@aifabrix/builder 2.53.1 → 2.54.1

package/lib/programmatic/run-channel-package.js

@@ -12,6 +12,7 @@ const fs = require('../internal/fs-real-sync');
 const path = require('path');
 const { ensureIntegrationDirectory } = require('./workspace-context');
 const { resolveChannelRuntimeValues } = require('../channels/channel-runtime-resolver');
+const { vendorFacingUrlsFromCtx } = require('../channels/vendor-dataplane-url');
 const { generateChannelArtifact } = require('../channels/channel-artifact-generator');
 const { loadChannelPackageContext } = require('../channels/channel-discovery');
 const {
@@ -20,6 +21,10 @@ const {
   mergeChannelBranding
 } = require('../channels/channel-branding');
 const { isChannelTargetKey } = require('../channels/channel-targets');
+const {
+  httpError,
+  readChannelInstallSessionForDefinition
+} = require('./channel-install-session');
 
 /**
  * @param {import('./workspace-context').WorkspaceContext} ctx
@@ -43,6 +48,16 @@ function requireChannelTarget(systemKey) {
   return systemKey;
 }
 
+/**
+ * Catalog packaging key: instance paths (name slug) still read dist/channels/<catalog>/.
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {string}
+ */
+function packagingChannelTarget(ctx) {
+  const { resolveInstallDefinitionKey } = require('./channel-install-help-resolve');
+  return requireChannelTarget(resolveInstallDefinitionKey(ctx));
+}
+
 /**
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @returns {{ type: string, token: string }}
@@ -82,8 +97,13 @@ function generatePackageArtifact(ctx, body, channelTarget, branding, dataplaneUr
     branding.displayName || body.name || packageContext.displayName || channelTarget;
   const description =
     branding.description || body.description || packageContext.description || '';
+  const vendor = vendorFacingUrlsFromCtx({
+    ...ctx,
+    dataplaneUrl
+  });
   const runtimeValues = resolveChannelRuntimeValues({
-    dataplaneBaseUrl: dataplaneUrl,
+    dataplaneBaseUrl: vendor.dataplaneBaseUrl,
+    controllerUrl: vendor.controllerUrl,
     channelTarget,
     appName,
     baseName: body.baseName || appName,
@@ -91,6 +111,7 @@ function generatePackageArtifact(ctx, body, channelTarget, branding, dataplaneUr
     appDescription: description,
     layerBToolNames: packageContext.governedToolNames || [],
     packageContext,
+    oauthPluginVaultReferenceId: body.oauthPluginVaultReferenceId,
     iconColorPath: branding.iconColorPath,
     iconOutlinePath: branding.iconOutlinePath
   });
@@ -108,7 +129,7 @@ function generatePackageArtifact(ctx, body, channelTarget, branding, dataplaneUr
  * @returns {Promise<Object>}
  */
 async function buildChannelPackage(ctx, body = {}) {
-  const channelTarget = requireChannelTarget(ctx.systemKey);
+  const channelTarget = packagingChannelTarget(ctx);
   ensureIntegrationDirectory(ctx);
   const dir = workspaceSystemDir(ctx);
   const branding = mergeChannelBranding(readChannelBranding(dir), body.branding || {});
@@ -151,7 +172,7 @@ async function buildChannelPackage(ctx, body = {}) {
  * @returns {Object}
  */
 function getChannelPackageSummary(ctx) {
-  const channelTarget = requireChannelTarget(ctx.systemKey);
+  const channelTarget = packagingChannelTarget(ctx);
   const projectRoot = ctx.getUserRoot();
   const summaryPath = path.join(
     projectRoot,
@@ -161,7 +182,7 @@ function getChannelPackageSummary(ctx) {
     `channel-${channelTarget}.json`
   );
   if (!fs.existsSync(summaryPath)) {
-    throw new Error(`Channel package summary not found: ${summaryPath}`);
+    throw httpError(`Channel package summary not found: ${summaryPath}`, 404);
   }
   const summary = JSON.parse(fs.readFileSync(summaryPath, 'utf8'));
   return {
@@ -177,8 +198,8 @@ function getChannelPackageSummary(ctx) {
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @returns {{ fileName: string, contentType: string, byteLength: number, zipBase64: string }}
  */
-function getChannelPackageZip(ctx) {
-  const channelTarget = requireChannelTarget(ctx.systemKey);
+function readChannelPackageZip(ctx) {
+  const channelTarget = packagingChannelTarget(ctx);
   const summary = getChannelPackageSummary(ctx).summary;
   const zipPath =
     typeof summary?.links?.zip === 'string' && summary.links.zip
@@ -192,7 +213,7 @@ function getChannelPackageZip(ctx) {
         `appPackage.${summary.environment || 'dev'}.zip`
       );
   if (!fs.existsSync(zipPath)) {
-    throw new Error(`Channel package ZIP not found: ${zipPath}`);
+    throw httpError(`Channel package ZIP not found: ${zipPath}`, 404);
   }
   const buffer = fs.readFileSync(zipPath);
   return {
@@ -203,6 +224,65 @@ function getChannelPackageZip(ctx) {
   };
 }
 
+/**
+ * @param {Object|null} session
+ * @returns {Object}
+ */
+function packageBodyFromSession(session) {
+  if (!session || typeof session !== 'object') {
+    return {};
+  }
+  return {
+    name: session.displayName || session.name,
+    oauthPluginVaultReferenceId: session.oauthPluginVaultReferenceId
+  };
+}
+
+/**
+ * Portal ZIP GET must not 500 with CLI `--oauth-plugin-vault-reference-id` text.
+ * @param {unknown} err
+ * @returns {unknown}
+ */
+function mapCopilotPackageHttpError(err) {
+  if (err && err.statusCode) {
+    return err;
+  }
+  const msg = String((err && err.message) || '');
+  if (/oauth-plugin-vault-reference-id|OAuthPluginVault/i.test(msg)) {
+    return httpError(
+      'Copilot app package is not ready until Teams Entra SSO registration is stored on this install.',
+      409
+    );
+  }
+  return err;
+}
+
+/**
+ * Rebuild the Copilot ZIP when the workspace lost dist/ after an image recreate.
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {Promise<{ fileName: string, contentType: string, byteLength: number, zipBase64: string }>}
+ */
+async function getChannelPackageZip(ctx) {
+  let summaryMissing = false;
+  try {
+    getChannelPackageSummary(ctx);
+  } catch (err) {
+    if (!err || err.statusCode !== 404) {
+      throw mapCopilotPackageHttpError(err);
+    }
+    summaryMissing = true;
+  }
+  if (summaryMissing) {
+    try {
+      const session = readChannelInstallSessionForDefinition(ctx, packagingChannelTarget(ctx));
+      await buildChannelPackage(ctx, packageBodyFromSession(session));
+    } catch (err) {
+      throw mapCopilotPackageHttpError(err);
+    }
+  }
+  return readChannelPackageZip(ctx);
+}
+
 /**
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @param {Object} body

package/lib/programmatic/workspace-context.js

@@ -51,6 +51,7 @@ function resolveWorkspaceRoot(segment) {
  * @param {string} [params.environment]
  * @param {string} [params.controllerUrl]
  * @param {string} [params.dataplaneUrl]
+ * @param {string} [params.publicOrigin]
  * @returns {WorkspaceContext}
  */
 function createWorkspaceContext(params) {
@@ -88,6 +89,7 @@ function createWorkspaceContext(params) {
       process.env.CONTROLLER_URL ||
       '',
     dataplaneUrl: params.dataplaneUrl || process.env.DATAPLANE_URL || '',
+    publicOrigin: typeof params.publicOrigin === 'string' ? params.publicOrigin.trim() : '',
     bearerToken,
     getUserRoot: () => userRoot,
     getIntegrationRoot: () => integrationRoot,

package/lib/role-assistant/evidence-sync.js

@@ -22,6 +22,7 @@ const {
 } = require('../api/evidence.api');
 const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
 const { SYSTEM_KIND_DIGITAL_WORKER } = require('./settings');
+const { formatEvidenceValidationIssues } = require('./evidence-validation-issues');
 
 const EVIDENCE_DIR_NAME = 'evidence';
 const EVIDENCE_EXPORT_FILE = 'evidence.json';
@@ -288,8 +289,9 @@ function isActivatedEvidenceRow(row) {
 async function runEvidenceLifecycleForRef(dataplaneUrl, authConfig, evidenceRef) {
   const validation = await validateEvidenceCandidate(dataplaneUrl, authConfig, evidenceRef);
   if (validationFailed(validation)) {
-    const issues = Array.isArray(validation?.issues) ? validation.issues.length : 0;
-    throw new Error(`Validation failed for evidence ${evidenceRef} (${issues} issue${issues === 1 ? '' : 's'}).`);
+    throw new Error(
+      `Validation failed for evidence ${evidenceRef} (${formatEvidenceValidationIssues(validation?.issues)}).`
+    );
   }
   if (String(validation?.status || '').trim().toLowerCase() !== VALIDATION_PASSED) {
     throw new Error(`Validation status for evidence ${evidenceRef} is "${validation?.status || 'unknown'}".`);

package/lib/role-assistant/evidence-validation-issues.js

@@ -0,0 +1,51 @@
+/**
+ * Format Evidence validate issues[] for CLI errors.
+ */
+
+'use strict';
+
+function formatOneEvidenceIssue(issue) {
+  if (issue === undefined || issue === null) {
+    return '';
+  }
+  if (typeof issue !== 'object') {
+    return String(issue);
+  }
+  const bits = [];
+  if (issue.field) {
+    bits.push(String(issue.field));
+  }
+  if (issue.code) {
+    bits.push(String(issue.code));
+  }
+  if (issue.message) {
+    bits.push(String(issue.message));
+  }
+  if (bits.length > 0) {
+    return bits.join(' — ');
+  }
+  try {
+    return JSON.stringify(issue);
+  } catch {
+    return String(issue);
+  }
+}
+
+/**
+ * @param {unknown} issues
+ * @returns {string}
+ */
+function formatEvidenceValidationIssues(issues) {
+  if (!Array.isArray(issues) || issues.length === 0) {
+    return '0 issues';
+  }
+  const parts = issues.map(formatOneEvidenceIssue).filter(Boolean);
+  const noun = issues.length === 1 ? 'issue' : 'issues';
+  const detail = parts.length > 0 ? `: ${parts.join('; ')}` : '';
+  return `${issues.length} ${noun}${detail}`;
+}
+
+module.exports = {
+  formatOneEvidenceIssue,
+  formatEvidenceValidationIssues
+};

package/lib/role-assistant/knowledge-sync.js

@@ -19,6 +19,7 @@ const {
   updateAssistantSettings
 } = require('../api/assistants.api');
 const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
+const { bareRoleKey } = require('../utils/role-assistant-paths');
 const {
   SYSTEM_KIND_DIGITAL_WORKER,
   getRoleAssistantYamlPath,
@@ -75,7 +76,11 @@ async function resolveDocumentStorageKeyFromDataplane(dataplaneUrl, authConfig,
     return null;
   }
   try {
-    const response = await getAssistantDetails(dataplaneUrl, systemKey, authConfig);
+    const response = await getAssistantDetails(
+      dataplaneUrl,
+      systemKey,
+      authConfig
+    );
     return extractDocumentStorageKeyFromAssistantDetails(response);
   } catch (_error) {
     return null;
@@ -141,16 +146,17 @@ async function applyAssistantSettingsPush(dataplaneUrl, systemKey, authConfig, s
   const { documentStorageKey, debugBody, patchBody } = settingsPush;
   const hasDocumentStorageKey = documentStorageKey !== '';
   const hasDebugSettings = Object.keys(debugBody).length > 0;
+  const assistantKey = String(systemKey || '').trim();
   let response = await updateAssistantSettings(
     dataplaneUrl,
-    systemKey,
+    assistantKey,
     authConfig,
     patchBody
   );
   if (response && response.success === false && hasDocumentStorageKey && hasDebugSettings) {
     response = await updateAssistantSettings(
       dataplaneUrl,
-      systemKey,
+      assistantKey,
       authConfig,
       debugBody
     );
@@ -352,7 +358,7 @@ function writeRoleAssistantSettingsFile(systemKey, docStorageKey, environment =
     apiVersion: 'aifabrix.ai/v1',
     version: '1.0.0',
     kind: 'RoleAssistantSettings',
-    roleKey: systemKey,
+    roleKey: bareRoleKey(systemKey),
     [envKey]: {
       knowledge: docStorageKey ? { documentStorageKey: docStorageKey } : {}
     }

package/lib/role-assistant/settings.js

@@ -13,7 +13,11 @@ const fs = require('../internal/fs-real-sync');
 const yaml = require('js-yaml');
 const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
 const { loadRoleAssistantSettingsSchema } = require('../utils/schema-loader');
-const { SYSTEM_KIND_DIGITAL_WORKER } = require('../utils/role-assistant-paths');
+const {
+  SYSTEM_KIND_DIGITAL_WORKER,
+  WORKSPACE_ROLE_ASSISTANT,
+  bareRoleKey
+} = require('../utils/role-assistant-paths');
 
 function getRoleAssistantYamlPath(systemKey, options = {}) {
   const appPath = resolveExternalSystemPath(systemKey, options.pathOptions || {});
@@ -115,6 +119,48 @@ function resolveRoleAssistantSettingsVersion(settings) {
   return value.trim();
 }
 
+function defaultRoleAssistantSettings(systemKey) {
+  return {
+    apiVersion: 'aifabrix.ai/v1',
+    version: '1.0.0',
+    kind: 'RoleAssistantSettings',
+    roleKey: bareRoleKey(systemKey)
+  };
+}
+
+function mergeRoleAssistantSettings(existing, systemKey) {
+  const next = existing && typeof existing === 'object' ? { ...existing } : {};
+  const defaults = defaultRoleAssistantSettings(systemKey);
+  return {
+    ...defaults,
+    ...next,
+    apiVersion: defaults.apiVersion,
+    kind: defaults.kind,
+    roleKey: defaults.roleKey
+  };
+}
+
+function writeOrMergeRoleAssistantSettings(systemKey, options = {}) {
+  const filePath = getRoleAssistantYamlPath(systemKey, {
+    ...options,
+    pathOptions: {
+      ...(options.pathOptions || {}),
+      workspace: WORKSPACE_ROLE_ASSISTANT
+    }
+  });
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  let payload = defaultRoleAssistantSettings(systemKey);
+  if (!options.force && fs.existsSync(filePath)) {
+    try {
+      payload = mergeRoleAssistantSettings(parseRoleAssistantYaml(filePath), systemKey);
+    } catch {
+      payload = defaultRoleAssistantSettings(systemKey);
+    }
+  }
+  fs.writeFileSync(filePath, yaml.dump(payload, { lineWidth: -1 }), 'utf8');
+  return filePath;
+}
+
 module.exports = {
   SYSTEM_KIND_DIGITAL_WORKER,
   getRoleAssistantYamlPath,
@@ -122,5 +168,6 @@ module.exports = {
   readRoleAssistantSettings,
   resolveRoleAssistantEnvironmentSettings,
   resolveDocumentStorageKeyFromRoleAssistantSettings,
-  resolveRoleAssistantSettingsVersion
+  resolveRoleAssistantSettingsVersion,
+  writeOrMergeRoleAssistantSettings
 };

package/lib/role-assistant/test-cases-evaluate.js

@@ -10,6 +10,14 @@ const {
   evaluateHonestyExpectations
 } = require('./test-cases-honesty');
 const { collectBidAssertions } = require('./test-cases-bid');
+const {
+  evaluateEvidenceExpectations,
+  evaluateForbiddenCapabilities
+} = require('./test-cases-evidence');
+const {
+  evaluateSearchExpectations,
+  evaluateSkillsExpectations
+} = require('./test-cases-search');
 
 function getValueAtPath(obj, dottedPath) {
   const parts = String(dottedPath || '').split('.').filter(Boolean);
@@ -111,6 +119,10 @@ function buildCaseObservation(result, lifecycleVerdict, portalUrl) {
     workResult,
     workResultError: result?.workResultError || null,
     honesty: buildHonestyObservation(workResult),
+    evidencePreflight: result?.evidencePreflight || null,
+    search: result?.search || null,
+    skills: result?.skills || null,
+    roleRef: result?.roleRef || null,
     interactions: Array.isArray(result?.interactions)
       ? result.interactions
       : Array.isArray(result?.workInteractions)
@@ -136,11 +148,15 @@ function softWrapLifecycleAssertion(lifecycleAssertion, soft) {
   };
 }
 
+function softWrapFailedAssertion(assertion, soft) {
+  return softWrapLifecycleAssertion(assertion, soft);
+}
+
 function collectCaseAssertions(expected, observation) {
   const soft = expected.soft === true;
   const observedCapabilities = observation.capabilities?.observed || [];
   const assertions = [];
-  const lifecycleAssertion = softWrapLifecycleAssertion(
+  const lifecycleAssertion = softWrapFailedAssertion(
     evaluateLifecycleStateExpectation(expected.lifecycleState, observation.lifecycleState),
     soft
   );
@@ -148,12 +164,24 @@ function collectCaseAssertions(expected, observation) {
     assertions.push(lifecycleAssertion);
   }
   assertions.push(
-    ...evaluateCapabilityExpectations(expected?.capabilities?.required, observedCapabilities)
+    ...evaluateCapabilityExpectations(
+      expected?.capabilities?.required,
+      observedCapabilities
+    ).map((row) => softWrapFailedAssertion(row, soft))
+  );
+  assertions.push(
+    ...evaluateForbiddenCapabilities(
+      expected?.capabilities?.forbidden,
+      observedCapabilities
+    ).map((row) => softWrapFailedAssertion(row, soft))
   );
   assertions.push(...evaluateFactExpectations(expected.facts, observation));
   assertions.push(...evaluateProhibitedExpectations(expected.prohibited, observation));
   assertions.push(...evaluateHonestyExpectations(expected.honesty, observation, { soft }));
   assertions.push(...collectBidAssertions(expected.bid, observation, { soft }));
+  assertions.push(...evaluateEvidenceExpectations(expected.evidence, observation));
+  assertions.push(...evaluateSearchExpectations(expected.search, observation));
+  assertions.push(...evaluateSkillsExpectations(expected.skills, observation));
   return assertions;
 }
 

package/lib/role-assistant/test-cases-evidence.js

@@ -0,0 +1,175 @@
+/**
+ * Role Assistant case Evidence preflight — live dataplane rows only.
+ * @fileoverview Hard-stop when required Evidence keys are missing or not active
+ */
+
+'use strict';
+
+const { listEvidence } = require('../api/evidence.api');
+const { bareRoleKey } = require('../utils/role-assistant-paths');
+
+function asStringList(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.map((item) => String(item || '').trim()).filter(Boolean);
+}
+
+function evidenceSpecFromCase(testCase) {
+  const preflight = testCase?.preflight?.evidence;
+  const expected = testCase?.expected?.evidence;
+  const requiredKeys = asStringList(preflight?.requiredKeys).concat(
+    asStringList(expected?.requiredKeys)
+  );
+  const unique = [...new Set(requiredKeys)];
+  if (unique.length === 0) {
+    return null;
+  }
+  const roleKey =
+    String(preflight?.roleKey || expected?.roleKey || '').trim() ||
+    bareRoleKey(testCase?.input?.businessRoleRef || '') ||
+    '';
+  const resourceType = String(preflight?.resourceType || expected?.resourceType || '').trim();
+  return {
+    requiredKeys: unique,
+    roleKey,
+    resourceType,
+    requireStatus: String(preflight?.requireStatus || expected?.requireStatus || 'active')
+      .trim()
+      .toLowerCase() || 'active'
+  };
+}
+
+function rowKey(row) {
+  return String(row?.key || row?.evidenceKey || '').trim();
+}
+
+function rowStatus(row) {
+  return String(row?.status || '').trim().toLowerCase();
+}
+
+function isActiveStatus(status, requiredStatus) {
+  if (requiredStatus === 'active') {
+    return !status || status === 'active';
+  }
+  return status === requiredStatus;
+}
+
+function findMissingEvidenceKeys(spec, rows) {
+  const byKey = new Map();
+  for (const row of rows) {
+    const key = rowKey(row);
+    if (key) {
+      byKey.set(key, row);
+    }
+  }
+  const missing = [];
+  for (const key of spec.requiredKeys) {
+    const row = byKey.get(key);
+    if (!row) {
+      missing.push(`${key} (not in dataplane)`);
+      continue;
+    }
+    const status = rowStatus(row);
+    if (!isActiveStatus(status, spec.requireStatus)) {
+      missing.push(`${key} (status=${status || 'unknown'}, need ${spec.requireStatus})`);
+    }
+  }
+  return missing;
+}
+
+async function loadLiveEvidenceRows(authContext, spec) {
+  const dataplaneUrl = authContext?.dataplaneUrl;
+  const authConfig = authContext?.authConfig;
+  if (!dataplaneUrl || !authConfig) {
+    throw new Error(
+      'Evidence preflight failed: dataplane URL or auth is missing. Run aifabrix login and retry.'
+    );
+  }
+  const params = {
+    roleKey: spec.roleKey || undefined,
+    resourceType: spec.resourceType || undefined,
+    status: spec.requireStatus === 'active' ? 'active' : spec.requireStatus,
+    page: 1,
+    pageSize: 100
+  };
+  try {
+    return await listEvidence(dataplaneUrl, authConfig, params);
+  } catch (error) {
+    const detail = error && error.message ? error.message : String(error);
+    throw new Error(`Evidence preflight failed: could not read Evidence from the dataplane (${detail}).`);
+  }
+}
+
+/**
+ * Hard-stop before work.start when the case requires live Evidence.
+ * @returns {Promise<{ skipped: boolean, requiredKeys: string[], rows: Object[] }>}
+ */
+async function assertRoleAssistantEvidencePreflight(testCase, authContext) {
+  const spec = evidenceSpecFromCase(testCase);
+  if (!spec) {
+    return { skipped: true, requiredKeys: [], rows: [] };
+  }
+  if (!spec.roleKey) {
+    throw new Error(
+      'Evidence preflight failed: roleKey is required (preflight.evidence.roleKey or input.businessRoleRef).'
+    );
+  }
+  const rows = await loadLiveEvidenceRows(authContext, spec);
+  const missing = findMissingEvidenceKeys(spec, rows);
+  if (missing.length > 0) {
+    throw new Error(
+      'Evidence preflight failed: required Evidence is not active in the dataplane: ' +
+        `${missing.join('; ')}. Upload the Role Assistant package to the target dataplane, ` +
+        'then retry. Hard stop.'
+    );
+  }
+  return { skipped: false, requiredKeys: spec.requiredKeys, rows };
+}
+
+function evaluateEvidenceExpectations(evidenceSpec, observation) {
+  const requiredKeys = asStringList(evidenceSpec?.requiredKeys);
+  if (requiredKeys.length === 0) {
+    return [];
+  }
+  const preflight = observation?.evidencePreflight || {};
+  const liveKeys = new Set(
+    (Array.isArray(preflight.rows) ? preflight.rows : []).map(rowKey).filter(Boolean)
+  );
+  return requiredKeys.map((key) => {
+    const passed = liveKeys.has(key);
+    return {
+      id: `expected.evidence.requiredKeys:${key}`,
+      passed,
+      message: passed
+        ? `Evidence key "${key}" was active in the dataplane at test start.`
+        : `Evidence key "${key}" was not active in the dataplane at test start.`
+    };
+  });
+}
+
+function evaluateForbiddenCapabilities(forbiddenList, observedCapabilities) {
+  if (!Array.isArray(forbiddenList) || forbiddenList.length === 0) {
+    return [];
+  }
+  const observedSet = new Set(observedCapabilities);
+  return forbiddenList.map((capability) => {
+    const key = String(capability || '').trim();
+    const passed = !observedSet.has(key);
+    return {
+      id: `expected.capabilities.forbidden:${key}`,
+      passed,
+      message: passed
+        ? `Forbidden capability "${key}" was not observed.`
+        : `Forbidden capability "${key}" was observed.`
+    };
+  });
+}
+
+module.exports = {
+  evidenceSpecFromCase,
+  findMissingEvidenceKeys,
+  assertRoleAssistantEvidencePreflight,
+  evaluateEvidenceExpectations,
+  evaluateForbiddenCapabilities
+};