Export createKnowledgePlane for out-of-band capture and search

The KnowledgePlane type was exported but not its constructor, and the exports
map only allows ".", "./migrations", and "./config" — so there was no way in.

That left mountKnowledgeEngine as the only way to obtain a plane, and it
requires a Hono app and mounts three HTTP routes as a side effect. Any caller
wanting to capture or search outside a request had nowhere to go: CLI seeders,
batch ingesters, tests that exercise capture without standing up an app.

Odd given knowledge.ts advertises the plane as the no-HTTP-hop path ("Wraps the
capture and hybrid-search services directly") — you could only reach it by
going through the thing that adds HTTP.

Exports createKnowledgePlane, KnowledgeError, and the param types. The README
now shows both the in-process case (plane returned from mountKnowledgeEngine)
and the standalone case, and notes that the standalone path bypasses
requireGrant — so a caller acting for a user has to check the capability itself.
Per-document visibility is not a substitute for that.

Refs CL-4508

Claude-Session: https://claude.ai/code/session_017GTgGzn5xAwvkU2GAPAHpF

Author: TheGreatAxios

README.md

@@ -41,7 +41,7 @@ import { loadKnowledgeConfig } from "@corbits/knowledge-engine/config";
 // `app` is your Interchange createApp (Hono<TenantEnv>). Pass the same grant
 // store + condition registry you give createApp/createRequireGrant.
 mountKnowledgeEngine(app, {
-  config: loadKnowledgeConfig(),          // or build the object yourself
+  config: loadKnowledgeConfig(), // or build the object yourself
   grants: { grantStore, conditionRegistry },
 });
 ```
@@ -51,6 +51,51 @@ That mounts `POST /api/knowledge/capture`, `POST /api/knowledge/search`, and
 `requireGrant("knowledge", <action>)`. Clients never send tenant or principal —
 identity is the context principal.
 
+### Capturing and searching outside a request
+
+`mountKnowledgeEngine` returns the `KnowledgePlane` it built, and the plane takes
+identity as data — so an in-process caller passes `{tenantId, principalId}`
+explicitly rather than faking a request context:
+
+```ts
+const { knowledge } = mountKnowledgeEngine(app, { config, grants });
+
+await knowledge.search({ tenantId, principalId, query: "…", k: 6 });
+```
+
+For a CLI seeder, a batch ingester, or a test with no app at all, construct a
+plane directly:
+
+```ts
+import {
+  createKnowledgePlane,
+  loadKnowledgeConfig,
+} from "@corbits/knowledge-engine";
+
+const knowledge = createKnowledgePlane(loadKnowledgeConfig());
+await knowledge.capture({ tenantId, principalId, title, text });
+await knowledge.close();
+```
+
+Note that this path bypasses the `requireGrant` route guard, since there is no
+request. If the caller is acting for a user rather than as an operator, check the
+capability yourself — the per-document visibility the engine applies is not a
+substitute for "may this principal search at all":
+
+```ts
+import { authorize } from "@intx/authz";
+
+const decision = await authorize(
+  grantStore,
+  principalId,
+  tenantId,
+  "knowledge",
+  "search",
+  conditionRegistry,
+);
+if (decision.effect !== "allow") throw new Error("not permitted");
+```
+
 Apply the knowledge/vector schema once (idempotent):
 
 ```ts

src/index.ts

@@ -23,7 +23,20 @@ export type { KnowledgeConfig } from "./mount-config.ts";
 export { loadKnowledgeConfig } from "./mount-config.ts";
 export type { EngineConfig } from "./config.ts";
 // Knowledge plane + capture log
-export type { KnowledgePlane } from "./knowledge.ts";
+//
+// `createKnowledgePlane` is exported so a host can capture or search outside a
+// request — a CLI seeder, a batch ingester, or a test — without standing up a
+// Hono app just to get a plane. Callers acting on behalf of a user are
+// responsible for the capability check `requireGrant` would have performed; see
+// the README.
+export { createKnowledgePlane } from "./knowledge.ts";
+export type {
+  KnowledgeCaptureParams,
+  KnowledgeIdentity,
+  KnowledgePlane,
+  KnowledgeSearchParams,
+} from "./knowledge.ts";
+export { KnowledgeError } from "./knowledge.ts";
 export { CaptureLog, type CaptureEvent } from "./capture-log.ts";
 // Migrations
 export { runKnowledgeMigrations } from "./migrations.ts";