@plumbus/core 0.3.2 → 0.4.0

package/dist/types/enums.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../../src/types/enums.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAGjG,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAGlF,eAAO,MAAM,YAAY;;;;;;;CAOf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAG5E,eAAO,MAAM,eAAe;;;CAGlB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAGrF,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAG5E,eAAO,MAAM,SAAS;;;;;;;;CAQZ,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAGnE,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAG9F,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAG/E,eAAO,MAAM,UAAU;;;;;CAKb,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC"}
+{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../../src/types/enums.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAGjG,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAGlF,eAAO,MAAM,YAAY;;;;;;;CAOf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAG5E,eAAO,MAAM,eAAe;;;CAGlB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAGrF,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAG5E,eAAO,MAAM,SAAS;;;;;;;;CAQZ,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAGnE,eAAO,MAAM,QAAQ;IACnB,+FAA+F;;CAEvF,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAC;AAGhE,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAG9F,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAG/E,eAAO,MAAM,UAAU;;;;;CAKb,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC"}

package/dist/types/enums.js

@@ -44,6 +44,11 @@ export const ErrorCode = {
     LeaseLost: 'leaseLost',
     Cancelled: 'cancelled',
 };
+// ── Auth Role (well-known role names) ──
+export const AuthRole = {
+    /** Flow engine and trusted internal runners; capability must list in access.roles to allow. */
+    System: 'system',
+};
 // ── Governance Severity ──
 export const GovernanceSeverity = {
     Info: 'info',

package/dist/types/enums.js.map

@@ -1 +1 @@
-{"version":3,"file":"enums.js","sourceRoot":"","sources":["../../src/types/enums.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,kBAAkB;CAC3B,CAAC;AAIX,wBAAwB;AACxB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,YAAY,EAAE,cAAc;CACpB,CAAC;AAIX,uBAAuB;AACvB,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,yBAAyB;AACzB,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,aAAa;IAC1B,KAAK,EAAE,OAAO;CACN,CAAC;AAIX,sBAAsB;AACtB,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,aAAa;IACxB,UAAU,EAAE,cAAc;CAClB,CAAC;AAIX,mBAAmB;AACnB,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;CACJ,CAAC;AAIX,uBAAuB;AACvB,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,wBAAwB,EAAE,4BAA4B;CAC9C,CAAC;AAIX,+BAA+B;AAC/B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAC"}
+{"version":3,"file":"enums.js","sourceRoot":"","sources":["../../src/types/enums.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,kBAAkB;CAC3B,CAAC;AAIX,wBAAwB;AACxB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,YAAY,EAAE,cAAc;CACpB,CAAC;AAIX,uBAAuB;AACvB,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,yBAAyB;AACzB,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,aAAa;IAC1B,KAAK,EAAE,OAAO;CACN,CAAC;AAIX,sBAAsB;AACtB,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,aAAa;IACxB,UAAU,EAAE,cAAc;CAClB,CAAC;AAIX,mBAAmB;AACnB,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,0CAA0C;AAC1C,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,+FAA+F;IAC/F,MAAM,EAAE,QAAQ;CACR,CAAC;AAIX,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;CACJ,CAAC;AAIX,uBAAuB;AACvB,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,wBAAwB,EAAE,4BAA4B;CAC9C,CAAC;AAIX,+BAA+B;AAC/B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAC"}

package/dist/types/index.d.ts

@@ -1,6 +1,6 @@
 export type { AuditRecord, AuditService } from './audit.js';
-export type { CapabilityAuditConfig, CapabilityContract, CapabilityEffects, CapabilityExplanationConfig, } from './capability.js';
-export type { AIProviderConfig, AIProvidersConfig, AuthAdapterConfig, DatabaseConfig, Environment, PlumbusConfig, PromptModelOverride, QueueConfig, } from './config.js';
+export type { CapabilityAuditConfig, CapabilityContract, CapabilityEffects, CapabilityExplanationConfig, CapabilityExposeAs, McpExposureConfig, } from './capability.js';
+export type { AIProviderConfig, AIProvidersConfig, AuthAdapterConfig, DatabaseConfig, Environment, McpAgentConfig, McpConfig, PlumbusConfig, PromptModelOverride, QueueConfig, } from './config.js';
 export type { AIDocument, AIGenerateResult, AIService, AIStreamEvent, AITokenUsage, ConfigService, DataService, EventService, ExecutionContext, FlowExecution, FlowService, LoggerService, QueryOptions, Repository, RequestMeta, SecurityService, TimeService, } from './context.js';
 export type { EntityDefinition, EntityRetention } from './entity.js';
 export { BackoffStrategy, CapabilityKind, ErrorCode, FieldClassification, FlowStepType, GovernanceSeverity, PolicyProfile, RelationType, RuleStatus, } from './enums.js';

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAMA,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5D,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EACL,eAAe,EACf,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAElE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,cAAc,EACd,eAAe,EACf,SAAS,EACT,aAAa,EACb,cAAc,EACd,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEjE,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE/D,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAMA,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5D,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,cAAc,EACd,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EACL,eAAe,EACf,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAElE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,cAAc,EACd,eAAe,EACf,SAAS,EACT,aAAa,EACb,cAAc,EACd,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEjE,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE/D,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC"}

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,iEAAiE;AACjE,uEAAuE;AACvE,8EAA8E;AA4C9E,0BAA0B;AAC1B,OAAO,EACL,eAAe,EACf,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,iEAAiE;AACjE,uEAAuE;AACvE,8EAA8E;AAgD9E,0BAA0B;AAC1B,OAAO,EACL,eAAe,EACf,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/types/security.d.ts

@@ -13,7 +13,9 @@ export interface AuthContext {
     provider: string;
     sessionId?: string;
     authenticatedAt?: Date;
-    /** When true, skip role/scope checks (e.g. flow-driven execution). Tenant scoping still enforced. */
+    /**
+     * @deprecated Use role {@link AuthRole.System} (`system`) instead. Still mapped to `system` for compatibility.
+     */
     internal?: boolean;
 }
 //# sourceMappingURL=security.d.ts.map

package/dist/types/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/types/security.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAGD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/types/security.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAGD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}

package/instructions/capabilities.md

@@ -144,6 +144,42 @@ Errors are `PlumbusError` instances (extends `Error`) with `code`, `message`, an
 
 **Do not** use `throw new Error(...)` in capability handlers — always use `ctx.errors.*()` for proper HTTP status mapping and structured error responses.
 
+## MCP Exposure (Optional)
+
+A capability can be exposed to **external AI agents** as a Model Context Protocol tool by adding `exposeAs: ['mcp']`. The default is HTTP-only; MCP is opt-in per capability.
+
+```ts
+export const getRefund = defineCapability({
+  name: "getRefund",
+  kind: "query",
+  domain: "billing",
+  description: "Fetch a refund by id",
+
+  // Opt in to MCP exposure
+  exposeAs: ["mcp"],
+  mcp: {
+    description: "Look up a refund for billing support agents",  // agent-facing override
+    dangerous: false,           // sets MCP annotations.destructiveHint
+    agentTags: ["billing"],     // categorization hint for agent tool selection
+  },
+
+  // Restrict which agents may call this — service-account-style auth
+  access: {
+    serviceAccounts: ["billing-agent"],
+    tenantScoped: true,
+  },
+
+  // ...input, output, effects, handler unchanged
+});
+```
+
+**Rules when MCP-exposed:**
+- Only `kind: "query"` and `kind: "action"` may be exposed. `job` and `eventHandler` are rejected at `defineCapability()` time.
+- Either `description`, `mcp.description`, or `explanation.summary` is required.
+- Agent identity is controlled via `access.serviceAccounts` and `access.scopes`. Deny-by-default still holds.
+
+Read `node_modules/@plumbus/core/instructions/mcp.md` and `node_modules/@plumbus/mcp/instructions/README.md` for MCP (auth, transports, tasks, testing).
+
 ## Job Capabilities
 
 Capabilities with `kind: "job"` are for long-running operations. They return immediately with a job handle, and the work executes asynchronously.

package/instructions/cli.md

@@ -136,6 +136,50 @@ All migration commands accept `--json` for machine-readable output.
 plumbus dev
 ```
 
+## Production server
+
+`plumbus start` is the production-mode counterpart to `plumbus dev`. It forces `environment: "production"`, runs `validateConfig` (which **fails fast** if `AUTH_SECRET` is missing or weak), and exposes `GET /health` + `GET /ready`.
+
+```bash
+plumbus start                      # defaults: port 3000, host 0.0.0.0
+plumbus start --port 8080 --host 127.0.0.1
+```
+
+Behind a load balancer set `TRUST_PROXY=true` (or a specific IP/CIDR) so Fastify trusts `X-Forwarded-*` headers. `app/server.ts` extension hooks (`onRoutesRegistered`, `resolveAiOverrides`, `onCapabilityError`, `onProcessError`, `onAICostRecorded`, `onFlowError`, `enableStrictStructuredOutputs`) are loaded automatically.
+
+## Translations
+
+```bash
+plumbus translation new <name>     # scaffold app/translations/<name>.translation.ts
+plumbus translation export         # --format json|xliff, --locale, --out-dir
+plumbus translation import         # --format json|xliff, --file or --dir
+plumbus translation status         # --json for CI; exits non-zero on incomplete locales
+```
+
+Wire `plumbus translation status` into CI to catch missing translations before release.
+
+## MCP (Model Context Protocol)
+
+Expose capabilities marked with `exposeAs: ['mcp']` to AI agents.
+
+```bash
+# Generate MCP tool manifest and skill files (always available, no install needed)
+plumbus mcp generate
+# → .plumbus/generated/mcp-manifest.json
+# → .plumbus/generated/skills/<domain>/<kebab-name>.md
+
+# Run an MCP server — requires `pnpm add @plumbus/mcp` (optional peer dep)
+plumbus mcp serve --stdio                        # Claude Desktop, Cursor, local agents
+plumbus mcp serve --http --port 3001             # remote agents over Streamable HTTP
+
+# Human-readable manifest dump for debugging
+plumbus mcp list-tools
+```
+
+If `@plumbus/mcp` is not installed, `plumbus mcp serve` prints `Run: pnpm add @plumbus/mcp` and exits. Manifest generation works without the runtime.
+
+Read `node_modules/@plumbus/core/instructions/mcp.md` and `node_modules/@plumbus/mcp/instructions/README.md` for MCP.
+
 ## App Commands
 
 Run custom command scripts defined in your project's `app/commands/` directory. Use this for setup scripts, data migration tasks, and other one-off operations that need framework infrastructure (DB, config, password hashing).

package/instructions/framework.md

@@ -1,6 +1,6 @@
 # Plumbus Framework
 
-Plumbus is an AI-native, contract-driven TypeScript application framework. You build applications by composing five primitives — **Entities**, **Capabilities**, **Flows**, **Events**, and **Prompts** — through a controlled execution context (`ctx`).
+Plumbus is an AI-native, contract-driven TypeScript application framework. You build applications by composing six primitives — **Capabilities**, **Entities**, **Events**, **Flows**, **Prompts**, and **Translations** — through a controlled execution context (`ctx`). Two opt-in companion packages extend the surface: `@plumbus/chat` for conversational runtimes (the `Chat` primitive lives there) and `@plumbus/mcp` for serving capabilities to AI agents.
 
 ## Non-Negotiable Guardrails
 
@@ -13,11 +13,12 @@ Plumbus is an AI-native, contract-driven TypeScript application framework. You b
 
 | Primitive | Purpose | Defined with |
 |-----------|---------|--------------|
-| **Entity** | Data model with classification, retention, relations | `defineEntity()` |
 | **Capability** | Discrete unit of business logic (query, action, job, event handler) | `defineCapability()` |
-| **Flow** | Multi-step workflow orchestrating capabilities | `defineFlow()` |
+| **Entity** | Data model with classification, retention, relations | `defineEntity()` |
 | **Event** | Domain fact emitted by capabilities, consumed by handlers/flows | `defineEvent()` |
+| **Flow** | Multi-step workflow orchestrating capabilities | `defineFlow()` |
 | **Prompt** | AI interaction template with typed input/output | `definePrompt()` |
+| **Translation** | i18n catalog of localized strings consumed via `ctx.translations` | `defineTranslation()` |
 
 ## Execution Context (`ctx`)
 
@@ -36,10 +37,23 @@ Every capability handler receives `ctx` — the scoped runtime context:
 | `ctx.time` | Time utilities — `ctx.time.now()` |
 | `ctx.config` | Read-only application configuration |
 | `ctx.security` | Security service — policy evaluation and access enforcement |
+| `ctx.translations` | Localized string resolution — `ctx.translations.t("errors.notFound")` |
+
+## Consumption Surfaces
+
+Capabilities can be consumed by:
+
+| Surface | Default | Opt-in |
+|---------|---------|--------|
+| **HTTP** (REST) | Auto-generated for every `query` / `action` / `job` capability | — |
+| **Typed TS clients** (`@plumbus/ui`) | Generated by `plumbus ui generate` | — |
+| **MCP** (Model Context Protocol) | Off | Add `exposeAs: ['mcp']` to selected capabilities; install `@plumbus/mcp`; run `plumbus mcp serve` |
+
+The same `executeCapability()` pipeline (validation → access → handler → audit) runs for every surface. See `node_modules/@plumbus/core/instructions/mcp.md` (core surface) and `node_modules/@plumbus/mcp/instructions/README.md` (runtime recipes) for MCP.
 
 ## How Subsystems Connect
 
-1. **Capabilities** are the only entry points for business logic. HTTP routes are auto-generated from capability contracts.
+1. **Capabilities** are the only entry points for business logic. HTTP routes are auto-generated from capability contracts; selected capabilities may additionally be exposed to AI agents via MCP (`exposeAs: ['mcp']`).
 2. **Entities** provide typed data access via repositories injected on `ctx.data`.
 3. **Events** are emitted inside capabilities (`ctx.events.emit`), persisted via the outbox pattern (same transaction as data), then dispatched to consumers.
 4. **Flows** orchestrate multiple capabilities in sequence, with support for conditional branching, parallel execution, waits, and delays. Flows can be triggered by events or cron schedules.
@@ -67,6 +81,8 @@ app/
     <name>.event.ts   # Event definition
   prompts/
     <name>.prompt.ts  # Prompt definition
+  translations/
+    <name>.translation.ts  # Translation catalog
 config/
   app.config.ts       # PlumbusConfig
   ai.config.ts        # AI provider configuration

package/instructions/mcp.md

@@ -0,0 +1,20 @@
+# MCP (Model Context Protocol) — Core surface
+
+Plumbus capabilities can be exposed to external AI agents as MCP tools. **Contract and CLI** live in `@plumbus/core`; **runtime server, tasks, and test helpers** live in `@plumbus/mcp`.
+
+## Where to read
+
+| Layer | Location |
+|-------|----------|
+| **Agent recipes (start here when `@plumbus/mcp` is installed)** | `node_modules/@plumbus/mcp/instructions/README.md` |
+| **Conceptual docs** | `docs/mcp/` in the monorepo — [overview](../../../docs/mcp/overview.md), [expose-a-capability](../../../docs/mcp/expose-a-capability.md), [agent-authentication](../../../docs/mcp/agent-authentication.md), [tasks-and-jobs](../../../docs/mcp/tasks-and-jobs.md), [transports](../../../docs/mcp/transports.md) |
+
+## Core responsibilities
+
+- **`exposeAs: ['mcp']`** on `defineCapability` — opt-in per capability.
+- **`kind: 'query'` and `kind: 'action'`** — standard MCP tools via `tools/call`.
+- **`kind: 'job'`** — exposed via MCP Tasks (`tools/call` + `_meta.taskMetadata`); see Tasks section in `@plumbus/mcp/instructions/README.md` and [tasks-and-jobs.md](../../../docs/mcp/tasks-and-jobs.md). **`kind: 'eventHandler'`** cannot be MCP-exposed.
+- **`plumbus generate`** — MCP manifest + skill files (no `@plumbus/mcp` install required).
+- **`plumbus mcp serve` / `list-tools` / `mcp generate`** — CLI entry points; `mcp.agents` in `plumbus.config.ts`.
+
+Install the runtime when serving agents: `pnpm add @plumbus/mcp` (optional peer of `@plumbus/core`, version-locked `0.4.x`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plumbus/core",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Plumbus framework core — types, SDK, runtime, CLI, test utilities",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,6 +24,10 @@
     "./vitest": {
       "types": "./dist/vitest/index.d.ts",
       "import": "./dist/vitest/index.js"
+    },
+    "./mcp": {
+      "types": "./dist/mcp/index.d.ts",
+      "import": "./dist/mcp/index.js"
     }
   },
   "files": [
@@ -45,6 +49,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "engines": {
+    "node": ">=20.6.0"
+  },
   "dependencies": {
     "commander": "^12.1.0",
     "drizzle-kit": "^0.31.9",
@@ -58,11 +65,20 @@
     "zod": "^3.24.0",
     "zod-to-json-schema": "^3.25.2"
   },
+  "peerDependencies": {
+    "@plumbus/mcp": "0.4.x"
+  },
+  "peerDependenciesMeta": {
+    "@plumbus/mcp": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@biomejs/biome": "^2.4.6",
     "@types/node": "^25.4.0",
     "@vitest/browser": "^3.0.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "@plumbus/mcp": "0.4.0"
   },
   "scripts": {
     "build": "tsc -b",

package/dist/ai/__tests__/ai-service.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ai-service.test.d.ts.map

package/dist/ai/__tests__/ai-service.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ai-service.test.d.ts","sourceRoot":"","sources":["../../../src/ai/__tests__/ai-service.test.ts"],"names":[],"mappings":""}