usertrust-server 1.4.0

package/README.md

@@ -0,0 +1,74 @@
+# usertrust-server
+
+Self-hostable HTTP control plane for the [usertrust](https://github.com/usertools/usertrust)
+governance kernel. Wraps the headless Governor's two-phase lifecycle
+(authorize → settle/abort) with per-tenant isolation, bearer-key auth, and SSE telemetry.
+
+## Quickstart
+
+```bash
+# Generate a tenant key (high-entropy secret) and its SHA-256 hash for the config:
+KEY=$(openssl rand -hex 32)
+node -e "console.log(require('node:crypto').createHash('sha256').update(process.argv[1]).digest('hex'))" "$KEY"
+```
+
+`usertrust-server.config.json`:
+
+```json
+{
+	"port": 4519,
+	"stateDir": ".usertrust-server",
+	"tenants": [{ "id": "acme", "keyHash": "<sha256 hex of the key>", "budget": 50000 }]
+}
+```
+
+```bash
+usertrust-server --config usertrust-server.config.json
+
+curl -s localhost:4519/v1/authorize -H "Authorization: Bearer $KEY" \
+  -H "content-type: application/json" \
+  -d '{"model":"claude-sonnet-4-6","estimatedInputTokens":200,"maxOutputTokens":100}'
+curl -s localhost:4519/v1/settle -H "Authorization: Bearer $KEY" \
+  -H "content-type: application/json" \
+  -d '{"transferId":"<from authorize>","inputTokens":200,"outputTokens":40}'
+```
+
+## Endpoints
+
+| Method | Path            | Auth   | Purpose                                             |
+| ------ | --------------- | ------ | --------------------------------------------------- |
+| POST   | `/v1/authorize` | Bearer | Phase 1: policy gate + PENDING budget hold          |
+| POST   | `/v1/settle`    | Bearer | Phase 2a: post actual usage, returns a TrustReceipt |
+| POST   | `/v1/abort`     | Bearer | Phase 2b: void the hold for a failed call           |
+| GET    | `/v1/budget`    | Bearer | Remaining tenant budget                             |
+| GET    | `/v1/events`    | Bearer | SSE stream of tenant governance events              |
+| GET    | `/v1/health`    | none   | Liveness                                            |
+
+Errors: `403 policy_denied`, `402 budget_exceeded`, `429 anomaly`, `401 unauthorized`,
+`404 not_found` (unknown/already-settled transferId), `413 too_large` (1 MiB body cap).
+Pending holds not settled within `pendingTtlMs` (default 5 min) are swept and aborted.
+
+## Keys
+
+Tenant keys are generated high-entropy secrets (`openssl rand -hex 32`), never passwords.
+The config stores only the SHA-256 hash of each key — this is the standard API-key model
+(hash-at-rest for a random 256-bit secret), not a password store, so no slow hash
+(scrypt/argon2) is needed. Lookup is timing-safe. The server never logs request bodies,
+messages, params, or Authorization headers.
+
+## Shadow mode (`"enforcement": "evaluate_only"`)
+
+In `evaluate_only` mode a denial is converted into a shadow allow: the client receives
+`200 { shadow: true, shadowId: "shadow_…", decision: "would_deny", reason }` and a
+`denied` event with `shadow: true` is emitted. No reservation is created — a `shadowId`
+is not a `transferId` and cannot be settled or aborted (those routes 404). This is the
+server-layer semantic; other usertrust layers define their own evaluate-only behavior.
+
+## Audit authority
+
+Only Governor-produced receipts and audit-chain records are authoritative. The server
+invents no audit records of its own; every receipt returned by `/v1/settle` comes from
+the tenant's Governor (per-tenant `stateDir/<tenant>` vault: separate audit chain and
+spend ledger). The SSE stream is best-effort operational telemetry, NOT an audit
+source — dropped subscribers lose events. Shadow denials produce no receipt and are
+not auditable or verifiable.

package/dist/cli/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/cli/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":""}

package/dist/cli/main.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+import { loadServerConfig } from "../config.js";
+import { createUsertrustServer } from "../server.js";
+function argValue(flag) {
+    const index = process.argv.indexOf(flag);
+    return index >= 0 ? process.argv[index + 1] : undefined;
+}
+async function main() {
+    const configPath = argValue("--config") ?? "usertrust-server.config.json";
+    const config = await loadServerConfig(configPath);
+    const portOverride = argValue("--port");
+    if (portOverride)
+        config.port = Number.parseInt(portOverride, 10);
+    const server = createUsertrustServer({ config });
+    const { port } = await server.listen();
+    process.stderr.write(`usertrust-server listening on ${config.host}:${port}\n`);
+    const shutdown = async () => {
+        process.stderr.write("usertrust-server shutting down — voiding pending holds\n");
+        await server.close();
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void shutdown());
+    process.on("SIGTERM", () => void shutdown());
+}
+main().catch((err) => {
+    process.stderr.write(`usertrust-server failed to start: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/cli/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AACA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,SAAS,QAAQ,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,IAAI;IAClB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,8BAA8B,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,YAAY;QAAE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACjF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACzF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,85 @@
+import { z } from "zod";
+declare const TenantSchema: z.ZodObject<{
+    id: z.ZodString;
+    /** SHA-256 hex of the tenant's bearer key. Keys are never stored in plaintext. */
+    keyHash: z.ZodString;
+    budget: z.ZodOptional<z.ZodNumber>;
+    tier: z.ZodOptional<z.ZodString>;
+    configPath: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    keyHash: string;
+    budget?: number | undefined;
+    tier?: string | undefined;
+    configPath?: string | undefined;
+}, {
+    id: string;
+    keyHash: string;
+    budget?: number | undefined;
+    tier?: string | undefined;
+    configPath?: string | undefined;
+}>;
+declare const ServerConfigSchema: z.ZodObject<{
+    host: z.ZodDefault<z.ZodString>;
+    port: z.ZodDefault<z.ZodNumber>;
+    stateDir: z.ZodDefault<z.ZodString>;
+    enforcement: z.ZodDefault<z.ZodEnum<["enforce", "evaluate_only"]>>;
+    pendingTtlMs: z.ZodDefault<z.ZodNumber>;
+    dryRun: z.ZodDefault<z.ZodBoolean>;
+    tenants: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        /** SHA-256 hex of the tenant's bearer key. Keys are never stored in plaintext. */
+        keyHash: z.ZodString;
+        budget: z.ZodOptional<z.ZodNumber>;
+        tier: z.ZodOptional<z.ZodString>;
+        configPath: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        keyHash: string;
+        budget?: number | undefined;
+        tier?: string | undefined;
+        configPath?: string | undefined;
+    }, {
+        id: string;
+        keyHash: string;
+        budget?: number | undefined;
+        tier?: string | undefined;
+        configPath?: string | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    host: string;
+    port: number;
+    stateDir: string;
+    enforcement: "enforce" | "evaluate_only";
+    pendingTtlMs: number;
+    dryRun: boolean;
+    tenants: {
+        id: string;
+        keyHash: string;
+        budget?: number | undefined;
+        tier?: string | undefined;
+        configPath?: string | undefined;
+    }[];
+}, {
+    tenants: {
+        id: string;
+        keyHash: string;
+        budget?: number | undefined;
+        tier?: string | undefined;
+        configPath?: string | undefined;
+    }[];
+    host?: string | undefined;
+    port?: number | undefined;
+    stateDir?: string | undefined;
+    enforcement?: "enforce" | "evaluate_only" | undefined;
+    pendingTtlMs?: number | undefined;
+    dryRun?: boolean | undefined;
+}>;
+export type TenantConfig = z.infer<typeof TenantSchema>;
+export type ServerConfig = z.infer<typeof ServerConfigSchema>;
+export declare function hashKey(key: string): string;
+export declare function loadServerConfig(path: string): Promise<ServerConfig>;
+/** Constant-time key lookup: hash the presented key, compare against every tenant. */
+export declare function resolveTenant(config: ServerConfig, bearerKey: string): TenantConfig | null;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,YAAY;;IAIjB,kFAAkF;;;;;;;;;;;;;;;;;EAKjF,CAAC;AAEH,QAAA,MAAM,kBAAkB;;;;;;;;;QAPvB,kFAAkF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAejF,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkB1E;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAU1F"}

package/dist/config.js

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+import { createHash, timingSafeEqual } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { z } from "zod";
+const TenantSchema = z.object({
+    // Interpolated into a filesystem path (pool.ts vaultBase), so it must not be
+    // able to escape stateDir — constrain to a safe, traversal-proof charset.
+    id: z.string().regex(/^[a-zA-Z0-9_-]+$/),
+    /** SHA-256 hex of the tenant's bearer key. Keys are never stored in plaintext. */
+    keyHash: z.string().regex(/^[0-9a-f]{64}$/),
+    budget: z.number().int().positive().optional(),
+    tier: z.string().optional(),
+    configPath: z.string().optional(),
+});
+const ServerConfigSchema = z.object({
+    host: z.string().default("127.0.0.1"),
+    port: z.number().int().min(1).max(65535).default(4519),
+    stateDir: z.string().default(".usertrust-server"),
+    enforcement: z.enum(["enforce", "evaluate_only"]).default("enforce"),
+    pendingTtlMs: z.number().int().positive().default(300_000),
+    dryRun: z.boolean().default(false),
+    tenants: z.array(TenantSchema).min(1),
+});
+export function hashKey(key) {
+    return createHash("sha256").update(key, "utf-8").digest("hex");
+}
+export async function loadServerConfig(path) {
+    const raw = await readFile(path, "utf-8");
+    const config = ServerConfigSchema.parse(JSON.parse(raw));
+    const ids = new Set();
+    const keyHashes = new Set();
+    for (const tenant of config.tenants) {
+        if (ids.has(tenant.id)) {
+            throw new Error(`duplicate tenant id: ${tenant.id}`);
+        }
+        ids.add(tenant.id);
+        // A duplicated keyHash would silently resolve to the last matching tenant
+        // (resolveTenant keeps the last match), misrouting auth. Reject it.
+        if (keyHashes.has(tenant.keyHash)) {
+            throw new Error(`duplicate tenant keyHash: ${tenant.id}`);
+        }
+        keyHashes.add(tenant.keyHash);
+    }
+    return config;
+}
+/** Constant-time key lookup: hash the presented key, compare against every tenant. */
+export function resolveTenant(config, bearerKey) {
+    const presented = Buffer.from(hashKey(bearerKey), "hex");
+    let match = null;
+    for (const tenant of config.tenants) {
+        const expected = Buffer.from(tenant.keyHash, "hex");
+        if (expected.length === presented.length && timingSafeEqual(expected, presented)) {
+            match = tenant;
+        }
+    }
+    return match;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACxC,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAC;AAKH,MAAM,UAAU,OAAO,CAAC,GAAW;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnB,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,SAAiB;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK,GAAwB,IAAI,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAClF,KAAK,GAAG,MAAM,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/events.d.ts

@@ -0,0 +1,36 @@
+export type ServerEvent = {
+    type: "authorized";
+    transferId: string;
+    model: string;
+    estimatedCost: number;
+    at: string;
+} | {
+    type: "settled";
+    transferId: string;
+    cost: number;
+    budgetRemaining: number;
+    at: string;
+} | {
+    type: "aborted";
+    transferId: string;
+    reason: string;
+    at: string;
+} | {
+    type: "denied";
+    error: string;
+    reason: string;
+    shadow: boolean;
+    at: string;
+} | {
+    type: "pending_expired";
+    transferId: string;
+    at: string;
+};
+type Listener = (event: ServerEvent) => void;
+export declare class EventBus {
+    private readonly listeners;
+    subscribe(tenantId: string, listener: Listener): () => void;
+    publish(tenantId: string, event: ServerEvent): void;
+}
+export {};
+//# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,KAAK,QAAQ,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;AAE7C,qBAAa,QAAQ;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,IAAI;IAe3D,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI;CAWnD"}

package/dist/events.js

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+export class EventBus {
+    listeners = new Map();
+    subscribe(tenantId, listener) {
+        let set = this.listeners.get(tenantId);
+        if (!set) {
+            set = new Set();
+            this.listeners.set(tenantId, set);
+        }
+        set.add(listener);
+        return () => {
+            set.delete(listener);
+            if (set.size === 0) {
+                this.listeners.delete(tenantId);
+            }
+        };
+    }
+    publish(tenantId, event) {
+        const set = this.listeners.get(tenantId);
+        if (!set)
+            return;
+        for (const listener of set) {
+            try {
+                listener(event);
+            }
+            catch {
+                // A broken subscriber must never break governance event delivery.
+            }
+        }
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAWjC,MAAM,OAAO,QAAQ;IACH,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE9D,SAAS,CAAC,QAAgB,EAAE,QAAkB;QAC7C,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,OAAO,GAAG,EAAE;YACX,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;QACF,CAAC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,KAAkB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,KAAK,MAAM,QAAQ,IAAI,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACR,kEAAkE;YACnE,CAAC;QACF,CAAC;IACF,CAAC;CACD"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { hashKey, loadServerConfig, resolveTenant } from "./config.js";
+export type { ServerConfig, TenantConfig } from "./config.js";
+export { EventBus } from "./events.js";
+export type { ServerEvent } from "./events.js";
+export { GovernorPool } from "./pool.js";
+export type { GovernorFactory } from "./pool.js";
+export { createUsertrustServer } from "./server.js";
+export type { UsertrustServer } from "./server.js";
+export { AbortRequestSchema, AuthorizeRequestSchema, SettleRequestSchema, toHttpError, } from "./wire.js";
+export type { AuthorizeRequest, AuthorizeResponse, SettleRequest, ShadowResponse } from "./wire.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACN,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,GACX,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+export { hashKey, loadServerConfig, resolveTenant } from "./config.js";
+export { EventBus } from "./events.js";
+export { GovernorPool } from "./pool.js";
+export { createUsertrustServer } from "./server.js";
+export { AbortRequestSchema, AuthorizeRequestSchema, SettleRequestSchema, toHttpError, } from "./wire.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EACN,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,GACX,MAAM,WAAW,CAAC"}

package/dist/pool.d.ts

@@ -0,0 +1,17 @@
+import type { Governor, TrustOpts } from "usertrust";
+import type { ServerConfig, TenantConfig } from "./config.js";
+export type GovernorFactory = (opts: TrustOpts) => Promise<Governor>;
+/**
+ * Lazy per-tenant Governor instances. Tenant isolation comes from per-tenant
+ * vaultBase directories (separate audit chains + spend ledgers) and per-tenant
+ * budget/tier overrides. The factory is injectable for tests.
+ */
+export declare class GovernorPool {
+    private readonly config;
+    private readonly factory;
+    private readonly governors;
+    constructor(config: ServerConfig, factory?: GovernorFactory);
+    get(tenant: TenantConfig): Promise<Governor>;
+    destroyAll(): Promise<void>;
+}
+//# sourceMappingURL=pool.d.ts.map

package/dist/pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErE;;;;GAIG;AACH,qBAAa,YAAY;IAIvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;gBAGhD,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,eAAgD;IAG3E,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmBtC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAKjC"}

package/dist/pool.js

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+import { join } from "node:path";
+import { createGovernor } from "usertrust";
+/**
+ * Lazy per-tenant Governor instances. Tenant isolation comes from per-tenant
+ * vaultBase directories (separate audit chains + spend ledgers) and per-tenant
+ * budget/tier overrides. The factory is injectable for tests.
+ */
+export class GovernorPool {
+    config;
+    factory;
+    governors = new Map();
+    constructor(config, factory = (opts) => createGovernor(opts)) {
+        this.config = config;
+        this.factory = factory;
+    }
+    get(tenant) {
+        const existing = this.governors.get(tenant.id);
+        if (existing)
+            return existing;
+        const opts = {
+            vaultBase: join(this.config.stateDir, tenant.id),
+            dryRun: this.config.dryRun,
+        };
+        if (tenant.budget !== undefined)
+            opts.budget = tenant.budget;
+        if (tenant.tier !== undefined)
+            opts.tier = tenant.tier;
+        if (tenant.configPath !== undefined)
+            opts.configPath = tenant.configPath;
+        const created = this.factory(opts).catch((err) => {
+            // Failed creation must not poison the cache.
+            this.governors.delete(tenant.id);
+            throw err;
+        });
+        this.governors.set(tenant.id, created);
+        return created;
+    }
+    async destroyAll() {
+        const all = [...this.governors.values()];
+        this.governors.clear();
+        await Promise.allSettled(all.map(async (p) => (await p).destroy()));
+    }
+}
+//# sourceMappingURL=pool.js.map

package/dist/pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAK3C;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAIN;IACA;IAJD,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IAElE,YACkB,MAAoB,EACpB,UAA2B,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC;QADzD,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAkD;IACxE,CAAC;IAEJ,GAAG,CAAC,MAAoB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAc;YACvB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACzD,6CAA6C;YAC7C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,MAAM,GAAG,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU;QACf,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;CACD"}

package/dist/server.d.ts

@@ -0,0 +1,19 @@
+import type { ServerConfig } from "./config.js";
+import { EventBus } from "./events.js";
+import type { GovernorFactory } from "./pool.js";
+import { GovernorPool } from "./pool.js";
+export interface UsertrustServer {
+    listen(): Promise<{
+        port: number;
+    }>;
+    close(): Promise<void>;
+    readonly bus: EventBus;
+    readonly pool: GovernorPool;
+    pendingCount(): number;
+    sweepExpired(now?: number): Promise<number>;
+}
+export declare function createUsertrustServer(opts: {
+    config: ServerConfig;
+    factory?: GovernorFactory;
+}): UsertrustServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAuBzC,MAAM,WAAW,eAAe;IAC/B,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,YAAY,IAAI,MAAM,CAAC;IACvB,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,eAAe,CAAC;CAC1B,GAAG,eAAe,CA0WlB"}

package/dist/server.js

@@ -0,0 +1,370 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+import { resolveTenant } from "./config.js";
+import { EventBus } from "./events.js";
+import { GovernorPool } from "./pool.js";
+import { AbortRequestSchema, AuthorizeRequestSchema, SettleRequestSchema, toHttpError, } from "./wire.js";
+const MAX_BODY_BYTES = 1024 * 1024;
+const SERVER_NAME = "usertrust-server";
+const SERVER_VERSION = "1.3.0";
+const SWEEP_INTERVAL_MS = 30_000;
+/** Max concurrent SSE streams a single tenant may hold open at once. */
+const MAX_SSE_PER_TENANT = 8;
+/** Drop an SSE subscriber whose kernel send buffer backs up past this. */
+const MAX_SSE_BUFFER_BYTES = 1024 * 1024;
+export function createUsertrustServer(opts) {
+    const { config } = opts;
+    const bus = new EventBus();
+    const pool = opts.factory ? new GovernorPool(config, opts.factory) : new GovernorPool(config);
+    const pending = new Map();
+    // Live SSE stream count per tenant id, enforcing MAX_SSE_PER_TENANT.
+    const sseCounts = new Map();
+    let httpServer;
+    let sweeper;
+    function sendJson(res, status, body) {
+        const payload = JSON.stringify(body);
+        res.writeHead(status, {
+            "content-type": "application/json",
+            "content-length": Buffer.byteLength(payload),
+        });
+        res.end(payload);
+    }
+    function readBody(req) {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            let size = 0;
+            req.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_BODY_BYTES) {
+                    // Stop buffering and let the caller answer 413; destroying the
+                    // socket here would reset the connection before the response
+                    // can be flushed to the client.
+                    req.removeAllListeners("data");
+                    req.removeAllListeners("end");
+                    resolve(null);
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+            req.on("error", reject);
+        });
+    }
+    /** Extract the bearer key. Empty or whitespace-only tokens are rejected before hashing. */
+    function bearerKey(req) {
+        const header = req.headers.authorization;
+        if (!header?.startsWith("Bearer "))
+            return null;
+        const token = header.slice("Bearer ".length);
+        if (token.trim() === "")
+            return null;
+        return token;
+    }
+    async function handleAuthorize(tenant, body, res) {
+        const parsed = AuthorizeRequestSchema.safeParse(body);
+        if (!parsed.success) {
+            sendJson(res, 400, {
+                error: "bad_request",
+                reason: parsed.error.issues[0]?.message ?? "invalid",
+            });
+            return;
+        }
+        const governor = await pool.get(tenant);
+        try {
+            const auth = await governor.authorize(parsed.data);
+            pending.set(auth.transferId, { auth, tenantId: tenant.id, createdAt: Date.now() });
+            bus.publish(tenant.id, {
+                type: "authorized",
+                transferId: auth.transferId,
+                model: auth.model,
+                estimatedCost: auth.estimatedCost,
+                at: new Date().toISOString(),
+            });
+            sendJson(res, 200, {
+                transferId: auth.transferId,
+                estimatedCost: auth.estimatedCost,
+                model: auth.model,
+                createdAt: auth.createdAt,
+            });
+        }
+        catch (err) {
+            const mapped = toHttpError(err);
+            const shadow = config.enforcement === "evaluate_only" && mapped.status !== 500;
+            bus.publish(tenant.id, {
+                type: "denied",
+                error: mapped.body.error,
+                reason: mapped.body.reason,
+                shadow,
+                at: new Date().toISOString(),
+            });
+            if (shadow) {
+                // Shadow ids are NOT transferIds: no reservation exists, so they can
+                // never be settled or aborted (those routes 404 on unknown ids).
+                sendJson(res, 200, {
+                    shadow: true,
+                    shadowId: `shadow_${randomUUID()}`,
+                    decision: "would_deny",
+                    reason: mapped.body.reason,
+                });
+                return;
+            }
+            sendJson(res, mapped.status, mapped.body);
+        }
+    }
+    async function handleSettle(tenant, body, res) {
+        const parsed = SettleRequestSchema.safeParse(body);
+        if (!parsed.success) {
+            sendJson(res, 400, { error: "bad_request", reason: "invalid settle request" });
+            return;
+        }
+        const { transferId, ...usage } = parsed.data;
+        const entry = pending.get(transferId);
+        if (!entry || entry.tenantId !== tenant.id) {
+            sendJson(res, 404, { error: "not_found", reason: "unknown transferId" });
+            return;
+        }
+        // Atomic claim: first concurrent caller wins; a governor failure re-inserts
+        // the entry so a transient settle error stays retryable.
+        pending.delete(transferId);
+        try {
+            const governor = await pool.get(tenant);
+            const receipt = await governor.settle(entry.auth, usage);
+            bus.publish(tenant.id, {
+                type: "settled",
+                transferId,
+                cost: receipt.cost,
+                budgetRemaining: receipt.budgetRemaining,
+                at: new Date().toISOString(),
+            });
+            sendJson(res, 200, receipt);
+        }
+        catch (err) {
+            pending.set(transferId, entry);
+            const mapped = toHttpError(err);
+            sendJson(res, mapped.status, mapped.body);
+        }
+    }
+    async function handleAbort(tenant, body, res) {
+        const parsed = AbortRequestSchema.safeParse(body);
+        if (!parsed.success) {
+            sendJson(res, 400, { error: "bad_request", reason: "invalid abort request" });
+            return;
+        }
+        const { transferId } = parsed.data;
+        const entry = pending.get(transferId);
+        if (!entry || entry.tenantId !== tenant.id) {
+            sendJson(res, 404, { error: "not_found", reason: "unknown transferId" });
+            return;
+        }
+        // Atomic claim with re-insert on failure (same contract as settle).
+        pending.delete(transferId);
+        try {
+            const governor = await pool.get(tenant);
+            await governor.abort(entry.auth, parsed.data.error);
+        }
+        catch (err) {
+            pending.set(transferId, entry);
+            const mapped = toHttpError(err);
+            sendJson(res, mapped.status, mapped.body);
+            return;
+        }
+        bus.publish(tenant.id, {
+            type: "aborted",
+            transferId,
+            reason: parsed.data.error ?? "aborted",
+            at: new Date().toISOString(),
+        });
+        sendJson(res, 200, { aborted: true, transferId });
+    }
+    function handleEvents(tenant, req, res) {
+        // Per-tenant fan-out cap: a tenant opening unbounded SSE streams would pin
+        // memory and file descriptors. Reject past the cap; the slot is released
+        // when the connection closes (below).
+        const active = sseCounts.get(tenant.id) ?? 0;
+        if (active >= MAX_SSE_PER_TENANT) {
+            sendJson(res, 429, { error: "too_many_streams", reason: "SSE subscriber limit reached" });
+            return;
+        }
+        sseCounts.set(tenant.id, active + 1);
+        let released = false;
+        const release = () => {
+            if (released)
+                return;
+            released = true;
+            const remaining = (sseCounts.get(tenant.id) ?? 1) - 1;
+            if (remaining <= 0)
+                sseCounts.delete(tenant.id);
+            else
+                sseCounts.set(tenant.id, remaining);
+        };
+        res.writeHead(200, {
+            "content-type": "text/event-stream",
+            "cache-control": "no-cache",
+            connection: "keep-alive",
+        });
+        res.write(": connected\n\n");
+        // SSE is best-effort operational telemetry — a broken pipe drops the
+        // subscriber, it never breaks governance processing.
+        const unsubscribe = bus.subscribe(tenant.id, (event) => {
+            try {
+                const ok = res.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+                // Backpressure guard: a subscriber that cannot keep up (kernel send
+                // buffer backed up past 1 MiB) is dropped rather than allowed to grow
+                // unbounded. destroy() fires the close handler → unsubscribe + release.
+                if (!ok && res.writableLength > MAX_SSE_BUFFER_BYTES)
+                    res.destroy();
+            }
+            catch {
+                unsubscribe();
+            }
+        });
+        const heartbeat = setInterval(() => {
+            try {
+                res.write(": heartbeat\n\n");
+            }
+            catch {
+                clearInterval(heartbeat);
+                unsubscribe();
+            }
+        }, 15_000);
+        heartbeat.unref();
+        req.on("close", () => {
+            clearInterval(heartbeat);
+            unsubscribe();
+            release();
+        });
+    }
+    async function route(req, res) {
+        const url = req.url ?? "/";
+        if (req.method === "GET" && url === "/v1/health") {
+            sendJson(res, 200, { ok: true, name: SERVER_NAME, version: SERVER_VERSION });
+            return;
+        }
+        const key = bearerKey(req);
+        const tenant = key ? resolveTenant(config, key) : null;
+        if (!tenant) {
+            sendJson(res, 401, { error: "unauthorized", reason: "missing or invalid bearer key" });
+            return;
+        }
+        if (req.method === "GET" && url === "/v1/budget") {
+            const governor = await pool.get(tenant);
+            sendJson(res, 200, { remaining: governor.budgetRemaining() });
+            return;
+        }
+        if (req.method === "GET" && url === "/v1/events") {
+            handleEvents(tenant, req, res);
+            return;
+        }
+        if (req.method === "POST" &&
+            (url === "/v1/authorize" || url === "/v1/settle" || url === "/v1/abort")) {
+            const raw = await readBody(req);
+            if (raw === null) {
+                // The rest of the oversized body is never read — close the
+                // connection after the response so the socket cannot be reused.
+                res.setHeader("connection", "close");
+                sendJson(res, 413, { error: "too_large", reason: "body exceeds 1 MiB" });
+                return;
+            }
+            let body;
+            try {
+                body = JSON.parse(raw === "" ? "{}" : raw);
+            }
+            catch {
+                sendJson(res, 400, { error: "bad_request", reason: "invalid JSON" });
+                return;
+            }
+            if (url === "/v1/authorize")
+                await handleAuthorize(tenant, body, res);
+            else if (url === "/v1/settle")
+                await handleSettle(tenant, body, res);
+            else
+                await handleAbort(tenant, body, res);
+            return;
+        }
+        sendJson(res, 404, { error: "not_found", reason: "unknown route" });
+    }
+    async function abortEntry(transferId, entry, reason) {
+        const tenant = config.tenants.find((t) => t.id === entry.tenantId);
+        if (tenant) {
+            try {
+                const governor = await pool.get(tenant);
+                await governor.abort(entry.auth, reason);
+            }
+            catch {
+                // Best-effort — the Governor's own destroy()/reconciliation voids
+                // anything the control plane fails to abort here.
+            }
+        }
+    }
+    async function sweepExpired(now = Date.now()) {
+        let swept = 0;
+        for (const [transferId, entry] of pending) {
+            if (now - entry.createdAt < config.pendingTtlMs)
+                continue;
+            pending.delete(transferId);
+            swept += 1;
+            await abortEntry(transferId, entry, "pending TTL expired");
+            bus.publish(entry.tenantId, {
+                type: "pending_expired",
+                transferId,
+                at: new Date().toISOString(),
+            });
+        }
+        return swept;
+    }
+    return {
+        bus,
+        pool,
+        pendingCount: () => pending.size,
+        sweepExpired,
+        listen() {
+            return new Promise((resolve, reject) => {
+                httpServer = createServer((req, res) => {
+                    route(req, res).catch((err) => {
+                        const mapped = toHttpError(err);
+                        if (!res.headersSent)
+                            sendJson(res, mapped.status, mapped.body);
+                    });
+                });
+                httpServer.on("error", reject);
+                httpServer.listen(config.port, config.host, () => {
+                    sweeper = setInterval(() => {
+                        void sweepExpired();
+                    }, SWEEP_INTERVAL_MS);
+                    sweeper.unref();
+                    const address = httpServer?.address();
+                    const port = typeof address === "object" && address !== null ? address.port : config.port;
+                    resolve({ port });
+                });
+            });
+        },
+        async close() {
+            if (sweeper)
+                clearInterval(sweeper);
+            // Abort every remaining pending hold (best-effort) so the control plane
+            // and the ledger stay consistent; Governor.destroy() voids at the ledger
+            // layer as the backstop.
+            const remaining = [...pending.entries()];
+            pending.clear();
+            for (const [transferId, entry] of remaining) {
+                await abortEntry(transferId, entry, "server shutdown");
+                bus.publish(entry.tenantId, {
+                    type: "aborted",
+                    transferId,
+                    reason: "server shutdown",
+                    at: new Date().toISOString(),
+                });
+            }
+            await new Promise((resolve) => {
+                if (!httpServer)
+                    return resolve();
+                httpServer.closeAllConnections();
+                httpServer.close(() => resolve());
+            });
+            await pool.destroyAll();
+        },
+    };
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACN,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,GACX,MAAM,WAAW,CAAC;AAEnB,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AAiBzC,MAAM,UAAU,qBAAqB,CAAC,IAGrC;IACA,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,IAAI,UAA8B,CAAC;IACnC,IAAI,OAAmC,CAAC;IAExC,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;YACrB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;SAC5C,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,SAAS,QAAQ,CAAC,GAAoB;QACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAChC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;oBAC3B,+DAA+D;oBAC/D,6DAA6D;oBAC7D,gCAAgC;oBAChC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC/B,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO;gBACR,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,SAAS,SAAS,CAAC,GAAoB;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,UAAU,eAAe,CAC7B,MAAoB,EACpB,IAAa,EACb,GAAmB;QAEnB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBAClB,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;gBACtB,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;aACzB,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,KAAK,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;YAC/E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;gBACtB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,MAAM;gBACN,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,iEAAiE;gBACjE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBAClB,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,UAAU,UAAU,EAAE,EAAE;oBAClC,QAAQ,EAAE,YAAY;oBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;IAED,KAAK,UAAU,YAAY,CAC1B,MAAoB,EACpB,IAAa,EACb,GAAmB;QAEnB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC/E,OAAO;QACR,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzE,OAAO;QACR,CAAC;QACD,4EAA4E;QAC5E,yDAAyD;QACzD,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;gBACtB,IAAI,EAAE,SAAS;gBACf,UAAU;gBACV,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;IAED,KAAK,UAAU,WAAW,CACzB,MAAoB,EACpB,IAAa,EACb,GAAmB;QAEnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC9E,OAAO;QACR,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzE,OAAO;QACR,CAAC;QACD,oEAAoE;QACpE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;YACtB,IAAI,EAAE,SAAS;YACf,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS;YACtC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC5B,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS,YAAY,CAAC,MAAoB,EAAE,GAAoB,EAAE,GAAmB;QACpF,2EAA2E;QAC3E,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,kBAAkB,EAAE,CAAC;YAClC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAC1F,OAAO;QACR,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG,GAAS,EAAE;YAC1B,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,SAAS,IAAI,CAAC;gBAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;;gBAC3C,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC,CAAC;QAEF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACxB,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7B,qEAAqE;QACrE,qDAAqD;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE;YACtD,IAAI,CAAC;gBACJ,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjF,oEAAoE;gBACpE,sEAAsE;gBACtE,wEAAwE;gBACxE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,cAAc,GAAG,oBAAoB;oBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACR,WAAW,EAAE,CAAC;YACf,CAAC;QACF,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC;gBACJ,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACR,aAAa,CAAC,SAAS,CAAC,CAAC;gBACzB,WAAW,EAAE,CAAC;YACf,CAAC;QACF,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,GAAoB,EAAE,GAAmB;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAClD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;YAC7E,OAAO;QACR,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACvF,OAAO;QACR,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAC9D,OAAO;QACR,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAClD,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,OAAO;QACR,CAAC;QACD,IACC,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,WAAW,CAAC,EACvE,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,2DAA2D;gBAC3D,gEAAgE;gBAChE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACzE,OAAO;YACR,CAAC;YACD,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBACrE,OAAO;YACR,CAAC;YACD,IAAI,GAAG,KAAK,eAAe;gBAAE,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;iBACjE,IAAI,GAAG,KAAK,YAAY;gBAAE,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;;gBAChE,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,UAAU,UAAU,CACxB,UAAkB,EAClB,KAAmB,EACnB,MAAc;QAEd,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACR,kEAAkE;gBAClE,kDAAkD;YACnD,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;QACnD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,YAAY;gBAAE,SAAS;YAC1D,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3B,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAC3B,IAAI,EAAE,iBAAiB;gBACvB,UAAU;gBACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC5B,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACN,GAAG;QACH,IAAI;QACJ,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI;QAChC,YAAY;QACZ,MAAM;YACL,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACtC,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACtC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;wBACtC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;wBAChC,IAAI,CAAC,GAAG,CAAC,WAAW;4BAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBACjE,CAAC,CAAC,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC/B,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;oBAChD,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;wBAC1B,KAAK,YAAY,EAAE,CAAC;oBACrB,CAAC,EAAE,iBAAiB,CAAC,CAAC;oBACtB,OAAO,CAAC,KAAK,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC1F,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACV,IAAI,OAAO;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YACpC,wEAAwE;YACxE,yEAAyE;YACzE,yBAAyB;YACzB,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC7C,MAAM,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;oBAC3B,IAAI,EAAE,SAAS;oBACf,UAAU;oBACV,MAAM,EAAE,iBAAiB;oBACzB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBAC5B,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,IAAI,CAAC,UAAU;oBAAE,OAAO,OAAO,EAAE,CAAC;gBAClC,UAAU,CAAC,mBAAmB,EAAE,CAAC;gBACjC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/wire.d.ts

@@ -0,0 +1,85 @@
+import { z } from "zod";
+export declare const AuthorizeRequestSchema: z.ZodObject<{
+    model: z.ZodString;
+    estimatedInputTokens: z.ZodOptional<z.ZodNumber>;
+    maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+    messages: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    actor: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    model: string;
+    params?: Record<string, unknown> | undefined;
+    estimatedInputTokens?: number | undefined;
+    maxOutputTokens?: number | undefined;
+    messages?: unknown[] | undefined;
+    actor?: string | undefined;
+}, {
+    model: string;
+    params?: Record<string, unknown> | undefined;
+    estimatedInputTokens?: number | undefined;
+    maxOutputTokens?: number | undefined;
+    messages?: unknown[] | undefined;
+    actor?: string | undefined;
+}>;
+export declare const SettleRequestSchema: z.ZodObject<{
+    transferId: z.ZodString;
+    inputTokens: z.ZodOptional<z.ZodNumber>;
+    outputTokens: z.ZodOptional<z.ZodNumber>;
+    chunksDelivered: z.ZodOptional<z.ZodNumber>;
+    usageSource: z.ZodOptional<z.ZodEnum<["provider", "estimated"]>>;
+}, "strip", z.ZodTypeAny, {
+    transferId: string;
+    inputTokens?: number | undefined;
+    outputTokens?: number | undefined;
+    chunksDelivered?: number | undefined;
+    usageSource?: "provider" | "estimated" | undefined;
+}, {
+    transferId: string;
+    inputTokens?: number | undefined;
+    outputTokens?: number | undefined;
+    chunksDelivered?: number | undefined;
+    usageSource?: "provider" | "estimated" | undefined;
+}>;
+export declare const AbortRequestSchema: z.ZodObject<{
+    transferId: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    transferId: string;
+    error?: string | undefined;
+}, {
+    transferId: string;
+    error?: string | undefined;
+}>;
+export type AuthorizeRequest = z.infer<typeof AuthorizeRequestSchema>;
+export type SettleRequest = z.infer<typeof SettleRequestSchema>;
+export type AbortRequest = z.infer<typeof AbortRequestSchema>;
+export interface AuthorizeResponse {
+    transferId: string;
+    estimatedCost: number;
+    model: string;
+    createdAt: number;
+}
+/**
+ * Shadow (evaluate_only) response. Carries a `shadowId` — deliberately NOT a
+ * `transferId` — because no reservation exists: shadow ids cannot be settled
+ * or aborted, and hitting those routes with one 404s naturally.
+ */
+export interface ShadowResponse {
+    shadow: true;
+    shadowId: string;
+    decision: "would_deny";
+    reason: string;
+}
+/**
+ * Map governance errors to HTTP responses. Unknown errors return an opaque
+ * 500 — internal messages (which may embed key material or file paths) are
+ * never forwarded to clients.
+ */
+export declare function toHttpError(err: unknown): {
+    status: number;
+    body: {
+        error: string;
+        reason: string;
+    };
+};
+//# sourceMappingURL=wire.d.ts.map

package/dist/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAOjC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;EAM9B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;EAG7B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC,CAiBA"}

package/dist/wire.js

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+import { AnomalyError, InsufficientBalanceError, PolicyDeniedError } from "usertrust";
+import { z } from "zod";
+export const AuthorizeRequestSchema = z.object({
+    model: z.string().min(1),
+    estimatedInputTokens: z.number().int().nonnegative().optional(),
+    maxOutputTokens: z.number().int().positive().optional(),
+    messages: z.array(z.unknown()).optional(),
+    params: z.record(z.unknown()).optional(),
+    actor: z.string().optional(),
+});
+export const SettleRequestSchema = z.object({
+    transferId: z.string().min(1),
+    inputTokens: z.number().int().nonnegative().optional(),
+    outputTokens: z.number().int().nonnegative().optional(),
+    chunksDelivered: z.number().int().nonnegative().optional(),
+    usageSource: z.enum(["provider", "estimated"]).optional(),
+});
+export const AbortRequestSchema = z.object({
+    transferId: z.string().min(1),
+    error: z.string().optional(),
+});
+/**
+ * Map governance errors to HTTP responses. Unknown errors return an opaque
+ * 500 — internal messages (which may embed key material or file paths) are
+ * never forwarded to clients.
+ */
+export function toHttpError(err) {
+    if (err instanceof PolicyDeniedError) {
+        return { status: 403, body: { error: "policy_denied", reason: err.reason } };
+    }
+    if (err instanceof InsufficientBalanceError) {
+        return {
+            status: 402,
+            body: {
+                error: "budget_exceeded",
+                reason: `need ${err.required}, have ${err.available}`,
+            },
+        };
+    }
+    if (err instanceof AnomalyError) {
+        return { status: 429, body: { error: "anomaly", reason: err.message } };
+    }
+    return { status: 500, body: { error: "internal", reason: "internal error" } };
+}
+//# sourceMappingURL=wire.js.map

package/dist/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC/D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAyBH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IAIvC,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC7C,OAAO;YACN,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACL,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,QAAQ,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,SAAS,EAAE;aACrD;SACD,CAAC;IACH,CAAC;IACD,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC;AAC/E,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+	"name": "usertrust-server",
+	"version": "1.4.0",
+	"description": "Self-hostable HTTP control plane for the usertrust governance kernel",
+	"license": "Apache-2.0",
+	"author": "Usertools, Inc. <hello@usertools.ai> (https://usertrust.ai)",
+	"homepage": "https://usertrust.ai",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/usertools-ai/usertrust.git",
+		"directory": "packages/server"
+	},
+	"bugs": "https://github.com/usertools-ai/usertrust/issues",
+	"keywords": ["ai", "governance", "llm", "agent", "server", "self-hosted", "control-plane"],
+	"type": "module",
+	"main": "dist/index.js",
+	"types": "dist/index.d.ts",
+	"exports": {
+		".": {
+			"import": "./dist/index.js",
+			"types": "./dist/index.d.ts"
+		}
+	},
+	"bin": {
+		"usertrust-server": "./dist/cli/main.js"
+	},
+	"scripts": {
+		"build": "tsc -b",
+		"prepublishOnly": "tsc -b"
+	},
+	"files": ["dist"],
+	"dependencies": {
+		"usertrust": "*",
+		"zod": "^3.23.0"
+	}
+}