+      }
+      const found = await res.json();
+      idByHandle = /* @__PURE__ */ new Map();
+      for (const r of found) {
+        if (!idByHandle.has(r.handle)) idByHandle.set(r.handle, r.id);
+      }
+    } catch (err) {
+      return jsonResponse(502, {
+        error: "handle-resolution-failed",
+        table: "compile_outcome_quality",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+    const unresolved = handles.filter((h) => !idByHandle.has(h));
+    if (unresolved.length > 0) {
+      return jsonResponse(404, {
+        error: "handle_not_found",
+        table: "compile_outcome_quality",
+        unresolved
+      });
+    }
+    const rewritten = rows.map(
+      (r) => typeof r?.outcome_id === "string" && idByHandle.has(r.outcome_id) ? { ...r, outcome_id: idByHandle.get(r.outcome_id) } : r
+    );
+    return Array.isArray(body) ? rewritten : rewritten[0];
+  }
+  async function handle(req, segment) {
+    try {
+      if (req.method !== "POST") {
+        return jsonResponse(405, {
+          error: "method-not-allowed",
+          method: req.method,
+          allowed: ["POST"]
+        });
+      }
+      const table = SEGMENT_TO_TABLE[segment];
+      if (!table) {
+        return jsonResponse(404, {
+          error: "unknown-brain-forward-segment",
+          segment,
+          known: KNOWN_SEGMENTS
+        });
+      }
+      if (bearerOf(req) !== ingestSecret) {
+        return jsonResponse(401, { error: "unauthorized" });
+      }
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return jsonResponse(400, { error: "invalid-json" });
+      }
+      let row = Array.isArray(body) ? body : { ...body };
+      if (table === "compile_outcome_quality") {
+        const outcome = await resolveQualityOutcomeIds(row);
+        if (outcome instanceof Response) return outcome;
+        row = outcome;
+      }
+      const wantsRepresentation = /return=representation/i.test(
+        req.headers.get("Prefer") ?? ""
+      );
+      let brainRes;
+      try {
+        brainRes = await fetchFn(`${brainUrl}/rest/v1/${table}`, {
+          method: "POST",
+          headers: {
+            apikey: serviceKey,
+            Authorization: `Bearer ${serviceKey}`,
+            "Content-Type": "application/json",
+            Prefer: wantsRepresentation ? "return=representation" : "return=minimal"
+          },
+          body: JSON.stringify(row)
+        });
+      } catch (err) {
+        return jsonResponse(502, {
+          error: "brain-unreachable",
+          table,
+          detail: err instanceof Error ? err.message : String(err)
+        });
+      }
+      if (brainRes.ok) {
+        if (wantsRepresentation) {
+          const text2 = await brainRes.text().catch(() => "");
+          if (text2.length > 0) {
+            return new Response(text2, { status: 201, headers: JSON_HEADERS });
+          }
+        }
+        return jsonResponse(201, { ok: true });
+      }
+      const text = await brainRes.text().catch(() => "<no body>");
+      return jsonResponse(brainRes.status, {
+        error: "brain-write-failed",
+        table,
+        status: brainRes.status,
+        detail: text
+      });
+    } catch (err) {
+      return jsonResponse(500, {
+        error: "brain-forward-internal-error",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { handle, segments: KNOWN_SEGMENTS };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createBrainForwardRoutes
+});

package/dist/brain-proxy.mjs

@@ -0,0 +1,6 @@
+import {
+  createBrainForwardRoutes
+} from "./chunk-IUWFML6Z.mjs";
+export {
+  createBrainForwardRoutes
+};