@plumbus/core 0.1.0

package/dist/ai/validation.js

@@ -0,0 +1,39 @@
+// ── Output Validation with Retry ──
+// Validates AI responses against Zod schemas, retries on mismatch
+export async function generateWithValidation(provider, request, schema, config) {
+    const maxRetries = config?.maxRetries ?? 2;
+    const feedbackOnError = config?.feedbackOnError ?? true;
+    let totalUsage = { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
+    let lastError = null;
+    let currentPrompt = request.prompt;
+    for (let attempt = 1; attempt <= maxRetries + 1; attempt++) {
+        const response = await provider.complete({
+            ...request,
+            prompt: currentPrompt,
+            responseFormat: 'json',
+        });
+        totalUsage = {
+            inputTokens: totalUsage.inputTokens + response.usage.inputTokens,
+            outputTokens: totalUsage.outputTokens + response.usage.outputTokens,
+            totalTokens: totalUsage.totalTokens + response.usage.totalTokens,
+        };
+        try {
+            const parsed = JSON.parse(response.content);
+            const result = schema.parse(parsed);
+            return {
+                data: result,
+                raw: response.content,
+                attempts: attempt,
+                usage: totalUsage,
+            };
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err : new Error(String(err));
+            if (attempt <= maxRetries && feedbackOnError) {
+                currentPrompt = `${request.prompt}\n\nYour previous response was invalid. Error: ${lastError.message}\nPlease fix the output to match the required schema.`;
+            }
+        }
+    }
+    throw new Error(`AI output validation failed after ${maxRetries + 1} attempts: ${lastError?.message}`);
+}
+//# sourceMappingURL=validation.js.map

package/dist/ai/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/ai/validation.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,kEAAkE;AAmBlE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAA2B,EAC3B,OAAwB,EACxB,MAAoB,EACpB,MAA8B;IAE9B,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,IAAI,CAAC;IAExD,IAAI,UAAU,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACrE,IAAI,SAAS,GAAiB,IAAI,CAAC;IACnC,IAAI,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAEnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAqB,MAAM,QAAQ,CAAC,QAAQ,CAAC;YACzD,GAAG,OAAO;YACV,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,MAAM;SACvB,CAAC,CAAC;QAEH,UAAU,GAAG;YACX,WAAW,EAAE,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW;YAChE,YAAY,EAAE,UAAU,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY;YACnE,WAAW,EAAE,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW;SACjE,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,QAAQ,CAAC,OAAO;gBACrB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,UAAU;aAClB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAEhE,IAAI,OAAO,IAAI,UAAU,IAAI,eAAe,EAAE,CAAC;gBAC7C,aAAa,GAAG,GAAG,OAAO,CAAC,MAAM,kDAAkD,SAAS,CAAC,OAAO,uDAAuD,CAAC;YAC9J,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qCAAqC,UAAU,GAAG,CAAC,cAAc,SAAS,EAAE,OAAO,EAAE,CACtF,CAAC;AACJ,CAAC"}

package/dist/api/__tests__/route-generator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=route-generator.test.d.ts.map

package/dist/api/__tests__/route-generator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-generator.test.d.ts","sourceRoot":"","sources":["../../../src/api/__tests__/route-generator.test.ts"],"names":[],"mappings":""}

package/dist/api/__tests__/route-generator.test.js

@@ -0,0 +1,101 @@
+import { describe, expect, it, vi } from 'vitest';
+import { z } from 'zod';
+import { registerAllRoutes, registerCapabilityRoute } from '../route-generator.js';
+// ── Helpers ──
+function makeCapability(overrides = {}) {
+    return {
+        name: 'getUser',
+        kind: 'query',
+        domain: 'users',
+        input: z.object({ id: z.string() }),
+        output: z.object({ id: z.string(), name: z.string() }),
+        effects: { data: ['User'], events: [], external: [], ai: false },
+        access: { roles: ['admin'] },
+        handler: async (_ctx, input) => ({
+            id: input.id,
+            name: 'Test User',
+        }),
+        ...overrides,
+    };
+}
+function makeMockApp() {
+    return {
+        get: vi.fn(),
+        post: vi.fn(),
+    };
+}
+function makeMockConfig() {
+    return {
+        authAdapter: {
+            authenticate: vi.fn().mockResolvedValue({
+                userId: 'u1',
+                roles: ['admin'],
+                scopes: [],
+                provider: 'test',
+                tenantId: 'tenant-1',
+            }),
+        },
+        createDependencies: vi.fn().mockReturnValue({
+            auth: {
+                userId: 'u1',
+                roles: ['admin'],
+                scopes: [],
+                provider: 'test',
+                tenantId: 'tenant-1',
+            },
+            data: {},
+        }),
+    };
+}
+// ── Tests ──
+describe('registerCapabilityRoute', () => {
+    it('registers a GET route for query capabilities', () => {
+        const app = makeMockApp();
+        const config = makeMockConfig();
+        const cap = makeCapability({ kind: 'query' });
+        registerCapabilityRoute(app, cap, config);
+        expect(app.get).toHaveBeenCalledTimes(1);
+        expect(app.post).not.toHaveBeenCalled();
+        expect(app.get.mock.calls[0]?.[0]).toBe('/api/users/get-user');
+    });
+    it('registers a POST route for action capabilities', () => {
+        const app = makeMockApp();
+        const config = makeMockConfig();
+        const cap = makeCapability({ kind: 'action', name: 'createUser' });
+        registerCapabilityRoute(app, cap, config);
+        expect(app.post).toHaveBeenCalledTimes(1);
+        expect(app.get).not.toHaveBeenCalled();
+        expect(app.post.mock.calls[0]?.[0]).toBe('/api/users/create-user');
+    });
+    it('registers a POST route for job capabilities', () => {
+        const app = makeMockApp();
+        const config = makeMockConfig();
+        const cap = makeCapability({ kind: 'job', name: 'processReport' });
+        registerCapabilityRoute(app, cap, config);
+        expect(app.post).toHaveBeenCalledTimes(1);
+        expect(app.post.mock.calls[0]?.[0]).toBe('/api/users/process-report');
+    });
+    it('skips eventHandler capabilities', () => {
+        const app = makeMockApp();
+        const config = makeMockConfig();
+        const cap = makeCapability({ kind: 'eventHandler', name: 'onUserCreated' });
+        registerCapabilityRoute(app, cap, config);
+        expect(app.get).not.toHaveBeenCalled();
+        expect(app.post).not.toHaveBeenCalled();
+    });
+});
+describe('registerAllRoutes', () => {
+    it('registers routes for multiple capabilities', () => {
+        const app = makeMockApp();
+        const config = makeMockConfig();
+        const caps = [
+            makeCapability({ kind: 'query', name: 'getUser' }),
+            makeCapability({ kind: 'action', name: 'createUser' }),
+            makeCapability({ kind: 'eventHandler', name: 'onUserCreated' }),
+        ];
+        registerAllRoutes(app, caps, config);
+        expect(app.get).toHaveBeenCalledTimes(1);
+        expect(app.post).toHaveBeenCalledTimes(1);
+    });
+});
+//# sourceMappingURL=route-generator.test.js.map

package/dist/api/__tests__/route-generator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-generator.test.js","sourceRoot":"","sources":["../../../src/api/__tests__/route-generator.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,gBAAgB;AAEhB,SAAS,cAAc,CAAC,YAAyC,EAAE;IACjE,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;QAChE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,WAAW;SAClB,CAAC;QACF,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;QACZ,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO;QACL,WAAW,EAAE;YACX,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACtC,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;aACrB,CAAC;SACH;QACD,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;YAC1C,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;aACrB;YACD,IAAI,EAAE,EAAE;SACT,CAAC;KACH,CAAC;AACJ,CAAC;AAED,cAAc;AAEd,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9C,uBAAuB,CAAC,GAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAEnE,uBAAuB,CAAC,GAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAEnE,uBAAuB,CAAC,GAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAE5E,uBAAuB,CAAC,GAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG;YACX,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAClD,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACtD,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;SAChE,CAAC;QAEF,iBAAiB,CAAC,GAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/api/index.d.ts

@@ -0,0 +1,3 @@
+export { registerAllRoutes, registerCapabilityRoute, } from './route-generator.js';
+export type { RouteGeneratorConfig } from './route-generator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/api/index.js

@@ -0,0 +1,7 @@
+// ── API Module ──
+// HTTP route generation: registers Fastify routes for capabilities.
+// Maps capability kind to HTTP method (query→GET, action/job→POST).
+//
+// Key exports: registerAllRoutes, registerCapabilityRoute
+export { registerAllRoutes, registerCapabilityRoute, } from './route-generator.js';
+//# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,mBAAmB;AACnB,oEAAoE;AACpE,oEAAoE;AACpE,EAAE;AACF,0DAA0D;AAE1D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC"}

package/dist/api/route-generator.d.ts

@@ -0,0 +1,24 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuthAdapter } from '../auth/adapter.js';
+import type { EventQueue } from '../events/queue.js';
+import type { ContextDependencies } from '../execution/context-factory.js';
+import type { CapabilityContract } from '../types/capability.js';
+export interface RouteGeneratorConfig {
+    /** Auth adapter for extracting identity from requests */
+    authAdapter: AuthAdapter;
+    /** Factory to build base context dependencies for each request */
+    createDependencies: (auth: NonNullable<Awaited<ReturnType<AuthAdapter['authenticate']>>>) => ContextDependencies;
+    /** Optional queue for dispatching async job capabilities */
+    jobQueue?: EventQueue;
+}
+/**
+ * Register Fastify routes for a single capability.
+ * HTTP method is derived from capability kind:
+ *   query → GET, action → POST, job → POST (async), eventHandler → skipped
+ */
+export declare function registerCapabilityRoute(app: FastifyInstance, capability: CapabilityContract, config: RouteGeneratorConfig): void;
+/**
+ * Register routes for multiple capabilities at once.
+ */
+export declare function registerAllRoutes(app: FastifyInstance, capabilities: CapabilityContract[], config: RouteGeneratorConfig): void;
+//# sourceMappingURL=route-generator.d.ts.map

package/dist/api/route-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-generator.d.ts","sourceRoot":"","sources":["../../src/api/route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,MAAM,WAAW,oBAAoB;IACnC,yDAAyD;IACzD,WAAW,EAAE,WAAW,CAAC;IACzB,kEAAkE;IAClE,kBAAkB,EAAE,CAClB,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAChE,mBAAmB,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CA2DN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,kBAAkB,EAAE,EAClC,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CAIN"}

package/dist/api/route-generator.js

@@ -0,0 +1,77 @@
+import { errorToHttpResponse } from '../errors/http.js';
+import { executeCapability } from '../execution/capability-executor.js';
+import { createExecutionContext } from '../execution/context-factory.js';
+/**
+ * Register Fastify routes for a single capability.
+ * HTTP method is derived from capability kind:
+ *   query → GET, action → POST, job → POST (async), eventHandler → skipped
+ */
+export function registerCapabilityRoute(app, capability, config) {
+    // Event handlers are internal-only, no HTTP route
+    if (capability.kind === 'eventHandler')
+        return;
+    const method = capability.kind === 'query' ? 'GET' : 'POST';
+    const path = `/api/${capability.domain}/${toKebabCase(capability.name)}`;
+    const handler = async (request, reply) => {
+        // 1. Authenticate
+        const authHeader = request.headers.authorization;
+        const auth = await config.authAdapter.authenticate(authHeader);
+        // For public capabilities, use a minimal anonymous context
+        const authContext = auth ?? {
+            userId: undefined,
+            roles: [],
+            scopes: [],
+            provider: 'anonymous',
+        };
+        // 2. Build execution context
+        const deps = config.createDependencies(authContext);
+        const ctx = createExecutionContext(deps);
+        // 3. Extract input (query params for GET, body for POST)
+        const input = method === 'GET' ? request.query : request.body;
+        // 4. Execute capability (jobs dispatched async via queue if available)
+        if (capability.kind === 'job' && config.jobQueue) {
+            const jobId = crypto.randomUUID();
+            await config.jobQueue.publish({
+                id: jobId,
+                eventType: `job.${capability.domain}.${capability.name}`,
+                version: '1',
+                occurredAt: new Date(),
+                actor: ctx.auth.userId ?? 'anonymous',
+                tenantId: ctx.auth.tenantId,
+                correlationId: jobId,
+                payload: input,
+            });
+            reply.status(202).send({ data: { jobId, status: 'accepted' } });
+            return;
+        }
+        const result = await executeCapability(capability, ctx, input);
+        if (result.success) {
+            reply.status(200).send({ data: result.data });
+        }
+        else {
+            const httpError = errorToHttpResponse(result.error);
+            reply.status(httpError.statusCode).send(httpError.body);
+        }
+    };
+    if (method === 'GET') {
+        app.get(path, handler);
+    }
+    else {
+        app.post(path, handler);
+    }
+}
+/**
+ * Register routes for multiple capabilities at once.
+ */
+export function registerAllRoutes(app, capabilities, config) {
+    for (const cap of capabilities) {
+        registerCapabilityRoute(app, cap, config);
+    }
+}
+function toKebabCase(str) {
+    return str
+        .replace(/([A-Z])/g, '-$1')
+        .toLowerCase()
+        .replace(/^-/, '');
+}
+//# sourceMappingURL=route-generator.js.map

package/dist/api/route-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-generator.js","sourceRoot":"","sources":["../../src/api/route-generator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAezE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAoB,EACpB,UAA8B,EAC9B,MAA4B;IAE5B,kDAAkD;IAClD,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO;IAE/C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,UAAU,CAAC,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAEzE,MAAM,OAAO,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QACpF,kBAAkB;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAE/D,2DAA2D;QAC3D,MAAM,WAAW,GAAG,IAAI,IAAI;YAC1B,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,WAAW;SACtB,CAAC;QAEF,6BAA6B;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,WAAkB,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAqB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE3D,yDAAyD;QACzD,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAE9D,uEAAuE;QACvE,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,OAAO,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE;gBACxD,OAAO,EAAE,GAAG;gBACZ,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW;gBACrC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;gBAC3B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,KAAgC;aAC1C,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAE/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpD,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAoB,EACpB,YAAkC,EAClC,MAA4B;IAE5B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG;SACP,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC;SAC1B,WAAW,EAAE;SACb,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC"}

package/dist/audit/__tests__/service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service.test.d.ts.map

package/dist/audit/__tests__/service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.test.d.ts","sourceRoot":"","sources":["../../../src/audit/__tests__/service.test.ts"],"names":[],"mappings":""}

package/dist/audit/__tests__/service.test.js

@@ -0,0 +1,97 @@
+import { describe, expect, it, vi } from 'vitest';
+import { createAuditService } from '../service.js';
+function makeMockDb() {
+    const inserted = [];
+    return {
+        inserted,
+        insert: vi.fn().mockReturnValue({
+            values: vi.fn().mockImplementation((row) => {
+                inserted.push(row);
+                return Promise.resolve();
+            }),
+        }),
+    };
+}
+describe('createAuditService', () => {
+    it('records an audit event with correct fields', async () => {
+        const db = makeMockDb();
+        const service = createAuditService({
+            db: db,
+            auth: {
+                userId: 'user-1',
+                tenantId: 'tenant-1',
+                roles: ['admin'],
+                scopes: [],
+                provider: 'test',
+            },
+            component: 'orders',
+        });
+        await service.record('order.created', { orderId: '123', outcome: 'success' });
+        expect(db.insert).toHaveBeenCalledTimes(1);
+        expect(db.inserted[0]).toMatchObject({
+            actor: 'user-1',
+            tenantId: 'tenant-1',
+            component: 'orders',
+            action: 'order.created',
+            outcome: 'success',
+        });
+    });
+    it('defaults actor to anonymous when userId is undefined', async () => {
+        const db = makeMockDb();
+        const service = createAuditService({
+            db: db,
+            auth: { userId: undefined, roles: [], scopes: [], provider: 'anonymous' },
+        });
+        await service.record('system.ping');
+        expect(db.inserted[0]).toMatchObject({
+            actor: 'anonymous',
+            component: 'system',
+        });
+    });
+    it('defaults outcome to success when not provided', async () => {
+        const db = makeMockDb();
+        const service = createAuditService({
+            db: db,
+            auth: { userId: 'u1', roles: [], scopes: [], provider: 'test' },
+        });
+        await service.record('check');
+        expect(db.inserted[0]).toMatchObject({ outcome: 'success' });
+    });
+    it('strips _maskedFields from stored metadata', async () => {
+        const db = makeMockDb();
+        const service = createAuditService({
+            db: db,
+            auth: { userId: 'u1', roles: [], scopes: [], provider: 'test' },
+        });
+        await service.record('sensitive.op', {
+            email: '***',
+            _maskedFields: ['email'],
+        });
+        const row = db.inserted[0];
+        expect(row.maskedFields).toEqual(['email']);
+        const meta = row.metadata;
+        expect(meta).not.toHaveProperty('_maskedFields');
+        expect(meta).toHaveProperty('email', '***');
+    });
+    it('records null metadata when none provided', async () => {
+        const db = makeMockDb();
+        const service = createAuditService({
+            db: db,
+            auth: { userId: 'u1', roles: [], scopes: [], provider: 'test' },
+        });
+        await service.record('simple.event');
+        const row = db.inserted[0];
+        expect(row.metadata).toBeNull();
+    });
+    it('passes tenantId as null when not in auth', async () => {
+        const db = makeMockDb();
+        const service = createAuditService({
+            db: db,
+            auth: { userId: 'u1', roles: [], scopes: [], provider: 'test' },
+        });
+        await service.record('event');
+        const row = db.inserted[0];
+        expect(row.tenantId).toBeNull();
+    });
+});
+//# sourceMappingURL=service.test.js.map

package/dist/audit/__tests__/service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.test.js","sourceRoot":"","sources":["../../../src/audit/__tests__/service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;YAC9B,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAY,EAAE,EAAE;gBAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC,CAAC;SACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,EAAE,EAAE,EAAS;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,MAAM;aACjB;YACD,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACnC,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,EAAE,EAAE,EAAS;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAC1E,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEpC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACnC,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,EAAE,EAAE,EAAS;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,EAAE,EAAE,EAAS;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;YACnC,KAAK,EAAE,KAAK;YACZ,aAAa,EAAE,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAA4B,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAmC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,EAAE,EAAE,EAAS;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErC,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAA4B,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,EAAE,EAAE,EAAS;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAA4B,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,4 @@
+export { auditRecords } from './schema.js';
+export { createAuditService } from './service.js';
+export type { AuditServiceConfig } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,8 @@
+// ── Audit Module ──
+// Audit trail: Drizzle schema for audit_records table and a service that
+// writes structured audit records to PostgreSQL. Used by ctx.audit.
+//
+// Key exports: createAuditService, auditRecords (Drizzle table)
+export { auditRecords } from './schema.js';
+export { createAuditService } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,gEAAgE;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/audit/schema.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Drizzle schema for the audit_records table.
+ */
+export declare const auditRecords: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "audit_records";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "audit_records";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actor: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor";
+            tableName: "audit_records";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "audit_records";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        timestamp: import("drizzle-orm/pg-core").PgColumn<{
+            name: "timestamp";
+            tableName: "audit_records";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        component: import("drizzle-orm/pg-core").PgColumn<{
+            name: "component";
+            tableName: "audit_records";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        action: import("drizzle-orm/pg-core").PgColumn<{
+            name: "action";
+            tableName: "audit_records";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        outcome: import("drizzle-orm/pg-core").PgColumn<{
+            name: "outcome";
+            tableName: "audit_records";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        metadata: import("drizzle-orm/pg-core").PgColumn<{
+            name: "metadata";
+            tableName: "audit_records";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        maskedFields: import("drizzle-orm/pg-core").PgColumn<{
+            name: "masked_fields";
+            tableName: "audit_records";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/audit/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/audit/schema.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUvB,CAAC"}

package/dist/audit/schema.js

@@ -0,0 +1,16 @@
+import { jsonb, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+/**
+ * Drizzle schema for the audit_records table.
+ */
+export const auditRecords = pgTable('audit_records', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    actor: text('actor').notNull(),
+    tenantId: text('tenant_id'),
+    timestamp: timestamp('timestamp', { withTimezone: true }).defaultNow().notNull(),
+    component: text('component').notNull(),
+    action: text('action').notNull(),
+    outcome: text('outcome').notNull(), // "success" | "failure" | "denied"
+    metadata: jsonb('metadata'),
+    maskedFields: jsonb('masked_fields'),
+});
+//# sourceMappingURL=schema.js.map

package/dist/audit/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/audit/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE5E;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE;IACnD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAChF,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACtC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,mCAAmC;IACvE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC;CACrC,CAAC,CAAC"}

package/dist/audit/service.d.ts

@@ -0,0 +1,14 @@
+import type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import type { AuditService } from '../types/audit.js';
+import type { AuthContext } from '../types/security.js';
+export interface AuditServiceConfig {
+    db: PostgresJsDatabase;
+    auth: AuthContext;
+    /** Component name for this audit context (e.g. capability name) */
+    component?: string;
+}
+/**
+ * Creates a persistent AuditService that writes records to PostgreSQL.
+ */
+export declare function createAuditService(config: AuditServiceConfig): AuditService;
+//# sourceMappingURL=service.d.ts.map

package/dist/audit/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,kBAAkB,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAyB3E"}