@od-oneapp/ai-platform 0.1.0

package/dist/governance.mjs

@@ -0,0 +1,432 @@
+import { t as __exportAll } from "./chunk-CkzbjWQW.mjs";
+import "./schemas-CxQtxIga.mjs";
+import { a as TOKEN_LIMITS, c as detectRiskFromMessages, i as resolveLoopPolicy, l as getTokenLimitForRisk, n as defaultTelemetry, o as applyDefaultGuardrails, r as mergeActiveTools, s as detectPromptInjection, t as createTelemetrySettings } from "./telemetry-2eKMojIb.mjs";
+import { C as isVersionCompatible, D as updateVersionedConfig, E as satisfiesRange, O as validateConfigIntegrity, S as getCurrentVersion, T as parseVersion, _ as createVersionRegistry, a as logToolCall, b as getCurrentPolicyVersion, c as AuditActionSchema, d as validateAuditEntry, f as validateQueryFilter, g as compareVersions, h as SCHEMA_VERSION, i as logRedaction, l as AuditEntrySchema, m as POLICY_VERSION, n as getAuditLogger, o as setAuditLogger, p as PLATFORM_VERSION, r as logGeneration, s as ABACDecisionSchema, t as createAuditLogger, u as AuditQueryFilterSchema, v as createVersionedConfig, w as migrateVersionedConfig, x as getCurrentSchemaVersion, y as defaultRegistry } from "./audit-logger-CHIP8bRO.mjs";
+import { C as unregisterPolicy, S as registerPolicy, _ as getPolicies, a as analyzePHI, b as hasRole, c as isSafeHarborCompliant, d as getConfidenceScore, f as isFalsePositive, g as evaluatePolicy, h as deny, i as sanitizeForLogging, l as HIGH_CONFIDENCE_PATTERNS, m as createABACContext, n as redactPHI, o as containsPHI, p as allow, r as redactSpecificTypes, s as detectPHI, t as previewRedactions, u as SAFE_HARBOR_PATTERNS, v as hasAllRoles, x as isResourceSensitive, y as hasAnyRole } from "./redaction-utils-DcQwsiNh.mjs";
+import { n as getApprovalQueue, r as setApprovalQueue, t as createApprovalQueue } from "./compliance-approval-queue-DQGLojAm.mjs";
+import { a as getTenantContext, c as withTenantContext, i as createTenantContext, l as TenantQuotaExceededError, n as createQuotaMiddleware, o as getTenantContextOrNull, r as clearTenantContext, s as setTenantContext, t as InMemoryQuotaTracker } from "./quota-manager-D_N7FuQ2.mjs";
+import { logInfo } from "@od-oneapp/shared/logs";
+
+//#region src/governance/entitlements/index.ts
+/**
+* @fileoverview User Entitlements & Access Control.
+* @module @od-oneapp/ai-platform/governance/entitlements
+*
+* Type-safe model access control and feature enablement by user tier.
+*
+* Features:
+* - Tier-based access control (free, pro, enterprise)
+* - Per-model access restrictions
+* - Token quotas per day/hour/minute
+* - Request rate limiting
+* - Feature flag enablement by tier
+* - Organization-scoped entitlements
+*/
+/**
+* Default entitlements by tier
+*/
+const DEFAULT_ENTITLEMENTS = {
+	free: {
+		tier: "free",
+		models: ["gpt-4-mini", "claude-3-haiku"],
+		maxTokensPerDay: 1e4,
+		maxTokensPerHour: 1e3,
+		maxRequestsPerMinute: 10,
+		maxConcurrentRequests: 1,
+		features: [
+			"basic-chat",
+			"conversation-history",
+			"file-upload"
+		]
+	},
+	pro: {
+		tier: "pro",
+		models: [
+			"gpt-4-mini",
+			"gpt-4-turbo",
+			"claude-3-haiku",
+			"claude-3-sonnet"
+		],
+		maxTokensPerDay: 5e5,
+		maxTokensPerHour: 1e5,
+		maxRequestsPerMinute: 60,
+		maxConcurrentRequests: 5,
+		features: [
+			"basic-chat",
+			"conversation-history",
+			"code-execution",
+			"image-analysis",
+			"file-upload"
+		],
+		rateLimitBucket: {
+			capacity: 1e5,
+			refillRate: 100
+		}
+	},
+	enterprise: {
+		tier: "enterprise",
+		models: [
+			"gpt-4-mini",
+			"gpt-4-turbo",
+			"o1",
+			"claude-3-haiku",
+			"claude-3-sonnet",
+			"claude-3-opus"
+		],
+		maxTokensPerDay: 1e8,
+		maxTokensPerHour: 1e7,
+		maxRequestsPerMinute: 1e3,
+		maxConcurrentRequests: 100,
+		features: [
+			"basic-chat",
+			"conversation-history",
+			"code-execution",
+			"image-analysis",
+			"file-upload",
+			"api-access",
+			"custom-models",
+			"priority-support",
+			"audit-logs",
+			"sso"
+		],
+		rateLimitBucket: {
+			capacity: 5e7,
+			refillRate: 1e4
+		}
+	}
+};
+/**
+* Create an entitlement checker instance
+*
+* @param config - Entitlement configuration
+* @param storage - Optional quota storage backend (defaults to in-memory)
+* @returns EntitlementChecker instance
+*
+* @example
+* ```typescript
+* const checker = createEntitlementChecker({
+*   tiers: DEFAULT_ENTITLEMENTS,
+*   enableLogging: true
+* });
+*
+* const user = { id: 'user-123', tier: 'pro' };
+* const result = checker.canAccessModel(user, 'gpt-4-turbo');
+* console.log(result.allowed); // true
+* ```
+*/
+function createEntitlementChecker(config, storage) {
+	const logger = config.enableLogging ? logInfo : () => {};
+	const quotaStorage = storage || createInMemoryQuotaStorage();
+	return {
+		canAccessModel(user, modelId) {
+			if (!this.getUserEntitlements(user).models.includes(modelId)) {
+				let suggestedTier;
+				const tierOrder = [
+					"free",
+					"pro",
+					"enterprise"
+				];
+				const currentIndex = tierOrder.indexOf(user.tier);
+				for (let i = currentIndex + 1; i < tierOrder.length; i++) {
+					const tier = tierOrder[i];
+					if (!tier) continue;
+					if (config.tiers[tier]?.models.includes(modelId)) {
+						suggestedTier = tier;
+						break;
+					}
+				}
+				logger(`[Entitlements] Model access denied: user ${user.id} (${user.tier}) tried to access ${modelId}`);
+				return {
+					allowed: false,
+					reason: `Model '${modelId}' not available in ${user.tier} tier`,
+					suggestedTier
+				};
+			}
+			logger(`[Entitlements] Model access granted: user ${user.id} can access ${modelId}`);
+			return { allowed: true };
+		},
+		canAccessFeature(user, feature) {
+			if (!this.getUserEntitlements(user).features.includes(feature)) {
+				let suggestedTier;
+				const tierOrder = [
+					"free",
+					"pro",
+					"enterprise"
+				];
+				const currentIndex = tierOrder.indexOf(user.tier);
+				for (let i = currentIndex + 1; i < tierOrder.length; i++) {
+					const tier = tierOrder[i];
+					if (!tier) continue;
+					if (config.tiers[tier]?.features.includes(feature)) {
+						suggestedTier = tier;
+						break;
+					}
+				}
+				logger(`[Entitlements] Feature access denied: user ${user.id} (${user.tier}) tried to access ${feature}`);
+				return {
+					allowed: false,
+					reason: `Feature '${feature}' not available in ${user.tier} tier`,
+					suggestedTier
+				};
+			}
+			logger(`[Entitlements] Feature access granted: user ${user.id} can access ${feature}`);
+			return { allowed: true };
+		},
+		async getRemainingTokens(userId) {
+			const user = {
+				id: userId,
+				tier: "pro"
+			};
+			const entitlements = this.getUserEntitlements(user);
+			const consumed = await quotaStorage.getTokenUsage(userId, "day");
+			const remaining = Math.max(0, entitlements.maxTokensPerDay - consumed);
+			logger(`[Entitlements] Remaining tokens for user ${userId}: ${remaining}`);
+			return remaining;
+		},
+		async getRemainingRequests(userId) {
+			const user = {
+				id: userId,
+				tier: "pro"
+			};
+			const entitlements = this.getUserEntitlements(user);
+			const consumed = await quotaStorage.getRequestCount(userId, "minute");
+			const remaining = Math.max(0, entitlements.maxRequestsPerMinute - consumed);
+			logger(`[Entitlements] Remaining requests for user ${userId}: ${remaining}`);
+			return remaining;
+		},
+		async consumeTokens(userId, tokens) {
+			const remaining = await this.getRemainingTokens(userId);
+			if (tokens > remaining) {
+				logger(`[Entitlements] Token quota exceeded for user ${userId}: needs ${tokens}, has ${remaining}`);
+				return false;
+			}
+			await quotaStorage.addTokenUsage(userId, tokens);
+			logger(`[Entitlements] Consumed ${tokens} tokens for user ${userId}`);
+			return true;
+		},
+		async consumeRequest(userId) {
+			if (await this.getRemainingRequests(userId) <= 0) {
+				logger(`[Entitlements] Request quota exceeded for user ${userId}`);
+				return false;
+			}
+			await quotaStorage.addRequest(userId);
+			logger(`[Entitlements] Consumed 1 request for user ${userId}`);
+			return true;
+		},
+		getUserEntitlements(user) {
+			const tier = config.getTierForUser?.(user) || user.tier;
+			return config.tiers[tier];
+		},
+		async resetQuotas(userId) {
+			await quotaStorage.reset(userId);
+			logger(`[Entitlements] Reset quotas for user ${userId}`);
+		},
+		async getQuotaStats(userId) {
+			const user = {
+				id: userId,
+				tier: "pro"
+			};
+			const entitlements = this.getUserEntitlements(user);
+			const tokensConsumedToday = await quotaStorage.getTokenUsage(userId, "day");
+			const tokensConsumedThisHour = await quotaStorage.getTokenUsage(userId, "hour");
+			const requestsThisMinute = await quotaStorage.getRequestCount(userId, "minute");
+			return {
+				tokensConsumedToday,
+				tokensConsumedThisHour,
+				requestsThisMinute,
+				requestsToday: await quotaStorage.getRequestCount(userId, "day"),
+				tokenUsagePercent: tokensConsumedToday / entitlements.maxTokensPerDay * 100,
+				tokenUsagePercentHour: tokensConsumedThisHour / entitlements.maxTokensPerHour * 100,
+				requestUsagePercent: requestsThisMinute / entitlements.maxRequestsPerMinute * 100,
+				resetsAt: getNextResetTime("day")
+			};
+		}
+	};
+}
+/**
+* Check if a user has access to a specific model
+* Convenience function that creates a temporary checker
+*
+* @param user - User to check
+* @param modelId - Model ID to check access for
+* @returns Whether access is allowed
+*
+* @example
+* ```typescript
+* const user = { id: 'user-123', tier: 'free' };
+* const canUse = checkModelAccess(user, 'gpt-4-turbo');
+* ```
+*/
+function checkModelAccess(user, modelId) {
+	return createEntitlementChecker({ tiers: DEFAULT_ENTITLEMENTS }).canAccessModel(user, modelId).allowed;
+}
+/**
+* Check if a user has access to a specific feature
+* Convenience function that creates a temporary checker
+*
+* @param user - User to check
+* @param feature - Feature to check access for
+* @returns Whether access is allowed
+*
+* @example
+* ```typescript
+* const user = { id: 'user-123', tier: 'pro' };
+* const canUse = checkFeatureAccess(user, 'code-execution');
+* ```
+*/
+function checkFeatureAccess(user, feature) {
+	return createEntitlementChecker({ tiers: DEFAULT_ENTITLEMENTS }).canAccessFeature(user, feature).allowed;
+}
+/**
+* Create in-memory quota storage backend
+* Suitable for development and testing, not recommended for production
+*
+* @returns QuotaStorage instance
+*/
+function createInMemoryQuotaStorage() {
+	const tokenUsage = /* @__PURE__ */ new Map();
+	const requestCount = /* @__PURE__ */ new Map();
+	return {
+		async getTokenUsage(userId, period) {
+			const usage = tokenUsage.get(userId);
+			if (!usage) return 0;
+			const hoursSinceReset = ((/* @__PURE__ */ new Date()).getTime() - usage.lastReset.getTime()) / (1e3 * 60 * 60);
+			if (period === "day" && hoursSinceReset >= 24) return 0;
+			if (period === "hour" && hoursSinceReset >= 1) return 0;
+			return period === "day" ? usage.day : usage.hour;
+		},
+		async getRequestCount(userId, period) {
+			const count = requestCount.get(userId);
+			if (!count) return 0;
+			const minutesSinceReset = ((/* @__PURE__ */ new Date()).getTime() - count.lastReset.getTime()) / (1e3 * 60);
+			if (period === "day" && minutesSinceReset >= 1440) return 0;
+			if (period === "hour" && minutesSinceReset >= 60) return 0;
+			if (period === "minute" && minutesSinceReset >= 1) return 0;
+			return count[period];
+		},
+		async addTokenUsage(userId, tokens) {
+			const current = tokenUsage.get(userId) || {
+				day: 0,
+				hour: 0,
+				lastReset: /* @__PURE__ */ new Date()
+			};
+			current.day += tokens;
+			current.hour += tokens;
+			tokenUsage.set(userId, current);
+		},
+		async addRequest(userId) {
+			const current = requestCount.get(userId) || {
+				minute: 0,
+				hour: 0,
+				day: 0,
+				lastReset: /* @__PURE__ */ new Date()
+			};
+			current.minute += 1;
+			current.hour += 1;
+			current.day += 1;
+			requestCount.set(userId, current);
+		},
+		async reset(userId) {
+			tokenUsage.delete(userId);
+			requestCount.delete(userId);
+		},
+		async clearExpired() {}
+	};
+}
+/**
+* Get the next reset time for a quota period
+*/
+function getNextResetTime(period) {
+	const now = /* @__PURE__ */ new Date();
+	if (period === "minute") return new Date(now.getTime() + 60 * 1e3);
+	if (period === "hour") return new Date(now.getTime() + 3600 * 1e3);
+	const tomorrow = new Date(now);
+	tomorrow.setDate(tomorrow.getDate() + 1);
+	tomorrow.setHours(0, 0, 0, 0);
+	return tomorrow;
+}
+
+//#endregion
+//#region src/governance/index.ts
+var governance_exports = /* @__PURE__ */ __exportAll({
+	ABACDecisionSchema: () => ABACDecisionSchema,
+	AuditActionSchema: () => AuditActionSchema,
+	AuditEntrySchema: () => AuditEntrySchema,
+	AuditQueryFilterSchema: () => AuditQueryFilterSchema,
+	DEFAULT_ENTITLEMENTS: () => DEFAULT_ENTITLEMENTS,
+	HIGH_CONFIDENCE_PATTERNS: () => HIGH_CONFIDENCE_PATTERNS,
+	InMemoryQuotaTracker: () => InMemoryQuotaTracker,
+	PLATFORM_VERSION: () => PLATFORM_VERSION,
+	POLICY_VERSION: () => POLICY_VERSION,
+	SAFE_HARBOR_PATTERNS: () => SAFE_HARBOR_PATTERNS,
+	SCHEMA_VERSION: () => SCHEMA_VERSION,
+	TOKEN_LIMITS: () => TOKEN_LIMITS,
+	TenantQuotaExceededError: () => TenantQuotaExceededError,
+	allow: () => allow,
+	analyzePHI: () => analyzePHI,
+	applyDefaultGuardrails: () => applyDefaultGuardrails,
+	checkFeatureAccess: () => checkFeatureAccess,
+	checkModelAccess: () => checkModelAccess,
+	clearTenantContext: () => clearTenantContext,
+	compareVersions: () => compareVersions,
+	containsPHI: () => containsPHI,
+	createABACContext: () => createABACContext,
+	createApprovalQueue: () => createApprovalQueue,
+	createAuditLogger: () => createAuditLogger,
+	createEntitlementChecker: () => createEntitlementChecker,
+	createQuotaMiddleware: () => createQuotaMiddleware,
+	createTelemetrySettings: () => createTelemetrySettings,
+	createTenantContext: () => createTenantContext,
+	createVersionRegistry: () => createVersionRegistry,
+	createVersionedConfig: () => createVersionedConfig,
+	defaultRegistry: () => defaultRegistry,
+	defaultTelemetry: () => defaultTelemetry,
+	deny: () => deny,
+	detectPHI: () => detectPHI,
+	detectPromptInjection: () => detectPromptInjection,
+	detectRiskFromMessages: () => detectRiskFromMessages,
+	evaluatePolicy: () => evaluatePolicy,
+	getApprovalQueue: () => getApprovalQueue,
+	getAuditLogger: () => getAuditLogger,
+	getConfidenceScore: () => getConfidenceScore,
+	getCurrentPolicyVersion: () => getCurrentPolicyVersion,
+	getCurrentSchemaVersion: () => getCurrentSchemaVersion,
+	getCurrentVersion: () => getCurrentVersion,
+	getPolicies: () => getPolicies,
+	getTenantContext: () => getTenantContext,
+	getTenantContextOrNull: () => getTenantContextOrNull,
+	getTokenLimitForRisk: () => getTokenLimitForRisk,
+	hasAllRoles: () => hasAllRoles,
+	hasAnyRole: () => hasAnyRole,
+	hasRole: () => hasRole,
+	isFalsePositive: () => isFalsePositive,
+	isResourceSensitive: () => isResourceSensitive,
+	isSafeHarborCompliant: () => isSafeHarborCompliant,
+	isVersionCompatible: () => isVersionCompatible,
+	logGeneration: () => logGeneration,
+	logRedaction: () => logRedaction,
+	logToolCall: () => logToolCall,
+	mergeActiveTools: () => mergeActiveTools,
+	migrateVersionedConfig: () => migrateVersionedConfig,
+	parseVersion: () => parseVersion,
+	previewRedactions: () => previewRedactions,
+	redactPHI: () => redactPHI,
+	redactSpecificTypes: () => redactSpecificTypes,
+	registerPolicy: () => registerPolicy,
+	resolveLoopPolicy: () => resolveLoopPolicy,
+	sanitizeForLogging: () => sanitizeForLogging,
+	satisfiesRange: () => satisfiesRange,
+	setApprovalQueue: () => setApprovalQueue,
+	setAuditLogger: () => setAuditLogger,
+	setTenantContext: () => setTenantContext,
+	unregisterPolicy: () => unregisterPolicy,
+	updateVersionedConfig: () => updateVersionedConfig,
+	validateAuditEntry: () => validateAuditEntry,
+	validateConfigIntegrity: () => validateConfigIntegrity,
+	validateQueryFilter: () => validateQueryFilter,
+	withTenantContext: () => withTenantContext
+});
+
+//#endregion
+export { ABACDecisionSchema, AuditActionSchema, AuditEntrySchema, AuditQueryFilterSchema, DEFAULT_ENTITLEMENTS, HIGH_CONFIDENCE_PATTERNS, InMemoryQuotaTracker, PLATFORM_VERSION, POLICY_VERSION, SAFE_HARBOR_PATTERNS, SCHEMA_VERSION, TOKEN_LIMITS, TenantQuotaExceededError, allow, analyzePHI, applyDefaultGuardrails, checkFeatureAccess, checkModelAccess, clearTenantContext, compareVersions, containsPHI, createABACContext, createApprovalQueue, createAuditLogger, createEntitlementChecker, createQuotaMiddleware, createTelemetrySettings, createTenantContext, createVersionRegistry, createVersionedConfig, defaultRegistry, defaultTelemetry, deny, detectPHI, detectPromptInjection, detectRiskFromMessages, evaluatePolicy, getApprovalQueue, getAuditLogger, getConfidenceScore, getCurrentPolicyVersion, getCurrentSchemaVersion, getCurrentVersion, getPolicies, getTenantContext, getTenantContextOrNull, getTokenLimitForRisk, hasAllRoles, hasAnyRole, hasRole, isFalsePositive, isResourceSensitive, isSafeHarborCompliant, isVersionCompatible, logGeneration, logRedaction, logToolCall, mergeActiveTools, migrateVersionedConfig, parseVersion, previewRedactions, redactPHI, redactSpecificTypes, registerPolicy, resolveLoopPolicy, sanitizeForLogging, satisfiesRange, setApprovalQueue, setAuditLogger, setTenantContext, governance_exports as t, unregisterPolicy, updateVersionedConfig, validateAuditEntry, validateConfigIntegrity, validateQueryFilter, withTenantContext };
+//# sourceMappingURL=governance.mjs.map

package/dist/governance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.mjs","names":[],"sources":["../src/governance/entitlements/index.ts","../src/governance/index.ts"],"sourcesContent":["/**\n * @fileoverview User Entitlements & Access Control.\n * @module @od-oneapp/ai-platform/governance/entitlements\n *\n * Type-safe model access control and feature enablement by user tier.\n *\n * Features:\n * - Tier-based access control (free, pro, enterprise)\n * - Per-model access restrictions\n * - Token quotas per day/hour/minute\n * - Request rate limiting\n * - Feature flag enablement by tier\n * - Organization-scoped entitlements\n */\n\nimport { logInfo } from '@repo/shared/logs';\n\n/**\n * User tier levels with increasing capabilities\n */\nexport type UserTier = 'free' | 'pro' | 'enterprise';\n\n/**\n * User representation for entitlement checks\n */\nexport interface User {\n  /** Unique user identifier */\n  id: string;\n\n  /** User's tier level */\n  tier: UserTier;\n\n  /** Organization ID (for org-scoped quotas) */\n  organizationId?: string;\n\n  /** Additional user metadata */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Entitlements for a specific user tier\n */\nexport interface UserEntitlements {\n  /** User tier */\n  tier: UserTier;\n\n  /** List of allowed model IDs for this tier */\n  models: string[];\n\n  /** Maximum tokens allowed per day */\n  maxTokensPerDay: number;\n\n  /** Maximum tokens allowed per hour */\n  maxTokensPerHour: number;\n\n  /** Maximum requests allowed per minute */\n  maxRequestsPerMinute: number;\n\n  /** Maximum concurrent requests */\n  maxConcurrentRequests: number;\n\n  /** List of enabled features for this tier */\n  features: string[];\n\n  /** Custom rate limit bucket (for advanced configurations) */\n  rateLimitBucket?: {\n    capacity: number;\n    refillRate: number; // tokens per second\n  };\n}\n\n/**\n * Configuration for entitlement checker\n */\nexport interface EntitlementConfig {\n  /** Entitlements by tier */\n  tiers: Record<UserTier, UserEntitlements>;\n\n  /** Enable audit logging */\n  enableLogging?: boolean;\n\n  /** Custom tier mapping function */\n  getTierForUser?: (user: User) => UserTier;\n}\n\n/**\n * Result of an entitlement check\n */\nexport interface EntitlementCheckResult {\n  /** Whether the access is allowed */\n  allowed: boolean;\n\n  /** Reason if denied */\n  reason?: string;\n\n  /** Recommended tier upgrade if access denied */\n  suggestedTier?: UserTier;\n}\n\n/**\n * Entitlement checker interface\n */\nexport interface EntitlementChecker {\n  /** Check if user has access to a specific model */\n  canAccessModel(user: User, modelId: string): EntitlementCheckResult;\n\n  /** Check if user has access to a feature */\n  canAccessFeature(user: User, feature: string): EntitlementCheckResult;\n\n  /** Get remaining token quota for a user */\n  getRemainingTokens(userId: string): Promise<number>;\n\n  /** Get remaining requests quota for a user */\n  getRemainingRequests(userId: string): Promise<number>;\n\n  /** Consume tokens for a request */\n  consumeTokens(userId: string, tokens: number): Promise<boolean>;\n\n  /** Consume a request quota */\n  consumeRequest(userId: string): Promise<boolean>;\n\n  /** Get user's current entitlements */\n  getUserEntitlements(user: User): UserEntitlements;\n\n  /** Reset quotas for a user */\n  resetQuotas(userId: string): Promise<void>;\n\n  /** Get quota usage stats */\n  getQuotaStats(userId: string): Promise<QuotaStats>;\n}\n\n/**\n * Statistics about quota usage\n */\nexport interface QuotaStats {\n  /** Tokens consumed today */\n  tokensConsumedToday: number;\n\n  /** Tokens consumed this hour */\n  tokensConsumedThisHour: number;\n\n  /** Requests made this minute */\n  requestsThisMinute: number;\n\n  /** Total requests made today */\n  requestsToday: number;\n\n  /** Percentage of daily token quota used */\n  tokenUsagePercent: number;\n\n  /** Percentage of hourly token quota used */\n  tokenUsagePercentHour: number;\n\n  /** Percentage of per-minute request quota used */\n  requestUsagePercent: number;\n\n  /** When quotas reset */\n  resetsAt: Date;\n}\n\n/**\n * Storage backend for quota tracking\n */\nexport interface QuotaStorage {\n  /** Get current token usage for a user in a specific period */\n  getTokenUsage(userId: string, period: 'day' | 'hour'): Promise<number>;\n\n  /** Get current request count for a user in a specific period */\n  getRequestCount(userId: string, period: 'minute' | 'hour' | 'day'): Promise<number>;\n\n  /** Add tokens to usage */\n  addTokenUsage(userId: string, tokens: number): Promise<void>;\n\n  /** Add request to count */\n  addRequest(userId: string): Promise<void>;\n\n  /** Reset usage for a user */\n  reset(userId: string): Promise<void>;\n\n  /** Clear expired records */\n  clearExpired(): Promise<void>;\n}\n\n/**\n * Default entitlements by tier\n */\nexport const DEFAULT_ENTITLEMENTS: Record<UserTier, UserEntitlements> = {\n  free: {\n    tier: 'free',\n    models: ['gpt-4-mini', 'claude-3-haiku'],\n    maxTokensPerDay: 10000,\n    maxTokensPerHour: 1000,\n    maxRequestsPerMinute: 10,\n    maxConcurrentRequests: 1,\n    features: ['basic-chat', 'conversation-history', 'file-upload'],\n  },\n  pro: {\n    tier: 'pro',\n    models: ['gpt-4-mini', 'gpt-4-turbo', 'claude-3-haiku', 'claude-3-sonnet'],\n    maxTokensPerDay: 500000,\n    maxTokensPerHour: 100000,\n    maxRequestsPerMinute: 60,\n    maxConcurrentRequests: 5,\n    features: [\n      'basic-chat',\n      'conversation-history',\n      'code-execution',\n      'image-analysis',\n      'file-upload',\n    ],\n    rateLimitBucket: {\n      capacity: 100000,\n      refillRate: 100,\n    },\n  },\n  enterprise: {\n    tier: 'enterprise',\n    models: [\n      'gpt-4-mini',\n      'gpt-4-turbo',\n      'o1',\n      'claude-3-haiku',\n      'claude-3-sonnet',\n      'claude-3-opus',\n    ],\n    maxTokensPerDay: 100000000,\n    maxTokensPerHour: 10000000,\n    maxRequestsPerMinute: 1000,\n    maxConcurrentRequests: 100,\n    features: [\n      'basic-chat',\n      'conversation-history',\n      'code-execution',\n      'image-analysis',\n      'file-upload',\n      'api-access',\n      'custom-models',\n      'priority-support',\n      'audit-logs',\n      'sso',\n    ],\n    rateLimitBucket: {\n      capacity: 50000000,\n      refillRate: 10000,\n    },\n  },\n};\n\n/**\n * Create an entitlement checker instance\n *\n * @param config - Entitlement configuration\n * @param storage - Optional quota storage backend (defaults to in-memory)\n * @returns EntitlementChecker instance\n *\n * @example\n * ```typescript\n * const checker = createEntitlementChecker({\n *   tiers: DEFAULT_ENTITLEMENTS,\n *   enableLogging: true\n * });\n *\n * const user = { id: 'user-123', tier: 'pro' };\n * const result = checker.canAccessModel(user, 'gpt-4-turbo');\n * console.log(result.allowed); // true\n * ```\n */\nexport function createEntitlementChecker(\n  config: EntitlementConfig,\n  storage?: QuotaStorage,\n): EntitlementChecker {\n  const logger = config.enableLogging ? logInfo : () => {};\n  const quotaStorage = storage || createInMemoryQuotaStorage();\n\n  return {\n    canAccessModel(user: User, modelId: string): EntitlementCheckResult {\n      const entitlements = this.getUserEntitlements(user);\n      const allowed = entitlements.models.includes(modelId);\n\n      if (!allowed) {\n        // Find a tier that has this model\n        let suggestedTier: UserTier | undefined;\n        const tierOrder: UserTier[] = ['free', 'pro', 'enterprise'];\n        const currentIndex = tierOrder.indexOf(user.tier);\n\n        for (let i = currentIndex + 1; i < tierOrder.length; i++) {\n          const tier = tierOrder[i];\n          if (!tier) continue;\n          const tierConfig = config.tiers[tier];\n          if (tierConfig?.models.includes(modelId)) {\n            suggestedTier = tier;\n            break;\n          }\n        }\n\n        logger(\n          `[Entitlements] Model access denied: user ${user.id} (${user.tier}) tried to access ${modelId}`,\n        );\n\n        return {\n          allowed: false,\n          reason: `Model '${modelId}' not available in ${user.tier} tier`,\n          suggestedTier,\n        };\n      }\n\n      logger(`[Entitlements] Model access granted: user ${user.id} can access ${modelId}`);\n      return { allowed: true };\n    },\n\n    canAccessFeature(user: User, feature: string): EntitlementCheckResult {\n      const entitlements = this.getUserEntitlements(user);\n      const allowed = entitlements.features.includes(feature);\n\n      if (!allowed) {\n        let suggestedTier: UserTier | undefined;\n        const tierOrder: UserTier[] = ['free', 'pro', 'enterprise'];\n        const currentIndex = tierOrder.indexOf(user.tier);\n\n        for (let i = currentIndex + 1; i < tierOrder.length; i++) {\n          const tier = tierOrder[i];\n          if (!tier) continue;\n          const tierConfig = config.tiers[tier];\n          if (tierConfig?.features.includes(feature)) {\n            suggestedTier = tier;\n            break;\n          }\n        }\n\n        logger(\n          `[Entitlements] Feature access denied: user ${user.id} (${user.tier}) tried to access ${feature}`,\n        );\n\n        return {\n          allowed: false,\n          reason: `Feature '${feature}' not available in ${user.tier} tier`,\n          suggestedTier,\n        };\n      }\n\n      logger(`[Entitlements] Feature access granted: user ${user.id} can access ${feature}`);\n      return { allowed: true };\n    },\n\n    async getRemainingTokens(userId: string): Promise<number> {\n      const user = { id: userId, tier: 'pro' as const }; // Default to pro for quota lookup\n      const entitlements = this.getUserEntitlements(user);\n\n      const consumed = await quotaStorage.getTokenUsage(userId, 'day');\n      const remaining = Math.max(0, entitlements.maxTokensPerDay - consumed);\n\n      logger(`[Entitlements] Remaining tokens for user ${userId}: ${remaining}`);\n      return remaining;\n    },\n\n    async getRemainingRequests(userId: string): Promise<number> {\n      const user = { id: userId, tier: 'pro' as const };\n      const entitlements = this.getUserEntitlements(user);\n\n      const consumed = await quotaStorage.getRequestCount(userId, 'minute');\n      const remaining = Math.max(0, entitlements.maxRequestsPerMinute - consumed);\n\n      logger(`[Entitlements] Remaining requests for user ${userId}: ${remaining}`);\n      return remaining;\n    },\n\n    async consumeTokens(userId: string, tokens: number): Promise<boolean> {\n      const remaining = await this.getRemainingTokens(userId);\n\n      if (tokens > remaining) {\n        logger(\n          `[Entitlements] Token quota exceeded for user ${userId}: needs ${tokens}, has ${remaining}`,\n        );\n        return false;\n      }\n\n      await quotaStorage.addTokenUsage(userId, tokens);\n      logger(`[Entitlements] Consumed ${tokens} tokens for user ${userId}`);\n      return true;\n    },\n\n    async consumeRequest(userId: string): Promise<boolean> {\n      const remaining = await this.getRemainingRequests(userId);\n\n      if (remaining <= 0) {\n        logger(`[Entitlements] Request quota exceeded for user ${userId}`);\n        return false;\n      }\n\n      await quotaStorage.addRequest(userId);\n      logger(`[Entitlements] Consumed 1 request for user ${userId}`);\n      return true;\n    },\n\n    getUserEntitlements(user: User): UserEntitlements {\n      const tier = config.getTierForUser?.(user) || user.tier;\n      return config.tiers[tier];\n    },\n\n    async resetQuotas(userId: string): Promise<void> {\n      await quotaStorage.reset(userId);\n      logger(`[Entitlements] Reset quotas for user ${userId}`);\n    },\n\n    async getQuotaStats(userId: string): Promise<QuotaStats> {\n      // For demo purposes, we assume pro tier\n      const user = { id: userId, tier: 'pro' as const };\n      const entitlements = this.getUserEntitlements(user);\n\n      const tokensConsumedToday = await quotaStorage.getTokenUsage(userId, 'day');\n      const tokensConsumedThisHour = await quotaStorage.getTokenUsage(userId, 'hour');\n      const requestsThisMinute = await quotaStorage.getRequestCount(userId, 'minute');\n      const requestsToday = await quotaStorage.getRequestCount(userId, 'day');\n\n      return {\n        tokensConsumedToday,\n        tokensConsumedThisHour,\n        requestsThisMinute,\n        requestsToday,\n        tokenUsagePercent: (tokensConsumedToday / entitlements.maxTokensPerDay) * 100,\n        tokenUsagePercentHour: (tokensConsumedThisHour / entitlements.maxTokensPerHour) * 100,\n        requestUsagePercent: (requestsThisMinute / entitlements.maxRequestsPerMinute) * 100,\n        resetsAt: getNextResetTime('day'),\n      };\n    },\n  };\n}\n\n/**\n * Check if a user has access to a specific model\n * Convenience function that creates a temporary checker\n *\n * @param user - User to check\n * @param modelId - Model ID to check access for\n * @returns Whether access is allowed\n *\n * @example\n * ```typescript\n * const user = { id: 'user-123', tier: 'free' };\n * const canUse = checkModelAccess(user, 'gpt-4-turbo');\n * ```\n */\nexport function checkModelAccess(user: User, modelId: string): boolean {\n  const checker = createEntitlementChecker({\n    tiers: DEFAULT_ENTITLEMENTS,\n  });\n\n  const result = checker.canAccessModel(user, modelId);\n  return result.allowed;\n}\n\n/**\n * Check if a user has access to a specific feature\n * Convenience function that creates a temporary checker\n *\n * @param user - User to check\n * @param feature - Feature to check access for\n * @returns Whether access is allowed\n *\n * @example\n * ```typescript\n * const user = { id: 'user-123', tier: 'pro' };\n * const canUse = checkFeatureAccess(user, 'code-execution');\n * ```\n */\nexport function checkFeatureAccess(user: User, feature: string): boolean {\n  const checker = createEntitlementChecker({\n    tiers: DEFAULT_ENTITLEMENTS,\n  });\n\n  const result = checker.canAccessFeature(user, feature);\n  return result.allowed;\n}\n\n/**\n * Create in-memory quota storage backend\n * Suitable for development and testing, not recommended for production\n *\n * @returns QuotaStorage instance\n */\nfunction createInMemoryQuotaStorage(): QuotaStorage {\n  const tokenUsage = new Map<string, { day: number; hour: number; lastReset: Date }>();\n  const requestCount = new Map<\n    string,\n    { minute: number; hour: number; day: number; lastReset: Date }\n  >();\n\n  return {\n    async getTokenUsage(userId: string, period: 'day' | 'hour'): Promise<number> {\n      const usage = tokenUsage.get(userId);\n      if (!usage) return 0;\n\n      // Check if we need to reset\n      const now = new Date();\n      const hoursSinceReset = (now.getTime() - usage.lastReset.getTime()) / (1000 * 60 * 60);\n\n      if (period === 'day' && hoursSinceReset >= 24) {\n        return 0;\n      }\n      if (period === 'hour' && hoursSinceReset >= 1) {\n        return 0;\n      }\n\n      return period === 'day' ? usage.day : usage.hour;\n    },\n\n    async getRequestCount(userId: string, period: 'minute' | 'hour' | 'day'): Promise<number> {\n      const count = requestCount.get(userId);\n      if (!count) return 0;\n\n      const now = new Date();\n      const minutesSinceReset = (now.getTime() - count.lastReset.getTime()) / (1000 * 60);\n\n      if (period === 'day' && minutesSinceReset >= 1440) {\n        return 0;\n      }\n      if (period === 'hour' && minutesSinceReset >= 60) {\n        return 0;\n      }\n      if (period === 'minute' && minutesSinceReset >= 1) {\n        return 0;\n      }\n\n      return count[period];\n    },\n\n    async addTokenUsage(userId: string, tokens: number): Promise<void> {\n      const current = tokenUsage.get(userId) || {\n        day: 0,\n        hour: 0,\n        lastReset: new Date(),\n      };\n\n      current.day += tokens;\n      current.hour += tokens;\n      tokenUsage.set(userId, current);\n    },\n\n    async addRequest(userId: string): Promise<void> {\n      const current = requestCount.get(userId) || {\n        minute: 0,\n        hour: 0,\n        day: 0,\n        lastReset: new Date(),\n      };\n\n      current.minute += 1;\n      current.hour += 1;\n      current.day += 1;\n      requestCount.set(userId, current);\n    },\n\n    async reset(userId: string): Promise<void> {\n      tokenUsage.delete(userId);\n      requestCount.delete(userId);\n    },\n\n    async clearExpired(): Promise<void> {\n      // In-memory storage doesn't need cleanup\n    },\n  };\n}\n\n/**\n * Get the next reset time for a quota period\n */\nfunction getNextResetTime(period: 'day' | 'hour' | 'minute'): Date {\n  const now = new Date();\n\n  if (period === 'minute') {\n    return new Date(now.getTime() + 60 * 1000);\n  }\n\n  if (period === 'hour') {\n    return new Date(now.getTime() + 60 * 60 * 1000);\n  }\n\n  // Day - reset at midnight\n  const tomorrow = new Date(now);\n  tomorrow.setDate(tomorrow.getDate() + 1);\n  tomorrow.setHours(0, 0, 0, 0);\n  return tomorrow;\n}\n\n// Re-export types\n","/**\n * Governance Module\n *\n * Enterprise compliance, audit, and policy management:\n * - Compliance (ABAC, approval workflows, validators)\n * - Audit logging\n * - Policy engine\n * - Multi-tenant isolation and quotas\n *\n * @module governance\n */\n\n// Compliance (ABAC, approval workflows)\nexport * from \"./compliance\";\n\n// Audit logging\nexport * from \"./audit\";\n\n// Policy engine\nexport * from \"./policies\";\n\n// Multi-tenant isolation and quotas\nexport * from \"./tenancy\";\n\n// Entitlements, quotas, and rate limiting\nexport * from \"./entitlements\";\n\n// Version control\nexport * from \"./versioning\";\n\n// Note: Approval workflows are exported through ./compliance/index\n// Use: getApprovalQueue, createApprovalQueue, setApprovalQueue\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA0LA,MAAa,uBAA2D;CACtE,MAAM;EACJ,MAAM;EACN,QAAQ,CAAC,cAAc,iBAAiB;EACxC,iBAAiB;EACjB,kBAAkB;EAClB,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;GAAC;GAAc;GAAwB;GAAc;EAChE;CACD,KAAK;EACH,MAAM;EACN,QAAQ;GAAC;GAAc;GAAe;GAAkB;GAAkB;EAC1E,iBAAiB;EACjB,kBAAkB;EAClB,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;GACR;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;GACf,UAAU;GACV,YAAY;GACb;EACF;CACD,YAAY;EACV,MAAM;EACN,QAAQ;GACN;GACA;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,kBAAkB;EAClB,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;GACR;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;GACf,UAAU;GACV,YAAY;GACb;EACF;CACF;;;;;;;;;;;;;;;;;;;;AAqBD,SAAgB,yBACd,QACA,SACoB;CACpB,MAAM,SAAS,OAAO,gBAAgB,gBAAgB;CACtD,MAAM,eAAe,WAAW,4BAA4B;AAE5D,QAAO;EACL,eAAe,MAAY,SAAyC;AAIlE,OAAI,CAHiB,KAAK,oBAAoB,KAAK,CACtB,OAAO,SAAS,QAAQ,EAEvC;IAEZ,IAAI;IACJ,MAAM,YAAwB;KAAC;KAAQ;KAAO;KAAa;IAC3D,MAAM,eAAe,UAAU,QAAQ,KAAK,KAAK;AAEjD,SAAK,IAAI,IAAI,eAAe,GAAG,IAAI,UAAU,QAAQ,KAAK;KACxD,MAAM,OAAO,UAAU;AACvB,SAAI,CAAC,KAAM;AAEX,SADmB,OAAO,MAAM,OAChB,OAAO,SAAS,QAAQ,EAAE;AACxC,sBAAgB;AAChB;;;AAIJ,WACE,4CAA4C,KAAK,GAAG,IAAI,KAAK,KAAK,oBAAoB,UACvF;AAED,WAAO;KACL,SAAS;KACT,QAAQ,UAAU,QAAQ,qBAAqB,KAAK,KAAK;KACzD;KACD;;AAGH,UAAO,6CAA6C,KAAK,GAAG,cAAc,UAAU;AACpF,UAAO,EAAE,SAAS,MAAM;;EAG1B,iBAAiB,MAAY,SAAyC;AAIpE,OAAI,CAHiB,KAAK,oBAAoB,KAAK,CACtB,SAAS,SAAS,QAAQ,EAEzC;IACZ,IAAI;IACJ,MAAM,YAAwB;KAAC;KAAQ;KAAO;KAAa;IAC3D,MAAM,eAAe,UAAU,QAAQ,KAAK,KAAK;AAEjD,SAAK,IAAI,IAAI,eAAe,GAAG,IAAI,UAAU,QAAQ,KAAK;KACxD,MAAM,OAAO,UAAU;AACvB,SAAI,CAAC,KAAM;AAEX,SADmB,OAAO,MAAM,OAChB,SAAS,SAAS,QAAQ,EAAE;AAC1C,sBAAgB;AAChB;;;AAIJ,WACE,8CAA8C,KAAK,GAAG,IAAI,KAAK,KAAK,oBAAoB,UACzF;AAED,WAAO;KACL,SAAS;KACT,QAAQ,YAAY,QAAQ,qBAAqB,KAAK,KAAK;KAC3D;KACD;;AAGH,UAAO,+CAA+C,KAAK,GAAG,cAAc,UAAU;AACtF,UAAO,EAAE,SAAS,MAAM;;EAG1B,MAAM,mBAAmB,QAAiC;GACxD,MAAM,OAAO;IAAE,IAAI;IAAQ,MAAM;IAAgB;GACjD,MAAM,eAAe,KAAK,oBAAoB,KAAK;GAEnD,MAAM,WAAW,MAAM,aAAa,cAAc,QAAQ,MAAM;GAChE,MAAM,YAAY,KAAK,IAAI,GAAG,aAAa,kBAAkB,SAAS;AAEtE,UAAO,4CAA4C,OAAO,IAAI,YAAY;AAC1E,UAAO;;EAGT,MAAM,qBAAqB,QAAiC;GAC1D,MAAM,OAAO;IAAE,IAAI;IAAQ,MAAM;IAAgB;GACjD,MAAM,eAAe,KAAK,oBAAoB,KAAK;GAEnD,MAAM,WAAW,MAAM,aAAa,gBAAgB,QAAQ,SAAS;GACrE,MAAM,YAAY,KAAK,IAAI,GAAG,aAAa,uBAAuB,SAAS;AAE3E,UAAO,8CAA8C,OAAO,IAAI,YAAY;AAC5E,UAAO;;EAGT,MAAM,cAAc,QAAgB,QAAkC;GACpE,MAAM,YAAY,MAAM,KAAK,mBAAmB,OAAO;AAEvD,OAAI,SAAS,WAAW;AACtB,WACE,gDAAgD,OAAO,UAAU,OAAO,QAAQ,YACjF;AACD,WAAO;;AAGT,SAAM,aAAa,cAAc,QAAQ,OAAO;AAChD,UAAO,2BAA2B,OAAO,mBAAmB,SAAS;AACrE,UAAO;;EAGT,MAAM,eAAe,QAAkC;AAGrD,OAFkB,MAAM,KAAK,qBAAqB,OAAO,IAExC,GAAG;AAClB,WAAO,kDAAkD,SAAS;AAClE,WAAO;;AAGT,SAAM,aAAa,WAAW,OAAO;AACrC,UAAO,8CAA8C,SAAS;AAC9D,UAAO;;EAGT,oBAAoB,MAA8B;GAChD,MAAM,OAAO,OAAO,iBAAiB,KAAK,IAAI,KAAK;AACnD,UAAO,OAAO,MAAM;;EAGtB,MAAM,YAAY,QAA+B;AAC/C,SAAM,aAAa,MAAM,OAAO;AAChC,UAAO,wCAAwC,SAAS;;EAG1D,MAAM,cAAc,QAAqC;GAEvD,MAAM,OAAO;IAAE,IAAI;IAAQ,MAAM;IAAgB;GACjD,MAAM,eAAe,KAAK,oBAAoB,KAAK;GAEnD,MAAM,sBAAsB,MAAM,aAAa,cAAc,QAAQ,MAAM;GAC3E,MAAM,yBAAyB,MAAM,aAAa,cAAc,QAAQ,OAAO;GAC/E,MAAM,qBAAqB,MAAM,aAAa,gBAAgB,QAAQ,SAAS;AAG/E,UAAO;IACL;IACA;IACA;IACA,eANoB,MAAM,aAAa,gBAAgB,QAAQ,MAAM;IAOrE,mBAAoB,sBAAsB,aAAa,kBAAmB;IAC1E,uBAAwB,yBAAyB,aAAa,mBAAoB;IAClF,qBAAsB,qBAAqB,aAAa,uBAAwB;IAChF,UAAU,iBAAiB,MAAM;IAClC;;EAEJ;;;;;;;;;;;;;;;;AAiBH,SAAgB,iBAAiB,MAAY,SAA0B;AAMrE,QALgB,yBAAyB,EACvC,OAAO,sBACR,CAAC,CAEqB,eAAe,MAAM,QAAQ,CACtC;;;;;;;;;;;;;;;;AAiBhB,SAAgB,mBAAmB,MAAY,SAA0B;AAMvE,QALgB,yBAAyB,EACvC,OAAO,sBACR,CAAC,CAEqB,iBAAiB,MAAM,QAAQ,CACxC;;;;;;;;AAShB,SAAS,6BAA2C;CAClD,MAAM,6BAAa,IAAI,KAA6D;CACpF,MAAM,+BAAe,IAAI,KAGtB;AAEH,QAAO;EACL,MAAM,cAAc,QAAgB,QAAyC;GAC3E,MAAM,QAAQ,WAAW,IAAI,OAAO;AACpC,OAAI,CAAC,MAAO,QAAO;GAInB,MAAM,oCADM,IAAI,MAAM,EACO,SAAS,GAAG,MAAM,UAAU,SAAS,KAAK,MAAO,KAAK;AAEnF,OAAI,WAAW,SAAS,mBAAmB,GACzC,QAAO;AAET,OAAI,WAAW,UAAU,mBAAmB,EAC1C,QAAO;AAGT,UAAO,WAAW,QAAQ,MAAM,MAAM,MAAM;;EAG9C,MAAM,gBAAgB,QAAgB,QAAoD;GACxF,MAAM,QAAQ,aAAa,IAAI,OAAO;AACtC,OAAI,CAAC,MAAO,QAAO;GAGnB,MAAM,sCADM,IAAI,MAAM,EACS,SAAS,GAAG,MAAM,UAAU,SAAS,KAAK,MAAO;AAEhF,OAAI,WAAW,SAAS,qBAAqB,KAC3C,QAAO;AAET,OAAI,WAAW,UAAU,qBAAqB,GAC5C,QAAO;AAET,OAAI,WAAW,YAAY,qBAAqB,EAC9C,QAAO;AAGT,UAAO,MAAM;;EAGf,MAAM,cAAc,QAAgB,QAA+B;GACjE,MAAM,UAAU,WAAW,IAAI,OAAO,IAAI;IACxC,KAAK;IACL,MAAM;IACN,2BAAW,IAAI,MAAM;IACtB;AAED,WAAQ,OAAO;AACf,WAAQ,QAAQ;AAChB,cAAW,IAAI,QAAQ,QAAQ;;EAGjC,MAAM,WAAW,QAA+B;GAC9C,MAAM,UAAU,aAAa,IAAI,OAAO,IAAI;IAC1C,QAAQ;IACR,MAAM;IACN,KAAK;IACL,2BAAW,IAAI,MAAM;IACtB;AAED,WAAQ,UAAU;AAClB,WAAQ,QAAQ;AAChB,WAAQ,OAAO;AACf,gBAAa,IAAI,QAAQ,QAAQ;;EAGnC,MAAM,MAAM,QAA+B;AACzC,cAAW,OAAO,OAAO;AACzB,gBAAa,OAAO,OAAO;;EAG7B,MAAM,eAA8B;EAGrC;;;;;AAMH,SAAS,iBAAiB,QAAyC;CACjE,MAAM,sBAAM,IAAI,MAAM;AAEtB,KAAI,WAAW,SACb,QAAO,IAAI,KAAK,IAAI,SAAS,GAAG,KAAK,IAAK;AAG5C,KAAI,WAAW,OACb,QAAO,IAAI,KAAK,IAAI,SAAS,GAAG,OAAU,IAAK;CAIjD,MAAM,WAAW,IAAI,KAAK,IAAI;AAC9B,UAAS,QAAQ,SAAS,SAAS,GAAG,EAAE;AACxC,UAAS,SAAS,GAAG,GAAG,GAAG,EAAE;AAC7B,QAAO"}

package/dist/grounding-attribution.d.mts

@@ -0,0 +1,63 @@
+//#region src/grounding/attribution/index.d.ts
+interface AttributionSource {
+  readonly id: string;
+  readonly content: string;
+  readonly metadata?: {
+    title?: string;
+    url?: string;
+    author?: string;
+    date?: Date;
+    reliability?: number;
+  };
+}
+interface Claim {
+  readonly id: string;
+  readonly text: string;
+  readonly startOffset: number;
+  readonly endOffset: number;
+  readonly type: 'factual' | 'opinion' | 'inference' | 'unknown';
+}
+interface AttributionEntry {
+  readonly sourceId: string;
+  readonly contributionScore: number;
+  readonly claimIds: string[];
+  readonly matchedSegments: Array<{
+    sourceSpan: {
+      start: number;
+      end: number;
+    };
+    claimSpan: {
+      start: number;
+      end: number;
+    };
+    similarity: number;
+  }>;
+}
+interface AttributionReport {
+  readonly totalSources: number;
+  readonly totalClaims: number;
+  readonly attributions: AttributionEntry[];
+  readonly unattributedClaims: string[];
+  readonly attributionCoverage: number;
+  readonly generatedAt: Date;
+  readonly metadata?: Record<string, unknown>;
+}
+interface AttributionTrackerConfig {
+  readonly minSimilarityThreshold?: number;
+  readonly maxClaimsPerSource?: number;
+  readonly extractClaims?: boolean;
+  readonly computeContribution?: boolean;
+}
+interface AttributionTracker {
+  addSource(source: AttributionSource): void;
+  removeSource(sourceId: string): void;
+  getSources(): AttributionSource[];
+  extractClaims(text: string): Claim[];
+  generateReport(text: string, sourceIds?: string[]): Promise<AttributionReport>;
+  getConfig(): AttributionTrackerConfig;
+}
+declare function createAttributionTracker(config?: AttributionTrackerConfig): AttributionTracker;
+declare function generateAttributionReport(text: string, sources: AttributionSource[]): AttributionReport;
+//#endregion
+export { AttributionEntry, AttributionReport, AttributionSource, AttributionTracker, AttributionTrackerConfig, Claim, createAttributionTracker, generateAttributionReport };
+//# sourceMappingURL=grounding-attribution.d.mts.map

package/dist/grounding-attribution.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grounding-attribution.d.mts","names":[],"sources":["../src/grounding/attribution/index.ts"],"mappings":";UA8BiB,iBAAA;EAAA,SACN,EAAA;EAAA,SACA,OAAA;EAAA,SACA,QAAA;IACP,KAAA;IACA,GAAA;IACA,MAAA;IACA,IAAA,GAAO,IAAA;IACP,WAAA;EAAA;AAAA;AAAA,UAKa,KAAA;EAAA,SACN,EAAA;EAAA,SACA,IAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAIM,gBAAA;EAAA,SACN,QAAA;EAAA,SACA,iBAAA;EAAA,SACA,QAAA;EAAA,SACA,eAAA,EAAiB,KAAA;IACxB,UAAA;MAAc,KAAA;MAAe,GAAA;IAAA;IAC7B,SAAA;MAAa,KAAA;MAAe,GAAA;IAAA;IAC5B,UAAA;EAAA;AAAA;AAAA,UAKa,iBAAA;EAAA,SACN,YAAA;EAAA,SACA,WAAA;EAAA,SACA,YAAA,EAAc,gBAAA;EAAA,SACd,kBAAA;EAAA,SACA,mBAAA;EAAA,SACA,WAAA,EAAa,IAAA;EAAA,SACb,QAAA,GAAW,MAAA;AAAA;AAAA,UAIL,wBAAA;EAAA,SACN,sBAAA;EAAA,SACA,kBAAA;EAAA,SACA,aAAA;EAAA,SACA,mBAAA;AAAA;AAAA,UAIM,kBAAA;EACf,SAAA,CAAU,MAAA,EAAQ,iBAAA;EAClB,YAAA,CAAa,QAAA;EACb,UAAA,IAAc,iBAAA;EACd,aAAA,CAAc,IAAA,WAAe,KAAA;EAC7B,cAAA,CAAe,IAAA,UAAc,SAAA,cAAuB,OAAA,CAAQ,iBAAA;EAC5D,SAAA,IAAa,wBAAA;AAAA;AAAA,iBA6BC,wBAAA,CACd,MAAA,GAAQ,wBAAA,GACP,kBAAA;AAAA,iBA0Ja,yBAAA,CACd,IAAA,UACA,OAAA,EAAS,iBAAA,KACR,iBAAA"}