@alneas/eaos-server 0.0.0-stage → 0.2.0

package/dist/engine.d.ts

@@ -0,0 +1,205 @@
+import * as _alneas_eaos_core from '@alneas/eaos-core';
+import { PluginManifest, EaosEnv, PluginRegistry, McpGatekeeper } from '@alneas/eaos-core';
+import { LifecycleRuntime } from './lifecycle/index.js';
+import { McpRouterOptions } from './mcp.js';
+import { Hono } from 'hono';
+import { AuthSessionVerifier } from './middleware/auth.js';
+import { HealthRouterOptions } from './health/index.js';
+import { PluginEntitlementRuntime, EntitlementPrincipalResolver } from './entitlements/index.js';
+import '@alneas/eaos-server/lifecycle-engine';
+import 'hono/types';
+import './plugin-data/index.js';
+import '@alneas/eaos-core/plugin-sdk';
+
+/**
+ * Engine composition settings retained by {@link ErpEngine}; host adapters own authentication and persistence.
+ */
+interface EaosConfig {
+    /** Nonblank application label used by public health responses. */
+    appName: string;
+    /** Trusted plugin manifests registered sequentially during initialize. */
+    plugins: PluginManifest[];
+    /** Optional host UI theme metadata retained in config; the server engine does not apply it. */
+    theme?: {
+        /** Optional host UI accent color; not interpreted by this engine. */
+        primaryColor?: string;
+        /** Optional host UI logo URL; not fetched by this engine. */
+        logoUrl?: string;
+    };
+    /** Optional host driver metadata retained in config; this engine does not create a database connection. */
+    database?: {
+        /** Selected host database dialect; does not create or migrate a connection. */
+        driver: 'oracle' | 'supabase' | 'postgres';
+    };
+    /** Optional exact browser allowOrigins list; empty/absent disables CORS middleware. */
+    cors?: {
+        /** Exact allowed browser origins; credentials are enabled for configured CORS. */
+        allowOrigins: string[];
+    };
+    /** Optional verifier and skipped path prefixes; see AuthMiddlewareOptions. */
+    auth?: {
+        /** Optional verified session/API-key adapter; omission installs no authentication. */
+        verifier?: AuthSessionVerifier;
+        /** Authentication-exempt path prefixes; defaults follow createAuthMiddleware. */
+        skipPaths?: string[];
+    };
+    /** Validate each manifest's declared secrets unless exactly false. Defaults to true. */
+    validateSecrets?: boolean;
+    /** Host composition callbacks invoked synchronously after shared authentication and before plugin route guards; each receives the app and returns no value. */
+    middleware?: Array<(app: Hono<EaosEnv>) => void>;
+}
+/**
+ * Returns an engine configuration unchanged while checking its TypeScript shape.
+ * @param config - Configuration to retain; no runtime validation or cloning occurs.
+ * @returns The same object reference.
+ * @example
+ * ```typescript
+ * import { defineConfig } from "@alneas/eaos-server/engine";
+ * const config = defineConfig({ appName: "example-service", plugins: [] });
+ * console.log(config.appName);
+ * ```
+ */
+declare function defineConfig(config: EaosConfig): EaosConfig;
+/**
+ * Per-application host authorization, route, and health adapters for {@link ErpEngine.createApp}.
+ */
+interface CreateAppOptions {
+    /** Optional shared runtime for declared commercial/usage entitlement admission. */
+    entitlements?: PluginEntitlementRuntime;
+    /** Optional verified principal resolver; defaults to resolveEngineEntitlementPrincipal. */
+    resolveEntitlementPrincipal?: EntitlementPrincipalResolver;
+    /** Optional current lifecycle/tenant/backend admission for plugin routes and MCP tools. */
+    lifecycle?: LifecycleRuntime;
+    /** Optional module middleware factory called at composition for each plugin/extension requirement; defaults to createModuleGuard. */
+    requireModule?: (moduleId: string) => any;
+    /** Optional authentication verifier overriding config.auth.verifier. */
+    verifier?: AuthSessionVerifier;
+    /** Install module guards unless exactly false. Defaults to true. */
+    enableModuleGuard?: boolean;
+    /** Per-plugin dependencies passed to the route factory. */
+    pluginOptions?: Record<string, unknown>;
+    /** Optional MCP adapter configuration; prefix defaults to /api/mcp and shared entitlements take precedence. */
+    mcp?: McpRouterOptions & {
+        /**
+         * Optional mount path for the shared MCP router; defaults to /api/mcp when the engine composes routes.
+         */
+        prefix?: string;
+    };
+    /** Additional host routers mounted after plugin/MCP routes; no plugin-specific guard is automatically added. */
+    customRoutes?: Array<{
+        /** Host-selected mount prefix passed directly to Hono route composition; this entry receives no automatic plugin/module-specific guard. */
+        prefix: string;
+        /** Trusted Hono child router; host composition must install its route-specific authorization before exposing handlers. */
+        router: Hono<any>;
+    }>;
+    /** Optional dependency readiness checks and clock; engine appName is supplied automatically. */
+    health?: Omit<HealthRouterOptions, 'appName'>;
+}
+/**
+ * Registers plugin manifests and composes Hono routes with host authentication, entitlement, and lifecycle adapters.
+ * @remarks Constructing the engine creates no HTTP listener or persistent store. Initialize once before composing apps. Configuration is retained by reference. Authentication is installed only when a verifier is supplied; custom routes need their own authorization policies beyond the shared middleware.
+ * @example
+ * ```typescript
+ * import { createErpEngine } from "@alneas/eaos-server/engine";
+ * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+ * await engine.initialize();
+ * const app = engine.createApp();
+ * console.log((await app.request("/health/live")).status); // 200
+ * ```
+ */
+declare class ErpEngine {
+    /** Public plugin registry populated during initialize; external mutation affects subsequently composed apps. */
+    readonly registry: PluginRegistry;
+    /** Shared MCP policy registry populated from plugin manifests during initialize. */
+    readonly gatekeeper: McpGatekeeper;
+    private initialized;
+    private config;
+    /**
+     * Retains host composition configuration for registration and future app creation.
+     * @param config - App label, plugin manifests, and optional host composition settings.
+     */
+    constructor(config: EaosConfig);
+    /**
+     * Registers manifests and gatekeeper policies and validates declared plugin secrets by default.
+     * @returns No value; resolves after registration and validation, or immediately after a prior successful initialization.
+     * @throws Rejects duplicate plugin IDs, registry failures, or secret validation failures.
+     * @remarks Registration occurs before secret validation, so failure can leave partial registry state. Concurrent initialization is not serialized and retrying a failed initialization may encounter already-registered IDs. Create a new engine after correcting failed setup. No migrations or plugin activation are performed.
+     * @example
+     * ```typescript
+     * import { createErpEngine } from "@alneas/eaos-server/engine";
+     * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+     * await engine.initialize();
+     * console.log(engine.getRegisteredPlugins().length); // 0
+     * ```
+     */
+    initialize(): Promise<void>;
+    /**
+     * Composes registered plugin routes, shared middleware, optional MCP/custom routes, and public health endpoints.
+     * @param options - Live host adapters and route settings; see {@link CreateAppOptions}.
+     * @returns A new Hono app sharing this engine registry, gatekeeper, and configured adapters; it does not start a server.
+     * @throws Before initialization, or for synchronous middleware, plugin route factory, or health setup failures. Request-time adapter errors pass through the app error handler.
+     * @remarks Module guarding defaults on. Lifecycle enforcement is installed only when supplied, while declared plugin entitlements require their corresponding runtime checks. CORS uses configured origins with credentials enabled; unknown origins receive the first configured allow-origin value. Repeated calls create separate routers but may reuse host dependencies.
+     * @example
+     * ```typescript
+     * import { createErpEngine } from "@alneas/eaos-server/engine";
+     * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+     * await engine.initialize();
+     * const app = engine.createApp();
+     * console.log((await app.request("/health/live")).status);
+     * ```
+     */
+    createApp(options?: CreateAppOptions): Hono<EaosEnv>;
+    /**
+     * Reads the manifests currently registered in this engine.
+     * @returns Registry manifest list, empty before registration or with no configured plugins; objects are not deep-cloned by this method.
+     * @example
+     * ```typescript
+     * import { createErpEngine } from "@alneas/eaos-server/engine";
+     * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+     * await engine.initialize();
+     * console.log(engine.getRegisteredPlugins()); // []
+     * ```
+     */
+    getRegisteredPlugins(): PluginManifest[];
+    /**
+     * Collects MCP tool definitions from all currently registered manifests.
+     * @returns Registry tool definitions, or an empty array when none exist; this list is not filtered for a request principal or tenant.
+     * @example
+     * ```typescript
+     * import { createErpEngine } from "@alneas/eaos-server/engine";
+     * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+     * await engine.initialize();
+     * console.log(engine.getAllMcpTools()); // []
+     * ```
+     */
+    getAllMcpTools(): _alneas_eaos_core.McpToolDefinition[];
+    /**
+     * Reads the host configuration retained at construction.
+     * @returns The original mutable configuration object; no cloning occurs.
+     * @example
+     * ```typescript
+     * import { createErpEngine } from "@alneas/eaos-server/engine";
+     * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+     * await engine.initialize();
+     * console.log(engine.getConfig().appName);
+     * ```
+     */
+    getConfig(): EaosConfig;
+}
+/**
+ * Creates an uninitialized engine retaining the supplied host configuration.
+ * @param config - Engine composition settings; see {@link EaosConfig}.
+ * @returns A new engine; await initialize before createApp.
+ * @example
+ * ```typescript
+ * import { createErpEngine } from "@alneas/eaos-server/engine";
+ * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+ * await engine.initialize();
+ * const app = engine.createApp();
+ * console.log((await app.request("/health/live")).status);
+ * ```
+ */
+declare function createErpEngine(config: EaosConfig): ErpEngine;
+
+export { ErpEngine, createErpEngine, defineConfig };
+export type { CreateAppOptions, EaosConfig };

package/dist/engine.js

@@ -0,0 +1,20 @@
+import {
+  ErpEngine,
+  createErpEngine,
+  defineConfig
+} from "./chunk-F4IITPGX.js";
+import "./chunk-L6PMAEMB.js";
+import "./chunk-XIEY2OF4.js";
+import "./chunk-AVDMLTPF.js";
+import "./chunk-VC2PCK2S.js";
+import "./chunk-R4ADP2DC.js";
+import "./chunk-VF5YDZJC.js";
+import "./chunk-46UWPEW2.js";
+import "./chunk-INCHXAFK.js";
+import "./chunk-3VITSHN3.js";
+export {
+  ErpEngine,
+  createErpEngine,
+  defineConfig
+};
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/entitlements/index.d.ts

@@ -0,0 +1,313 @@
+import * as hono_types from 'hono/types';
+import * as hono from 'hono';
+import { Context, Hono } from 'hono';
+import { TenantEntitlements, PlatformPrincipal, PluginEntitlement, EntitlementDecision } from '@alneas/eaos-core';
+import { AtomicRepository, AtomicSession } from '../plugin-data/index.js';
+import { Dialect, DataContract } from '@alneas/eaos-server/lifecycle-engine';
+import '@alneas/eaos-core/plugin-sdk';
+
+/**
+ * Declares reviewed control-plane storage for tenant subscription/addon/quota state across supported SQL dialects.
+ * @remarks Hosts install this contract through reviewed lifecycle operations; importing the constant performs no migration.
+ * @see createSqlTenantEntitlementLoader for the reader usage example.
+ */
+declare const tenantEntitlementContract: DataContract;
+/**
+ * Builds a parameterized tenant entitlement reader for the reviewed control-plane table.
+ * @param driver - Host SQL dialect and execute callback; execute receives SQL and one tenant binding and resolves optional rows. Credentials and connection lifecycle remain host-owned.
+ * @returns An async loader accepting a verified 1–128-character tenant ID (letters/digits/underscore/dot/hyphen, starting alphanumeric) and resolving validated entitlements or null when no row exists.
+ * @throws Loader calls reject invalid tenant IDs, multiple rows, malformed JSON/contracts, tenant mismatch, and propagated SQL errors.
+ * @remarks Row keys are normalized to lowercase; JSON columns may be strings or already parsed values. No row-level authorization or shared transaction is established by this factory.
+ * @example
+ * ```typescript
+ * import { createSqlTenantEntitlementLoader } from "@alneas/eaos-server/entitlements";
+ * export function entitlementLoader(driver: Parameters<typeof createSqlTenantEntitlementLoader>[0]) {
+ *   return createSqlTenantEntitlementLoader(driver);
+ * }
+ * ```
+ */
+declare function createSqlTenantEntitlementLoader(driver: {
+    /**
+   * SQL placeholder dialect: Oracle uses :1, PostgreSQL $1, and SQLite ? for the tenant binding.
+   */
+    dialect: Dialect;
+    /**
+   * Executes the loader's parameterized tenant SELECT through the trusted host connection.
+   * @param sql - SQL supplied by the loader with one dialect-correct tenant placeholder.
+   * @param bindings - One verified tenant ID in placeholder order.
+   * @returns Optional result rows; no rows resolves to null at the loader boundary.
+   * @throws Host query errors reject the entitlement lookup.
+   * @example
+   * ```typescript
+   * import { createSqlTenantEntitlementLoader } from '@alneas/eaos-server/entitlements';
+   * export async function loadContract(driver: Parameters<typeof createSqlTenantEntitlementLoader>[0], verifiedTenantId: string) {
+   *   // The host supplies the reviewed schema and privileged read connection.
+   *   return createSqlTenantEntitlementLoader(driver)(verifiedTenantId);
+   * }
+   * ```
+   */
+    execute(sql: string, bindings: unknown[]): Promise<{
+        /**
+       * Optional result rows; missing rows is treated as an empty result, while more than one row rejects as ambiguous.
+       */
+        rows?: Record<string, unknown>[];
+    }>;
+}): (tenantId: string) => Promise<TenantEntitlements | null>;
+
+/**
+ * Carries a denied entitlement decision for HTTP or host failure handling.
+ * @example
+ * ```typescript
+ * import { EntitlementError } from "@alneas/eaos-server/entitlements";
+ * const error = new EntitlementError({ allowed: false, status: 402, reason: "quota-exceeded" });
+ * console.log(error.decision.status);
+ * ```
+ */
+declare class EntitlementError extends Error {
+    readonly decision: Exclude<EntitlementDecision, {
+        /** Type-level allowed-branch discriminator removed by Exclude; this constructor accepts only denied decisions with allowed false. */
+        allowed: true;
+    }>;
+    /**
+     * Creates an error whose message is the denial reason.
+     * @param decision - Denied decision retained as a public readonly property for status/reason mapping.
+     */
+    constructor(decision: Exclude<EntitlementDecision, {
+        /** Type-level allowed-branch discriminator removed by Exclude; this constructor accepts only denied decisions with allowed false. */
+        allowed: true;
+    }>);
+}
+/**
+ * Trusted control-plane reads, lifecycle policy, and reservation persistence for {@link PluginEntitlementRuntime}.
+ */
+interface EntitlementRuntimeOptions {
+    /** Shared durable control-plane repository, with transaction/CAS and tenant isolation. */
+    repository: AtomicRepository;
+    /** Read current contracts from eaos_tenant_entitlements; never from request headers/body. */
+    load: (tenantId: string) => Promise<TenantEntitlements | null>;
+    /** Optional joined control-plane read; quota and contract observe the same host transaction. */
+    loadInTransaction?: (principal: PlatformPrincipal, session: AtomicSession) => Promise<TenantEntitlements | null>;
+    /** Same live lifecycle admission for HTTP, MCP, jobs, webhooks and asset delivery. */
+    isActive: (principal: PlatformPrincipal, pluginId: string) => Promise<boolean>;
+    /** Clock for validity and UTC monthly metering period; defaults to a fresh Date per read. */
+    clock?: () => Date;
+}
+/**
+ * Checks live plugin entitlements and durably reserves metered admission attempts.
+ * @remarks A durable quota reservation counts admitted attempts, including failed handler attempts. No refund, cancellation, retry, or business-handler transaction is supplied. Shared concurrency/CAS and tenant isolation depend on the host AtomicRepository. For a contract snapshot consistent with reservation writes, supply loadInTransaction.
+ * @example
+ * ```typescript
+ * import { PluginEntitlementRuntime, type EntitlementRuntimeOptions } from "@alneas/eaos-server/entitlements";
+ * export function entitlementRuntime(options: EntitlementRuntimeOptions) {
+ *   return new PluginEntitlementRuntime(options);
+ * }
+ * ```
+ */
+declare class PluginEntitlementRuntime {
+    private readonly options;
+    /**
+     * Retains host control-plane callbacks and repository without opening a connection.
+     * @param options - Trusted entitlement persistence, active-plugin checks, and optional clock.
+     */
+    constructor(options: EntitlementRuntimeOptions);
+    /**
+     * Loads and validates current tenant contract data for a verified principal.
+     * @param principal - Verified platform principal validated by assertPlatformPrincipal.
+     * @param session - Optional active atomic session; loadInTransaction is used only when both are supplied.
+     * @returns A structured clone of current entitlements, or null when absent.
+     * @throws Rejects invalid principal/contract, mismatched tenant, clone errors, or host load failures.
+     * @example
+     * ```typescript
+     * import { PluginEntitlementRuntime, type EntitlementRuntimeOptions } from "@alneas/eaos-server/entitlements";
+     * import type { PlatformPrincipal } from "@alneas/eaos-core";
+     * export async function snapshot(options: EntitlementRuntimeOptions, principal: PlatformPrincipal) {
+     *   return new PluginEntitlementRuntime(options).snapshot(principal);
+     * }
+     * ```
+     */
+    snapshot(principal: PlatformPrincipal, session?: AtomicSession): Promise<TenantEntitlements | null>;
+    /**
+     * Evaluates lifecycle and subscription policy without consuming quota.
+     * @param principal - Verified user/tenant principal.
+     * @param pluginId - Exact plugin ID used by lifecycle and entitlement evaluation.
+     * @param rule - Plugin access tier, allowed tenants, and optional metering declaration.
+     * @param session - Optional reservation transaction for a joined contract read.
+     * @returns Allowed/denied decision; inactive lifecycle returns denied 404 tenant-locked. This check does not reserve usage.
+     * @throws Rejects invalid data or propagated lifecycle/load/clock errors.
+     * @example
+     * ```typescript
+     * import { PluginEntitlementRuntime, type EntitlementRuntimeOptions } from "@alneas/eaos-server/entitlements";
+     * import type { PlatformPrincipal, PluginEntitlement } from "@alneas/eaos-core";
+     * export async function check(options: EntitlementRuntimeOptions, principal: PlatformPrincipal, pluginId: string, rule: PluginEntitlement) {
+     *   return new PluginEntitlementRuntime(options).check(principal, pluginId, rule);
+     * }
+     * ```
+     */
+    check(principal: PlatformPrincipal, pluginId: string, rule: PluginEntitlement, session?: AtomicSession): Promise<EntitlementDecision>;
+    /**
+     * Rechecks entitlement under the repository transaction and reserves one metered attempt with an audit entry.
+     * @param principal - Verified principal used for tenant-scoped repository admission.
+     * @param pluginId - Plugin whose live entitlement is required.
+     * @param rule - Current plugin entitlement policy; unmetered rules perform no counter write.
+     * @param operation - Host operation label recorded in metering audit data.
+     * @returns No value; resolves after entitlement admission and any quota/audit persistence.
+     * @throws Rejects EntitlementError for denied policy/quota, invalid stored usage counter, or host transaction/load/lifecycle/audit failures.
+     * @remarks Counters use a UTC YYYY-MM period and count admitted attempts, not successful work. Calling admit repeatedly consumes repeatedly; no idempotency key is applied.
+     * @example
+     * ```typescript
+     * import { PluginEntitlementRuntime, type EntitlementRuntimeOptions } from "@alneas/eaos-server/entitlements";
+     * import type { PlatformPrincipal, PluginEntitlement } from "@alneas/eaos-core";
+     * export async function admit(options: EntitlementRuntimeOptions, principal: PlatformPrincipal, pluginId: string, rule: PluginEntitlement) {
+     *   await new PluginEntitlementRuntime(options).admit(principal, pluginId, rule, "example:execute");
+     * }
+     * ```
+     */
+    admit(principal: PlatformPrincipal, pluginId: string, rule: PluginEntitlement, operation: string): Promise<void>;
+    /**
+     * Reserves admission before executing host work outside the reservation transaction.
+     * @typeParam T - Resolved host work result.
+     * @param principal - Verified tenant/user principal.
+     * @param pluginId - Required plugin ID.
+     * @param rule - Plugin entitlement policy.
+     * @param operation - Host operation label for metering audit.
+     * @param work - Called without arguments only after admission; resolves the business result.
+     * @returns The host work result.
+     * @throws Rejects admission or work failures; failed work does not refund a reservation.
+     * @example
+     * ```typescript
+     * import { PluginEntitlementRuntime, type EntitlementRuntimeOptions } from "@alneas/eaos-server/entitlements";
+     * import type { PlatformPrincipal, PluginEntitlement } from "@alneas/eaos-core";
+     * export async function execute<T>(options: EntitlementRuntimeOptions, principal: PlatformPrincipal, pluginId: string, rule: PluginEntitlement, work: () => Promise<T>) {
+     *   return new PluginEntitlementRuntime(options).run(principal, pluginId, rule, "example:execute", work);
+     * }
+     * ```
+     */
+    run<T>(principal: PlatformPrincipal, pluginId: string, rule: PluginEntitlement, operation: string, work: () => Promise<T>): Promise<T>;
+}
+/**
+ * Host callback resolving authenticated user/tenant membership from a request.
+ * @param context - Hono request context after host authentication.
+ * @returns Verified platform principal, or null to deny authentication.
+ * @throws Host failures propagate through request handling.
+ * @see createPluginEntitlementGuard for usage.
+ */
+type EntitlementPrincipalResolver = (context: Context) => Promise<PlatformPrincipal | null>;
+/**
+ * Resolves the engine context principal only when user.tenantId matches tenantId and userId exists.
+ * @param c - Hono context populated exclusively by trusted host authentication middleware.
+ * @returns Principal using context IDs and user roles, or null for missing/mismatched identity.
+ * @remarks Does not independently query live membership or authenticate headers.
+ * @example
+ * ```typescript
+ * import { Hono } from "hono";
+ * import { resolveEngineEntitlementPrincipal } from "@alneas/eaos-server/entitlements";
+ * const app = new Hono();
+ * app.get("/identity-state", async c => c.json({ authenticated: !!await resolveEngineEntitlementPrincipal(c) }));
+ * ```
+ */
+declare const resolveEngineEntitlementPrincipal: EntitlementPrincipalResolver;
+/**
+ * Determines whether a plugin rule needs the external entitlement runtime.
+ * @param rule - Declared plugin entitlement policy.
+ * @returns True for nonpublic tier, any metering, or any allowedTenants property; otherwise false.
+ * @remarks Public unmetered rules still require authentication and host lifecycle/resource admission.
+ * @example
+ * ```typescript
+ * import { requiresEntitlementRuntime } from "@alneas/eaos-server/entitlements";
+ * import type { PluginEntitlement } from "@alneas/eaos-core";
+ * export function needsSubscription(rule: PluginEntitlement) { return requiresEntitlementRuntime(rule); }
+ * ```
+ */
+declare function requiresEntitlementRuntime(rule: PluginEntitlement): boolean;
+/**
+ * Creates a request guard reserving current restricted/metered plugin admission before downstream work.
+ * @param pluginId - Exact plugin ID to admit.
+ * @param rule - Declared plugin access and metering policy.
+ * @param runtime - Required for restricted/metered/allowed-tenant rules; absence returns 503.
+ * @param resolvePrincipal - Verified request principal callback; defaults to resolveEngineEntitlementPrincipal.
+ * @returns Hono middleware returning 401 for absent identity, policy status for EntitlementError, or completing downstream work without a value.
+ * @throws Request handling propagates invalid principal, host runtime, resolver, and downstream errors outside normalized entitlement denial.
+ * @remarks Public unmetered rules skip runtime checks after principal validation; host lifecycle/resource authorization remains required. Metered admission counts failed downstream attempts.
+ * @example
+ * ```typescript
+ * import { Hono } from "hono";
+ * import { createPluginEntitlementGuard, type PluginEntitlementRuntime, type EntitlementPrincipalResolver } from "@alneas/eaos-server/entitlements";
+ * import type { PluginEntitlement } from "@alneas/eaos-core";
+ * export function protectedApp(rule: PluginEntitlement, runtime: PluginEntitlementRuntime, resolvePrincipal: EntitlementPrincipalResolver) {
+ *   const app = new Hono();
+ *   app.use("*", createPluginEntitlementGuard("example-plugin", rule, runtime, resolvePrincipal));
+ *   return app;
+ * }
+ * ```
+ */
+declare function createPluginEntitlementGuard(pluginId: string, rule: PluginEntitlement, runtime?: PluginEntitlementRuntime, resolvePrincipal?: EntitlementPrincipalResolver): hono.MiddlewareHandler<any, string, {}, Response | (Response & hono.TypedResponse<{
+    error: string;
+}, 401, "json">)>;
+/**
+ * Trusted downloadable asset catalog entry; client input selects IDs rather than object keys.
+ * @see createPluginAssetRouter.
+ */
+interface ProtectedPluginAsset {
+    /** Public asset ID unique within a plugin catalog. */
+    id: string;
+    /** Owning plugin ID. */
+    pluginId: string;
+    /** Host storage object key passed to the signing port. */
+    key: string;
+    /** Lowercase 64-hex checksum validated before signing. */
+    sha256: string;
+    /** Host-declared media type returned as metadata. */
+    contentType: string;
+}
+/**
+ * Creates entitled asset URL delivery using a trusted catalog and host signing transport.
+ * @param options - runtime checks current entitlement; resolvePrincipal authenticates the request; plugins supplies rules; assets supplies trusted object metadata; sign receives cloned asset, verified principal, and expiresIn=60 seconds and resolves a capability URL.
+ * @returns A router serving GET /:pluginId/:assetId with URL/checksum/contentType/60-second lifetime, or 401/404/policy denial responses. Successful responses use private, no-store caching.
+ * @throws Request handling propagates resolver/runtime/signing errors or invalid trusted checksums.
+ * @remarks Entitlement is checked before and after external signing, but no quota is reserved by this route. Signed URLs may remain usable after later revocation until expiry; the signing port must enforce private access and the requested lifetime. Catalogs, keys, and credentials must remain host-controlled.
+ * @example
+ * ```typescript
+ * import { createPluginAssetRouter } from "@alneas/eaos-server/entitlements";
+ * export function assetRoutes(options: Parameters<typeof createPluginAssetRouter>[0]) {
+ *   return createPluginAssetRouter(options);
+ * }
+ * ```
+ */
+declare function createPluginAssetRouter(options: {
+    /**
+     * Current lifecycle/subscription policy checker; URL delivery checks it before signing and immediately before returning the capability.
+     */
+    runtime: PluginEntitlementRuntime;
+    /**
+     * Authenticates each asset request and resolves a verified tenant/user principal or null to return 401; errors propagate through Hono.
+     */
+    resolvePrincipal: EntitlementPrincipalResolver;
+    /**
+     * Trusted plugin-ID to entitlement-policy catalog; an unknown plugin is returned as unavailable.
+     */
+    plugins: Readonly<Record<string, PluginEntitlement>>;
+    /**
+     * Trusted asset catalog looked up by plugin ID and asset ID; client input never supplies storage object keys.
+     */
+    assets: readonly ProtectedPluginAsset[];
+    /**
+     * Host signing callback invoked after initial admission with exact asset/principal and a 60-second lifetime; resolves a private capability URL and may reject.
+     */
+    sign: (input: {
+        /**
+         * Structured clone of the trusted catalog asset, including storage key and validated lowercase SHA-256.
+         */
+        asset: ProtectedPluginAsset;
+        /**
+         * Verified principal for the current asset request; use it for host signing authorization.
+         */
+        principal: PlatformPrincipal;
+        /**
+         * Requested signed URL lifetime in seconds; this router always supplies 60.
+         */
+        expiresIn: number;
+    }) => Promise<string>;
+}): Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
+
+export { EntitlementError, PluginEntitlementRuntime, createPluginAssetRouter, createPluginEntitlementGuard, createSqlTenantEntitlementLoader, requiresEntitlementRuntime, resolveEngineEntitlementPrincipal, tenantEntitlementContract };
+export type { EntitlementPrincipalResolver, EntitlementRuntimeOptions, ProtectedPluginAsset };

package/dist/entitlements/index.js

@@ -0,0 +1,23 @@
+import {
+  EntitlementError,
+  PluginEntitlementRuntime,
+  createPluginAssetRouter,
+  createPluginEntitlementGuard,
+  createSqlTenantEntitlementLoader,
+  requiresEntitlementRuntime,
+  resolveEngineEntitlementPrincipal,
+  tenantEntitlementContract
+} from "../chunk-46UWPEW2.js";
+import "../chunk-INCHXAFK.js";
+import "../chunk-3VITSHN3.js";
+export {
+  EntitlementError,
+  PluginEntitlementRuntime,
+  createPluginAssetRouter,
+  createPluginEntitlementGuard,
+  createSqlTenantEntitlementLoader,
+  requiresEntitlementRuntime,
+  resolveEngineEntitlementPrincipal,
+  tenantEntitlementContract
+};
+//# sourceMappingURL=index.js.map

package/dist/entitlements/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/execution/chat.d.ts

@@ -0,0 +1,7 @@
+import '@alneas/appkit-core/ai/ai-chat';
+import '@alneas/appkit-core/ai/action';
+import '@alneas/eaos-core';
+export { ChatClientOptions, ChatCompletion, ChatGovernanceOptions, createChatClient } from './index.js';
+import 'hono/types';
+import 'hono';
+import '@alneas/appkit-core/ai';

package/dist/execution/chat.js

@@ -0,0 +1,7 @@
+import {
+  createChatClient
+} from "../chunk-YMHVRBUU.js";
+export {
+  createChatClient
+};
+//# sourceMappingURL=chat.js.map

package/dist/execution/chat.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}