@alneas/eaos-server 0.0.0-stage → 0.2.0

package/dist/plugin-data/index.d.ts

@@ -0,0 +1,2798 @@
+import * as _alneas_eaos_core from '@alneas/eaos-core';
+import { OutboxDispatcherOptions, OutboxDispatcher, OutboxStore, WorkflowEventSink, OutboxEventInput, OutboxEvent } from '@alneas/eaos-core';
+import * as hono_types from 'hono/types';
+import * as _alneas_eaos_core_plugin_sdk from '@alneas/eaos-core/plugin-sdk';
+import { PluginStoragePolicy, PluginManifest, McpToolDefinition } from '@alneas/eaos-core/plugin-sdk';
+import { Context, Hono } from 'hono';
+import { JsonDocumentContract, DataContractCatalog, DataContractBinding } from '@alneas/eaos-server/lifecycle-engine';
+
+/**
+ * Minimum tenant-owned aggregate state with an append-only in-record operation history.
+ *
+ * @see RecordCommandService for canonical host integration.
+ */
+interface CommandState {
+    /**
+     * Tenant identity bound by the trusted principal; never selected as an authorization grant from request data.
+     */
+    tenantId: string;
+    /**
+     * In-record operation/actor/ISO-time history appended for accepted writes; maximum history length is enforced by the service.
+     */
+    history: {
+        /**
+         * Declared accepted write operation appended by RecordCommandService.
+         */
+        operation: string;
+        /**
+         * Verified user ID whose accepted write created this history entry.
+         */
+        actorId: string;
+        /**
+         * Trusted UTC ISO operation timestamp.
+         */
+        at: string;
+    }[];
+}
+/**
+ * Tenant/record/revision envelope returned after an admitted aggregate operation.
+ * @typeParam T - Cloned reducer response data or resulting state payload.
+ *
+ * @see RecordCommandService for canonical host integration.
+ */
+interface CommandResponse<T> {
+    /**
+     * Tenant identity bound by the trusted principal; never selected as an authorization grant from request data.
+     */
+    tenantId: string;
+    /**
+     * Logical aggregate ID selected by the trusted definition.
+     */
+    recordId: string;
+    /**
+     * Observed aggregate revision; new or unstored reads may use 0, while accepted writes advance it by one.
+     */
+    revision: number;
+    /**
+     * Cloned reducer result, or the resulting aggregate state when the reducer returns undefined.
+     */
+    data: T;
+}
+/**
+ * Host persistence, transaction and live authorization ports for aggregate command execution.
+ * @typeParam T - Tenant-owned aggregate state required by the store and reducer transaction.
+ *
+ * @see RecordCommandService for canonical host integration.
+ */
+interface CommandHost<T extends CommandState> {
+    /**
+     * Optional durable tenant record store; used when transaction is absent.
+     */
+    store?: PluginRecordStore<T>;
+    /**
+     * Runs aggregate reads, CAS and final permission checks through one real connection-bound transaction.
+     *
+     * Trusted connection-bound store; all reads, CAS and final authorization share one transaction.
+     * May expose an unstored projection at revision 0; the first write creates revision 1.
+     * @param principal - Verified current principal owning the transaction.
+     * @param work - Async service work receiving the joined record store; do not retain that store after completion.
+     * @typeParam R - Value resolved by the transaction/connection callback.
+     * @returns The callback result after commit; rejection rolls back joined writes.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { CommandHost, CommandState, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function readAggregate(host: CommandHost<CommandState>, principal: PluginPrincipal, recordId: string) {
+     *   if (!host.transaction) throw new Error("Joined transaction port required");
+     *   return host.transaction(principal, store => store.read(principal.tenantId, recordId));
+     * }
+     * ```
+     */
+    transaction?<R>(principal: PluginPrincipal, work: (store: PluginRecordStore<T>) => Promise<R>): Promise<R>;
+    /**
+     * Checks current lifecycle and permission for the operation and complete returned aggregate.
+     *
+     * Must check live activation and access to the entire returned aggregate, including referenced resources.
+     * @param p - Verified principal copied for this check.
+     * @param operation - Declared operation name.
+     * @param input - Schema input (initial admission occurs before schema validation).
+     * @param current - Optional copied current aggregate including all referenced-resource access.
+     * @returns Exactly true to admit; false denies with PluginError 403.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { CommandHost, CommandState, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function canOperate(host: CommandHost<CommandState>, principal: PluginPrincipal, operation: string, input: unknown, current: Readonly<CommandState>) {
+     *   return await host.authorize(principal, operation, input, current) === true;
+     * }
+     * ```
+     */
+    authorize(p: PluginPrincipal, operation: string, input: unknown, current?: Readonly<T>): Promise<boolean>;
+    /**
+     * Optional trusted clock used for operation history timestamps; defaults to new Date().
+     
+     * @returns A valid Date whose toISOString value becomes the operation timestamp.
+     * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+     */
+    now?: () => Date;
+}
+/**
+ * Private mutable reducer context supplied after command and resource validation.
+ * @typeParam T - Private mutable aggregate state supplied to the reducer.
+ *
+ * @see RecordCommandService for canonical host integration.
+ */
+interface CommandContext<T> {
+    /**
+     * Cloned verified principal for this admitted reducer invocation.
+     */
+    principal: PluginPrincipal;
+    /**
+     * Declared operation being executed.
+     */
+    operation: string;
+    /**
+     * Cloned schema-validated operation input.
+     */
+    args: Record<string, any>;
+    /**
+     * Private mutable aggregate snapshot; persist through the owning service rather than writing the store directly.
+     */
+    state: T;
+    /**
+     * Trusted UTC ISO operation timestamp.
+     */
+    at: string;
+    /**
+     * Logical aggregate ID resolved for this command.
+     */
+    recordId: string;
+}
+/**
+ * Executes schema-validated aggregate reducers through tenant isolation, live admission and revision-predicated persistence.
+ *
+ * Plugin-owned reducers may change their private snapshot only; irreversible external effects must be queued durably.
+ * @typeParam T - Tenant-owned aggregate state with tenantId and appendable operation history.
+ *
+ * @remarks
+ * Requires server Ajv/formats and a real host store or connection-bound transaction. Reducers mutate only their private cloned snapshot; queue irreversible external effects durably. Transactional hosts keep reads, write/CAS and final admission in one commit boundary; plain stores do not add a transaction. No command deduplication or automatic retry is added.
+ *
+ * @example
+ * ```typescript
+ * import { RecordCommandService, type CommandState, type CommandHost } from '@alneas/eaos-server/plugin-data';
+ * export function connectAggregate<T extends CommandState>(host: CommandHost<T>, definition: ConstructorParameters<typeof RecordCommandService<T>>[1]) { return new RecordCommandService(host, definition); }
+ * ```
+ */
+declare class RecordCommandService<T extends CommandState> {
+    private readonly host;
+    private readonly definition;
+    private readonly validators;
+    /**
+     * Compiles the declared operation schemas and binds real host persistence/admission capabilities.
+     * @param host - Live authorization and durable store or transaction; transaction takes precedence when provided.
+     * @param definition - Plugin schemas, write-operation allowlist, record-ID resolver, initial-state factory, reducer and invariant validator.
+     * @throws Throws for absent durable store/transaction or live authorization and for invalid strict Ajv schemas.
+     *
+     * @example
+     * ```typescript
+     * import { RecordCommandService, type CommandState, type CommandHost } from '@alneas/eaos-server/plugin-data';
+     * export function connectAggregate<T extends CommandState>(host: CommandHost<T>, definition: ConstructorParameters<typeof RecordCommandService<T>>[1]) { return new RecordCommandService(host, definition); }
+     * ```
+     */
+    constructor(host: CommandHost<T>, definition: {
+        /**
+         * Strict noncoercing JSON Schemas indexed by accepted operation names.
+         */
+        schemas: Record<string, object>;
+        /**
+         * Explicit operation names that persist state, require matching revision and append history.
+         */
+        writes: readonly string[];
+        /**
+         * Optional pure resolver from admitted input to a nonblank record scope up to 256 characters; omitted uses state.
+         
+         * @param input - Cloned schema-admitted input.
+         * @returns Nonblank logical record ID up to 256 characters; omitted resolver defaults to state.
+         * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+         */
+        recordId?: (input: Record<string, any>) => string;
+        /**
+         * Create a tenant/record-bound unstored aggregate snapshot when no row exists.
+         
+         * @param tenantId - Verified tenant ID owning the aggregate.
+         * @param recordId - Resolved logical record ID.
+         * @returns A new private unstored tenant-owned state with initialized history.
+         * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+         */
+        initial: (tenantId: string, recordId: string) => T;
+        /**
+         * Async plugin reducer receiving private state/input and verified context; mutate only that snapshot and queue external effects durably.
+         
+         * @param context - Private mutable state, cloned principal/input and trusted operation time.
+         * @returns Optional domain response data; undefined selects the resulting state for response data.
+         * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+         */
+        reduce: (context: CommandContext<T>) => Promise<unknown>;
+        /**
+         * Synchronous aggregate invariant assertion before/after writes; throw to reject invalid state.
+         
+         * @param state - Private aggregate state whose tenant/history/domain invariants must hold.
+         * @returns Completes without a value when invariants pass; throw to reject before persistence.
+         * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+         */
+        validate: (state: T) => void;
+    });
+    /**
+     * Validates and admits one aggregate operation, running a reducer against a private current snapshot.
+     * @param principal - Host-authenticated current tenant/user context; structural validation alone proves no membership.
+     * @param operation - Declared schema key; membership in definition.writes selects persistence.
+     * @param input - Operation-schema input; writes require a safe integer revision matching the current snapshot, including 0 for a new/unstored aggregate.
+     * @returns A tenant/record/revision envelope with cloned reducer data, or resulting state when the reducer returns undefined; read-only reducers do not persist mutations.
+     * @throws Rejects malformed principal (401), denied live admission (403), schema/scope errors (400), stale revision/capacity/CAS conflict (409), invalid foreign records/reducer scope, and propagated reducer/invariant/clock/store/transaction failures.
+     *
+     * @remarks
+     * Record ID defaults to state and must be nonblank/up to 256 characters. Writes append actor/UTC history and reject over 5000 entries or 8 MiB JSON state. Host transaction projections may start at revision 0. Rejections can follow partial plain-store/adapter effects; callers must reload before retrying uncertain outcomes.
+     *
+     * @example
+     * ```typescript
+     * import { RecordCommandService, type CommandState, type PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export function executeAggregate<T extends CommandState>(service: RecordCommandService<T>, principal: PluginPrincipal, operation: string, input: unknown) { return service.execute(principal, operation, input); }
+     * ```
+     */
+    execute(principal: PluginPrincipal, operation: string, input: unknown): Promise<CommandResponse<any>>;
+}
+
+/**
+ * Version-1 hash-linked journal event storing payload hashes and optional command receipt identity.
+ *
+ * @see appendAtomicAudit for canonical host integration.
+ */
+interface AtomicAuditEvent {
+    /**
+     * Persisted journal schema version; must be 1.
+     */
+    version: 1;
+    /**
+     * Tenant identity bound by the trusted principal; never selected as an authorization grant from request data.
+     */
+    tenantId: string;
+    /**
+     * Positive monotonically increasing journal position within the tenant/namespace.
+     */
+    sequence: number;
+    /**
+     * Trusted operation label recorded for this admitted command.
+     */
+    operation: string;
+    /**
+     * Verified actor identity at append time.
+     */
+    actorId: string;
+    /**
+     * UTC ISO append timestamp.
+     */
+    at: string;
+    /**
+     * Hash of JSON-normalized command input; no input payload bytes are stored here.
+     */
+    inputHash: string;
+    /**
+     * Hash of JSON-normalized command result; undefined is normalized to null.
+     */
+    resultHash: string;
+    /**
+     * Optional immutable command receipt key, otherwise null.
+     */
+    commandKey: string | null;
+    /**
+     * Previous journal event hash, or null for the first event.
+     */
+    previousHash: string | null;
+    /**
+     * Canonical hash of the other event fields; not an external signature.
+     */
+    hash: string;
+}
+/**
+ * Append a hash-linked immutable audit event and CAS-update its head in the current transaction.
+ * @param tx - Live atomic session shared with the domain command.
+ * @param p - Verified tenant/user principal.
+ * @param operation - Trusted nonempty operation label of at most 240 characters.
+ * @param input - Input whose JSON-normalized hash is recorded; payload bytes are not stored in the audit event.
+ * @param result - Result whose JSON-normalized hash is recorded; undefined is normalized to null.
+ * @param commandKey - Optional command/ receipt key linking command input/result evidence; defaults to null.
+ * @returns The appended version-1 event with sequence and integrity hash.
+ * @throws Rejects invalid principals/labels/receipt keys, corrupt head/previous event, sequence capacity or transaction failures.
+ * @remarks Requires the caller's existing transaction and current authorization. Hash continuity is not an external trust anchor; real business payloads remain outside audit events.
+ * @example
+ * import { appendAtomicAudit } from '@alneas/eaos-server/plugin-data'
+ * export function audit(tx: Parameters<typeof appendAtomicAudit>[0], p: Parameters<typeof appendAtomicAudit>[1], input: unknown, result: unknown) { return appendAtomicAudit(tx, p, 'example-operation', input, result) }
+ */
+declare function appendAtomicAudit(tx: AtomicSession, p: PluginPrincipal, operation: string, input: unknown, result: unknown, commandKey?: string | null): Promise<{
+    hash: string;
+    version: 1;
+    tenantId: string;
+    sequence: number;
+    operation: string;
+    actorId: string;
+    at: string;
+    inputHash: string;
+    resultHash: string;
+    commandKey: string | null;
+    previousHash: string | null;
+}>;
+/**
+ * Read and verify one bounded page of immutable tenant audit events.
+ * @param tx - Live tenant-scoped atomic session.
+ * @param p - Verified principal whose tenant must match each event.
+ * @param afterSequence - Exclusive nonnegative sequence; defaults to 0.
+ * @param limit - Integer page size from 1 to 100; defaults to 50.
+ * @returns Verified events and a continuation sequence or null when no further row was observed.
+ * @throws Rejects invalid pagination, event identity/version/revision/hash mismatches or store failures.
+ * @remarks Caller enforces current resource permission before and after reading. One page does not verify full chain continuity or an external trust anchor.
+ * @example
+ * import { readAtomicAudit } from '@alneas/eaos-server/plugin-data'
+ * export function auditPage(tx: Parameters<typeof readAtomicAudit>[0], p: Parameters<typeof readAtomicAudit>[1]) { return readAtomicAudit(tx, p, 0, 50) }
+ */
+declare function readAtomicAudit(tx: AtomicSession, p: PluginPrincipal, afterSequence?: number, limit?: number): Promise<{
+    events: AtomicAuditEvent[];
+    nextSequence: number | null;
+}>;
+/**
+ * Verify a bounded audit chain, its head and linked command receipts within the current tenant transaction.
+ * @param tx - Live atomic session containing the journal and receipts.
+ * @param p - Verified tenant/user principal with host-admitted audit access.
+ * @returns Tenant identity, verified event count/head hash and explicit externalTrustAnchor=false.
+ * @throws Rejects more than 10000 events, discontinuous sequence/hash links, receipt mismatches, corrupt head/tail or store failures.
+ * @remarks Integrity verification cannot prove an external actor has not rewritten the entire journal. Larger histories need the host's reviewed archival verifier.
+ * @example
+ * import { verifyAtomicAudit } from '@alneas/eaos-server/plugin-data'
+ * export function verifyJournal(tx: Parameters<typeof verifyAtomicAudit>[0], p: Parameters<typeof verifyAtomicAudit>[1]) { return verifyAtomicAudit(tx, p) }
+ */
+declare function verifyAtomicAudit(tx: AtomicSession, p: PluginPrincipal): Promise<{
+    tenantId: string;
+    status: "verified";
+    count: number;
+    headHash: string | null;
+    coverage: "atomic-journal-v1";
+    externalTrustAnchor: false;
+}>;
+
+/**
+ * Insert or replay one immutable Outbox event inside the same transaction as its domain write.
+ * @param tx - Live tenant-scoped atomic session.
+ * @param input - Canonical event input with stable tenant, topic and idempotency identity.
+ * @typeParam T - JSON-serializable event payload type.
+ * @returns A cloned new event or the matching existing event.
+ * @throws Rejects invalid event input, conflicting idempotency input or transaction failures.
+ * @remarks Does not deliver externally; the host scheduler and idempotent handler process the committed event later.
+ * @example
+ * import { enqueueOutboxEvent } from '@alneas/eaos-server/plugin-data'
+ * export function enqueue<T>(tx: Parameters<typeof enqueueOutboxEvent>[0], input: Parameters<typeof enqueueOutboxEvent<T>>[1]) { return enqueueOutboxEvent(tx, input) }
+ */
+declare function enqueueOutboxEvent<T>(tx: AtomicSession, input: OutboxEventInput<T>): Promise<OutboxEvent<T>>;
+/**
+ * Bind workflow event append operations to the caller's current atomic transaction.
+ * @param tx - Live session containing the same domain CAS operation.
+ * @param topicPrefix - Trusted nonempty topic prefix; defaults to workflow and admits letters/digits/underscore/dot/colon/slash/hyphen.
+ * @returns A WorkflowEventSink that enqueues copied envelopes in the existing Outbox.
+ * @throws Invalid session/prefix throws at construction; appended event validation/idempotency/store failures reject.
+ * @remarks The sink owns no commit boundary and performs no external transport; use it only while the parent transaction is active.
+ * @example
+ * import { createAtomicWorkflowEventSink, type AtomicRepository, type PluginPrincipal } from '@alneas/eaos-server/plugin-data'
+ * import type { WorkflowEventEnvelope } from '@alneas/eaos-core'
+ * export function appendWorkflow<T>(repository: AtomicRepository, principal: PluginPrincipal, event: WorkflowEventEnvelope<T>) {
+ *  return repository.run(principal, session => createAtomicWorkflowEventSink(session).append(event))
+ * }
+ */
+declare function createAtomicWorkflowEventSink(tx: AtomicSession, topicPrefix?: string): WorkflowEventSink;
+/**
+ * Principal, repository and stale-claim settings for durable Outbox transitions.
+ *
+ * @see createAtomicOutboxStore for canonical host integration.
+ */
+interface AtomicOutboxStoreOptions {
+    /**
+     * Real atomic repository for durable tenant-scoped Outbox transitions.
+     */
+    repository: AtomicRepository;
+    /**
+     * Verified fixed tenant/user scope copied at construction; replace the store when identity changes.
+     */
+    principal: PluginPrincipal;
+    /**
+     * Claim staleness threshold in milliseconds; defaults to 300000 and must be finite and at least 1000.
+     */
+    staleAfterMs?: number;
+    /**
+     * Optional dispatcher clock; createAtomicOutboxDispatcher forwards it, while standalone store.claim uses its explicit now parameter.
+     
+     * @returns The trusted current Date when used by createAtomicOutboxDispatcher; standalone store.claim receives an explicit Date.
+     * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+     */
+    now?: () => Date;
+}
+/**
+ * Bind durable Outbox claim/result transitions to one verified principal and atomic repository.
+ * @param options - Repository/principal plus optional staleAfterMs (default 300000, minimum 1000) and clock.
+ * @returns An OutboxStore using CAS claim tokens for publication/failure transitions.
+ * @throws Invalid stale timeout throws; claims reject batch sizes outside 1–100, scope mismatches, nonadvancing pages or scan capacity above 30000; result writes reject changed claim tokens.
+ * @remarks Stale claims can be reclaimed, so external handlers must tolerate duplicate delivery. No global scheduler or external exactly-once guarantee is provided.
+ * @example
+ * import { createAtomicOutboxStore } from '@alneas/eaos-server/plugin-data'
+ * export function store(options: Parameters<typeof createAtomicOutboxStore>[0]) { return createAtomicOutboxStore(options) }
+ */
+declare function createAtomicOutboxStore(options: AtomicOutboxStoreOptions): OutboxStore;
+/**
+ * Existing dispatcher options combined with the canonical atomic tenant Outbox store.
+ *
+ * @see createAtomicOutboxDispatcher for canonical host integration.
+ */
+interface AtomicOutboxDispatcherOptions extends Omit<OutboxDispatcherOptions, 'store'>, AtomicOutboxStoreOptions {
+}
+/**
+ * Compose the existing OutboxDispatcher with the tenant-scoped atomic Outbox store.
+ * @param options - Dispatcher handlers/time/retry settings plus the atomic repository and principal.
+ * @returns An OutboxDispatcher instance; construction alone does not start a worker loop.
+ * @throws Invalid store/dispatcher configuration throws; later dispatch rejects according to its host handlers and store.
+ * @remarks Host scheduling and handler idempotency remain explicit; no parallel transport or global singleton is introduced.
+ * @example
+ * import { createAtomicOutboxDispatcher } from '@alneas/eaos-server/plugin-data'
+ * export function dispatcher(options: Parameters<typeof createAtomicOutboxDispatcher>[0]) { return createAtomicOutboxDispatcher(options) }
+ */
+declare function createAtomicOutboxDispatcher(options: AtomicOutboxDispatcherOptions): OutboxDispatcher;
+/**
+ * Reset one failed tenant event to pending while retaining its immutable identity.
+ * @param tx - Live session entered after explicit host recovery authorization.
+ * @param tenantId - Verified tenant identity required to match the stored event.
+ * @param id - Existing failed event ID, nonempty and at most 256 characters.
+ * @param availableAt - Parseable retry timestamp; defaults to the current ISO time.
+ * @returns The requeued event with claim/error fields cleared.
+ * @throws Rejects invalid identifiers/timestamps, missing/nonfailed/foreign events or CAS failures.
+ * @remarks Does not perform delivery or authorize recovery. A prior uncertain external effect may already exist; handlers must deduplicate by the retained identity.
+ * @example
+ * import { requeueOutboxEvent } from '@alneas/eaos-server/plugin-data'
+ * export function requeue(tx: Parameters<typeof requeueOutboxEvent>[0], tenantId: string, id: string) { return requeueOutboxEvent(tx, tenantId, id) }
+ */
+declare function requeueOutboxEvent(tx: AtomicSession, tenantId: string, id: string, availableAt?: string): Promise<OutboxEvent>;
+
+/**
+ * Host record storage and live resource authorization, optionally joined to a shared atomic repository.
+ * @typeParam T - Tenant-owned stored record payload.
+ *
+ * @see ScopedRecordService for canonical host integration.
+ */
+interface ScopedRecordHost<T> {
+    /**
+     * Host record store with real tenant scoping and revision-predicated writes.
+     */
+    store: PluginRecordStore<T>;
+    /**
+     * Checks current plugin activation and resource permission before exposing or persisting records.
+     * @param principal - Verified current principal.
+     * @param operation - Declared operation name.
+     * @param input - Operation input, list criteria or created payload appropriate to the check.
+     * @param current - Optional copied current record; absence requires operation-level admission.
+     * @returns Exactly true to admit the operation/record; false denies or filters the record during lists.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { ScopedRecordHost, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function admitted(host: ScopedRecordHost<{ title: string }>, principal: PluginPrincipal, operation: string, input: unknown, current?: unknown) {
+     *   return await host.authorize(principal, operation, input, current) === true;
+     * }
+     * ```
+     */
+    authorize(principal: PluginPrincipal, operation: string, input: unknown, current?: unknown): Promise<boolean>;
+    /**
+     * Optional trusted operation clock; defaults to new Date().
+     
+     * @returns A valid Date used for the current CRUD/domain operation timestamp.
+     * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+     */
+    now?: () => Date;
+    /**
+     * Optional existing atomic repository joining ordinary CRUD, workflow commands, reservations and audit in one commit boundary.
+     *
+     * Ordinary CRUD and workflow commands share the provided transaction boundary.
+     */
+    repository?: AtomicRepository;
+}
+/**
+ * Plugin-owned schemas, CRUD reducers, filtering and transactional identity/composition rules.
+ * @typeParam T - Stored record payload with stable tenantId/id.
+ * @typeParam S - Decoded record view extending T with a positive CAS revision.
+ *
+ * @see ScopedRecordService for canonical host integration.
+ */
+interface ScopedRecordDefinition<T extends {
+    tenantId: string;
+    id: string;
+}, S extends T & {
+    revision: number;
+}> {
+    /**
+     * Explicit per-operation JSON Schemas compiled with coercion disabled.
+     */
+    schemas: Record<string, object>;
+    /**
+     * Exact list/get/create/update/archive operation names used for shared dispatch.
+     */
+    operations: {
+        /**
+         * Host operation name for bounded or keyset-paged authorized record listing.
+         */
+        list: string;
+        /**
+         * Host operation name for reading one authorized record.
+         */
+        get: string;
+        /**
+         * Host operation name for creating one tenant record.
+         */
+        create: string;
+        /**
+         * Host operation name for revision-predicated record patching.
+         */
+        update: string;
+        /**
+         * Host operation name for the plugin-owned retained-data archive transition.
+         */
+        archive: string;
+    };
+    /**
+     * Response property under which admitted records are returned.
+     */
+    listKey: string;
+    /**
+     * Trusted domain label used in validation/conflict errors.
+     */
+    label: string;
+    /**
+     * Enable filtered keyset scanning when the host store supplies listPage; otherwise a supplied cursor is rejected.
+     *
+     * Enable complete filtered paging when the store supplies listPage.
+     */
+    pagination?: boolean;
+    /**
+     * Additional auxiliary record prefixes omitted from business CRUD results.
+     *
+     * Plugin-owned auxiliary keys must not appear as business records.
+     */
+    excludedIdPrefixes?: readonly string[];
+    /**
+     * Optional composite identity reservation rules; require a shared transaction for concurrent enforcement.
+     *
+     * Transactional reservations enforce composite business identities across concurrent writers.
+     */
+    unique?: readonly {
+        /**
+         * Trusted uniqueness constraint label matching lowercase letter followed by up to 60 lowercase letters/digits/underscore/hyphen characters.
+         */
+        name: string;
+        /**
+         * Nonempty ordered stored field keys; every active value must be a nonblank string.
+         */
+        fields: readonly (keyof T & string)[];
+        /** Trusted domain predicate; false releases this record's reservation.
+         * @param record - Cloned current record; this predicate must be pure.
+         * @returns True to reserve the composite identity, false to release it; nonboolean results reject.
+         * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+         */ when?: (record: T) => boolean;
+    }[];
+    /**
+     * Fields searched by the generic case-insensitive query filter.
+     */
+    searchableFields?: readonly (keyof S & string)[];
+    /**
+     * Optional synchronous domain filter applied in addition to standard criteria and live record authorization.
+     
+     * @param input - Schema-admitted list criteria.
+     * @param value - Decoded scoped record being considered.
+     * @returns True to retain this candidate before the additional search/live-record permission checks.
+     * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+     */
+    filter?: (input: Record<string, any>, value: S) => boolean;
+    /**
+     * Creates a new tenant-owned domain payload from admitted inputs.
+     * @param input - Schema-validated create input.
+     * @param principal - Verified current tenant principal.
+     * @param at - Trusted UTC ISO operation timestamp.
+     * @returns The new payload with stable id and matching tenantId; no persistence is performed by this reducer.
+     * @throws Reducer errors propagate; do not perform irreversible external effects.
+     
+     * @example
+     * ```typescript
+     * import type { ScopedRecordDefinition, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * type Stored = { tenantId: string; id: string; archived: boolean };
+     * type View = Stored & { revision: number };
+     * export function reduceCreate(definition: ScopedRecordDefinition<Stored, View>, principal: PluginPrincipal, admittedInput: Record<string, unknown>) {
+     *   return definition.create(admittedInput, principal, new Date().toISOString());
+     * }
+     * ```
+     */
+    create(input: Record<string, any>, principal: PluginPrincipal, at: string): T;
+    /**
+     * Mutates only the private record snapshot with the admitted patch.
+     * @param value - Mutable current decoded revisioned record; preserve tenantId/id.
+     * @param patch - Schema-admitted patch fields.
+     * @param at - Trusted UTC ISO operation timestamp.
+     * @returns Completes without a value; the owning service performs CAS persistence.
+     * @throws Reducer errors propagate and roll back joined transactional work.
+     
+     * @example
+     * ```typescript
+     * import type { ScopedRecordDefinition } from '@alneas/eaos-server/plugin-data';
+     * type Stored = { tenantId: string; id: string; archived: boolean };
+     * type View = Stored & { revision: number };
+     * export function reduceUpdate(definition: ScopedRecordDefinition<Stored, View>, snapshot: View, admittedPatch: Record<string, unknown>) {
+     *   const next = structuredClone(snapshot);
+     *   definition.update(next, admittedPatch, new Date().toISOString());
+     *   return next; // The owning service still performs revision-checked persistence.
+     * }
+     * ```
+     */
+    update(value: S, patch: Record<string, unknown>, at: string): void;
+    /**
+     * Mutates the private record snapshot to the plugin's archive state.
+     * @param value - Mutable current record; preserve stable tenantId/id.
+     * @param at - Trusted UTC ISO operation timestamp.
+     * @param input - Optional schema-admitted archive command input.
+     * @param principal - Optional verified current principal supplied by the service.
+     * @returns Completes without a value; archive retains data according to the plugin reducer.
+     * @throws Reducer errors propagate; do not perform irreversible external effects.
+     
+     * @example
+     * ```typescript
+     * import type { ScopedRecordDefinition, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * type Stored = { tenantId: string; id: string; archived: boolean };
+     * type View = Stored & { revision: number };
+     * export function reduceArchive(definition: ScopedRecordDefinition<Stored, View>, snapshot: View, principal: PluginPrincipal, admittedInput: Record<string, unknown>) {
+     *   const next = structuredClone(snapshot);
+     *   definition.archive(next, new Date().toISOString(), admittedInput, principal);
+     *   return next; // No persistence is performed by this reducer call.
+     * }
+     * ```
+     */
+    archive(value: S, at: string, input?: Record<string, any>, principal?: PluginPrincipal): void;
+    /**
+     * Additional plugin-owned mutation reducers persisted through the same CAS path; never perform irreversible external effects here.
+     *
+     * Plugin-owned durable workflow commands. Each command is validated by its
+     * declared schema, receives the current revision, and is persisted through
+     * the same tenant-scoped CAS path as update/archive.
+     
+     * @param value - Private mutable revisioned record; preserve stable tenant/id.
+     * @param input - Schema-admitted custom command input.
+     * @param at - Trusted ISO operation timestamp.
+     * @param principal - Verified current principal.
+     * @returns Completes without a value after mutating the private snapshot; the owning service performs CAS persistence.
+     * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+     */
+    custom?: Record<string, (value: S, input: Record<string, any>, at: string, principal: PluginPrincipal) => void>;
+    /**
+     * Optional async owning-domain composition inside the shared transaction before final authorization; not an external side-effect hook.
+     *
+     * Owning domain composition inside the existing transaction, before final live authorization. Never use for external effects.
+     
+     * @param principal - Verified current principal.
+     * @param operation - Declared mutation operation.
+     * @param input - Schema-admitted command input.
+     * @param current - Cloned resulting decoded record; do not mutate service state through this copy.
+     * @param previous - Optional prior decoded record, absent on create.
+     * @returns Resolves without a value after owning-domain composition inside the same transaction; no external effects.
+     * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+     */
+    afterWrite?: (principal: PluginPrincipal, operation: string, input: Record<string, any>, current: S, previous?: S) => Promise<void>;
+}
+/**
+ * Derive a stable atomic reservation key for a named composite business identity.
+ * @param name - Trusted lowercase uniqueness label of at most 61 characters.
+ * @param values - Nonempty tuple of nonblank string values in canonical field order.
+ * @returns unique/ followed by a canonical content hash.
+ * @throws Invalid declarations throw Error; nonstring/blank identity values throw PluginError 409.
+ * @remarks Derivation alone reserves nothing; concurrent uniqueness requires CAS reservations in the enclosing atomic transaction.
+ * @example
+ * import { uniqueRecordKey } from '@alneas/eaos-server/plugin-data'
+ * const key = uniqueRecordKey('external-id', ['example'])
+ */
+declare function uniqueRecordKey(name: string, values: readonly unknown[]): string;
+/**
+ * Applies schema-validated record CRUD and workflow commands through tenant checks, live admission and optimistic revisions.
+ *
+ * Shared tenant-scoped CRUD/CAS boundary for small plugin-owned master records.
+ * @typeParam T - Stored tenant-owned record payload containing stable tenantId and id.
+ * @typeParam S - Decoded public record view extending T with a positive CAS revision.
+ *
+ * @remarks
+ * Use a real atomic repository for unique identity reservations, owning-domain composition and command/audit receipts. Repository execution joins CRUD/domain writes and final authorization in one transaction; plain stores do not gain those guarantees. Domain reducers must not perform irreversible external effects. Auxiliary audit/command/event/unique keys are excluded from business results as configured.
+ *
+ * @example
+ * ```typescript
+ * import { ScopedRecordService, type ScopedRecordHost, type ScopedRecordDefinition } from '@alneas/eaos-server/plugin-data';
+ * type Row = { tenantId: string; id: string; title: string };
+ * type RevisionedRow = Row & { revision: number };
+ * export function connectRecords(host: ScopedRecordHost<Row>, definition: ScopedRecordDefinition<Row, RevisionedRow>) { return new ScopedRecordService(host, definition); }
+ * ```
+ */
+declare class ScopedRecordService<T extends {
+    tenantId: string;
+    id: string;
+}, S extends T & {
+    revision: number;
+}> {
+    private readonly host;
+    private readonly definition;
+    private readonly atomicSession?;
+    private readonly validators;
+    /**
+     * Compiles strict noncoercing command schemas for one trusted record definition.
+     * @param host - Durable tenant-scoped store, live authorization, optional clock and shared atomic repository.
+     * @param definition - Plugin-owned operation names, schemas, reducers, paging and identity rules.
+     * @param atomicSession - Optional already active internal session used for joined composition/uniqueness; its lifetime must not exceed the enclosing repository callback.
+     * @throws Throws when durable store or live authorization is missing, or strict schema compilation fails.
+     *
+     * @example
+     * ```typescript
+     * import { ScopedRecordService, type ScopedRecordHost, type ScopedRecordDefinition } from '@alneas/eaos-server/plugin-data';
+     * type Row = { tenantId: string; id: string; title: string };
+     * type RevisionedRow = Row & { revision: number };
+     * export function connectRecords(host: ScopedRecordHost<Row>, definition: ScopedRecordDefinition<Row, RevisionedRow>) { return new ScopedRecordService(host, definition); }
+     * ```
+     */
+    constructor(host: ScopedRecordHost<T>, definition: ScopedRecordDefinition<T, S>, atomicSession?: AtomicSession | undefined);
+    private allow;
+    /**
+     * Exposes the same live tenant/permission check to a plugin's read-only
+     * domain previews. Preview operations do not persist records, but they must
+     * still be authorized through the host before invoking domain logic.
+     */
+    protected authorizeOperation(principal: PluginPrincipal, operation: string, input: unknown, current?: S): Promise<void>;
+    protected currentTime(): Date;
+    private excluded;
+    private decode;
+    private load;
+    private matches;
+    /** Read all authorized records for plugin-owned reports; providers must support keyset paging. */
+    protected readAllAuthorized(principal: PluginPrincipal, operation: string, input: unknown, accept: (value: S) => boolean): Promise<S[]>;
+    private readAllFromStore;
+    private reserveUnique;
+    /**
+     * Dispatches one admitted record operation and optionally joins it to durable command/audit receipt handling.
+     * @param principal - Verified current tenant/user principal; host authorization is rechecked throughout the operation.
+     * @param operation - Declared list/get/create/update/archive or plugin custom reducer key.
+     * @param input - Operation-schema input; mutations require matching record revision and optional durable commandId when declared.
+     * @returns List operations return the configured listKey with scoped records and paging metadata; get/mutations return a decoded revisioned record. Paged results may be incomplete and carry nextCursor/mayHaveMore.
+     * @throws Rejects invalid principal (401), denied/revoked admission (403), schema/operation errors (400), missing/excluded record (404), stale revision/uniqueness/CAS conflict or missing required transactional capability (409), foreign/corrupt records, and propagated domain/store/clock/callback failures.
+     *
+     * @remarks
+     * Pagination scans at most 10000 rows per request, selecting authorized/filter-matching records. Without paging, filtering applies only to the bounded store result. Repository writes with declared commandId replay the stored identical result; other repository writes append audit. Recheck live resource permission before replay, and reload uncertain plain-store outcomes rather than retrying blindly.
+     *
+     * @example
+     * ```typescript
+     * import { ScopedRecordService, type PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export function dispatch<T extends {tenantId: string; id: string}, S extends T & {revision: number}>(service: ScopedRecordService<T, S>, principal: PluginPrincipal, operation: string, input: unknown) { return service.execute(principal, operation, input); }
+     * ```
+     */
+    execute(principal: PluginPrincipal, operation: string, input: unknown): Promise<unknown>;
+}
+
+/**
+ * Minimal verified-principal operation dispatch contract shared by bounded composite services.
+ *
+ * @see createCompositePluginService for canonical host integration.
+ */
+interface PluginOperationService {
+    /**
+     * Executes one service-owned operation using host-verified identity and operation input.
+     * @param principal - Verified current tenant principal.
+     * @param operation - Declared service operation name.
+     * @param input - Operation input whose schema/permission must be checked by the owning service.
+     * @returns The owner's operation result; no composite layer adds authentication or transactions.
+     * @throws Rejects owning-service schema, authorization, persistence or domain failures.
+     
+     * @example
+     * ```typescript
+     * import type { PluginOperationService, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function executeAdmitted(service: PluginOperationService, principal: PluginPrincipal, operation: string, input: unknown) {
+     *   // The owning service validates input and live resource permission.
+     *   return service.execute(principal, operation, input);
+     * }
+     * ```
+     */
+    execute(principal: PluginPrincipal, operation: string, input: unknown): Promise<unknown>;
+}
+/**
+ * Route explicitly owned operations to their bounded service instances.
+ * @param services - Trusted service instances keyed by owner name.
+ * @param operationOwners - Explicit operation-to-owner mapping copied at construction.
+ * @returns A principal-aware execute service forwarding to the declared owner.
+ * @throws Unknown declared owners throw at construction; unknown operations reject with PluginError 400 and owner errors propagate.
+ * @remarks Does not authenticate principals or add authorization/transactions; each owner service retains its actual boundaries.
+ * @example
+ * import { createCompositePluginService } from '@alneas/eaos-server/plugin-data'
+ * export function composite(services: Parameters<typeof createCompositePluginService>[0]) { return createCompositePluginService(services, { list: 'records' }) }
+ */
+declare function createCompositePluginService(services: Readonly<Record<string, PluginOperationService>>, operationOwners: Readonly<Record<string, string>>): PluginOperationService;
+
+/**
+ * Apply canonical document validation to every existing host persistence path while retaining other host methods.
+ * @param host - Host with optional record store, repository and/or transaction callback.
+ * @param documents - Trusted canonical JSON document definitions.
+ * @typeParam T - Stored JSON payload shape.
+ * @typeParam H - Concrete host shape whose existing methods and persistence capabilities are retained.
+ * @returns A proxy with wrapped persistence capabilities and other functions bound to the original host.
+ * @throws Invalid document contracts throw during wrapper creation; subsequent validation and underlying host failures propagate.
+ * @remarks Does not replace transaction ownership or live authorization. Inputs are copied for validation; unrelated host methods keep their original receiver.
+ * @example
+ * import { createValidatedRecordHost } from '@alneas/eaos-server/plugin-data'
+ * export function validated<T>(host: Parameters<typeof createValidatedRecordHost<T, { store?: import('@alneas/eaos-server/plugin-data').PluginRecordStore<T> }>>[0], documents: Parameters<typeof createValidatedRecordHost>[1]) { return createValidatedRecordHost(host, documents) }
+ */
+declare function createValidatedRecordHost<T, H extends {
+    /**
+     * Optional existing tenant/CAS store wrapped with canonical payload checks.
+     */
+    store?: PluginRecordStore<T>;
+    /**
+     * Optional existing atomic repository wrapped without adding a second transaction.
+     */
+    repository?: AtomicRepository;
+    /**
+     * Optional real aggregate transaction; its callback receives a validated connection-bound store.
+     
+     * @param principal - Verified current principal.
+     * @param work - Async service work on the validated connection-bound store.
+     * @typeParam R - Callback result resolved by the host transaction.
+     * @returns The callback result after host commit; underlying transaction/rejection semantics are preserved.
+     * @throws Callback failures propagate to the owning operation; transactional writes roll back when the host boundary rejects.
+     */
+    transaction?: <R>(principal: PluginPrincipal, work: (store: PluginRecordStore<T>) => Promise<R>) => Promise<R>;
+}>(host: H, documents: readonly JsonDocumentContract[]): H;
+/**
+ * Resolve canonical payload document contracts for one verified Data Contract table/namespace binding.
+ * @param catalog - Trusted resolved Data Contract catalog.
+ * @param binding - Contract identity, table, namespace and optional declared document IDs.
+ * @returns All matching payload document contracts for the bound table/namespace, possibly empty.
+ * @throws Rejects missing/mismatched bindings, a table without id/revision/payload envelope fields or unavailable/duplicate requested document IDs.
+ * @remarks Validates requested document selection but returns every matching namespace document, not only the requested-ID subset.
+ * @example
+ * import { recordDocuments } from '@alneas/eaos-server/plugin-data'
+ * export function documents(catalog: Parameters<typeof recordDocuments>[0], binding: Parameters<typeof recordDocuments>[1]) { return recordDocuments(catalog, binding) }
+ */
+declare function recordDocuments(catalog: DataContractCatalog, binding: DataContractBinding & {
+    /**
+     * Optional explicit nonempty unique document IDs to verify against the bound namespace; all matching namespace documents are returned.
+     */
+    jsonDocuments?: readonly string[];
+}): JsonDocumentContract[];
+/**
+ * Compile closed payload schemas and route records by longest canonical prefix without coercion or remote loading.
+ * @param documents - Nonempty trusted document list; each binds column payload to a closed object schema.
+ * @returns A synchronous (tenantId, record) assertion that accepts only matching identity, revision, immutability and schema.
+ * @throws Rejects absent/open/ambiguous contracts at construction; assertions reject invalid IDs/revisions, unmatched routes, immutable replacements, schema or embedded-tenant mismatch.
+ * @remarks Does not write records or prove live authorization; document definitions are cloned before compilation.
+ * @example
+ * import { createRecordDocumentValidator } from '@alneas/eaos-server/plugin-data'
+ * export function validator(documents: Parameters<typeof createRecordDocumentValidator>[0]) { return createRecordDocumentValidator(documents) }
+ */
+declare function createRecordDocumentValidator(documents: readonly JsonDocumentContract[]): (tenantId: string, record: PluginRecord<unknown>) => void;
+/**
+ * Validate canonical documents on host-store reads and writes while retaining its transaction semantics.
+ * @param store - Existing host record store with real tenant/CAS behavior.
+ * @param documents - Trusted canonical payload contracts to clone and enforce.
+ * @typeParam T - JSON payload shape retained by the wrapped store.
+ * @returns A wrapped store retaining optional listPage/delete capabilities when supplied.
+ * @throws Invalid contracts throw at creation; operations reject mismatched IDs, invalid revision transitions/payloads and immutable deletion, with underlying errors propagated.
+ * @remarks Does not add a transaction or independent authorization. Host returned list rows must still be correctly tenant-scoped.
+ * @example
+ * import { createValidatedRecordStore } from '@alneas/eaos-server/plugin-data'
+ * export function store<T>(store: Parameters<typeof createValidatedRecordStore<T>>[0], documents: Parameters<typeof createValidatedRecordStore>[1]) { return createValidatedRecordStore(store, documents) }
+ */
+declare function createValidatedRecordStore<T>(store: PluginRecordStore<T>, documents: readonly JsonDocumentContract[]): PluginRecordStore<T>;
+/**
+ * Validate canonical document payloads inside the host repository's existing commit boundary.
+ * @param repository - Real tenant-scoped atomic repository.
+ * @param documents - Trusted canonical payload contracts copied for validation.
+ * @returns A repository with validating, expiring sessions and retained joined-SQL capability bindings.
+ * @throws Invalid contracts throw; work rejects wrong IDs/revisions/scopes, invalid batch order/length, expired sessions or payload/underlying repository failures.
+ * @remarks Does not open a second transaction or authorize operations. Wrapper capabilities expire after the work callback and are removed in finally.
+ * @example
+ * import { createValidatedAtomicRepository } from '@alneas/eaos-server/plugin-data'
+ * export function repository(repository: Parameters<typeof createValidatedAtomicRepository>[0], documents: Parameters<typeof createValidatedAtomicRepository>[1]) { return createValidatedAtomicRepository(repository, documents) }
+ */
+declare function createValidatedAtomicRepository(repository: AtomicRepository, documents: readonly JsonDocumentContract[]): AtomicRepository;
+
+/**
+ * Pinned owning-document scope hash and admitted anchor/check IDs; authorization is supplied by its owner.
+ *
+ *
+ * The owning plugin authorizes and pins the document before entering this transaction.
+ * @see documentAnnotations for canonical host integration.
+ */
+interface AnnotationTarget {
+    /**
+     * Trusted 64-character document-scope hash pinned by the owning plugin.
+     */
+    scope: string;
+    /**
+     * Exact anchor IDs valid for newly created reader comments.
+     */
+    anchorIds: readonly string[];
+    /**
+     * Exact reading-check IDs admitted for this pinned document.
+     */
+    checkIds: readonly string[];
+}
+/**
+ * Document-scoped reader comment with author-controlled resolution and private/shared visibility.
+ *
+ * @see documentAnnotations for canonical host integration.
+ */
+interface ReaderComment {
+    /**
+     * Generated comment UUID; physical storage also prefixes the pinned document and visibility scope.
+     */
+    id: string;
+    /**
+     * Pinned valid document anchor, or null for a document-wide comment.
+     */
+    anchorId: string | null;
+    /**
+     * Nonblank trimmed comment text; outer schema limits input to 4000 characters.
+     */
+    body: string;
+    /**
+     * private scopes rows to the actor hash; shared scopes them to the authorized document audience.
+     */
+    visibility: 'private' | 'shared';
+    /**
+     * Authenticated creator; only this actor may change resolution.
+     */
+    authorId: string;
+    /**
+     * Trusted ISO timestamp supplied by the owning command.
+     */
+    createdAt: string;
+    /**
+     * Author-controlled resolution flag, updated using the stored CAS revision.
+     */
+    resolved: boolean;
+}
+/**
+ * Supported reader annotation operation names; this list itself grants no document access.
+ *
+ * @see documentAnnotations for canonical usage.
+ */
+declare const annotationOperations: readonly ["get_annotations", "set_check", "add_comment", "resolve_comment"];
+/**
+ * Compose closed annotation operation schemas from the owning document's trusted target fields.
+ * @param target - Trusted JSON Schema property map for the owning document identity; those keys are required on every operation.
+ * @returns Schemas for get_annotations, set_check, add_comment and resolve_comment.
+ * @remarks Schema generation does not authorize or execute annotations; the owner validates input and pins the exact document before transaction work.
+ * @example
+ * import { annotationSchemas } from '@alneas/eaos-server/plugin-data'
+ * const schemas = annotationSchemas({ documentId: { type: 'string', minLength: 1 } })
+ */
+declare function annotationSchemas(target: Record<string, unknown>): {
+    get_annotations: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: {
+            [x: string]: unknown;
+        };
+    };
+    set_check: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: {
+            [x: string]: unknown;
+        };
+    };
+    add_comment: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: {
+            [x: string]: unknown;
+        };
+    };
+    resolve_comment: {
+        type: string;
+        additionalProperties: boolean;
+        required: string[];
+        properties: {
+            [x: string]: unknown;
+        };
+    };
+};
+/**
+ * Read or mutate document checks/comments within an already authorized atomic document command.
+ * @param tx - Live tenant-scoped atomic session inside the owner's atomicCommand.
+ * @param p - Verified document reader principal.
+ * @param target - Pinned document scope hash and its admitted anchor/check IDs.
+ * @param operation - One of annotationOperations.
+ * @param a - Input already validated against the selected annotation schema.
+ * @param now - Trusted ISO timestamp used for newly created comments.
+ * @returns Operation-specific checks, comment or page data with CAS revisions and optional scoped cursor.
+ * @throws Rejects invalid scope/cursors, unknown checks/anchors/operations, comment ownership violations, missing comments, capacity or CAS conflicts.
+ * @remarks Does not enforce the outer schema or own authorization/transaction/table creation. The owner must authorize the exact document and wrap write operations in atomicCommand; private/shared visibility is scoped by user and document hash.
+ * @example
+ * import { documentAnnotations } from '@alneas/eaos-server/plugin-data'
+ * export function readComments(tx: Parameters<typeof documentAnnotations>[0], p: Parameters<typeof documentAnnotations>[1], target: Parameters<typeof documentAnnotations>[2], now: string) { return documentAnnotations(tx, p, target, 'get_annotations', { visibility: 'private' }, now) }
+ */
+declare function documentAnnotations(tx: AtomicSession, p: PluginPrincipal, target: AnnotationTarget, operation: string, a: Record<string, any>, now: string): Promise<{
+    revision: number;
+    canResolve: boolean;
+    /**
+     * Generated comment UUID; physical storage also prefixes the pinned document and visibility scope.
+     */
+    id: string;
+    /**
+     * Pinned valid document anchor, or null for a document-wide comment.
+     */
+    anchorId: string | null;
+    /**
+     * Nonblank trimmed comment text; outer schema limits input to 4000 characters.
+     */
+    body: string;
+    /**
+     * private scopes rows to the actor hash; shared scopes them to the authorized document audience.
+     */
+    visibility: "private" | "shared";
+    /**
+     * Authenticated creator; only this actor may change resolution.
+     */
+    authorId: string;
+    /**
+     * Trusted ISO timestamp supplied by the owning command.
+     */
+    createdAt: string;
+    /**
+     * Author-controlled resolution flag, updated using the stored CAS revision.
+     */
+    resolved: boolean;
+} | {
+    cursor?: string | undefined;
+    checkIds: readonly string[];
+    checks: Record<string, boolean>;
+    revision: number;
+    comments: {
+        revision: number;
+        canResolve: boolean;
+        /**
+         * Generated comment UUID; physical storage also prefixes the pinned document and visibility scope.
+         */
+        id: string;
+        /**
+         * Pinned valid document anchor, or null for a document-wide comment.
+         */
+        anchorId: string | null;
+        /**
+         * Nonblank trimmed comment text; outer schema limits input to 4000 characters.
+         */
+        body: string;
+        /**
+         * private scopes rows to the actor hash; shared scopes them to the authorized document audience.
+         */
+        visibility: "private" | "shared";
+        /**
+         * Authenticated creator; only this actor may change resolution.
+         */
+        authorId: string;
+        /**
+         * Trusted ISO timestamp supplied by the owning command.
+         */
+        createdAt: string;
+        /**
+         * Author-controlled resolution flag, updated using the stored CAS revision.
+         */
+        resolved: boolean;
+    }[];
+} | {
+    checks: {
+        [x: string]: boolean;
+    };
+    revision: number;
+}>;
+
+/**
+ * Immutable staged artifact identity, content hash and size returned by the host builder.
+ *
+ * @see ArtifactDeliveryService for canonical host integration.
+ */
+interface DeliveryArtifact {
+    /**
+     * Immutable host artifact key, at most 1000 characters.
+     */
+    key: string;
+    /**
+     * Lowercase 64-character SHA-256 for the staged artifact.
+     */
+    contentHash: string;
+    /**
+     * Positive safe-integer artifact size in bytes.
+     */
+    bytes: number;
+}
+/**
+ * Exact target/content/approval identity requested for one public channel delivery.
+ *
+ * @see ArtifactDeliveryService for canonical host integration.
+ */
+interface DeliveryRequest {
+    /**
+     * Stable delivery job identity within its tenant repository.
+     */
+    jobId: string;
+    /**
+     * Host-defined publication channel serialized against other unfinished delivery work.
+     */
+    channel: string;
+    /**
+     * publish stages an artifact; withdraw starts at activation/withdrawal without a build.
+     */
+    kind: 'publish' | 'withdraw';
+    /**
+     * Exact host-owned public destination metadata bound to the approval request.
+     */
+    target: Record<string, unknown>;
+    /**
+     * Reviewed source-content SHA-256; the host verifies exact target/hash/approval binding.
+     */
+    contentHash: string;
+    /**
+     * Exact host approval request admitting this public delivery; reader access alone is insufficient.
+     */
+    approvalRequestId: string;
+}
+/**
+ * Durable delivery phase, worker ownership and retry state for one approved publication/withdrawal.
+ *
+ * @see ArtifactDeliveryService for canonical host integration.
+ */
+interface DeliveryJob extends DeliveryRequest {
+    /**
+     * Authenticated user who enqueued the approved request.
+     */
+    requestedBy: string;
+    /**
+     * Trusted UTC ISO enqueue time.
+     */
+    createdAt: string;
+    /**
+     * queued/running/failed/done/cancelled state retained with CAS revisions.
+     */
+    state: 'queued' | 'running' | 'failed' | 'done' | 'cancelled';
+    /**
+     * Last durable build/activate/purge/cancel/done phase; uncertain external effects are retried idempotently.
+     */
+    phase: 'build' | 'activate' | 'purge' | 'cancel' | 'done';
+    /**
+     * Number of worker claims; incremented when a new run owns the job.
+     */
+    attempts: number;
+    /**
+     * Worker ownership token; recovery requires proving prior workers drained rather than waiting for expiry.
+     */
+    token?: string;
+    /**
+     * Optional immutable build artifact used by the activation stage.
+     */
+    artifact?: DeliveryArtifact;
+    /**
+     * Sanitized failure notice; sensitive host details remain in host-owned logs.
+     */
+    error?: string;
+}
+/**
+ * Host publication approval, immutable artifact and idempotent external delivery capabilities.
+ *
+ * @see ArtifactDeliveryService for canonical host integration.
+ */
+interface DeliveryPorts {
+    /**
+     * Verify public publication/withdrawal approval for the exact target and content.
+     *
+     * Verify explicit PUBLIC publication (or withdrawal) permission, exact target/hash and approval. Ordinary reader access is insufficient.
+     * @param p - Verified principal requiring explicit public publication/withdrawal permission.
+     * @param job - Pinned request/job with exact approved target/contentHash/approvalRequestId.
+     * @returns Exactly true only when public permission and exact binding/approval remain valid.
+     * @throws Rejects host permission, artifact, delivery or worker-control failures; external effects may already be partially complete.
+     
+     * @example
+     * ```typescript
+     * import type { DeliveryPorts, DeliveryRequest, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function verifyReviewed(ports: DeliveryPorts, principal: PluginPrincipal, job: DeliveryRequest) {
+     *   // The host binds permission and external effects to this exact job.
+     *   return ports.verify(principal, job);
+     * }
+     * ```
+     */
+    verify(p: PluginPrincipal, job: DeliveryRequest): Promise<boolean>;
+    /**
+     * Build and stage an immutable artifact outside the database transaction.
+     *
+     * Build and stage an immutable artifact outside a DB transaction. Must be idempotent for jobId.
+     * @param p - Verified current principal.
+     * @param job - Durable job carrying the stable jobId idempotency identity.
+     * @returns An immutable staged artifact key, lowercase hash and positive safe byte size.
+     * @throws Rejects host permission, artifact, delivery or worker-control failures; external effects may already be partially complete.
+     
+     * @example
+     * ```typescript
+     * import type { DeliveryPorts, DeliveryJob, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function buildReviewed(ports: DeliveryPorts, principal: PluginPrincipal, job: DeliveryJob) {
+     *   // The host binds permission and external effects to this exact job.
+     *   return ports.build(principal, job);
+     * }
+     * ```
+     */
+    build(p: PluginPrincipal, job: DeliveryJob): Promise<DeliveryArtifact>;
+    /**
+     * Apply or withdraw the exact public channel version idempotently.
+     *
+     * Atomic, idempotent channel update/withdrawal. Serialize with other host publishers; key=jobId.
+     * @param p - Verified current principal.
+     * @param job - Exact pinned publish/withdraw job, including staged artifact when publishing.
+     * @returns Resolves without a value after the idempotent channel switch/withdrawal.
+     * @throws Rejects host permission, artifact, delivery or worker-control failures; external effects may already be partially complete.
+     
+     * @example
+     * ```typescript
+     * import type { DeliveryPorts, DeliveryJob, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function activateReviewed(ports: DeliveryPorts, principal: PluginPrincipal, job: DeliveryJob) {
+     *   // The host binds permission and external effects to this exact job.
+     *   await ports.activate(principal, job);
+     * }
+     * ```
+     */
+    activate(p: PluginPrincipal, job: DeliveryJob): Promise<void>;
+    /**
+     * Invalidate the delivered channel idempotently before recording completion.
+     *
+     * Idempotent CDN invalidation; completion is recorded only after success.
+     * @param p - Verified current principal.
+     * @param job - Exact job channel/version requiring invalidation.
+     * @returns Resolves without a value only after actual idempotent invalidation succeeds.
+     * @throws Rejects host permission, artifact, delivery or worker-control failures; external effects may already be partially complete.
+     
+     * @example
+     * ```typescript
+     * import type { DeliveryPorts, DeliveryJob, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function purgeReviewed(ports: DeliveryPorts, principal: PluginPrincipal, job: DeliveryJob) {
+     *   // The host binds permission and external effects to this exact job.
+     *   await ports.purge(principal, job);
+     * }
+     * ```
+     */
+    purge(p: PluginPrincipal, job: DeliveryJob): Promise<void>;
+    /**
+     * Reconcile uncertain job effects and purge only this job's owned version.
+     *
+     * Reconcile any uncertain activation for this job and purge it, idempotently. Never remove a newer publisher's version.
+     * @param p - Verified current principal admitted for cancellation.
+     * @param job - Pinned job whose uncertain effects need reconciliation.
+     * @returns Resolves without a value after idempotent reconciliation/purge of only this owned version; never remove newer publications.
+     * @throws Rejects host permission, artifact, delivery or worker-control failures; external effects may already be partially complete.
+     
+     * @example
+     * ```typescript
+     * import type { DeliveryPorts, DeliveryJob, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function cancelReviewed(ports: DeliveryPorts, principal: PluginPrincipal, job: DeliveryJob) {
+     *   if (!ports.cancel) throw new Error("Required recovery port unavailable");
+     *   // The host binds permission and external effects to this exact job.
+     *   await ports.cancel(principal, job);
+     * }
+     * ```
+     */
+    cancel?(p: PluginPrincipal, job: DeliveryJob): Promise<void>;
+    /**
+     * Prove prior workers for this job token can no longer perform effects.
+     * @param p - Verified principal admitted for recovery.
+     * @param job - Exact running job revision/token whose prior workers must be stopped.
+     * @returns Exactly true only when prior workers cannot perform further effects; false/absence prevents recovery.
+     * @throws Rejects host permission, artifact, delivery or worker-control failures; external effects may already be partially complete.
+     
+     * @example
+     * ```typescript
+     * import type { DeliveryPorts, DeliveryJob, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function drainedReviewed(ports: DeliveryPorts, principal: PluginPrincipal, job: DeliveryJob) {
+     *   if (!ports.drained) throw new Error("Required recovery port unavailable");
+     *   // The host binds permission and external effects to this exact job.
+     *   return ports.drained(principal, job);
+     * }
+     * ```
+     */
+    drained?(p: PluginPrincipal, job: DeliveryJob): Promise<boolean>;
+}
+/**
+ * Supported durable delivery command names; each requires live host resource/publication authorization.
+ *
+ * @see ArtifactDeliveryService for canonical usage.
+ */
+declare const deliveryOperations: readonly ["enqueue_delivery", "get_delivery", "run_delivery", "recover_delivery", "cancel_delivery"];
+/**
+ * Closed schema for a new approved delivery request with stable command/job/target/content identities.
+ *
+ * @see ArtifactDeliveryService for canonical usage.
+ */
+declare const enqueueDeliverySchema: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: {
+        commandId: {
+            type: string;
+            pattern: string;
+        };
+        jobId: {
+            type: string;
+            pattern: string;
+        };
+        channel: {
+            type: string;
+            pattern: string;
+        };
+        kind: {
+            enum: string[];
+        };
+        target: {
+            type: string;
+            maxProperties: number;
+            additionalProperties: boolean;
+        };
+        contentHash: {
+            type: string;
+            pattern: string;
+        };
+        approvalRequestId: {
+            type: string;
+            pattern: string;
+        };
+    };
+};
+/**
+ * Closed schema selecting an existing delivery job by its stable identifier.
+ *
+ * @see ArtifactDeliveryService for canonical usage.
+ */
+declare const deliveryJobSchema: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: {
+        jobId: {
+            type: string;
+            pattern: string;
+        };
+    };
+};
+/**
+ * Closed schema requiring the exact job revision for explicit drained-worker recovery.
+ *
+ * @see ArtifactDeliveryService for canonical usage.
+ */
+declare const recoverDeliverySchema: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: {
+        jobId: {
+            type: string;
+            pattern: string;
+        };
+        revision: {
+            type: string;
+            minimum: number;
+            maximum: number;
+        };
+    };
+};
+/**
+ * Coordinates durable approved publication/withdrawal jobs with channel ownership and resumable idempotent host effects.
+ *
+ * @remarks
+ * Requires a real atomic repository and host public-approval/build/channel/purge ports. Channel locks serialize unfinished jobs per tenant/repository. External build/activate/purge/cancel run outside database transactions; a failed reply can follow a completed external effect. Ports must deduplicate by stable jobId. Recovery requires proof that previous workers drained, never an elapsed lease alone.
+ *
+ * @example
+ * ```typescript
+ * import { ArtifactDeliveryService } from '@alneas/eaos-server/plugin-data';
+ * export function connectDelivery(options: ConstructorParameters<typeof ArtifactDeliveryService>[0]) { return new ArtifactDeliveryService(options); }
+ * ```
+ */
+declare class ArtifactDeliveryService {
+    private readonly options;
+    /**
+     * Binds the host atomic delivery ledger, public publication ports and live operation authorization.
+     * @param options - Real atomic repository, idempotent host delivery ports and current operation/resource authorization; construction does not validate or execute those ports.
+     *
+     * @example
+     * ```typescript
+     * import { ArtifactDeliveryService } from '@alneas/eaos-server/plugin-data';
+     * export function connectDelivery(options: ConstructorParameters<typeof ArtifactDeliveryService>[0]) { return new ArtifactDeliveryService(options); }
+     * ```
+     */
+    constructor(options: {
+        /**
+         * Real atomic delivery ledger used for jobs, channel ownership and enqueue command receipts.
+         */
+        repository: AtomicRepository;
+        /**
+         * Host public-approval, artifact, channel, purge and recovery adapters with stable jobId idempotency.
+         */
+        ports: DeliveryPorts;
+        /**
+         * Live operation/resource permission callback; exactly true admits, false denies; schema validation follows initial admission.
+         * @param p - Verified current tenant/user principal.
+         * @param operation - Declared operation name.
+         * @param input - Operation input to validate and authorize at the owning service boundary.
+         * @param resource - Optional current delivery job/resource when available.
+         * @returns Exactly true to admit the current operation; false denies.
+         * @throws Rejects underlying service, authorization or persistence failures.
+         
+         * @example
+         * ```typescript
+         * import type { ArtifactDeliveryService, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+         * export async function canEnqueue(options: ConstructorParameters<typeof ArtifactDeliveryService>[0], principal: PluginPrincipal, input: unknown) {
+         *   return await options.authorize(principal, "enqueue_delivery", input) === true;
+         * }
+         * ```
+         */
+        authorize(p: PluginPrincipal, operation: string, input: unknown, resource?: unknown): Promise<boolean>;
+    });
+    private allow;
+    private verify;
+    /**
+     * Enqueues, reads, runs, cancels or explicitly recovers one durable approved delivery job.
+     * @param p - Verified current tenant principal; operation/resource admission is rechecked before transitions.
+     * @param op - One of deliveryOperations; each input is checked by its closed schema.
+     * @param a - jobId for every operation; enqueue additionally needs commandId/channel/kind/target/contentHash/approvalRequestId, and recovery needs the exact running job revision.
+     * @returns The durable AtomicRow<DeliveryJob>, possibly an existing identical enqueue receipt or already terminal job; query get_delivery for current state after receipt replay.
+     * @throws Rejects invalid principal/input (401/400), denied live/public approval (403), absent job (404), busy channel/worker, stale recovery or unavailable cancellation port (409), invalid built artifact and propagated repository/port failures; effects may already have occurred.
+     *
+     * @remarks
+     * Publish starts at build, withdrawal at activate; completion follows successful purge. Cancellation requires a reconciliation port and never removes a newer host version. Completed jobs require a new withdrawal job instead of cancellation. Recovery requires exact revision and drained(old token), marks failed and clears ownership for retry. Failure retains the last durable phase and a sanitized error, while the original host error may reject the call.
+     *
+     * @example
+     * ```typescript
+     * import { ArtifactDeliveryService, type PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export function readDelivery(service: ArtifactDeliveryService, principal: PluginPrincipal, jobId: string) { return service.execute(principal, 'get_delivery', { jobId }); }
+     * ```
+     */
+    execute(p: PluginPrincipal, op: string, a: {
+        /**
+         * Stable job ID required by every delivery operation; 1–80 letters/digits/underscore/hyphen characters.
+         */
+        jobId: string;
+        /**
+         * Exact current positive running-job revision required only for explicit drained-worker recovery.
+         */
+        revision?: number;
+        /**
+         * Stable enqueue idempotency ID; identical input replays the original receipt and conflicting reuse rejects.
+         */
+        commandId?: string;
+    } & Partial<DeliveryRequest>): Promise<any>;
+}
+
+/**
+ * Bind a service under the trusted context symbol for copied static MCP tool definitions.
+ * @param service - Host-created service instance used by each copied tool handler.
+ * @param tools - Static tool definitions whose handlers consume the service context symbol.
+ * @param key - Trusted symbol agreed by the binder and operation handler.
+ * @typeParam TService - Concrete host-created service type retained in the symbol binding.
+ * @returns New tool objects with wrappers that preserve other context fields and override the service symbol.
+ * @remarks Does not resolve identity or grant permission. Tool execution still requires verified principal context and live host admission.
+ * @example
+ * import { createMcpToolBinder } from '@alneas/eaos-server/plugin-data'
+ * export function bindTools<T>(service: T, tools: Parameters<typeof createMcpToolBinder>[1], key: symbol) { return createMcpToolBinder(service, tools, key) }
+ */
+declare function createMcpToolBinder<TService>(service: TService, tools: readonly _alneas_eaos_core_plugin_sdk.McpToolDefinition[], key: symbol): _alneas_eaos_core_plugin_sdk.McpToolDefinition[];
+/**
+ * Create a static operation handler that dispatches through a host-bound service instance.
+ * @param operation - Trusted operation name selected by the manifest author.
+ * @param key - Service-binding symbol used by createMcpToolBinder.
+ * @typeParam TService - Host service exposing the principal-aware execute contract.
+ * @returns An async handler accepting tool arguments and trusted principal/service context.
+ * @throws The returned handler rejects when the service is absent or has no execute method; service failures propagate.
+ * @remarks The incoming context must already contain a verified PluginPrincipal. This helper neither authenticates a request nor verifies live resource access.
+ * @example
+ * import { createMcpOperationHandler } from '@alneas/eaos-server/plugin-data'
+ * const key = Symbol('service')
+ * const handler = createMcpOperationHandler('list', key)
+ */
+declare function createMcpOperationHandler<TService extends {
+    /**
+     * Service operation dispatch contract; callers must supply host-verified principal context and perform live admission.
+     * @param principal - Verified current tenant/user principal.
+     * @param operation - Declared operation name.
+     * @param input - Operation input to validate and authorize at the owning service boundary.
+     * @returns The service operation result; authorization and validation stay owner-controlled.
+     * @throws Rejects underlying service, authorization or persistence failures.
+     */
+    execute(principal: PluginPrincipal, operation: string, input: unknown): Promise<unknown>;
+}>(operation: string, key: symbol): (args: unknown, context?: Record<PropertyKey, unknown>) => Promise<unknown>;
+/**
+ * Structurally verified tenant/user identity supplied by a trusted host authentication boundary.
+ *
+ * @see createPluginRouter for canonical host integration.
+ */
+interface PluginPrincipal {
+    /**
+     * Tenant identity bound by the trusted principal; never selected as an authorization grant from request data.
+     */
+    tenantId: string;
+    /**
+     * Authenticated actor identity supplied by the host.
+     */
+    userId: string;
+    /**
+     * Current host-verified role names; structural validation alone does not grant permission.
+     */
+    roles: readonly string[];
+}
+/**
+ * Logical record identity, CAS revision and JSON payload envelope.
+ * @typeParam T - Stored JSON payload shape; compile-time typing does not itself validate data.
+ *
+ * @see createSqlRecordStore for canonical host integration.
+ */
+interface PluginRecord<T> {
+    /**
+     * Logical tenant/namespace-scoped record identity.
+     */
+    id: string;
+    /**
+     * CAS revision for the stored envelope; persisted records start at 1 unless a documented host projection uses 0.
+     */
+    revision: number;
+    /**
+     * Stored JSON payload whose runtime validation depends on the configured document contracts.
+     */
+    value: T;
+}
+/**
+ * Host record persistence contract requiring tenant predicates and atomic revision-predicated writes.
+ *
+ * Providers must enforce tenant keys and atomic compare-and-swap, never read/update without the revision predicate.
+ * @typeParam T - Stored payload shape shared by all scoped persistence operations.
+ *
+ * @see createSqlRecordStore for canonical host integration.
+ */
+interface PluginRecordStore<T> {
+    /**
+     * Reads one record within the exact tenant and logical namespace.
+     * @param tenantId - Verified tenant ID supplied by the host.
+     * @param id - Logical record ID within this store.
+     * @returns The matching envelope or null when absent.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { PluginRecordStore, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function readTitle(store: PluginRecordStore<{ title: string }>, principal: PluginPrincipal, id: string) {
+     *   const record = await store.read(principal.tenantId, id);
+     *   return record?.value.title ?? null;
+     * }
+     * ```
+     */
+    read(tenantId: string, id: string): Promise<PluginRecord<T> | null>;
+    /**
+     * Reads a bounded set of envelopes from one tenant and namespace.
+     * @param tenantId - Verified tenant ID.
+     * @param limit - Required provider-supported maximum row count; canonical SQL stores accept integers 1–100.
+     * @returns Scoped envelopes, possibly empty; filtering this bounded set does not prove completeness.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { PluginRecordStore, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function firstPage(store: PluginRecordStore<{ title: string }>, principal: PluginPrincipal) {
+     *   return store.list(principal.tenantId, 20);
+     * }
+     * ```
+     */
+    list(tenantId: string, limit: number): Promise<PluginRecord<T>[]>;
+    /**
+     * Reads a stable ID-ordered page after an optional exclusive logical record ID.
+     *
+     * Optional stable ID keyset paging; after is an exclusive logical record ID.
+     * @param tenantId - Verified tenant ID.
+     * @param limit - Required bounded page size; canonical SQL stores accept 1–100.
+     * @param after - Optional exclusive logical record ID; omitted starts the page.
+     * @returns Scoped envelopes in increasing logical-ID order; fewer than limit indicates the end.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { PluginRecordStore, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function nextPage(store: PluginRecordStore<{ title: string }>, principal: PluginPrincipal, after: string) {
+     *   if (!store.listPage) throw new Error("Keyset paging not supported");
+     *   return store.listPage(principal.tenantId, 20, after);
+     * }
+     * ```
+     */
+    listPage?(tenantId: string, limit: number, after?: string): Promise<PluginRecord<T>[]>;
+    /**
+     * Creates a previously absent tenant record with its initial stored revision.
+     * @param tenantId - Verified tenant ID owning the new record.
+     * @param record - New logical envelope; canonical validated/atomic stores require revision 1.
+     * @returns Resolves without a value after durable creation.
+     * @throws Rejects duplicate identity, invalid document/payload/revision or persistence failure.
+     
+     * @example
+     * ```typescript
+     * import type { PluginRecordStore, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function createTitle(store: PluginRecordStore<{ title: string }>, principal: PluginPrincipal, id: string, title: string) {
+     *   // Live create permission must be checked before persistence.
+     *   await store.create(principal.tenantId, { id, revision: 1, value: { title } });
+     * }
+     * ```
+     */
+    create(tenantId: string, record: PluginRecord<T>): Promise<void>;
+    /**
+     * Replaces a tenant record only when its stored revision matches the expected value.
+     * @param tenantId - Verified tenant ID.
+     * @param record - Next envelope whose revision must be expectedRevision+1.
+     * @param expectedRevision - Positive previously observed CAS revision.
+     * @returns True when one row is replaced; false for stale rows in plain SQL stores. Atomic adapters reject CAS conflicts instead of returning false.
+     * @throws Rejects invalid revision/document/payload or provider failure; atomic adapters also reject stale CAS.
+     
+     * @example
+     * ```typescript
+     * import type { PluginRecordStore, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function replaceTitle(store: PluginRecordStore<{ title: string }>, principal: PluginPrincipal, id: string, expectedRevision: number, title: string) {
+     *   return store.replace(principal.tenantId, { id, revision: expectedRevision + 1, value: { title } }, expectedRevision);
+     * }
+     * ```
+     */
+    replace(tenantId: string, record: PluginRecord<T>, expectedRevision: number): Promise<boolean>;
+    /**
+     * Optionally deletes one scoped envelope with an optional revision predicate.
+     * @param tenantId - Verified tenant ID.
+     * @param id - Logical record ID.
+     * @param expectedRevision - Optional expected CAS revision; omit only when unconditional scoped deletion is intended.
+     * @returns Whether a row was deleted; immutable document wrappers reject instead.
+     * @throws Rejects immutable document deletion or host persistence failure.
+     
+     * @example
+     * ```typescript
+     * import type { PluginRecordStore, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function deleteReviewed(store: PluginRecordStore<{ title: string }>, principal: PluginPrincipal, id: string, expectedRevision: number) {
+     *   if (!store.delete) throw new Error("Deletion not supported");
+     *   return store.delete(principal.tenantId, id, expectedRevision);
+     * }
+     * ```
+     */
+    delete?(tenantId: string, id: string, expectedRevision?: number): Promise<boolean>;
+}
+/**
+ * Carries an intentional sanitized plugin HTTP error status while preserving the caller-provided message.
+ *
+ * @remarks
+ * createPluginRouter returns this message/status to HTTP callers; exclude secrets, provider details and business payloads from messages.
+ *
+ * @example
+ * ```typescript
+ * import { PluginError } from '@alneas/eaos-server/plugin-data';
+ * const unavailable = new PluginError(404, 'Record unavailable');
+ * ```
+ */
+declare class PluginError extends Error {
+    readonly status: 400 | 401 | 403 | 404 | 409 | 410;
+    /**
+     * Creates an intentional plugin failure with one supported client-facing HTTP status.
+     * @param status - Supported bad-input/authentication/permission/missing/conflict/gone HTTP status.
+     * @param message - Safe public error description exposed by createPluginRouter.
+     *
+     * @example
+     * ```typescript
+     * import { PluginError } from '@alneas/eaos-server/plugin-data';
+     * const denied = new PluginError(403, 'Record access denied');
+     * ```
+     */
+    constructor(status: 400 | 401 | 403 | 404 | 409 | 410, message: string);
+}
+/**
+ * Check the structural presence of a nonblank tenant/user identity and string role list.
+ * @param p - Principal from a trusted authentication resolver.
+ * @returns No value; normal completion means the principal has the required shape.
+ * @throws Throws PluginError 401 for malformed principal fields.
+ * @remarks Shape validation is not authentication, membership verification or resource authorization.
+ * @example
+ * import { assertPrincipal } from '@alneas/eaos-server/plugin-data'
+ * assertPrincipal({ tenantId: 'example-tenant', userId: 'example-user', roles: [] })
+ */
+declare function assertPrincipal(p: PluginPrincipal): void;
+/**
+ * Hono variables carrying the principal resolved by the trusted plugin router.
+ *
+ * @see createPluginRouter for canonical host integration.
+ */
+type PluginHttpEnv = {
+    /**
+     * Hono variables populated by the trusted principal resolver before operation routes run.
+     */
+    Variables: {
+        /**
+         * Verified principal resolved for this request; still subject to current service authorization.
+         */
+        principal: PluginPrincipal;
+    };
+};
+/**
+ * Host-owned request-body bound for the shared authenticated plugin router.
+ *
+ * @see createPluginRouter for canonical host integration.
+ */
+interface PluginRouterOptions {
+    /**
+     * Request body size in bytes; defaults to 131072 and must be an integer from 1024 to 8388608.
+     *
+     * Trusted host bound, never request-controlled. Default 128KiB.
+     */ maxBodyBytes?: number;
+}
+/**
+ * Create a bounded Hono router that resolves a verified principal for every request.
+ * @param resolvePrincipal - Async host callback returning the authenticated principal or null; host owns current session validation.
+ * @param options - Trusted body bound, default 128 KiB; accepted integer range is 1024 bytes through 8 MiB.
+ * @returns A Hono router with body limits, scoped principal context and sanitized generic failure responses.
+ * @throws Invalid body limits throw at construction. Request-time missing/malformed principals produce 401; unexpected failures become sanitized 500 responses.
+ * @remarks Does not supply CSRF/Origin protection or per-resource authorization; compose those at the host/service boundary.
+ * @example
+ * import { createPluginRouter } from '@alneas/eaos-server/plugin-data'
+ * export function routes(resolvePrincipal: Parameters<typeof createPluginRouter>[0]) { return createPluginRouter(resolvePrincipal) }
+ */
+declare function createPluginRouter(resolvePrincipal: (c: Context) => Promise<PluginPrincipal | null>, options?: PluginRouterOptions): Hono<PluginHttpEnv, hono_types.BlankSchema, "/">;
+type StandardPluginService = {
+    /**
+     * Principal-aware operation dispatcher shared by HTTP and MCP; the concrete service owns schema checks and current resource permission.
+     * @param principal - Verified current tenant/user principal.
+     * @param operation - Declared operation name.
+     * @param input - Operation input to validate and authorize at the owning service boundary.
+     * @returns The service operation result; authorization and validation stay owner-controlled.
+     * @throws Rejects underlying service, authorization or persistence failures.
+     */
+    execute(principal: PluginPrincipal, operation: string, input: Record<string, any>): Promise<unknown>;
+};
+/**
+ * Compose a service-backed authenticated operation router and bound static MCP tools.
+ * @param manifest - Plugin metadata whose capabilities remain subject to host admission.
+ * @param ServiceClass - Trusted service constructor invoked once with options.
+ * @param bindTools - Synchronous tool binder invoked with that same service instance.
+ * @param options - Real store, authorization and other service configuration.
+ * @param resolvePrincipal - Async trusted request-to-principal resolver; required.
+ * @param configureRoutes - Optional synchronous callback adding routes using the same service instance.
+ * @param routerOptions - Optional host-owned request body bound.
+ * @typeParam TOptions - Host service configuration passed unchanged to the constructor.
+ * @typeParam TService - Principal-aware service implementation shared by HTTP and MCP.
+ * @returns Manifest fields plus createRoutes() and bound MCP definitions.
+ * @throws Missing principal resolver or constructor/router/binder/configuration failures propagate.
+ * @remarks Mounting the server does not activate tenants. HTTP and MCP hosts must enforce their current lifecycle/resource admission; static tool binding alone does not do that.
+ * @example
+ * import { createStandardPluginServer } from '@alneas/eaos-server/plugin-data'
+ * export function bindServer(...args: Parameters<typeof createStandardPluginServer>) { return createStandardPluginServer(...args) }
+ */
+declare function createStandardPluginServer<TOptions, TService extends StandardPluginService>(manifest: PluginManifest, ServiceClass: new (options: TOptions) => TService, bindTools: (service: TService) => McpToolDefinition[], options: TOptions, resolvePrincipal: (c: Context) => Promise<PluginPrincipal | null>, configureRoutes?: (routes: ReturnType<typeof createPluginRouter>, service: TService) => void, routerOptions?: PluginRouterOptions): {
+    createRoutes: () => Hono<PluginHttpEnv, hono_types.BlankSchema, "/">;
+    mcp: {
+        tools: McpToolDefinition[];
+    };
+    entitlement?: _alneas_eaos_core.PluginEntitlement;
+    id: string;
+    name: string;
+    version: string;
+    description: string;
+    icon: string;
+    category: string;
+    recommended?: boolean;
+    targets: _alneas_eaos_core.ClientTarget[];
+    dependencies: string[];
+    optionalDependencies?: string[];
+    tier: "public" | "standard" | "pro" | "corporate" | "free" | "premium";
+    industries: string[];
+    contracts: string[];
+    subscribes: string[];
+    publishes: string[];
+    navigation: _alneas_eaos_core.TargetNavigationConfig;
+    schema: _alneas_eaos_core.SchemaConfig;
+    extensions?: _alneas_eaos_core.PluginExtensionConfig[];
+    api: _alneas_eaos_core.ApiConfig;
+    secrets?: _alneas_eaos_core.PluginSecretRequirement[];
+    settings?: _alneas_eaos_core.PluginSettingConfig[];
+    agentCapabilities?: _alneas_eaos_core.AgentCapabilitiesConfig;
+    i18n?: _alneas_eaos_core.PluginI18nConfig;
+    docs?: _alneas_eaos_core.PluginDocConfig;
+    goExtension?: _alneas_eaos_core.GoExtensionConfig;
+};
+/**
+ * Read a JSON object request body with explicit content-type and shape checks.
+ * @param c - Hono request context, normally protected by the plugin router body limit.
+ * @returns Parsed nonnull object payload; arrays and primitives are rejected.
+ * @throws Rejects non-JSON content types and malformed/nonobject JSON with PluginError 400.
+ * @remarks This helper does not enforce a body-size bound, tenant identity or operation schema on its own.
+ * @example
+ * import { jsonBody } from '@alneas/eaos-server/plugin-data'
+ * export async function readRequest(c: Parameters<typeof jsonBody>[0]) { return jsonBody(c) }
+ */
+declare function jsonBody(c: Context): Promise<Record<string, any>>;
+/**
+ * Reject top-level object keys not present in an explicit operation allowlist.
+ * @param value - Object whose own enumerable string keys are inspected.
+ * @param keys - Trusted allowed top-level key names.
+ * @returns No value when all existing keys are allowed.
+ * @throws Throws PluginError 400 when an unknown key is present.
+ * @remarks Does not require listed keys to exist or validate nested fields.
+ * @example
+ * import { exactKeys } from '@alneas/eaos-server/plugin-data'
+ * exactKeys({ title: 'Example' }, ['title'])
+ */
+declare function exactKeys(value: object, keys: string[]): void;
+/**
+ * Validate bounded nonblank string input while preserving the original whitespace.
+ * @param value - Untrusted value to validate.
+ * @param name - Trusted field label used in the failure message.
+ * @param max - Maximum JavaScript string length; defaults to 256.
+ * @returns The original string without trimming.
+ * @throws Throws PluginError 400 if input is not a string, trims to empty or exceeds max.
+ * @example
+ * import { textInput } from '@alneas/eaos-server/plugin-data'
+ * const title = textInput('Example', 'title', 80)
+ */
+declare function textInput(value: unknown, name: string, max?: number): string;
+/**
+ * Require a positive safe-integer revision without coercing string inputs.
+ * @param value - Untrusted revision value.
+ * @returns The positive safe-integer revision.
+ * @throws Throws PluginError 400 for nonintegers, numeric strings, zero, negatives or unsafe integers.
+ * @example
+ * import { revisionInput } from '@alneas/eaos-server/plugin-data'
+ * const revision = revisionInput(1)
+ */
+declare function revisionInput(value: unknown): number;
+/**
+ * Parameterized SQL transport whose host owns tenant session, transaction and provider binding behavior.
+ *
+ * @see createSqlRecordStore for canonical host integration.
+ */
+interface RecordSqlDriver {
+    /**
+     * SQL placeholder/driver dialect selected by trusted host configuration.
+     */
+    dialect: 'sqlite' | 'postgres' | 'oracle';
+    /**
+     * Executes trusted parameterized SQL through the host-selected tenant session or transport.
+     *
+     * Bind arrays are positional. Host owns transaction/commit, Oracle CLOB bindings and authenticated tenant session.
+     * @param tenantId - Verified tenant context for host routing/session setup; it is not an independent permission proof.
+     * @param sql - Trusted SQL containing explicit tenant predicates; never untrusted SQL text.
+     * @param bindings - Positional binds in SQL placeholder order; host handles Oracle CLOB/session details.
+     * @returns Optional row data and affected-row count; CAS callers require accurate affectedRows.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { RecordSqlDriver, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function queryTenant(driver: RecordSqlDriver, principal: PluginPrincipal, trustedSql: string, bindings: unknown[]) {
+     *   // The host supplies dialect-correct SQL with explicit tenant predicates.
+     *   const result = await driver.execute(principal.tenantId, trustedSql, bindings);
+     *   return result.rows ?? [];
+     * }
+     * ```
+     */
+    execute(tenantId: string, sql: string, bindings: unknown[]): Promise<{
+        /**
+         * Optional SQL result rows using host provider object-column names.
+         */
+        rows?: Record<string, unknown>[];
+        /**
+         * Accurate DML row count; required by revision-predicated replace.
+         */
+        affectedRows?: number;
+    }>;
+}
+/**
+ * Manifest namespace, payload limits and optional canonical JSON document validation for SQL records.
+ *
+ * @see createSqlRecordStore for canonical host integration.
+ */
+interface SqlRecordStoreOptions {
+    /**
+     * Optional trusted logical namespace encoded into physical IDs for a shared table.
+     *
+     * Logical namespace encoded into the trusted physical id for a shared foundation table.
+     */
+    namespace?: string;
+    /**
+     * Declared payload/object/history limits; does not configure or authorize a provider.
+     *
+     * Payload/object/history policy declared by the plugin manifest.
+     */
+    storagePolicy?: PluginStoragePolicy;
+    /**
+     * Canonical closed payload contracts copied and enforced by the wrapper.
+     */
+    documents?: readonly JsonDocumentContract[];
+}
+/**
+ * Bind JSON record persistence to a trusted table, namespace and host SQL driver.
+ * @param table - Trusted lowercase table identifier, never a request-selected name.
+ * @param driver - Tenant-aware SQL transport; host owns transactions, Oracle binding/session cleanup and current authorization.
+ * @param options - Optional namespace, payload policy and canonical JSON document contracts.
+ * @typeParam T - Stored JSON payload type; runtime shape is enforced only when canonical document contracts are supplied.
+ * @returns A record store with tenant predicates, keyset reads and revision-predicated replace/delete operations.
+ * @throws Rejects invalid table/namespace/document bindings. Operations propagate provider errors, reject invalid limits/revisions/payloads and map duplicate keys to PluginError 409.
+ * @remarks Does not create/migrate tables or add a shared transaction around separate calls. Driver affected-row reporting is required for CAS correctness; hosts enforce live authorization.
+ * @example
+ * import { createSqlRecordStore } from '@alneas/eaos-server/plugin-data'
+ * export function records(driver: Parameters<typeof createSqlRecordStore>[1]) { return createSqlRecordStore<{ title: string }>('example_records', driver) }
+ */
+declare function createSqlRecordStore<T>(table: string, driver: RecordSqlDriver, options?: SqlRecordStoreOptions): PluginRecordStore<T>;
+/**
+ * Structural subset of the D1 prepared-statement API used by the record adapter.
+ *
+ * @see createCloudflareD1Driver for canonical host integration.
+ */
+interface CloudflareD1PreparedStatement {
+    /**
+     * Binds positional query values to a prepared Worker D1 statement.
+     * @param values - Positional values in SQL placeholder order.
+     * @returns The bound prepared statement used for all/run.
+     * @throws Provider binding errors throw synchronously.
+     
+     * @example
+     * ```typescript
+     * import type { CloudflareD1Binding } from '@alneas/eaos-server/plugin-data';
+     * export async function readProjection(db: CloudflareD1Binding, tenantId: string) {
+     *   const statement = db.prepare("SELECT ? AS tenant_id").bind(tenantId);
+     *   return (await statement.all<{ tenant_id: string }>()).results ?? [];
+     * }
+     * ```
+     */
+    bind(...values: unknown[]): CloudflareD1PreparedStatement;
+    /**
+     * Executes a prepared D1 read and resolves its structural query result.
+     * @typeParam T - Returned query row shape; defaults to a string-keyed unknown-value record.
+     * @returns Optional typed results and provider change metadata.
+     * @throws Rejects provider query failures.
+     
+     * @example
+     * ```typescript
+     * import type { CloudflareD1Binding } from '@alneas/eaos-server/plugin-data';
+     * export async function projection(db: CloudflareD1Binding, tenantId: string) {
+     *   const result = await db.prepare("SELECT ? AS tenant_id").bind(tenantId).all<{ tenant_id: string }>();
+     *   return result.results ?? [];
+     * }
+     * ```
+     */
+    all<T = Record<string, unknown>>(): Promise<{
+        /**
+         * Optional query rows with the caller-selected row shape.
+         */
+        results?: T[];
+        /**
+         * Optional provider execution metadata.
+         */
+        meta?: {
+            /**
+             * Optional provider affected-row count; record driver normalizes absence to 0.
+             */
+            changes?: number;
+        };
+    }>;
+    /**
+     * Executes a prepared D1 write and resolves provider change metadata.
+     * @returns Optional meta.changes affected-row metadata.
+     * @throws Rejects provider execution failures.
+     
+     * @example
+     * ```typescript
+     * import type { CloudflareD1Binding } from '@alneas/eaos-server/plugin-data';
+     * export async function executeReviewed(db: CloudflareD1Binding, trustedTenantDml: string, bindings: unknown[]) {
+     *   // Supply parameterized DML whose bindings include the authorized tenant.
+     *   const result = await db.prepare(trustedTenantDml).bind(...bindings).run();
+     *   return result.meta?.changes ?? 0;
+     * }
+     * ```
+     */
+    run(): Promise<{
+        /**
+         * Optional provider execution metadata.
+         */
+        meta?: {
+            /**
+             * Optional provider affected-row count; record driver normalizes absence to 0.
+             */
+            changes?: number;
+        };
+    }>;
+}
+/**
+ * Trusted Worker D1 binding supplied by the host runtime.
+ *
+ * @see createCloudflareD1Driver for canonical host integration.
+ */
+interface CloudflareD1Binding {
+    /**
+     * Prepares trusted parameterized SQL on the installed Worker D1 binding.
+     * @param query - Trusted SQL text; caller must bind tenant predicates.
+     * @returns A statement exposing bind/all/run.
+     * @throws Provider preparation errors throw synchronously.
+     
+     * @example
+     * ```typescript
+     * import type { CloudflareD1Binding } from '@alneas/eaos-server/plugin-data';
+     * export async function tenantProjection(db: CloudflareD1Binding, tenantId: string) {
+     *   const statement = db.prepare("SELECT ? AS tenant_id");
+     *   return (await statement.bind(tenantId).all()).results ?? [];
+     * }
+     * ```
+     */
+    prepare(query: string): CloudflareD1PreparedStatement;
+}
+/**
+ * Explicit Worker or HTTP transport configuration for the server-side D1 record driver.
+ *
+ * @see createCloudflareD1Driver for canonical host integration.
+ */
+interface CloudflareD1DriverOptions {
+    /**
+     * Optional trusted Worker D1 binding; takes precedence over HTTP credentials when valid.
+     *
+     * Direct Cloudflare Workers D1 binding (`env.DB`), when running inside a Worker.
+     */
+    binding?: CloudflareD1Binding;
+    /**
+     * Cloudflare account identity required by HTTP mode.
+     *
+     * Cloudflare Account ID for remote D1 HTTP API access (e.g. from OCI server or CLI).
+     */
+    accountId?: string;
+    /**
+     * Cloudflare D1 database identity required by HTTP mode.
+     *
+     * Cloudflare D1 Database UUID for remote D1 HTTP API access.
+     */
+    databaseId?: string;
+    /**
+     * Sensitive host API token required by HTTP mode; never expose to browser entries or docs examples.
+     *
+     * Cloudflare API Token with D1:Edit permission for remote D1 HTTP API access.
+     */
+    apiToken?: string;
+    /**
+     * Optional trusted fetch implementation; defaults to globalThis.fetch.
+     *
+     * Optional custom fetch implementation for D1 HTTP API calls.
+     */
+    fetch?: typeof globalThis.fetch;
+    /**
+     * Trusted HTTP API base; defaults to https://api.cloudflare.com/client/v4.
+     *
+     * Optional Cloudflare API base URL override (defaults to `https://api.cloudflare.com/client/v4`).
+     */
+    apiBaseUrl?: string;
+    /**
+     * Optional trusted table name; when supplied the first query runs CREATE TABLE IF NOT EXISTS. Omit when schema lifecycle is independently managed.
+     *
+     * Optional table name (e.g. `'eaos_customer_records'`) to auto-create via `CREATE TABLE IF NOT EXISTS` on first query.
+     */
+    autoBootstrapTable?: string;
+}
+/**
+ * Create a SQLite-dialect record driver using a Worker D1 binding or the explicit Cloudflare HTTP query endpoint.
+ * @param options - Trusted binding or complete account/database/token credentials; an available binding takes precedence over HTTP configuration.
+ * @returns A RecordSqlDriver whose execute method uses the selected D1 transport.
+ * @throws Rejects absent transport or invalid bootstrap table name; query/HTTP failures propagate and duplicate-key failures are normalized.
+ * @remarks The execute tenantId is not an independent authorization boundary; SQL callers must bind tenant predicates. autoBootstrapTable optionally executes CREATE TABLE on the first query; omit it when schemas are managed separately. Credentials and custom fetch/base URL are trusted server configuration.
+ * @example
+ * import { createCloudflareD1Driver } from '@alneas/eaos-server/plugin-data'
+ * export function d1(options: Parameters<typeof createCloudflareD1Driver>[0]) { return createCloudflareD1Driver(options) }
+ */
+declare function createCloudflareD1Driver(options: CloudflareD1DriverOptions): RecordSqlDriver;
+/**
+ * Resolve a manifest-owned storage table and optional canonical namespace/document bindings.
+ * @param manifest - Trusted plugin schema with one owned table or an explicit shared-storage binding.
+ * @param driver - Host SQL transport used by the resulting store.
+ * @param catalog - Required trusted Data Contract catalog for shared-storage bindings.
+ * @typeParam T - Stored payload shape retained by the record store.
+ * @returns The tenant-predicated record store for the declared table/namespace.
+ * @throws Rejects absent catalog, invalid storage binding or a legacy declaration without exactly one owned table; store validation failures propagate.
+ * @remarks Does not install schemas or activate a feature; migration and live authorization remain host responsibilities.
+ * @example
+ * import { createPluginRecordStore } from '@alneas/eaos-server/plugin-data'
+ * export function pluginRecords(manifest: Parameters<typeof createPluginRecordStore>[0], driver: Parameters<typeof createPluginRecordStore>[1], catalog: Parameters<typeof createPluginRecordStore>[2]) { return createPluginRecordStore(manifest, driver, catalog) }
+ */
+declare function createPluginRecordStore<T>(manifest: Pick<PluginManifest, 'schema'>, driver: RecordSqlDriver, catalog?: DataContractCatalog): PluginRecordStore<T>;
+
+/**
+ * Tenant-scoped logical row and its CAS revision at the time of reading/writing.
+ * @typeParam T - JSON row payload shape; defaults to unknown.
+ *
+ * @see createAtomicRepository for canonical host integration.
+ */
+interface AtomicRow<T = unknown> {
+    /**
+     * Logical tenant/namespace-scoped record identity.
+     */
+    id: string;
+    /**
+     * CAS revision for the stored envelope; persisted records start at 1 unless a documented host projection uses 0.
+     */
+    revision: number;
+    /**
+     * Stored JSON payload whose runtime validation depends on the configured document contracts.
+     */
+    value: T;
+}
+/**
+ * Temporary tenant/namespace-bound session valid only inside its repository work callback.
+ *
+ * @see createAtomicRepository for canonical host integration.
+ */
+interface AtomicSession {
+    /**
+     * Performs one scoped read inside the active repository transaction.
+     * @param id - Logical row ID; 1–240 supported record-key characters.
+     * @typeParam T - JSON payload type read or persisted by this session operation.
+     * @returns The scoped envelope or null when absent.
+     * @throws Rejects expired session, invalid IDs/revisions/limits, document/payload errors, duplicate/create or CAS conflict and provider failures as applicable.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicRepository, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function readTitle(repository: AtomicRepository, principal: PluginPrincipal, id: string) {
+     *   return repository.run(principal, async session => {
+     *     const row = await session.get<{ title: string }>(id);
+     *     return row?.value.title ?? null;
+     *   });
+     * }
+     * ```
+     */
+    get<T>(id: string): Promise<AtomicRow<T> | null>;
+    /**
+     * Performs ordered batch reads inside the active repository transaction.
+     *
+     * Batch reads preserve tenant scope and input order; missing rows are null.
+     * @param ids - Logical IDs in desired output order; duplicates retain their positions.
+     * @typeParam T - JSON payload type read or persisted by this session operation.
+     * @returns One envelope or null per input ID in the same order.
+     * @throws Rejects expired session, invalid IDs/revisions/limits, document/payload errors, duplicate/create or CAS conflict and provider failures as applicable.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicRepository, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function readTitles(repository: AtomicRepository, principal: PluginPrincipal, ids: string[]) {
+     *   return repository.run(principal, async session => {
+     *     if (!session.getMany) throw new Error("Batch reads not supported");
+     *     return session.getMany<{ title: string }>(ids);
+     *   });
+     * }
+     * ```
+     */
+    getMany?<T>(ids: string[]): Promise<(AtomicRow<T> | null)[]>;
+    /**
+     * Performs transactional batch CAS writes inside the active repository transaction.
+     *
+     * Every item uses CAS in the enclosing transaction; any failure rolls back all items.
+     * @param changes - Unique logical-ID/value/expected changes; expected=0 creates and positive expected performs exact CAS.
+     * @typeParam T - JSON payload type read or persisted by this session operation.
+     * @returns Next-revision envelopes in input order; any failure must reject the enclosing transaction.
+     * @throws Rejects expired session, invalid IDs/revisions/limits, document/payload errors, duplicate/create or CAS conflict and provider failures as applicable.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicRepository, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function createPair(repository: AtomicRepository, principal: PluginPrincipal) {
+     *   return repository.run(principal, async session => {
+     *     if (!session.putMany) throw new Error("Batch writes not supported");
+     *     return session.putMany([{ id: "examples/first", value: { title: "First" }, expected: 0 }, { id: "examples/second", value: { title: "Second" }, expected: 0 }]);
+     *   });
+     * }
+     * ```
+     */
+    putMany?<T>(changes: {
+        /**
+         * Unique logical record key within this batch and tenant namespace.
+         */
+        id: string;
+        /**
+         * JSON payload to validate against configured policy/document contracts.
+         */
+        value: T;
+        /**
+         * Expected safe CAS revision; 0 creates, positive values replace exactly that revision.
+         */
+        expected: number;
+    }[]): Promise<AtomicRow<T>[]>;
+    /**
+     * Performs a bounded scoped keyset read inside the active repository transaction.
+     *
+     * Empty prefix reads the repository's own tenant/namespace, never another tenant.
+     * @param prefix - Logical prefix; empty stays within this repository tenant/namespace.
+     * @param after - Optional exclusive logical ID; defaults to the start of the prefix range.
+     * @param limit - Integer page size 1–101; defaults to 100.
+     * @typeParam T - JSON payload type read or persisted by this session operation.
+     * @returns Envelopes in stable logical-ID order within the prefix.
+     * @throws Rejects expired session, invalid IDs/revisions/limits, document/payload errors, duplicate/create or CAS conflict and provider failures as applicable.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicRepository, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function firstPage(repository: AtomicRepository, principal: PluginPrincipal) {
+     *   return repository.run(principal, session => session.list<{ title: string }>("examples/", "", 20));
+     * }
+     * ```
+     */
+    list<T>(prefix: string, after?: string, limit?: number): Promise<AtomicRow<T>[]>;
+    /**
+     * Performs one create-or-CAS write inside the active repository transaction.
+     *
+     * expected=0 creates; otherwise atomically replaces exactly the expected revision.
+     * @param id - Logical row ID.
+     * @param value - JSON payload admitted by configured limits/contracts.
+     * @param expected - Safe integer expected revision from 0 to MAX_SAFE_INTEGER-1; 0 creates, otherwise exact CAS.
+     * @typeParam T - JSON payload type read or persisted by this session operation.
+     * @returns A cloned-payload envelope with revision expected+1.
+     * @throws Rejects expired session, invalid IDs/revisions/limits, document/payload errors, duplicate/create or CAS conflict and provider failures as applicable.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicRepository, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function createTitle(repository: AtomicRepository, principal: PluginPrincipal, id: string, title: string) {
+     *   return repository.run(principal, session => session.put(id, { title }, 0));
+     * }
+     * ```
+     */
+    put<T>(id: string, value: T, expected: number): Promise<AtomicRow<T>>;
+}
+/**
+ * Host-admitted transactional entrypoint that scopes all session operations to one verified principal.
+ *
+ * @see createAtomicRepository for canonical host integration.
+ */
+interface AtomicRepository {
+    /**
+     * Runs work in one verified tenant transaction whose session expires when work settles.
+     * @param principal - Verified tenant/user principal; repository structure checks do not prove live permission.
+     * @param work - Async domain work; never let session or joined SQL capabilities escape its lifetime.
+     * @typeParam T - Value resolved by the transaction/connection callback.
+     * @returns The callback result after successful commit; work/commit failure rejects and triggers rollback.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicRepository, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function updateTitle(repository: AtomicRepository, principal: PluginPrincipal, id: string, title: string) {
+     *   return repository.run(principal, async session => {
+     *     const current = await session.get<{ title: string }>(id);
+     *     if (!current) throw new Error("Record unavailable");
+     *     return session.put(id, { title }, current.revision);
+     *   });
+     * }
+     * ```
+     */
+    run<T>(principal: PluginPrincipal, work: (session: AtomicSession) => Promise<T>): Promise<T>;
+}
+/**
+ * Connection-bound SQL operations sharing the enclosing commit/rollback boundary.
+ *
+ * @see createAtomicRepository for canonical host integration.
+ */
+interface AtomicSqlConnection {
+    /**
+     * Executes one trusted SQL statement on the exact connection owning the enclosing transaction.
+     * @param sql - Trusted parameterized SQL with tenant/namespace predicates.
+     * @param binds - Positional bind values in placeholder order.
+     * @returns Optional query rows and an accurate affected-row count.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicSqlDriver, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function queryJoined(driver: AtomicSqlDriver, principal: PluginPrincipal, trustedTenantSql: string, bindings: unknown[]) {
+     *   return driver.transaction(principal, async connection => {
+     *     return (await connection.execute(trustedTenantSql, bindings)).rows ?? [];
+     *   });
+     * }
+     * ```
+     */
+    execute(sql: string, binds: unknown[]): Promise<{
+        /**
+         * Optional object rows from SELECT execution on this connection.
+         */
+        rows?: Record<string, unknown>[];
+        /**
+         * Accurate affected-row count for scalar execution or one count per ordered batch bind row.
+         */
+        affectedRows: number;
+    }>;
+    /**
+     * Optionally executes ordered bind batches on the same transaction connection.
+     * @param sql - Trusted parameterized DML.
+     * @param binds - Ordered positional bind rows.
+     * @returns An affectedRows count for every bind row in input order; missing/wrong counts must fail CAS.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicSqlDriver, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function batchReviewed(driver: AtomicSqlDriver, principal: PluginPrincipal, trustedTenantDml: string, binds: unknown[][]) {
+     *   return driver.transaction(principal, async connection => {
+     *     if (!connection.executeMany) throw new Error("Batch DML not supported");
+     *     return (await connection.executeMany(trustedTenantDml, binds)).affectedRows;
+     *   });
+     * }
+     * ```
+     */
+    executeMany?(sql: string, binds: unknown[][]): Promise<{
+        /**
+         * Accurate affected-row count for scalar execution or one count per ordered batch bind row.
+         */
+        affectedRows: number[];
+    }>;
+}
+/**
+ * Provider transaction boundary required for envelope CAS, domain writes and durable journal atomicity.
+ *
+ * @see createAtomicRepository for canonical host integration.
+ */
+interface AtomicSqlDriver {
+    /**
+     * SQL placeholder/driver dialect selected by trusted host configuration.
+     */
+    dialect: 'sqlite' | 'oracle' | 'postgres';
+    /**
+     * Acquires one transaction connection, commits success and rolls back rejection.
+     *
+     * Same connection for every statement; commits on success, rolls back on rejection.
+     * @param principal - Verified tenant/user principal used for host session admission.
+     * @param work - Async work on the same connection for every domain/CAS/audit statement.
+     * @typeParam T - Value resolved by the transaction/connection callback.
+     * @returns The callback result after commit; all joined writes roll back on failure.
+     * @throws Rejects propagated host persistence, validation or callback failures.
+     
+     * @example
+     * ```typescript
+     * import type { AtomicSqlDriver, PluginPrincipal } from '@alneas/eaos-server/plugin-data';
+     * export async function readJoined(driver: AtomicSqlDriver, principal: PluginPrincipal, trustedTenantSql: string, bindings: unknown[]) {
+     *   return driver.transaction(principal, async connection => {
+     *     const result = await connection.execute(trustedTenantSql, bindings);
+     *     return result.rows ?? [];
+     *   });
+     * }
+     * ```
+     */
+    transaction<T>(principal: PluginPrincipal, work: (connection: AtomicSqlConnection) => Promise<T>): Promise<T>;
+}
+/**
+ * Expose SQL execution on the exact active transaction that owns envelope CAS and receipts.
+ * @param session - Currently active repository session carrying a trusted SQL capability binding.
+ * @param principal - Verified principal matching both tenant and user of the joined transaction.
+ * @returns The bound driver dialect and an execute(tenantId, sql, binds) method using the existing connection.
+ * @throws Throws for malformed/mismatched principals, missing/expired transaction bindings or a foreign execute tenant; driver failures propagate.
+ * @remarks Never retain or use the executor after the parent transaction callback returns. It does not open another transaction or authorize arbitrary SQL.
+ * @example
+ * import { joinedAtomicSqlExecutor, type AtomicRepository, type PluginPrincipal } from '@alneas/eaos-server/plugin-data'
+ * export function queryJoined(repository: AtomicRepository, principal: PluginPrincipal, statement: string, binds: unknown[]) {
+ *  // The host supplies trusted SQL and verifies resource permission before entry.
+ *  return repository.run(principal, session => joinedAtomicSqlExecutor(session, principal).execute(principal.tenantId, statement, binds))
+ * }
+ */
+declare function joinedAtomicSqlExecutor(session: AtomicSession, principal: PluginPrincipal): {
+    dialect: "sqlite" | "oracle" | "postgres";
+    /**
+     * Executes trusted SQL on this session's still-active joined connection.
+     * @param tenantId - Must match the verified tenant bound to the original session.
+     * @param sql - Trusted parameterized SQL with explicit tenant predicates.
+     * @param binds - Positional bind values in placeholder order.
+     * @returns Query rows and affected-row metadata from the existing transaction.
+     * @throws Rejects expired/mismatched bindings, foreign tenant or underlying SQL failure.
+     * @see joinedAtomicSqlExecutor for scoped usage that does not retain this capability.
+     */
+    execute(tenantId: string, sql: string, binds: unknown[]): Promise<{
+        /**
+         * Optional object rows from SELECT execution on this connection.
+         */
+        rows?: Record<string, unknown>[];
+        /**
+         * Accurate affected-row count for scalar execution or one count per ordered batch bind row.
+         */
+        affectedRows: number;
+    }>;
+};
+/**
+ * Compute the canonical JSON SHA-256 used by atomic commands and scoped cursors.
+ * @param value - Canonical-JSON-compatible value to hash.
+ * @returns Lowercase hexadecimal SHA-256.
+ * @throws Canonical serialization rejects unsupported or invalid values.
+ * @remarks A hash binds content; it is not a signature or external trust anchor.
+ * @example
+ * import { atomicHash } from '@alneas/eaos-server/plugin-data'
+ * const hash = atomicHash({ id: 'example' })
+ */
+declare function atomicHash(value: unknown): string;
+/**
+ * Replay or atomically record one principal/operation-scoped command result in an existing transaction.
+ * @param tx - Live tenant-scoped atomic session enclosing the actual domain work.
+ * @param p - Verified principal whose user ID scopes the command receipt.
+ * @param operation - Trusted operation name included in the receipt key.
+ * @param input - Complete command input with a commandId of 1–80 letters/digits/underscore/hyphen.
+ * @param work - Async domain callback run only for a new command; must remain inside the same transaction.
+ * @typeParam T - JSON-serializable domain result stored and returned by the command receipt.
+ * @returns The existing identical receipt result or the newly computed result.
+ * @throws Rejects malformed command IDs, input reuse with a different hash, CAS/audit failures and propagated work errors.
+ * @remarks Caller performs live resource authorization before replay as well as execution. Domain writes, receipt and audit share the existing transaction; irreversible external effects must be durably queued, not performed inside work.
+ * @example
+ * import { atomicCommand, type AtomicRepository, type AtomicSession, type PluginPrincipal } from '@alneas/eaos-server/plugin-data'
+ * export function command<T>(repository: AtomicRepository, principal: PluginPrincipal, input: { commandId: string }, work: (session: AtomicSession) => Promise<T>) {
+ *  // The host performs live resource admission before replay or new execution.
+ *  return repository.run(principal, session => atomicCommand(session, principal, 'example-operation', input, () => work(session)))
+ * }
+ */
+declare function atomicCommand<T>(tx: AtomicSession, p: PluginPrincipal, operation: string, input: {
+    /**
+     * Stable nonempty 1–80 character command ID scoped by actor and operation; identical full input replays the stored result.
+     */
+    commandId: string;
+}, work: () => Promise<T>): Promise<T>;
+/**
+ * Encode an exclusive record position bound to the canonical hash of its query scope.
+ * @param scope - Tenant/user/operation/filter scope defined by the caller.
+ * @param after - Exclusive logical record ID to resume after.
+ * @returns Base64url cursor containing the scope hash and position.
+ * @throws Unsupported canonical scope values or JSON serialization failures propagate.
+ * @remarks Encoding is not encryption or a signature; the reader validates scope and record-key grammar.
+ * @example
+ * import { recordCursor } from '@alneas/eaos-server/plugin-data'
+ * const cursor = recordCursor(['example-tenant', 'list'], 'record-1')
+ */
+declare function recordCursor(scope: unknown, after: string): string;
+/**
+ * Decode a cursor only when its scope hash and logical record key match the current query.
+ * @param scope - Current tenant/user/operation/filter scope.
+ * @param cursor - Optional base64url cursor; omission returns the initial empty position.
+ * @returns Validated exclusive record ID, or an empty string for no cursor.
+ * @throws Throws PluginError 400 for invalid encoding/JSON, changed scope or invalid record keys.
+ * @example
+ * import { parseRecordCursor } from '@alneas/eaos-server/plugin-data'
+ * const after = parseRecordCursor(['example-tenant', 'list'])
+ */
+declare function parseRecordCursor(scope: unknown, cursor?: string): string;
+/**
+ * Canonical namespace, JSON payload policy and optional document contracts for the atomic envelope table.
+ *
+ *
+ * Plugin-owned table; tenant cannot be selected through individual row operations.
+ * @see createAtomicRepository for canonical host integration.
+ */
+interface AtomicRepositoryOptions {
+    /**
+     * Optional trusted logical namespace encoded into physical IDs for a shared table.
+     */
+    namespace?: string;
+    /**
+     * Declared payload/object/history limits; does not configure or authorize a provider.
+     */
+    storagePolicy?: PluginStoragePolicy;
+    /**
+     * Canonical closed payload contracts copied and enforced by the wrapper.
+     */
+    documents?: readonly JsonDocumentContract[];
+}
+/**
+ * Create tenant/namespace-scoped CAS sessions on a trusted transactional SQL driver.
+ * @param table - Trusted lowercase table identifier for envelope persistence.
+ * @param driver - Driver that commits the callback result or rolls back all statements on rejection.
+ * @param options - Optional namespace, payload policy and canonical document contracts.
+ * @returns Repository whose run callback receives a temporary session valid only until the callback settles.
+ * @throws Rejects invalid table/driver/namespace/document bindings; operations reject expired sessions, invalid IDs/revisions/payloads, duplicate keys and CAS conflicts.
+ * @remarks Does not create tables. Driver transaction atomicity, connection cleanup and live authorization remain host-owned. Batch writes use the same transaction; session capabilities expire in finally. list supports limits 1–101; getMany preserves input order and missing nulls.
+ * @example
+ * import { createAtomicRepository } from '@alneas/eaos-server/plugin-data'
+ * export function repository(driver: Parameters<typeof createAtomicRepository>[1]) { return createAtomicRepository('example_records', driver) }
+ */
+declare function createAtomicRepository(table: string, driver: AtomicSqlDriver, options?: AtomicRepositoryOptions): AtomicRepository;
+/**
+ * Adapt one active atomic session to the standard record-store boundary for exactly one tenant.
+ * @param session - Live session obtained inside repository.run.
+ * @param principal - Verified principal defining the only admitted tenant.
+ * @typeParam T - JSON payload shape retained by the adapted store.
+ * @returns A read/list/listPage/create/replace store backed by that same session.
+ * @throws Malformed principals throw immediately; foreign tenant, invalid revision transitions or expired/CAS session failures reject operations.
+ * @remarks Does not begin or commit a transaction and does not expose deletion. Replacement conflicts reject rather than returning false.
+ * @example
+ * import { createAtomicRecordStore, type AtomicRepository, type PluginPrincipal } from '@alneas/eaos-server/plugin-data'
+ * export function readRecord<T>(repository: AtomicRepository, principal: PluginPrincipal, id: string) {
+ *  return repository.run(principal, session => createAtomicRecordStore<T>(session, principal).read(principal.tenantId, id))
+ * }
+ */
+declare function createAtomicRecordStore<T>(session: AtomicSession, principal: PluginPrincipal): PluginRecordStore<T>;
+/**
+ * Resolve manifest storage metadata to an atomic repository with canonical document enforcement.
+ * @param manifest - Trusted schema with shared-storage binding or exactly one owned table.
+ * @param driver - Trusted transactional SQL driver.
+ * @param catalog - Required Data Contract catalog when shared storage is declared.
+ * @returns Atomic repository for the manifest-selected table/namespace.
+ * @throws Rejects absent/mismatched catalogs, ambiguous owned tables or invalid repository bindings.
+ * @remarks Does not install/enable storage contracts; host lifecycle and admission are separate.
+ * @example
+ * import { createPluginAtomicRepository } from '@alneas/eaos-server/plugin-data'
+ * export function repository(manifest: Parameters<typeof createPluginAtomicRepository>[0], driver: Parameters<typeof createPluginAtomicRepository>[1], catalog: Parameters<typeof createPluginAtomicRepository>[2]) { return createPluginAtomicRepository(manifest, driver, catalog) }
+ */
+declare function createPluginAtomicRepository(manifest: Pick<PluginManifest, 'schema'>, driver: AtomicSqlDriver, catalog?: DataContractCatalog): AtomicRepository;
+/**
+ * Structural synchronous SQLite database API; lifecycle and physical migrations remain host-owned.
+ *
+ *
+ * Structural Bun SQLite connection. The host owns the database and migration application.
+ * @see createSqliteAtomicDriver for canonical host integration.
+ */
+interface SqliteAtomicDatabase {
+    /**
+     * Executes trusted SQLite control SQL on the host-owned connection.
+     * @param sql - Trusted transaction/control SQL text.
+     * @returns The native database execution result.
+     * @throws SQLite control failures throw synchronously.
+     
+     * @example
+     * ```typescript
+     * import type { SqliteAtomicDatabase } from '@alneas/eaos-server/plugin-data';
+     * export function enforceForeignKeys(db: SqliteAtomicDatabase) {
+     *   db.exec("PRAGMA foreign_keys = ON");
+     * }
+     * ```
+     */
+    exec(sql: string): unknown;
+    /**
+     * Prepares trusted parameterized SQLite SQL on the host-owned connection.
+     * @param sql - Trusted SQL text with explicit tenant predicates.
+     * @returns A statement exposing synchronous all/run methods.
+     * @throws Preparation errors throw synchronously.
+     
+     * @example
+     * ```typescript
+     * import type { SqliteAtomicDatabase } from '@alneas/eaos-server/plugin-data';
+     * export function tenantProjection(db: SqliteAtomicDatabase, tenantId: string) {
+     *   return db.query("SELECT ? AS tenant_id").all(tenantId);
+     * }
+     * ```
+     */
+    query(sql: string): {
+        /**
+         * Synchronously execute the prepared query with positional values and return all rows.
+         * @param values - Positional prepared-statement values.
+         * @returns All prepared-query rows in provider order.
+         * @throws Provider execution/binding errors throw synchronously.
+         
+         * @example
+         * ```typescript
+         * import type { SqliteAtomicDatabase } from '@alneas/eaos-server/plugin-data';
+         * export function projectedRows(db: SqliteAtomicDatabase, tenantId: string) {
+         *   const statement = db.query("SELECT ? AS tenant_id");
+         *   return statement.all(tenantId);
+         * }
+         * ```
+         */
+        all(...values: any[]): unknown[];
+        /**
+         * Synchronously execute the prepared DML with positional values and return its change count.
+         * @param values - Positional prepared-statement values.
+         * @returns Native DML change-count metadata.
+         * @throws Provider execution/binding errors throw synchronously.
+         
+         * @example
+         * ```typescript
+         * import type { SqliteAtomicDatabase } from '@alneas/eaos-server/plugin-data';
+         * export function executeReviewed(db: SqliteAtomicDatabase, trustedTenantDml: string, bindings: unknown[]) {
+         *   return db.query(trustedTenantDml).run(...bindings).changes;
+         * }
+         * ```
+         */
+        run(...values: any[]): {
+            /**
+             * Number of rows affected by this prepared DML execution.
+             */
+            changes: number;
+        };
+    };
+}
+/**
+ * Serialize BEGIN IMMEDIATE transactions on a host-owned SQLite connection.
+ * @param db - Structural SQLite database whose schema and connection lifetime are owned by the host.
+ * @returns SQLite transaction driver with one connection-local promise queue.
+ * @throws BEGIN/statement/COMMIT/ROLLBACK errors and callback failures reject; a rollback failure can replace the original error.
+ * @remarks Queueing is per driver instance, not cross-process coordination. Do not nest repository transactions on the same connection; close the database only after all operations finish.
+ * @example
+ * import { createSqliteAtomicDriver } from '@alneas/eaos-server/plugin-data'
+ * export function driver(db: Parameters<typeof createSqliteAtomicDriver>[0]) { return createSqliteAtomicDriver(db) }
+ */
+declare function createSqliteAtomicDriver(db: SqliteAtomicDatabase): AtomicSqlDriver;
+/**
+ * Host Oracle connection subset used with autocommit disabled and explicit commit/rollback.
+ *
+ * @see createOracleAtomicDriver for canonical host integration.
+ */
+interface OracleAtomicConnection {
+    /**
+     * Executes one parameterized Oracle statement without autocommit.
+     * @param sql - Trusted parameterized SQL.
+     * @param binds - Ordered bind values, including explicit CLOB bindings for large payloads.
+     * @param options - Provider options requiring autoCommit=false and object row format, with optional per-column fetch types.
+     * @returns Optional object rows and rowsAffected count.
+     * @throws Rejects Oracle execution/binding failures.
+     
+     * @example
+     * ```typescript
+     * import type { OracleAtomicHost, OracleAtomicConnection } from '@alneas/eaos-server/plugin-data';
+     * export async function queryTenant(host: OracleAtomicHost, tenantId: string, trustedTenantSql: string, binds: unknown[], options: Parameters<OracleAtomicConnection["execute"]>[2]) {
+     *   return host.withTenantConnection("PLUGIN_RECORDS", async connection => {
+     *     return (await connection.execute(trustedTenantSql, binds, options)).rows ?? [];
+     *   }, { tenantId });
+     * }
+     * ```
+     */
+    execute(sql: string, binds: unknown[], options: {
+        /**
+         * Must be false so the host transaction explicitly commits or rolls back all joined work.
+         */
+        autoCommit: false;
+        /**
+         * Actual Oracle object-row output constant supplied by the installed driver.
+         */
+        outFormat: number;
+        /**
+         * Optional column-name to explicit fetch-type settings, including PAYLOAD string extraction.
+         */
+        fetchInfo?: Record<string, {
+            /**
+             * Actual installed Oracle provider type constant; no global conversion settings are changed.
+             */
+            type: unknown;
+        }>;
+    }): Promise<{
+        /**
+         * Optional Oracle object rows returned by a query.
+         */
+        rows?: Record<string, unknown>[];
+        /**
+         * Optional scalar DML affected-row count; adapter normalizes absence to 0.
+         */
+        rowsAffected?: number;
+    }>;
+    /**
+     * Executes ordered Oracle bind batches without autocommit.
+     * @param sql - Trusted parameterized DML.
+     * @param binds - Ordered positional bind rows.
+     * @param options - Provider options requiring autoCommit=false and dmlRowCounts=true.
+     * @returns Per-bind-row DML counts; adapters reject missing/invalid lengths or counts.
+     * @throws Rejects Oracle batch/binding failures.
+     
+     * @example
+     * ```typescript
+     * import type { OracleAtomicHost } from '@alneas/eaos-server/plugin-data';
+     * export async function batchReviewed(host: OracleAtomicHost, tenantId: string, trustedTenantDml: string, binds: unknown[][]) {
+     *   return host.withTenantConnection("PLUGIN_RECORDS", async connection => {
+     *     if (!connection.executeMany) throw new Error("Batch DML not supported");
+     *     try {
+     *       const result = await connection.executeMany(trustedTenantDml, binds, { autoCommit: false, dmlRowCounts: true });
+     *       await connection.commit();
+     *       return result.dmlRowCounts;
+     *     } catch (error) { await connection.rollback(); throw error; }
+     *   }, { tenantId });
+     * }
+     * ```
+     */
+    executeMany?(sql: string, binds: unknown[][], options: {
+        /**
+         * Must be false so the host transaction explicitly commits or rolls back all joined work.
+         */
+        autoCommit: false;
+        /**
+         * Requested per-row batch counts (true in options), or returned per-bind-row counts in the result.
+         */
+        dmlRowCounts: true;
+    }): Promise<{
+        /**
+         * Requested per-row batch counts (true in options), or returned per-bind-row counts in the result.
+         */
+        dmlRowCounts?: number[];
+    }>;
+    /**
+     * Explicitly commits the current Oracle transaction.
+     * @returns Resolves without a value after provider commit completes.
+     * @throws Rejects provider commit failure.
+     
+     * @example
+     * ```typescript
+     * import type { OracleAtomicConnection } from '@alneas/eaos-server/plugin-data';
+     * export async function commitOwned(connection: OracleAtomicConnection) {
+     *   // Only the owner of this transaction chooses its completion outcome.
+     *   await connection.commit();
+     * }
+     * ```
+     */
+    commit(): Promise<void>;
+    /**
+     * Explicitly rolls back the current Oracle transaction.
+     * @returns Resolves without a value after provider rollback completes.
+     * @throws Rejects provider rollback failure.
+     
+     * @example
+     * ```typescript
+     * import type { OracleAtomicConnection } from '@alneas/eaos-server/plugin-data';
+     * export async function rollbackOwned(connection: OracleAtomicConnection) {
+     *   // Only the owner of this transaction chooses its completion outcome.
+     *   await connection.rollback();
+     * }
+     * ```
+     */
+    rollback(): Promise<void>;
+}
+/**
+ * Trusted tenant Oracle connection acquisition and cleanup boundary.
+ *
+ * @see createOracleAtomicDriver for canonical host integration.
+ */
+interface OracleAtomicHost {
+    /**
+     * Acquires a verified tenant Oracle connection and cleans up its host session after work.
+     * @param domain - Trusted connection domain; this adapter uses PLUGIN_RECORDS.
+     * @param callback - Async work receiving the single admitted connection.
+     * @param context - Verified tenant/user session context; must not come from raw request authority.
+     * @typeParam T - Value resolved by the transaction/connection callback.
+     * @returns The callback result after host session cleanup and connection release.
+     * @throws Rejects acquisition, admission, callback or cleanup failures.
+     
+     * @example
+     * ```typescript
+     * import type { OracleAtomicHost } from '@alneas/eaos-server/plugin-data';
+     * export async function inspectTenant(host: OracleAtomicHost, tenantId: string, userId: string, inspect: (connection: Parameters<Parameters<OracleAtomicHost["withTenantConnection"]>[1]>[0]) => Promise<unknown>) {
+     *   return host.withTenantConnection("PLUGIN_RECORDS", inspect, { tenantId, userId });
+     * }
+     * ```
+     */
+    withTenantConnection<T>(domain: string, callback: (connection: OracleAtomicConnection) => Promise<T>, context: {
+        /**
+         * Verified concrete tenant admitted by the host session boundary.
+         */
+        tenantId: string;
+        /**
+         * Optional verified actor ID attached to the Oracle session.
+         */
+        userId?: string;
+    }): Promise<T>;
+}
+/**
+ * Run atomic envelope SQL on a host-provided tenant Oracle connection with explicit commit/rollback.
+ * @param host - Trusted connection provider admitting PLUGIN_RECORDS operations for the verified tenant/user.
+ * @param types - Actual Oracle object-format/string/CLOB constants; no global provider settings are changed.
+ * @returns Oracle transaction driver with optional batch execution and scalar fallback for large strings.
+ * @throws Connection/statement/commit/rollback errors and invalid batch row counts reject; rollback failures may replace the original failure.
+ * @remarks Host owns session authorization, tenant cleanup and connection release. Strings over 4000 characters use explicit CLOB bindings; no production connection is opened at construction.
+ * @example
+ * import { createOracleAtomicDriver } from '@alneas/eaos-server/plugin-data'
+ * export function driver(host: Parameters<typeof createOracleAtomicDriver>[0], types: Parameters<typeof createOracleAtomicDriver>[1]) { return createOracleAtomicDriver(host, types) }
+ */
+declare function createOracleAtomicDriver(host: OracleAtomicHost, types: {
+    /**
+     * Actual installed Oracle object-row output format constant.
+     */
+    objectFormat: number;
+    /**
+     * Actual Oracle string fetch type for JSON PAYLOAD extraction.
+     */
+    stringType: unknown;
+    /**
+     * Actual Oracle CLOB type used for strings longer than 4000 characters.
+     */
+    clobType: unknown;
+}): AtomicSqlDriver;
+
+export { ArtifactDeliveryService, PluginError, RecordCommandService, ScopedRecordService, annotationOperations, annotationSchemas, appendAtomicAudit, assertPrincipal, atomicCommand, atomicHash, createAtomicOutboxDispatcher, createAtomicOutboxStore, createAtomicRecordStore, createAtomicRepository, createAtomicWorkflowEventSink, createCloudflareD1Driver, createCompositePluginService, createMcpOperationHandler, createMcpToolBinder, createOracleAtomicDriver, createPluginAtomicRepository, createPluginRecordStore, createPluginRouter, createRecordDocumentValidator, createSqlRecordStore, createSqliteAtomicDriver, createStandardPluginServer, createValidatedAtomicRepository, createValidatedRecordHost, createValidatedRecordStore, deliveryJobSchema, deliveryOperations, documentAnnotations, enqueueDeliverySchema, enqueueOutboxEvent, exactKeys, joinedAtomicSqlExecutor, jsonBody, parseRecordCursor, readAtomicAudit, recordCursor, recordDocuments, recoverDeliverySchema, requeueOutboxEvent, revisionInput, textInput, uniqueRecordKey, verifyAtomicAudit };
+export type { AnnotationTarget, AtomicAuditEvent, AtomicOutboxDispatcherOptions, AtomicOutboxStoreOptions, AtomicRepository, AtomicRepositoryOptions, AtomicRow, AtomicSession, AtomicSqlConnection, AtomicSqlDriver, CloudflareD1Binding, CloudflareD1DriverOptions, CloudflareD1PreparedStatement, CommandContext, CommandHost, CommandResponse, CommandState, DeliveryArtifact, DeliveryJob, DeliveryPorts, DeliveryRequest, OracleAtomicConnection, OracleAtomicHost, PluginHttpEnv, PluginOperationService, PluginPrincipal, PluginRecord, PluginRecordStore, PluginRouterOptions, ReaderComment, RecordSqlDriver, ScopedRecordDefinition, ScopedRecordHost, SqlRecordStoreOptions, SqliteAtomicDatabase };