@alneas/eaos-server 0.0.0-stage → 0.2.0

package/docs/db/docs/guide.md

@@ -0,0 +1,47 @@
+---
+title: "Db ownership and host boundaries"
+description: "Data Contract ownership, JSON document validation, schema composition and SQLite adapters. This capability belongs to @alneas/eaos-server; it is not a separate npm package."
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# Db ownership and host boundaries
+
+## Motivation
+
+Data Contract ownership, JSON document validation, schema composition and SQLite adapters. This capability belongs to `@alneas/eaos-server`; it is not a separate npm package.
+
+## Architectural Diagram
+
+```mermaid
+flowchart LR
+  Host[Trusted host] --> Adapter[Scoped Server adapter]
+  Adapter --> Store[Host-owned durable provider]
+```
+
+## Public import
+
+Install the package; the subpath below is an import target, not a separate package. Registry installation requires a published EAOS release; before publication use the owning workspace's checksum-verified build artifact.
+
+```bash
+bun add @alneas/eaos-server
+```
+
+```typescript
+import { LocalFirstSqliteAdapter } from '@alneas/eaos-server/db/local-first-sqlite-adapter'
+
+export type LocalDatabaseOptions = ConstructorParameters<typeof LocalFirstSqliteAdapter>[0]
+```
+
+Server runtime only. The host supplies the database connection and independently enforces tenant/resource authorization.
+
+## Trade-offs & Decisions
+
+`LocalFirstSqliteAdapter` manages a local cache and Outbox. Failed begin/commit operations are not success; pull failures attempt rollback and report uncertainty. Null filters use `IS NULL`; zero limits and offset-only pagination retain their meaning. Invalid pagination and unsupported filters are rejected.
+
+Bind the SQLite driver and upstream to the same authorization scope and separate local tenant databases. An inserted default tenant ID is not RLS or runtime authorization. Durable business state, CAS and final authorization remain host-owned. Local enqueue and external delivery are not an exactly-once transaction.
+
+The host owns verified identity, tenant boundaries, credentials and real provider adoption. Package builds and tests never apply production changes or activate tenants. Review the [API reference](api.md) before binding the host.

package/docs/entitlements.md

@@ -0,0 +1,60 @@
+---
+title: "Live plugin contracts and metering"
+description: "Keep portable declarations separate from trusted host execution, current access checks and durable effects."
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# Live plugin contracts and metering
+
+## Motivation
+
+Keep portable declarations separate from trusted host execution, current access checks and durable effects.
+
+## Architectural Diagram
+
+```mermaid
+flowchart LR
+  Contract[Public contract] --> Host[Verified host scope]
+  Host --> Operation[Explicit runtime operation]
+  Operation --> Validation[Result and permission verification]
+```
+
+## Public import
+
+Install the package; the subpath below is an import target, not a separate package. Registry installation requires a published EAOS release; before publication use the owning workspace's checksum-verified build artifact.
+
+```bash
+bun add @alneas/eaos-server
+```
+
+```typescript
+import { PluginEntitlementRuntime } from '@alneas/eaos-server/entitlements'
+
+export function bindEntitlements(options: ConstructorParameters<typeof PluginEntitlementRuntime>[0]) {
+  return new PluginEntitlementRuntime(options)
+}
+```
+
+Server runtime only. Supply the live contract loader, lifecycle admission and a shared durable atomic repository; importing does not create the control tables.
+
+## Trade-offs & Decisions
+
+`@alneas/eaos-server/entitlements` exports `PluginEntitlementRuntime`, `createPluginEntitlementGuard`, `createPluginAssetRouter`, `tenantEntitlementContract` and `createSqlTenantEntitlementLoader`. Install the control contract through reviewed Lifecycle operations; importing it never creates a table. The SQL loader reads `eaos_tenant_entitlements` from the primary control database. Host administration owns grants, expiry and CAS updates; the framework does not issue payments or subscriptions.
+
+Construct a runtime with the loader, current Lifecycle admission callback and a shared `AtomicRepository`. Every admitted metered attempt reserves one unit in a UTC calendar-month bucket and appends the existing durable atomic audit chain in the same transaction. A failed audit write rolls back the reservation. A handler failure still counts its admitted attempt. Retries count separately; business command idempotency does not deduplicate admission. Discovery and asset URL requests do not consume execution units. Repository CAS conflicts fail closed; callers must not blindly retry a business operation.
+
+Pass the runtime as `createApp({ entitlements, resolveEntitlementPrincipal })`. An explicitly declared policy cannot be bypassed by disabling the legacy module guard or using development mode. A missing runtime returns 503 on HTTP; unmet subscriptions/addons/quotas return 402; a foreign Corporate tenant receives 404 before module checks. Existing manifests without `entitlement` retain their previous authorization behavior.
+
+MCP discovery filters current contracts. Both execute and JSON-RPC calls check the contract before constructing dependencies and reserve quota immediately before the handler. JSON-RPC errors contain the HTTP-equivalent status in `error.data.status`.
+
+Jobs and verified webhooks must use the same runtime's `run(principal, pluginId, rule, operation, callback)` in addition to their host authentication/resource checks. Never derive the principal or policy from a job payload. Existing direct service method calls do not automatically gain entitlement checks.
+
+`createSdkPluginRouter` in `@alneas/eaos-server/plugin-sdk` mounts a Core `definePlugin` definition. It requires a principal resolver, a current lifecycle/resource authorization callback and a scoped context factory. Identity cannot be overridden by the factory or request body. JSON bodies are bounded to 1 MiB; route-specific input validation remains the plugin's responsibility. Browser hosts still supply their established CSRF/Origin middleware.
+
+The asset router accepts only a trusted catalog and signing callback. It rechecks admission after signing, returns `private, no-store` metadata and limits the requested lifetime to 60 seconds. The signing adapter must enforce that lifetime and private storage. A copied signed URL can remain usable until expiry, and authorized browsers can read downloaded bytes; this is access control, not DRM. WASM and ONNX assets must not also be served from a public directory.
+
+For React, merge current runtime decisions into the authenticated context's `pluginAccess` map and refresh it on contract/session changes. Omit foreign Corporate plugins completely. UI gates never replace backend admission.

package/docs/guide.md

@@ -0,0 +1,92 @@
+---
+title: "Server boundaries"
+description: "Hono/MCP, identity integration, durable CAS/audit/Outbox, lifecycle, database and scoped storage implementations. Business plugins, customer data, credentials, actual infrastructure settings and operator receipts remain outside this public package."
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# Server boundaries
+
+## Motivation
+
+Hono/MCP, identity integration, durable CAS/audit/Outbox, lifecycle, database and scoped storage implementations. Business plugins, customer data, credentials, actual infrastructure settings and operator receipts remain outside this public package.
+
+## Architectural Diagram
+
+```mermaid
+flowchart LR
+  Contract[Public contract] --> Host[Verified host bindings]
+  Host --> Runtime[Scoped runtime operation]
+  Runtime --> Evidence[Durable result and audit]
+```
+
+## Public import
+
+Install the package; the subpath below is an import target, not a separate package. Registry installation requires a published EAOS release; before publication use the owning workspace's checksum-verified build artifact.
+
+```bash
+bun add @alneas/eaos-server
+```
+
+```typescript
+import { createSdkPluginRouter } from '@alneas/eaos-server/plugin-sdk'
+
+export const bindSdkRouter = createSdkPluginRouter
+```
+
+Server runtime only. Install the package's Hono dependency and provide verified identity, scoped context and current authorization.
+
+## Trade-offs & Decisions
+
+The host supplies verified identity and current lifecycle/resource authorization. CAS rejects stale revisions; durable host stores retain audit and Outbox. Provider connections and secrets are injected through trusted ports.
+
+Code installation, database/infrastructure application and tenant activation are separate operations. Import/build/test/install do not perform production migrations or infrastructure updates. Before registry publication, build and test checksum-pinned tarballs in isolated consumers instead of linking sibling source.
+
+See [live entitlements](entitlements.md), [database boundaries](db/docs/guide.md), [lifecycle](lifecycle/docs/guide.md) and [storage](storage/docs/guide.md).
+
+
+## Shared model execution
+
+`@alneas/eaos-server/execution/chat` owns generic chat orchestration and
+`@alneas/eaos-server/execution/tool-agent` owns bounded read-tool orchestration
+and unexecuted write handoffs. Appkit Core 0.2.0 owns HTTP/SSE and Action execution.
+Hosts retain model endpoints, credentials, tool registration, live permission,
+model bindings, budgets and durable accounting. Domain prompts, extraction schemas,
+account mappings and the proposal/approval/save composition belong to plugins.
+
+The built-in LiteLLM worker uses this same chat API with the existing endpoint,
+model and fetch options. `litellmHeaders` supplies Host credentials; `chat` supplies
+shared policies and adapters. Injected executors still run first. Goose/Hermes remain
+process adapters. Worker text output limits remain distinct from serialized stream
+event limits. Optional `runTask` cancellation applies to built-in chat; existing
+process and injected-executor cancellation contracts are unchanged.
+
+LiteLLM requests SSE (`stream: true`). A custom JSON-only endpoint must supply a
+compatible `AIChatAdapter` or an injected executor; no parallel provider parser is
+provided. A configured model registry requires explicit `modelAdapters` bindings
+for its model IDs. Host parameters cannot replace `model`, `messages`, `tools` or
+`stream`. Unknown usage is passed to the existing accounting port for reconciliation;
+Appkit's OpenAI-compatible adapter does not expose provider SSE token-usage fields.
+This integration does not estimate them or silently record zero.
+
+```typescript
+import { createChatClient, type ChatClientOptions } from '@alneas/eaos-server/execution/chat';
+import { createToolAgent, type ToolAgentOptions } from '@alneas/eaos-server/execution/tool-agent';
+
+export function connectChat(options: ChatClientOptions) {
+  return createChatClient(options);
+}
+
+export function connectReadAgent(options: ToolAgentOptions) {
+  return createToolAgent(options);
+}
+```
+
+Read-tool descriptors and retained tool results are reauthorized before model
+disclosure. Write requests remain handoffs to the existing Action/Proposal approval
+path. Provider errors, incomplete streams, cancellation, policy revocation and
+oversized output reject before an authorized response is returned. A transport
+fixture integration test is distinct from a live model/provider acceptance test.

package/docs/index.md

@@ -0,0 +1,57 @@
+---
+title: "Server execution and persistence"
+description: "Host developers use Server to compose HTTP/MCP, lifecycle and durable data services."
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos","explanation"]
+---
+
+<!-- Generated from packages/server/README.md; edit the README and run docs:readmes:prepare. -->
+
+# Server execution and persistence
+
+[![TypeScript](https://img.shields.io/badge/TypeScript-3178C6?style=flat&logo=typescript&logoColor=white)](https://www.typescriptlang.org/docs/) [![Node.js minimum 24](https://img.shields.io/badge/Node.js-%3E%3D24-339933?style=flat&logo=nodedotjs&logoColor=white)](https://nodejs.org/en/about/previous-releases) [![Hono](https://img.shields.io/badge/Hono-E36002?style=flat&logo=hono&logoColor=white)](https://hono.dev/docs/)
+
+## Elevator Pitch
+
+Host developers use Server to compose HTTP/MCP, lifecycle and durable data services.
+
+## Why & Value
+
+Shared implementations keep authorization, CAS, audit and Outbox consistent. The host retains provider connections, current identity and deployment policy. This MIT package owns its implementation and declarations in the public monorepo.
+
+## Key Highlights
+
+- Hono and MCP integration
+- Reviewed lifecycle plans
+- Durable CAS and audit
+- Scoped database and storage
+
+## Quickstart
+
+This checkout prepares version 0.2.0; version 0.1.0 is already published. Until 0.2.0 is published, install the checksum-pinned candidate tarball. The command below applies after that release.
+
+### Public import
+
+Use Node.js 24 or later and the required Appkit Core 0.2.0 peer. The canonicalization example is pure and needs no database connection or credentials. Server execution later requires host-owned identity, authorization and persistence bindings. The subpath is an import target, not a separately installed package.
+
+```bash
+bun add @alneas/eaos-server@0.2.0 @alneas/appkit-core@0.2.0
+```
+
+```typescript
+import { canonical } from '@alneas/eaos-server/lifecycle-engine'
+
+console.log(canonical({ format: 1, operation: 'inspect' }))
+```
+
+## Next Steps
+
+- [Change history](https://github.com/dataarthub/eaos/blob/main/packages/server/CHANGELOG.md)
+- [Architecture and boundaries](guide.md)
+- [API reference](api.md)
+- [EAOS composition](https://tech-docs.alneas.com/eaos-workspace/architecture/)
+
+Questions and issue reports in English are welcome in [GitHub Issues](https://github.com/dataarthub/eaos/issues). Private vulnerability reports can use [GitHub private reporting](https://github.com/dataarthub/eaos/security/advisories/new).

package/docs/ja/db/README.md

@@ -0,0 +1,46 @@
+---
+title: "eaos-db"
+description: "EAOSを組み込む開発者向けに、所有する公開機能と型付きの利用入口を提供します。"
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# eaos-db
+
+## 概要
+
+EAOSを組み込む開発者向けに、所有する公開機能と型付きの利用入口を提供します。
+
+## 目的と利点
+
+共通の実装を再利用し、業務機能とホストの接続・認可を分離します。実装の正本は公開Monorepoにあり、本番の設定や運用証拠は含めません。コードの導入、スキーマ適用、組織への有効化は別操作です。
+
+## 主な機能
+
+- 公開パッケージの型付きAPI
+- 明示的なホスト接続と現在の認可
+- パッケージ単位の検証と配布
+
+## クイックスタート
+
+registryからの導入には公開済みの版が必要です。公開前はworkspaceが作成・検証したSHA固定tarballを使用してください。パッケージのsubpath自体をbun addの引数にはしません。
+
+```bash
+bun add @alneas/eaos-server
+```
+
+```typescript
+import * as capability from '@alneas/eaos-server/db'
+
+console.log(Object.keys(capability))
+```
+
+## 次の手順
+
+
+- [Architecture and host boundaries](../../db/docs/guide.md)
+- [API reference](../../db/docs/api.md)
+- [Owning package](../../../README.md)

package/docs/ja/db/docs/guide.md

@@ -0,0 +1,53 @@
+---
+title: "eaos-db 開発と境界"
+description: "公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。"
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# eaos-db 開発と境界
+
+## 背景と目的
+
+公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。
+
+## 構成図
+
+```mermaid
+flowchart LR
+  Host[Trusted host] --> Adapter[Scoped Server adapter]
+  Adapter --> Store[Host-owned durable provider]
+```
+
+## トレードオフと判断
+
+### 所有範囲
+
+DataContract・JSON文書検証・schema集約・SQLite接続。業務plugin・業務物理schema・顧客データ・秘密値・実環境設定・運用receiptは含めません。
+
+### 開発
+
+
+
+EAOS依存がまだ未公開の場合は、workspaceのビルド入口を使います。先行パッケージをtgzにして隔離環境へ導入し、型生成・テスト・packの成功後だけ最新receiptを更新します。
+
+### 認可・永続化
+
+tenant/user/rolesは検証済みホストから渡します。Lifecycleの有効状態とresource権限を実行時に再確認します。CASは古いrevisionを拒否し、監査/Outboxはホストがdurableなstoreへ保存します。SQL接続・provider資格情報はホストから注入します。
+
+### 配布と適用
+
+コードの導入、DB/infra適用、tenant有効化は別操作です。build/test/installは本番migrationやPulumi updateを実行しません。共通ドキュメントサイトの原稿はこのrepoのdocsが正本です。
+
+### SQLiteの同期と検索
+
+`LocalFirstSqliteAdapter` はローカルキャッシュとOutboxを扱います。`pullChanges` のBEGIN/COMMIT失敗は成功扱いせず、同期失敗ではROLLBACKを試行し、確定できなければエラーを返します。`NULL` は `IS NULL` で検索し、`limit:0` とoffsetのみの指定も保持します。負数・小数・文字列のページ指定、未対応のfilter演算子は明示的に拒否します。
+
+SQLite driverとupstreamはホストが同じ認可範囲へ束縛し、ローカルDBはtenantごとに分離してください。`tenantId` による挿入時の既定値は、共有SQLiteに対するRLSや実行時認可を提供しません。業務の正本・CAS・最終認可にはホストのdurable repositoryを利用します。Outboxのローカル変更・enqueue全体や外部処理のexactly-onceを保証する部品ではありません。
+
+### 検証
+
+直接テストでは契約の所有権・依存循環・版範囲・移行順序と実SQLiteのCRUD、offline再試行、拒否時の復元、SCNのロールバック、listener終了を確認します。DDL生成は文字列検証であり、本番Oracle/PostgresのRLS/VPDや接続試験ではありません。

package/docs/ja/guide.md

@@ -0,0 +1,46 @@
+---
+title: "eaos-server 開発と境界"
+description: "公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。"
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# eaos-server 開発と境界
+
+## 背景と目的
+
+公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。
+
+## 構成図
+
+```mermaid
+flowchart LR
+  Contract[Public contract] --> Host[Verified host bindings]
+  Host --> Runtime[Scoped runtime operation]
+  Runtime --> Evidence[Durable result and audit]
+```
+
+## トレードオフと判断
+
+### 所有範囲
+
+Hono/MCP・認証接続・永続CAS/監査/Outbox・job実行。業務plugin・業務物理schema・顧客データ・秘密値・実環境設定・運用receiptは含めません。
+
+### 開発
+
+
+
+EAOS依存がまだ未公開の場合は、workspaceのビルド入口を使います。先行パッケージをtgzにして隔離環境へ導入し、型生成・テスト・packの成功後だけ最新receiptを更新します。
+
+### 認可・永続化
+
+tenant/user/rolesは検証済みホストから渡します。Lifecycleの有効状態とresource権限を実行時に再確認します。CASは古いrevisionを拒否し、監査/Outboxはホストがdurableなstoreへ保存します。SQL接続・provider資格情報はホストから注入します。
+
+### 配布と適用
+
+コードの導入、DB/infra適用、tenant有効化は別操作です。build/test/installは本番migrationやPulumi updateを実行しません。共通ドキュメントサイトの原稿はこのrepoのdocsが正本です。
+
+See [Live HTTP/MCP subscription admission, atomic monthly metering, private asset signing and SDK context injection](../entitlements.md) for the architecture additions and their host boundaries.

package/docs/ja/lifecycle/README.md

@@ -0,0 +1,46 @@
+---
+title: "eaos-lifecycle"
+description: "EAOSを組み込む開発者向けに、所有する公開機能と型付きの利用入口を提供します。"
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# eaos-lifecycle
+
+## 概要
+
+EAOSを組み込む開発者向けに、所有する公開機能と型付きの利用入口を提供します。
+
+## 目的と利点
+
+共通の実装を再利用し、業務機能とホストの接続・認可を分離します。実装の正本は公開Monorepoにあり、本番の設定や運用証拠は含めません。コードの導入、スキーマ適用、組織への有効化は別操作です。
+
+## 主な機能
+
+- 公開パッケージの型付きAPI
+- 明示的なホスト接続と現在の認可
+- パッケージ単位の検証と配布
+
+## クイックスタート
+
+registryからの導入には公開済みの版が必要です。公開前はworkspaceが作成・検証したSHA固定tarballを使用してください。パッケージのsubpath自体をbun addの引数にはしません。
+
+```bash
+bun add @alneas/eaos-server
+```
+
+```typescript
+import * as capability from '@alneas/eaos-server/lifecycle-engine'
+
+console.log(Object.keys(capability))
+```
+
+## 次の手順
+
+
+- [Architecture and host boundaries](../../lifecycle/docs/guide.md)
+- [API reference](../../lifecycle/docs/api.md)
+- [Owning package](../../../README.md)

package/docs/ja/lifecycle/docs/guide.md

@@ -0,0 +1,45 @@
+---
+title: "eaos-lifecycle 開発と境界"
+description: "公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。"
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# eaos-lifecycle 開発と境界
+
+## 背景と目的
+
+公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。
+
+## 構成図
+
+```mermaid
+flowchart LR
+  Host[Trusted host] --> Adapter[Scoped Server adapter]
+  Adapter --> Store[Host-owned durable provider]
+```
+
+## トレードオフと判断
+
+### 所有範囲
+
+導入/更新/有効化・migration履歴・配置と完了記録。業務plugin・業務物理schema・顧客データ・秘密値・実環境設定・運用receiptは含めません。
+
+### 開発
+
+
+
+EAOS依存がまだ未公開の場合は、workspaceのビルド入口を使います。先行パッケージをtgzにして隔離環境へ導入し、型生成・テスト・packの成功後だけ最新receiptを更新します。
+
+### 認可・永続化
+
+tenant/user/rolesは検証済みホストから渡します。Lifecycleの有効状態とresource権限を実行時に再確認します。CASは古いrevisionを拒否し、監査/Outboxはホストがdurableなstoreへ保存します。SQL接続・provider資格情報はホストから注入します。
+
+### 配布と適用
+
+コードの導入、DB/infra適用、tenant有効化は別操作です。build/test/installは本番migrationやPulumi updateを実行しません。共通ドキュメントサイトの原稿はこのrepoのdocsが正本です。
+
+See [Integrity-pinned schema baseline descriptors and a locked, non-DDL ledger rebase preserving historical evidence](../../../lifecycle/docs/baseline.md) for the architecture additions and their host boundaries.

package/docs/ja/storage/README.md

@@ -0,0 +1,46 @@
+---
+title: "eaos-storage"
+description: "EAOSを組み込む開発者向けに、所有する公開機能と型付きの利用入口を提供します。"
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# eaos-storage
+
+## 概要
+
+EAOSを組み込む開発者向けに、所有する公開機能と型付きの利用入口を提供します。
+
+## 目的と利点
+
+共通の実装を再利用し、業務機能とホストの接続・認可を分離します。実装の正本は公開Monorepoにあり、本番の設定や運用証拠は含めません。コードの導入、スキーマ適用、組織への有効化は別操作です。
+
+## 主な機能
+
+- 公開パッケージの型付きAPI
+- 明示的なホスト接続と現在の認可
+- パッケージ単位の検証と配布
+
+## クイックスタート
+
+registryからの導入には公開済みの版が必要です。公開前はworkspaceが作成・検証したSHA固定tarballを使用してください。パッケージのsubpath自体をbun addの引数にはしません。
+
+```bash
+bun add @alneas/eaos-server
+```
+
+```typescript
+import * as capability from '@alneas/eaos-server/storage'
+
+console.log(Object.keys(capability))
+```
+
+## 次の手順
+
+
+- [Architecture and host boundaries](../../storage/docs/guide.md)
+- [API reference](../../storage/docs/api.md)
+- [Owning package](../../../README.md)

package/docs/ja/storage/docs/guide.md

@@ -0,0 +1,43 @@
+---
+title: "eaos-storage 開発と境界"
+description: "公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。"
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# eaos-storage 開発と境界
+
+## 背景と目的
+
+公開契約とホストの実行責任を分け、同じ機能の重複や権限の取り違えを防ぎます。
+
+## 構成図
+
+```mermaid
+flowchart LR
+  Host[Trusted host] --> Adapter[Scoped Server adapter]
+  Adapter --> Store[Host-owned durable provider]
+```
+
+## トレードオフと判断
+
+### 所有範囲
+
+tenant-scoped storage・認可と署名URLの境界。業務plugin・業務物理schema・顧客データ・秘密値・実環境設定・運用receiptは含めません。
+
+### 開発
+
+
+
+EAOS依存がまだ未公開の場合は、workspaceのビルド入口を使います。先行パッケージをtgzにして隔離環境へ導入し、型生成・テスト・packの成功後だけ最新receiptを更新します。
+
+### 認可・永続化
+
+tenant/user/rolesは検証済みホストから渡します。Lifecycleの有効状態とresource権限を実行時に再確認します。CASは古いrevisionを拒否し、監査/Outboxはホストがdurableなstoreへ保存します。SQL接続・provider資格情報はホストから注入します。
+
+### 配布と適用
+
+コードの導入、DB/infra適用、tenant有効化は別操作です。build/test/installは本番migrationやPulumi updateを実行しません。共通ドキュメントサイトの原稿はこのrepoのdocsが正本です。

package/docs/lifecycle/README.md

@@ -0,0 +1,49 @@
+---
+title: "Lifecycle capability"
+description: "Host developers use @alneas/eaos-server/lifecycle-engine for reviewed lifecycle plans and migration history."
+sidebar:
+  order: 20
+archetype: "explanation"
+project: "eaos-workspace"
+tags: ["eaos", "explanation"]
+---
+
+# Lifecycle capability
+
+## Elevator Pitch
+
+Host developers use `@alneas/eaos-server/lifecycle-engine` for reviewed lifecycle plans and migration history.
+
+## Why & Value
+
+This topic belongs to `@alneas/eaos-server` and is not an independently installed package. Shared contracts keep capability ownership clear while host identity, provider configuration and acceptance remain explicit.
+
+## Key Highlights
+
+- Canonical package subpath
+- Explicit host boundaries
+- Typed declarations and local verification
+
+## Quickstart
+
+Install the owning package, using a verified tarball before registry publication.
+
+### Public import
+
+Install the owning package and use the exact import in the example below. The subpath is not a separate npm package. Check the selected entry's runtime and peer requirements in the linked architecture guide.
+
+```bash
+bun add @alneas/eaos-server
+```
+
+```typescript
+import * as capability from '@alneas/eaos-server/lifecycle-engine'
+
+console.log(Object.keys(capability))
+```
+
+## Next Steps
+
+- [Architecture and host boundaries](docs/guide.md)
+- [API reference](docs/api.md)
+- [Owning package](../index.md)