@alneas/eaos-server 0.0.0-stage → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (360) hide show
  1. package/CHANGELOG.md +41 -0
  2. package/LICENSE +21 -0
  3. package/README.ja.md +49 -0
  4. package/README.md +46 -2
  5. package/dist/agentic/agent-jobs.d.ts +333 -0
  6. package/dist/agentic/agent-jobs.js +15 -0
  7. package/dist/agentic/agent-jobs.js.map +1 -0
  8. package/dist/agentic/agent-node.d.ts +40 -0
  9. package/dist/agentic/agent-node.js +7 -0
  10. package/dist/agentic/agent-node.js.map +1 -0
  11. package/dist/agentic/agent-runner.d.ts +33 -0
  12. package/dist/agentic/agent-runner.js +7 -0
  13. package/dist/agentic/agent-runner.js.map +1 -0
  14. package/dist/agentic/ai-broker.d.ts +169 -0
  15. package/dist/agentic/ai-broker.js +8 -0
  16. package/dist/agentic/ai-broker.js.map +1 -0
  17. package/dist/agentic/atomic-checkpointer.d.ts +137 -0
  18. package/dist/agentic/atomic-checkpointer.js +9 -0
  19. package/dist/agentic/atomic-checkpointer.js.map +1 -0
  20. package/dist/agentic/autonomous-worker.d.ts +122 -0
  21. package/dist/agentic/autonomous-worker.js +10 -0
  22. package/dist/agentic/autonomous-worker.js.map +1 -0
  23. package/dist/agentic/event-bridge.d.ts +350 -0
  24. package/dist/agentic/event-bridge.js +9 -0
  25. package/dist/agentic/event-bridge.js.map +1 -0
  26. package/dist/agentic/executor.d.ts +91 -0
  27. package/dist/agentic/executor.js +12 -0
  28. package/dist/agentic/executor.js.map +1 -0
  29. package/dist/agentic/graph-projection.d.ts +119 -0
  30. package/dist/agentic/graph-projection.js +7 -0
  31. package/dist/agentic/graph-projection.js.map +1 -0
  32. package/dist/agentic/graph.d.ts +524 -0
  33. package/dist/agentic/graph.js +7 -0
  34. package/dist/agentic/graph.js.map +1 -0
  35. package/dist/agentic/index.d.ts +28 -0
  36. package/dist/agentic/index.js +87 -0
  37. package/dist/agentic/index.js.map +1 -0
  38. package/dist/agentic/local-runner.d.ts +106 -0
  39. package/dist/agentic/local-runner.js +7 -0
  40. package/dist/agentic/local-runner.js.map +1 -0
  41. package/dist/agentic/remote-executor.d.ts +67 -0
  42. package/dist/agentic/remote-executor.js +8 -0
  43. package/dist/agentic/remote-executor.js.map +1 -0
  44. package/dist/agentic/types.d.ts +157 -0
  45. package/dist/agentic/types.js +7 -0
  46. package/dist/agentic/types.js.map +1 -0
  47. package/dist/agentic/workflow-catalog.d.ts +152 -0
  48. package/dist/agentic/workflow-catalog.js +7 -0
  49. package/dist/agentic/workflow-catalog.js.map +1 -0
  50. package/dist/agentic/workflow-compiler.d.ts +44 -0
  51. package/dist/agentic/workflow-compiler.js +8 -0
  52. package/dist/agentic/workflow-compiler.js.map +1 -0
  53. package/dist/agentic/workflow-coordinator.d.ts +170 -0
  54. package/dist/agentic/workflow-coordinator.js +8 -0
  55. package/dist/agentic/workflow-coordinator.js.map +1 -0
  56. package/dist/agentic/workflow-manager.d.ts +91 -0
  57. package/dist/agentic/workflow-manager.js +7 -0
  58. package/dist/agentic/workflow-manager.js.map +1 -0
  59. package/dist/agentic/workflow-registry.d.ts +334 -0
  60. package/dist/agentic/workflow-registry.js +7 -0
  61. package/dist/agentic/workflow-registry.js.map +1 -0
  62. package/dist/artifacts-CteHmCMI.d.ts +614 -0
  63. package/dist/auth-hooks/api-key.d.ts +75 -0
  64. package/dist/auth-hooks/api-key.js +7 -0
  65. package/dist/auth-hooks/api-key.js.map +1 -0
  66. package/dist/auth-hooks/index.d.ts +80 -0
  67. package/dist/auth-hooks/index.js +28 -0
  68. package/dist/auth-hooks/index.js.map +1 -0
  69. package/dist/browser-auth/account-memberships.d.ts +213 -0
  70. package/dist/browser-auth/account-memberships.js +13 -0
  71. package/dist/browser-auth/account-memberships.js.map +1 -0
  72. package/dist/browser-auth/index.d.ts +8 -0
  73. package/dist/browser-auth/index.js +59 -0
  74. package/dist/browser-auth/index.js.map +1 -0
  75. package/dist/browser-auth/kratos-session.d.ts +37 -0
  76. package/dist/browser-auth/kratos-session.js +7 -0
  77. package/dist/browser-auth/kratos-session.js.map +1 -0
  78. package/dist/browser-auth/platform-session.d.ts +120 -0
  79. package/dist/browser-auth/platform-session.js +7 -0
  80. package/dist/browser-auth/platform-session.js.map +1 -0
  81. package/dist/browser-auth/public-memberships.d.ts +22 -0
  82. package/dist/browser-auth/public-memberships.js +7 -0
  83. package/dist/browser-auth/public-memberships.js.map +1 -0
  84. package/dist/cache/index.d.ts +181 -0
  85. package/dist/cache/index.js +197 -0
  86. package/dist/cache/index.js.map +1 -0
  87. package/dist/chunk-32746UQZ.js +131 -0
  88. package/dist/chunk-32746UQZ.js.map +1 -0
  89. package/dist/chunk-3NLSWP2Y.js +223 -0
  90. package/dist/chunk-3NLSWP2Y.js.map +1 -0
  91. package/dist/chunk-3P4XTTQH.js +346 -0
  92. package/dist/chunk-3P4XTTQH.js.map +1 -0
  93. package/dist/chunk-3VITSHN3.js +15 -0
  94. package/dist/chunk-3VITSHN3.js.map +1 -0
  95. package/dist/chunk-46UWPEW2.js +226 -0
  96. package/dist/chunk-46UWPEW2.js.map +1 -0
  97. package/dist/chunk-4BARRLJR.js +180 -0
  98. package/dist/chunk-4BARRLJR.js.map +1 -0
  99. package/dist/chunk-4VORUFKR.js +45 -0
  100. package/dist/chunk-4VORUFKR.js.map +1 -0
  101. package/dist/chunk-55D4ERWO.js +1 -0
  102. package/dist/chunk-55D4ERWO.js.map +1 -0
  103. package/dist/chunk-5TBBZIND.js +18 -0
  104. package/dist/chunk-5TBBZIND.js.map +1 -0
  105. package/dist/chunk-5WOZWPZA.js +211 -0
  106. package/dist/chunk-5WOZWPZA.js.map +1 -0
  107. package/dist/chunk-6CBVZ6CT.js +168 -0
  108. package/dist/chunk-6CBVZ6CT.js.map +1 -0
  109. package/dist/chunk-6XZXYNJR.js +74 -0
  110. package/dist/chunk-6XZXYNJR.js.map +1 -0
  111. package/dist/chunk-753HWDSC.js +222 -0
  112. package/dist/chunk-753HWDSC.js.map +1 -0
  113. package/dist/chunk-7AHSS7SO.js +81 -0
  114. package/dist/chunk-7AHSS7SO.js.map +1 -0
  115. package/dist/chunk-7FTJN4SA.js +1 -0
  116. package/dist/chunk-7FTJN4SA.js.map +1 -0
  117. package/dist/chunk-AVDMLTPF.js +24 -0
  118. package/dist/chunk-AVDMLTPF.js.map +1 -0
  119. package/dist/chunk-BKAHUEIT.js +95 -0
  120. package/dist/chunk-BKAHUEIT.js.map +1 -0
  121. package/dist/chunk-CJ7OFEF7.js +134 -0
  122. package/dist/chunk-CJ7OFEF7.js.map +1 -0
  123. package/dist/chunk-EJKWDZIU.js +111 -0
  124. package/dist/chunk-EJKWDZIU.js.map +1 -0
  125. package/dist/chunk-F2J6IQ6I.js +247 -0
  126. package/dist/chunk-F2J6IQ6I.js.map +1 -0
  127. package/dist/chunk-F3O7CELI.js +23 -0
  128. package/dist/chunk-F3O7CELI.js.map +1 -0
  129. package/dist/chunk-F4IITPGX.js +221 -0
  130. package/dist/chunk-F4IITPGX.js.map +1 -0
  131. package/dist/chunk-FD6VC2NA.js +66 -0
  132. package/dist/chunk-FD6VC2NA.js.map +1 -0
  133. package/dist/chunk-FRRRWAHO.js +14 -0
  134. package/dist/chunk-FRRRWAHO.js.map +1 -0
  135. package/dist/chunk-HCKAGLLB.js +17 -0
  136. package/dist/chunk-HCKAGLLB.js.map +1 -0
  137. package/dist/chunk-HVC7FG6B.js +191 -0
  138. package/dist/chunk-HVC7FG6B.js.map +1 -0
  139. package/dist/chunk-HXFVOR7Z.js +496 -0
  140. package/dist/chunk-HXFVOR7Z.js.map +1 -0
  141. package/dist/chunk-IJWYS2PF.js +122 -0
  142. package/dist/chunk-IJWYS2PF.js.map +1 -0
  143. package/dist/chunk-INCHXAFK.js +1395 -0
  144. package/dist/chunk-INCHXAFK.js.map +1 -0
  145. package/dist/chunk-JT6BRGQM.js +1 -0
  146. package/dist/chunk-JT6BRGQM.js.map +1 -0
  147. package/dist/chunk-L6PMAEMB.js +115 -0
  148. package/dist/chunk-L6PMAEMB.js.map +1 -0
  149. package/dist/chunk-LOUGW6MU.js +126 -0
  150. package/dist/chunk-LOUGW6MU.js.map +1 -0
  151. package/dist/chunk-LYPZPE53.js +129 -0
  152. package/dist/chunk-LYPZPE53.js.map +1 -0
  153. package/dist/chunk-NNCCN7JP.js +186 -0
  154. package/dist/chunk-NNCCN7JP.js.map +1 -0
  155. package/dist/chunk-PBC3MZUL.js +212 -0
  156. package/dist/chunk-PBC3MZUL.js.map +1 -0
  157. package/dist/chunk-R4ADP2DC.js +20 -0
  158. package/dist/chunk-R4ADP2DC.js.map +1 -0
  159. package/dist/chunk-RHN4Y6VS.js +44 -0
  160. package/dist/chunk-RHN4Y6VS.js.map +1 -0
  161. package/dist/chunk-SDJNYPYK.js +770 -0
  162. package/dist/chunk-SDJNYPYK.js.map +1 -0
  163. package/dist/chunk-UGNTCOVR.js +28 -0
  164. package/dist/chunk-UGNTCOVR.js.map +1 -0
  165. package/dist/chunk-VC2PCK2S.js +31 -0
  166. package/dist/chunk-VC2PCK2S.js.map +1 -0
  167. package/dist/chunk-VF5YDZJC.js +305 -0
  168. package/dist/chunk-VF5YDZJC.js.map +1 -0
  169. package/dist/chunk-VISRDVTK.js +675 -0
  170. package/dist/chunk-VISRDVTK.js.map +1 -0
  171. package/dist/chunk-W6O3LVBY.js +102 -0
  172. package/dist/chunk-W6O3LVBY.js.map +1 -0
  173. package/dist/chunk-WFEAKJLR.js +47 -0
  174. package/dist/chunk-WFEAKJLR.js.map +1 -0
  175. package/dist/chunk-XIEY2OF4.js +67 -0
  176. package/dist/chunk-XIEY2OF4.js.map +1 -0
  177. package/dist/chunk-XITLHDG3.js +37 -0
  178. package/dist/chunk-XITLHDG3.js.map +1 -0
  179. package/dist/chunk-XMWPYZWZ.js +61 -0
  180. package/dist/chunk-XMWPYZWZ.js.map +1 -0
  181. package/dist/chunk-XUP6CNOM.js +34 -0
  182. package/dist/chunk-XUP6CNOM.js.map +1 -0
  183. package/dist/chunk-YABTQZDJ.js +25 -0
  184. package/dist/chunk-YABTQZDJ.js.map +1 -0
  185. package/dist/chunk-YMHVRBUU.js +199 -0
  186. package/dist/chunk-YMHVRBUU.js.map +1 -0
  187. package/dist/chunk-YMJ7BRKU.js +510 -0
  188. package/dist/chunk-YMJ7BRKU.js.map +1 -0
  189. package/dist/chunk-ZC3XWU7B.js +28 -0
  190. package/dist/chunk-ZC3XWU7B.js.map +1 -0
  191. package/dist/chunk-ZHMTD5KV.js +90 -0
  192. package/dist/chunk-ZHMTD5KV.js.map +1 -0
  193. package/dist/chunk-ZWZDLOE7.js +160 -0
  194. package/dist/chunk-ZWZDLOE7.js.map +1 -0
  195. package/dist/db-package/db/local-first-sqlite-adapter.d.ts +432 -0
  196. package/dist/db-package/db/local-first-sqlite-adapter.js +7 -0
  197. package/dist/db-package/db/local-first-sqlite-adapter.js.map +1 -0
  198. package/dist/db-package/index.d.ts +7 -0
  199. package/dist/db-package/index.js +16 -0
  200. package/dist/db-package/index.js.map +1 -0
  201. package/dist/db-package/migration/aggregator.d.ts +86 -0
  202. package/dist/db-package/migration/aggregator.js +7 -0
  203. package/dist/db-package/migration/aggregator.js.map +1 -0
  204. package/dist/db-package/migration/index.d.ts +3 -0
  205. package/dist/db-package/migration/index.js +8 -0
  206. package/dist/db-package/migration/index.js.map +1 -0
  207. package/dist/engine.d.ts +205 -0
  208. package/dist/engine.js +20 -0
  209. package/dist/engine.js.map +1 -0
  210. package/dist/entitlements/index.d.ts +313 -0
  211. package/dist/entitlements/index.js +23 -0
  212. package/dist/entitlements/index.js.map +1 -0
  213. package/dist/execution/chat.d.ts +7 -0
  214. package/dist/execution/chat.js +7 -0
  215. package/dist/execution/chat.js.map +1 -0
  216. package/dist/execution/index.d.ts +342 -0
  217. package/dist/execution/index.js +66 -0
  218. package/dist/execution/index.js.map +1 -0
  219. package/dist/execution/tool-agent.d.ts +7 -0
  220. package/dist/execution/tool-agent.js +8 -0
  221. package/dist/execution/tool-agent.js.map +1 -0
  222. package/dist/extensions/index.d.ts +172 -0
  223. package/dist/extensions/index.js +95 -0
  224. package/dist/extensions/index.js.map +1 -0
  225. package/dist/health/index.d.ts +35 -0
  226. package/dist/health/index.js +7 -0
  227. package/dist/health/index.js.map +1 -0
  228. package/dist/index.d.ts +43 -0
  229. package/dist/index.js +161 -0
  230. package/dist/index.js.map +1 -0
  231. package/dist/lifecycle/index.d.ts +133 -0
  232. package/dist/lifecycle/index.js +13 -0
  233. package/dist/lifecycle/index.js.map +1 -0
  234. package/dist/lifecycle-engine/backend-migration.d.ts +2 -0
  235. package/dist/lifecycle-engine/backend-migration.js +11 -0
  236. package/dist/lifecycle-engine/backend-migration.js.map +1 -0
  237. package/dist/lifecycle-engine/baseline.d.ts +2 -0
  238. package/dist/lifecycle-engine/baseline.js +9 -0
  239. package/dist/lifecycle-engine/baseline.js.map +1 -0
  240. package/dist/lifecycle-engine/index.d.ts +1497 -0
  241. package/dist/lifecycle-engine/index.js +41 -0
  242. package/dist/lifecycle-engine/index.js.map +1 -0
  243. package/dist/lifecycle-engine/platform/artifacts.d.ts +4 -0
  244. package/dist/lifecycle-engine/platform/artifacts.js +7 -0
  245. package/dist/lifecycle-engine/platform/artifacts.js.map +1 -0
  246. package/dist/lifecycle-engine/platform/control-plane.d.ts +12 -0
  247. package/dist/lifecycle-engine/platform/control-plane.js +2 -0
  248. package/dist/lifecycle-engine/platform/control-plane.js.map +1 -0
  249. package/dist/lifecycle-engine/platform/database-router.d.ts +118 -0
  250. package/dist/lifecycle-engine/platform/database-router.js +7 -0
  251. package/dist/lifecycle-engine/platform/database-router.js.map +1 -0
  252. package/dist/lifecycle-engine/platform/deployment-placements.d.ts +464 -0
  253. package/dist/lifecycle-engine/platform/deployment-placements.js +16 -0
  254. package/dist/lifecycle-engine/platform/deployment-placements.js.map +1 -0
  255. package/dist/lifecycle-engine/platform/deployment.d.ts +4 -0
  256. package/dist/lifecycle-engine/platform/deployment.js +17 -0
  257. package/dist/lifecycle-engine/platform/deployment.js.map +1 -0
  258. package/dist/lifecycle-engine/platform/index.d.ts +737 -0
  259. package/dist/lifecycle-engine/platform/index.js +60 -0
  260. package/dist/lifecycle-engine/platform/index.js.map +1 -0
  261. package/dist/lifecycle-engine/platform/runtime.d.ts +80 -0
  262. package/dist/lifecycle-engine/platform/runtime.js +11 -0
  263. package/dist/lifecycle-engine/platform/runtime.js.map +1 -0
  264. package/dist/lifecycle-engine/platform/site-publication.d.ts +102 -0
  265. package/dist/lifecycle-engine/platform/site-publication.js +7 -0
  266. package/dist/lifecycle-engine/platform/site-publication.js.map +1 -0
  267. package/dist/lifecycle-engine/platform/user-directory.d.ts +139 -0
  268. package/dist/lifecycle-engine/platform/user-directory.js +13 -0
  269. package/dist/lifecycle-engine/platform/user-directory.js.map +1 -0
  270. package/dist/mcp.d.ts +92 -0
  271. package/dist/mcp.js +10 -0
  272. package/dist/mcp.js.map +1 -0
  273. package/dist/middleware/auth.d.ts +118 -0
  274. package/dist/middleware/auth.js +7 -0
  275. package/dist/middleware/auth.js.map +1 -0
  276. package/dist/middleware/error-handler.d.ts +35 -0
  277. package/dist/middleware/error-handler.js +7 -0
  278. package/dist/middleware/error-handler.js.map +1 -0
  279. package/dist/middleware/module-guard.d.ts +33 -0
  280. package/dist/middleware/module-guard.js +7 -0
  281. package/dist/middleware/module-guard.js.map +1 -0
  282. package/dist/platform-admin/index.d.ts +37 -0
  283. package/dist/platform-admin/index.js +11 -0
  284. package/dist/platform-admin/index.js.map +1 -0
  285. package/dist/platform-admin/store.d.ts +346 -0
  286. package/dist/platform-admin/store.js +7 -0
  287. package/dist/platform-admin/store.js.map +1 -0
  288. package/dist/plugin-data/annotations.d.ts +6 -0
  289. package/dist/plugin-data/annotations.js +12 -0
  290. package/dist/plugin-data/annotations.js.map +1 -0
  291. package/dist/plugin-data/atomic-context.d.ts +41 -0
  292. package/dist/plugin-data/atomic-context.js +9 -0
  293. package/dist/plugin-data/atomic-context.js.map +1 -0
  294. package/dist/plugin-data/atomic.d.ts +6 -0
  295. package/dist/plugin-data/atomic.js +26 -0
  296. package/dist/plugin-data/atomic.js.map +1 -0
  297. package/dist/plugin-data/audit.d.ts +6 -0
  298. package/dist/plugin-data/audit.js +12 -0
  299. package/dist/plugin-data/audit.js.map +1 -0
  300. package/dist/plugin-data/commands.d.ts +6 -0
  301. package/dist/plugin-data/commands.js +8 -0
  302. package/dist/plugin-data/commands.js.map +1 -0
  303. package/dist/plugin-data/composite.d.ts +6 -0
  304. package/dist/plugin-data/composite.js +8 -0
  305. package/dist/plugin-data/composite.js.map +1 -0
  306. package/dist/plugin-data/delivery.d.ts +6 -0
  307. package/dist/plugin-data/delivery.js +16 -0
  308. package/dist/plugin-data/delivery.js.map +1 -0
  309. package/dist/plugin-data/index.d.ts +2798 -0
  310. package/dist/plugin-data/index.js +102 -0
  311. package/dist/plugin-data/index.js.map +1 -0
  312. package/dist/plugin-data/json-documents.d.ts +6 -0
  313. package/dist/plugin-data/json-documents.js +16 -0
  314. package/dist/plugin-data/json-documents.js.map +1 -0
  315. package/dist/plugin-data/outbox.d.ts +6 -0
  316. package/dist/plugin-data/outbox.js +16 -0
  317. package/dist/plugin-data/outbox.js.map +1 -0
  318. package/dist/plugin-data/scoped-records.d.ts +6 -0
  319. package/dist/plugin-data/scoped-records.js +10 -0
  320. package/dist/plugin-data/scoped-records.js.map +1 -0
  321. package/dist/plugin-sdk.d.ts +41 -0
  322. package/dist/plugin-sdk.js +10 -0
  323. package/dist/plugin-sdk.js.map +1 -0
  324. package/dist/sql-lifecycle/index.d.ts +138 -0
  325. package/dist/sql-lifecycle/index.js +167 -0
  326. package/dist/sql-lifecycle/index.js.map +1 -0
  327. package/dist/storage/index.d.ts +2 -0
  328. package/dist/storage/index.js +13 -0
  329. package/dist/storage/index.js.map +1 -0
  330. package/dist/storage/s3-compatible.d.ts +139 -0
  331. package/dist/storage/s3-compatible.js +11 -0
  332. package/dist/storage/s3-compatible.js.map +1 -0
  333. package/dist/tenant.d.ts +108 -0
  334. package/dist/tenant.js +9 -0
  335. package/dist/tenant.js.map +1 -0
  336. package/dist/workspace-context.d.ts +119 -0
  337. package/dist/workspace-context.js +9 -0
  338. package/dist/workspace-context.js.map +1 -0
  339. package/docs/api.md +30560 -0
  340. package/docs/db/README.md +49 -0
  341. package/docs/db/docs/api.md +1613 -0
  342. package/docs/db/docs/guide.md +47 -0
  343. package/docs/entitlements.md +60 -0
  344. package/docs/guide.md +92 -0
  345. package/docs/index.md +57 -0
  346. package/docs/ja/db/README.md +46 -0
  347. package/docs/ja/db/docs/guide.md +53 -0
  348. package/docs/ja/guide.md +46 -0
  349. package/docs/ja/lifecycle/README.md +46 -0
  350. package/docs/ja/lifecycle/docs/guide.md +45 -0
  351. package/docs/ja/storage/README.md +46 -0
  352. package/docs/ja/storage/docs/guide.md +43 -0
  353. package/docs/lifecycle/README.md +49 -0
  354. package/docs/lifecycle/docs/api.md +3770 -0
  355. package/docs/lifecycle/docs/baseline.md +50 -0
  356. package/docs/lifecycle/docs/guide.md +47 -0
  357. package/docs/storage/README.md +49 -0
  358. package/docs/storage/docs/api.md +470 -0
  359. package/docs/storage/docs/guide.md +47 -0
  360. package/package.json +354 -4
@@ -0,0 +1,614 @@
1
+ import { PluginManifest } from '@alneas/eaos-core/plugin-sdk';
2
+ import { LifecyclePlugin } from './lifecycle-engine/index.js';
3
+
4
+ /**
5
+ * Supported deployment capability categories used to validate component declarations.
6
+ *
7
+ * @see summarizeDeployment for canonical integration usage.
8
+ */
9
+ declare const deploymentComponentKinds: readonly ["frontend", "api", "mcp", "service", "function", "worker", "job", "webhook", "workflow", "database", "infrastructure", "storage", "cache", "queue", "search", "integration", "native", "model", "data-import"];
10
+ /**
11
+ * Supported declarative work phases; inspection never executes these actions.
12
+ *
13
+ * @see summarizeDeployment for canonical integration usage.
14
+ */
15
+ declare const deploymentActions: readonly ["build", "test", "preview", "provision", "configure", "migrate", "deploy", "verify", "import", "enable"];
16
+ /**
17
+ * One declared deployable capability with explicit placement and nonsecret host requirements.
18
+ *
19
+ * @see summarizeDeployment for canonical integration usage.
20
+ */
21
+ interface DeploymentComponent {
22
+ /**
23
+ * Unique component ID within the plugin.
24
+ */
25
+ id: string;
26
+ /**
27
+ * False marks an optional capability; omitted means required.
28
+ *
29
+ * Optional provider/native capabilities remain visible without requiring every deployment to adopt them.
30
+ */
31
+ required?: boolean;
32
+ /**
33
+ * Supported frontend/server/storage/compute capability category.
34
+ */
35
+ kind: typeof deploymentComponentKinds[number];
36
+ /**
37
+ * Declared host/container/function/database/cloud/native/external placement.
38
+ */
39
+ placement: 'host' | 'container' | 'function' | 'database' | 'cloud' | 'native' | 'external';
40
+ /**
41
+ * Optional runtime descriptor.
42
+ */
43
+ runtime?: string;
44
+ /**
45
+ * Exact checksummed inventory asset references.
46
+ *
47
+ * References to files in the checksummed inventory, not arbitrary source paths.
48
+ */
49
+ assets?: string[];
50
+ /**
51
+ * Author-side asset selectors resolved by packing; unresolved patterns prevent completion.
52
+ *
53
+ * Author-side selectors resolved to exact assets by the packer; emitted inventories omit these.
54
+ */
55
+ assetPatterns?: string[];
56
+ /**
57
+ * Optional entry asset path.
58
+ */
59
+ entry?: string;
60
+ /**
61
+ * Canonical schema contract IDs and semver ranges, never copied DDL.
62
+ *
63
+ * Canonical contract IDs/ranges; no copied DDL.
64
+ */
65
+ dataContracts?: Record<string, string>;
66
+ /**
67
+ * Optional required tool ranges and host binding/adapter names.
68
+ */
69
+ requirements?: {
70
+ /**
71
+ * Tool-name to required-version/range map declared by the plugin.
72
+ */
73
+ tools?: Record<string, string>;
74
+ /**
75
+ * Required nonsecret host binding names; never credential values.
76
+ */
77
+ bindings?: string[];
78
+ /**
79
+ * Required host adapter capability names.
80
+ */
81
+ adapters?: string[];
82
+ };
83
+ }
84
+ /**
85
+ * Declarative host-approved work and dependency ordering for deployment evidence.
86
+ *
87
+ * @see summarizeDeployment for canonical integration usage.
88
+ */
89
+ interface DeploymentTask {
90
+ /**
91
+ * Unique task ID within the plugin.
92
+ */
93
+ id: string;
94
+ /**
95
+ * Existing components whose work this task covers.
96
+ */
97
+ componentIds: string[];
98
+ /**
99
+ * Supported build/test/provision/deploy/etc. phase.
100
+ */
101
+ action: typeof deploymentActions[number];
102
+ /**
103
+ * Artifact work is reusable; environment and tenant work require corresponding target evidence.
104
+ */
105
+ scope: 'artifact' | 'environment' | 'tenant';
106
+ /**
107
+ * Whether successful task evidence is required for completion.
108
+ */
109
+ required: boolean;
110
+ /**
111
+ * Existing task IDs that must succeed before this task is considered unblocked.
112
+ */
113
+ dependsOn: string[];
114
+ /**
115
+ * Host-approved executor reference; inspection never launches it.
116
+ *
117
+ * Host-approved executor reference. Inspection never executes it or argv.
118
+ */
119
+ executor: string;
120
+ /**
121
+ * Optional declarative arguments; never automatically executed by inspection.
122
+ */
123
+ argv?: string[];
124
+ /**
125
+ * Optional human operator instructions.
126
+ */
127
+ instructions?: string;
128
+ }
129
+ /**
130
+ * Classified deployment component/task graph for one lifecycle feature.
131
+ *
132
+ * @see summarizeDeployment for canonical integration usage.
133
+ */
134
+ interface DeploymentPlugin {
135
+ /**
136
+ * Plugin ID covered by the inventory lifecycle bundle.
137
+ */
138
+ id: string;
139
+ /**
140
+ * Unique deployable capability definitions.
141
+ */
142
+ components: DeploymentComponent[];
143
+ /**
144
+ * Unique work definitions forming an acyclic dependency graph.
145
+ */
146
+ tasks: DeploymentTask[];
147
+ }
148
+ /**
149
+ * Nonsecret exact environment, physical placement and optional tenant context for scoped evidence.
150
+ *
151
+ * @see summarizeDeployment for canonical integration usage.
152
+ */
153
+ interface DeploymentTarget {
154
+ /**
155
+ * Nonblank deployment environment label.
156
+ */
157
+ environment: string;
158
+ /**
159
+ * Optional exact lifecycle backend ID; required for database work evidence.
160
+ */
161
+ backendId?: string;
162
+ /**
163
+ * Optional physical database identity; required with backendId for database evidence.
164
+ */
165
+ databaseId?: string;
166
+ /**
167
+ * Optional concrete tenant; required for tenant tasks and absent for environment tasks.
168
+ */
169
+ tenantId?: string;
170
+ }
171
+ /**
172
+ * Reported execution evidence bound to a task, inventory and optional destination revision.
173
+ *
174
+ * @see summarizeDeployment for canonical integration usage.
175
+ */
176
+ interface DeploymentResult {
177
+ /**
178
+ * Declared inventory plugin ID.
179
+ */
180
+ pluginId: string;
181
+ /**
182
+ * Declared plugin task ID.
183
+ */
184
+ taskId: string;
185
+ /**
186
+ * Exact environment/tenant target; absent for artifact work.
187
+ */
188
+ target?: DeploymentTarget;
189
+ /**
190
+ * Reported running/succeeded/failed result; no independent execution proof is implied.
191
+ */
192
+ status: 'running' | 'succeeded' | 'failed';
193
+ /**
194
+ * Exact UTC ISO timestamp including millisecond precision; increases per task/target/placement.
195
+ */
196
+ recordedAt: string;
197
+ /**
198
+ * Nonblank host/operator identity reporting the result.
199
+ */
200
+ actor: string;
201
+ /**
202
+ * Nonempty distinct nonsecret evidence references, such as reviewed logs or CI receipts.
203
+ *
204
+ * Non-secret evidence references, such as a reviewed log, CI run or lifecycle plan receipt.
205
+ */
206
+ evidence: string[];
207
+ /**
208
+ * Optional explicit destination identity paired with placementSha256; forbidden for artifact results.
209
+ *
210
+ * Environment/tenant evidence bound to a reviewed component placement. Artifact results remain reusable.
211
+ */
212
+ destinationId?: string;
213
+ /**
214
+ * Hash of reviewed placement/binding revisions paired with destinationId.
215
+ */
216
+ placementSha256?: string;
217
+ }
218
+ /**
219
+ * Operator/host-owned reported evidence journal pinned to one inventory digest.
220
+ *
221
+ *
222
+ * Host/operator-owned journal. This is reported evidence, never runtime admission authority.
223
+ * @see summarizeDeployment for canonical integration usage.
224
+ */
225
+ interface DeploymentReceipt {
226
+ /**
227
+ * Receipt discriminator; currently 1.
228
+ */
229
+ apiVersion: 1;
230
+ /**
231
+ * Exact inventory owner to which these results belong.
232
+ */
233
+ owner: string;
234
+ /**
235
+ * Lowercase 64-character SHA-256 of the trusted inventory bytes.
236
+ */
237
+ inventorySha256: string;
238
+ /**
239
+ * Reported task outcomes in increasing per-task/target/placement timestamp order.
240
+ */
241
+ results: DeploymentResult[];
242
+ }
243
+ /**
244
+ * Derived task readiness: pending, dependency-blocked, stale evidence, running, succeeded or failed.
245
+ *
246
+ * @see summarizeDeployment for canonical integration usage.
247
+ */
248
+ type DeploymentTaskStatus = 'pending' | 'blocked' | 'stale' | 'running' | 'succeeded' | 'failed';
249
+ /**
250
+ * Validates declared plugin component references and task dependencies before artifact inspection.
251
+ *
252
+ * Validate references and the dependency DAG before artifact registration or status inspection.
253
+ * @param inventory - Deployment inventory with checksummed asset metadata and optional per-plugin work declarations.
254
+ * @returns The original plugin array, or undefined for legacy inventories without plugin declarations.
255
+ * @throws Error for invalid/duplicate declarations, unsupported component/action/scope, unknown references, cycles or missing required work.
256
+ *
257
+ * @remarks
258
+ * Requires explicit lifecycle-bundle coverage, known assets/components, acyclic dependencies and work for adopted components. This validates declarations without executing tasks or proving artifact file checksums.
259
+ *
260
+ * @example
261
+ * ```typescript
262
+ * import { validateDeploymentPlugins, type DeploymentInventory } from '@alneas/eaos-server/platform';
263
+ * export function inspectDeclaration(inventory: DeploymentInventory) { return validateDeploymentPlugins(inventory); }
264
+ * ```
265
+ */
266
+ declare function validateDeploymentPlugins(inventory: DeploymentInventory): DeploymentPlugin[] | undefined;
267
+ /**
268
+ * Validates the exact nonsecret environment/backend/database/tenant target shape.
269
+ * @param value - Untrusted target object with a nonblank environment and optional nonblank identity references.
270
+ * @returns Completes without a value and narrows the input to DeploymentTarget.
271
+ * @throws Error for missing/blank identity fields or unknown target properties.
272
+ *
273
+ * @remarks
274
+ * Does not resolve backend existence, tenant membership or deployment authority.
275
+ *
276
+ * @example
277
+ * ```typescript
278
+ * import { validateDeploymentTarget } from '@alneas/eaos-server/platform/deployment';
279
+ * const target: unknown = { environment: 'review' };
280
+ * validateDeploymentTarget(target);
281
+ * ```
282
+ */
283
+ declare function validateDeploymentTarget(value: unknown): asserts value is DeploymentTarget;
284
+ /**
285
+ * Validates version-1 reported task evidence and strictly increasing timestamps per task/target/placement.
286
+ * @param value - Untrusted receipt with owner, pinned inventory SHA-256 and task result records.
287
+ * @returns Completes without a value and narrows the input to DeploymentReceipt.
288
+ * @throws Error for malformed/extra fields, invalid hashes/timestamps, missing evidence or nonincreasing repeated-result timestamps.
289
+ *
290
+ * @remarks
291
+ * Each result needs a UTC millisecond ISO timestamp, actor and nonempty distinct evidence references. destinationId and placementSha256 must occur together. This validates shape/order only; it does not independently verify evidence or grant runtime admission.
292
+ *
293
+ * @example
294
+ * ```typescript
295
+ * import { validateDeploymentReceipt } from '@alneas/eaos-server/platform/deployment';
296
+ * const receipt: unknown = { apiVersion: 1, owner: 'reports', inventorySha256: 'a'.repeat(64), results: [] };
297
+ * validateDeploymentReceipt(receipt);
298
+ * ```
299
+ */
300
+ declare function validateDeploymentReceipt(value: unknown): asserts value is DeploymentReceipt;
301
+ /**
302
+ * Aggregates host/operator task evidence into dependency-aware plugin and component completion states.
303
+ *
304
+ * Aggregate operator/host evidence only. A build receipt cannot complete DB/infra/deployment tasks.
305
+ * @param inventory - Validated artifact declaration; missing plugins remains legacy-unclassified.
306
+ * @param inventorySha256 - Trusted lowercase 64-character inventory digest.
307
+ * @param receipts - Reported receipts; defaults to none.
308
+ * @param target - Optional current environment/backend/database/tenant context for scoped work.
309
+ * @returns A read-only summary with coverage, artifact resolution, task states and ignored owner/stale-inventory/placement receipts.
310
+ * @throws Error for invalid declarations/receipts/hash/target, undeclared tasks, scope mismatch or conflicting equal-time evidence.
311
+ *
312
+ * @remarks
313
+ * No task executes. Artifact work is reusable; environment/tenant evidence must match scope and database work needs explicit backend/database identities. Newer dependency evidence makes older success stale. Completion is host-reported evidence, never admission authority.
314
+ *
315
+ * @example
316
+ * ```typescript
317
+ * import { summarizeDeployment, type DeploymentInventory, type DeploymentReceipt, type DeploymentTarget } from '@alneas/eaos-server/platform';
318
+ * export function inspect(inventory: DeploymentInventory, digest: string, receipts: DeploymentReceipt[], target?: DeploymentTarget) { return summarizeDeployment(inventory, digest, receipts, target); }
319
+ * ```
320
+ */
321
+ declare function summarizeDeployment(inventory: DeploymentInventory, inventorySha256: string, receipts?: DeploymentReceipt[], target?: DeploymentTarget): {
322
+ owner: string;
323
+ inventorySha256: string;
324
+ target: DeploymentTarget | undefined;
325
+ coverage: "declared" | "legacy-unclassified";
326
+ artifactResolved: boolean;
327
+ complete: boolean;
328
+ plugins: {
329
+ id: string;
330
+ artifactResolved: boolean;
331
+ complete: boolean;
332
+ components: {
333
+ complete: boolean;
334
+ /**
335
+ * Unique component ID within the plugin.
336
+ */
337
+ id: string;
338
+ /**
339
+ * False marks an optional capability; omitted means required.
340
+ *
341
+ * Optional provider/native capabilities remain visible without requiring every deployment to adopt them.
342
+ */
343
+ required?: boolean;
344
+ /**
345
+ * Supported frontend/server/storage/compute capability category.
346
+ */
347
+ kind: (typeof deploymentComponentKinds)[number];
348
+ /**
349
+ * Declared host/container/function/database/cloud/native/external placement.
350
+ */
351
+ placement: "host" | "container" | "function" | "database" | "cloud" | "native" | "external";
352
+ /**
353
+ * Optional runtime descriptor.
354
+ */
355
+ runtime?: string;
356
+ /**
357
+ * Exact checksummed inventory asset references.
358
+ *
359
+ * References to files in the checksummed inventory, not arbitrary source paths.
360
+ */
361
+ assets?: string[];
362
+ /**
363
+ * Author-side asset selectors resolved by packing; unresolved patterns prevent completion.
364
+ *
365
+ * Author-side selectors resolved to exact assets by the packer; emitted inventories omit these.
366
+ */
367
+ assetPatterns?: string[];
368
+ /**
369
+ * Optional entry asset path.
370
+ */
371
+ entry?: string;
372
+ /**
373
+ * Canonical schema contract IDs and semver ranges, never copied DDL.
374
+ *
375
+ * Canonical contract IDs/ranges; no copied DDL.
376
+ */
377
+ dataContracts?: Record<string, string>;
378
+ /**
379
+ * Optional required tool ranges and host binding/adapter names.
380
+ */
381
+ requirements?: {
382
+ /**
383
+ * Tool-name to required-version/range map declared by the plugin.
384
+ */
385
+ tools?: Record<string, string>;
386
+ /**
387
+ * Required nonsecret host binding names; never credential values.
388
+ */
389
+ bindings?: string[];
390
+ /**
391
+ * Required host adapter capability names.
392
+ */
393
+ adapters?: string[];
394
+ };
395
+ }[];
396
+ tasks: {
397
+ status: DeploymentTaskStatus;
398
+ result?: DeploymentResult;
399
+ /**
400
+ * Unique task ID within the plugin.
401
+ */
402
+ id: string;
403
+ /**
404
+ * Existing components whose work this task covers.
405
+ */
406
+ componentIds: string[];
407
+ /**
408
+ * Supported build/test/provision/deploy/etc. phase.
409
+ */
410
+ action: (typeof deploymentActions)[number];
411
+ /**
412
+ * Artifact work is reusable; environment and tenant work require corresponding target evidence.
413
+ */
414
+ scope: "artifact" | "environment" | "tenant";
415
+ /**
416
+ * Whether successful task evidence is required for completion.
417
+ */
418
+ required: boolean;
419
+ /**
420
+ * Existing task IDs that must succeed before this task is considered unblocked.
421
+ */
422
+ dependsOn: string[];
423
+ /**
424
+ * Host-approved executor reference; inspection never launches it.
425
+ *
426
+ * Host-approved executor reference. Inspection never executes it or argv.
427
+ */
428
+ executor: string;
429
+ /**
430
+ * Optional declarative arguments; never automatically executed by inspection.
431
+ */
432
+ argv?: string[];
433
+ /**
434
+ * Optional human operator instructions.
435
+ */
436
+ instructions?: string;
437
+ }[];
438
+ }[];
439
+ ignoredReceipts: {
440
+ owner: string;
441
+ reason: string;
442
+ }[];
443
+ evidencePolicy: string;
444
+ };
445
+
446
+ /**
447
+ * Trusted code contributions restricted to explicit tenant IDs; registration never activates a plugin.
448
+ *
449
+ *
450
+ * Trusted package contributions; code registration does not grant tenant activation.
451
+ * @see PluginLifecycle for canonical integration usage.
452
+ */
453
+ interface PlatformContribution {
454
+ /**
455
+ * Contribution contract discriminator; currently 1.
456
+ */
457
+ apiVersion: 1;
458
+ /**
459
+ * Contribution/package identity.
460
+ */
461
+ id: string;
462
+ /**
463
+ * Concrete admitted tenant catalog; never wildcard authorization.
464
+ */
465
+ tenantIds: string[];
466
+ /**
467
+ * Optional public plugin manifests contributed by the trusted package.
468
+ */
469
+ manifests?: PluginManifest[];
470
+ /**
471
+ * Optional trusted lifecycle release definitions.
472
+ */
473
+ lifecycle?: LifecyclePlugin[];
474
+ /**
475
+ * Optional plugin ID to allowed route-prefix contributions.
476
+ */
477
+ routePrefixes?: Record<string, string[]>;
478
+ }
479
+ /**
480
+ * Checksummed artifact metadata and explicit per-plugin deployment work, separate from runtime admission.
481
+ *
482
+ * @see PluginLifecycle for canonical integration usage.
483
+ */
484
+ interface DeploymentInventory {
485
+ /**
486
+ * Inventory discriminator; currently 1.
487
+ */
488
+ apiVersion: 1;
489
+ /**
490
+ * Stable package/contribution owner used to bind receipts.
491
+ */
492
+ owner: string;
493
+ /**
494
+ * Optional package release version.
495
+ */
496
+ version?: string;
497
+ /**
498
+ * Optional declared execution runtime descriptor.
499
+ */
500
+ runtime?: string;
501
+ /**
502
+ * Optional ordered lifecycle plugin IDs; required for classified plugin work.
503
+ */
504
+ lifecycleBundle?: string[];
505
+ /**
506
+ * Tenant-scoped function source declarations and required tenant bindings.
507
+ */
508
+ functions: Array<{
509
+ /**
510
+ * Unique tenant-scoped function identity.
511
+ */
512
+ id: string;
513
+ /**
514
+ * Project-relative packaged function/database source path.
515
+ */
516
+ source: string;
517
+ /**
518
+ * Function scope discriminator; must be tenant.
519
+ */
520
+ scope: 'tenant';
521
+ /**
522
+ * Explicit binding names that the host must resolve separately for each tenant.
523
+ */
524
+ requiredTenantBindings: string[];
525
+ }>;
526
+ /**
527
+ * Optional adopted existing-history database declaration; never an instruction to recreate history.
528
+ */
529
+ database?: {
530
+ /**
531
+ * Project-relative packaged function/database source path.
532
+ */
533
+ source: string;
534
+ /**
535
+ * Database history policy; adopt-existing-history never recreates historical migrations.
536
+ */
537
+ mode: 'adopt-existing-history';
538
+ /**
539
+ * Canonical tenant isolation column; currently tenant_id.
540
+ */
541
+ tenantColumn: 'tenant_id';
542
+ };
543
+ /**
544
+ * Exact project-relative packaged asset paths and SHA-256 digests.
545
+ */
546
+ assets: Array<{
547
+ /**
548
+ * Exact project-relative packaged asset path.
549
+ */
550
+ path: string;
551
+ /**
552
+ * Lowercase SHA-256 digest of the asset bytes.
553
+ */
554
+ sha256: string;
555
+ }>;
556
+ /**
557
+ * Optional classified component/task declarations; absence is legacy-unclassified.
558
+ *
559
+ * Explicit per-plugin composition and required work. Omission is legacy/unclassified.
560
+ */
561
+ plugins?: DeploymentPlugin[];
562
+ }
563
+ /**
564
+ * Trusted project-relative artifact/module registration with explicit tenant/plugin scopes.
565
+ *
566
+ *
567
+ * Paths are project-relative. Settings are non-secret; use host-resolved references for credentials.
568
+ * @see PluginLifecycle for canonical integration usage.
569
+ */
570
+ interface PlatformPackage {
571
+ /**
572
+ * Unique nonblank registration ID.
573
+ */
574
+ id: string;
575
+ /**
576
+ * Project-relative inventory path without absolute/traversal/backslash segments.
577
+ */
578
+ inventory: string;
579
+ /**
580
+ * Project-relative entry module path without traversal.
581
+ */
582
+ module: string;
583
+ /**
584
+ * Nonempty concrete trimmed tenant IDs; wildcard is forbidden.
585
+ */
586
+ tenantIds: string[];
587
+ /**
588
+ * Nonempty unique plugin IDs contributed by this package.
589
+ */
590
+ pluginIds: string[];
591
+ /**
592
+ * Optional nonsecret host configuration object; resolve credentials by host references.
593
+ */
594
+ settings?: Record<string, unknown>;
595
+ }
596
+ /**
597
+ * Validates explicit checksummed package registrations and concrete tenant/plugin scope metadata.
598
+ * @param value - Untrusted package registration array, or undefined for no packages.
599
+ * @returns The original accepted array, or a new empty array for undefined.
600
+ * @throws Error for nonarray input, unknown fields, duplicate package IDs, invalid paths, empty/duplicate plugin IDs or invalid tenant scopes.
601
+ *
602
+ * @remarks
603
+ * Checks project-relative nontraversing inventory/module paths and nonsecret settings shape. It does not load files, verify checksums, resolve membership or activate plugins.
604
+ *
605
+ * @example
606
+ * ```typescript
607
+ * import { validatePlatformPackages } from '@alneas/eaos-server/platform/artifacts';
608
+ * const packages = validatePlatformPackages([{ id: 'reports', inventory: '.eaos/packages/reports/deployment.json', module: '.eaos/packages/reports/index.js', tenantIds: ['sample'], pluginIds: ['reports'] }]);
609
+ * ```
610
+ */
611
+ declare function validatePlatformPackages(value: unknown): PlatformPackage[];
612
+
613
+ export { deploymentComponentKinds as f, deploymentActions as g, validateDeploymentReceipt as k, validateDeploymentTarget as l, validatePlatformPackages as m, summarizeDeployment as s, validateDeploymentPlugins as v };
614
+ export type { DeploymentComponent as D, PlatformPackage as P, DeploymentTaskStatus as a, DeploymentTarget as b, DeploymentResult as c, DeploymentInventory as d, DeploymentReceipt as e, DeploymentPlugin as h, DeploymentTask as i, PlatformContribution as j };
@@ -0,0 +1,75 @@
1
+ import { ApiKeyRecord, PlatformPrincipal } from '@alneas/eaos-core';
2
+
3
+ /**
4
+ * Host persistence lookup for {@link resolveApiKey}; records must retain hashed credentials and lifecycle state.
5
+ */
6
+ interface ApiKeyLookup {
7
+ /**
8
+ * Reads a key record by its 12-character public prefix.
9
+ * @param prefix - Prefix extracted from an eaos_ credential; never the full secret.
10
+ * @returns The stored record, or null if absent.
11
+ * @throws Persistence errors propagate to resolveApiKey callers.
12
+
13
+ * @example
14
+ * ```typescript
15
+ * import type { ApiKeyLookup } from "@alneas/eaos-server/auth-hooks";
16
+ * export async function findStoredApiKey(lookup: ApiKeyLookup, parsedPrefix: string) {
17
+ * const record = await lookup.findByPrefix(parsedPrefix);
18
+ * return record; // A record match still requires secret, scope and lifecycle verification.
19
+ * }
20
+ * ```
21
+ */
22
+ findByPrefix(prefix: string): Promise<ApiKeyRecord | null>;
23
+ }
24
+ /**
25
+ * Verifies a stored API key and resolves its trusted user, tenant, and copied scopes.
26
+ * @param headers - Raw authorization and apiKey header values; a Bearer credential takes precedence, and credentials must begin with eaos_.
27
+ * @param lookup - Host record lookup by public prefix; see {@link ApiKeyLookup}.
28
+ * @param options - requiredScope is checked by core verification; now overrides the verification clock; authorize runs only after cryptographic and scope checks and must return exactly true.
29
+ * @returns A principal with apiKeyId and empty roles, or null for malformed, missing, invalid, expired, insufficiently scoped, or host-denied credentials.
30
+ * @throws Rejects on lookup or authorize failure; these are not converted to null.
31
+ * @remarks Membership and tenant lifecycle checks belong in authorize. No key usage or persistence update occurs here.
32
+ * @example
33
+ * ```typescript
34
+ * import { resolveApiKey, type ApiKeyLookup } from "@alneas/eaos-server/auth-hooks/api-key";
35
+ * import type { ApiKeyRecord } from "@alneas/eaos-core";
36
+ * export async function authenticate(
37
+ * authorization: string | null,
38
+ * lookup: ApiKeyLookup,
39
+ * authorize: (record: ApiKeyRecord) => Promise<boolean>,
40
+ * ) {
41
+ * return resolveApiKey({ authorization }, lookup, { requiredScope: "records:read", authorize });
42
+ * }
43
+ * ```
44
+ */
45
+ declare function resolveApiKey(headers: {
46
+ /**
47
+ * Optional raw Authorization header; a parsed Bearer credential takes precedence over the dedicated apiKey value.
48
+ */
49
+ authorization?: string | null;
50
+ /**
51
+ * Optional dedicated API-key header used only when no Bearer credential is parsed; surrounding whitespace is trimmed.
52
+ */
53
+ apiKey?: string | null;
54
+ }, lookup: ApiKeyLookup, options?: {
55
+ /**
56
+ * Optional exact key scope checked by core cryptographic/lifecycle verification.
57
+ */
58
+ requiredScope?: string;
59
+ /**
60
+ * Optional verification clock override; omission uses the core verifier clock.
61
+ */
62
+ now?: Date;
63
+ /**
64
+ * Optional live membership/lifecycle callback after key verification; receives the stored record and must return exactly true to allow, while errors reject resolution.
65
+ */
66
+ authorize?: (record: ApiKeyRecord) => Promise<boolean> | boolean;
67
+ }): Promise<(PlatformPrincipal & {
68
+ /**
69
+ * Stored key record ID attached to the resolved principal for audit/correlation, never the credential secret.
70
+ */
71
+ apiKeyId: string;
72
+ }) | null>;
73
+
74
+ export { resolveApiKey };
75
+ export type { ApiKeyLookup };
@@ -0,0 +1,7 @@
1
+ import {
2
+ resolveApiKey
3
+ } from "../chunk-ZC3XWU7B.js";
4
+ export {
5
+ resolveApiKey
6
+ };
7
+ //# sourceMappingURL=api-key.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}