Skip to content

feat: knowledge-serve HTTP API + SDK + API-key auth (self-host) - #16

Merged
andrei-hasna merged 5 commits into
mainfrom
feat/knowledge-serve-selfhost
Jul 6, 2026
Merged

feat: knowledge-serve HTTP API + SDK + API-key auth (self-host)#16
andrei-hasna merged 5 commits into
mainfrom
feat/knowledge-serve-selfhost

Conversation

@andrei-hasna

Copy link
Copy Markdown
Contributor

Stands up the fourth surface (knowledge-serve) and brings @hasna/knowledge to the self-host standard.

Surfaces

  • CLI (knowledge) and MCP (knowledge-mcp) — unchanged, still real.
  • knowledge-serve (new): Bun.serve HTTP API wrapping the core lib. PURE REMOTE per Amendment A1 — reads/writes the shared cloud Postgres directly (app role), no cache/sync in the service.
    • Public: GET /health, /ready (DB ping), /version -> {status,version,mode}, /openapi.json.
    • Versioned /v1: notes CRUD over knowledge_items, plus /v1/registry.
    • Auth: @hasna/contracts API-key middleware (verifyApiKey + ApiKeyStore revocation), scope grammar knowledge:read|write.
  • SDK: KnowledgeApiClient generated from the serve OpenAPI document (scripts/generate-sdk.mjs, run in build).

Storage / DB

  • knowledge_items migration appended to the cloud schema; api_keys ledger folded into the cloud migration runner. Runner prefers an owner-scoped DSN (HASNA_KNOWLEDGE_DATABASE_URL_OWNER) and restores kit sslmode=require semantics under node-postgres >= 8.22.

Packaging / Deploy

  • knowledge-serve bin, ARM64/bun Dockerfile, docker-compose.yml, and hasna.contract.json updated to class=service with HTTP-service + client metadata.

Proof

  • Live on ECS oss-fleet-prod behind the shared ALB at knowledge.hasna.xyz. /health,/ready,/version return 200; unauthenticated /v1 -> 401.
  • Authenticated CRUD roundtrip (create/get/list/update/delete/404) verified through the generated SDK client against the live ALB with an issued API key.
  • Tests green for touched surfaces; secrets scan clean; no Co-Authored-By.

…y auth

Adds the fourth surface: a Bun.serve HTTP API (knowledge-serve) wrapping the
core lib PURE REMOTE per Amendment A1 (reads/writes the shared cloud Postgres
directly). Public probes GET /health,/ready,/version + /openapi.json; versioned
/v1 notes CRUD (knowledge_items) and /v1/registry, gated by @hasna/contracts
API-key middleware. The typed SDK (KnowledgeApiClient) is generated from the
serve OpenAPI document.
Appends the cloud knowledge_items table to pg-migrations and folds the
@hasna/contracts api_keys migrations into the cloud migration runner (prefers an
owner-scoped DSN; restores kit sslmode=require semantics under pg >= 8.22).
@andrei-hasna
andrei-hasna merged commit 08e4703 into main Jul 6, 2026
7 checks passed
@andrei-hasna
andrei-hasna deleted the feat/knowledge-serve-selfhost branch July 6, 2026 13:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant