@mog-sdk/spreadsheet-contracts 0.1.12

package/dist/capabilities/scope.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Capability Scope - Resource scoping and domain matching
+ *
+ * This file defines:
+ * - CapabilityScope type
+ * - scopeMatches(): Check if a scope grants access to a resource
+ * - domainMatches(): Strict domain matching (no embedded domain attacks)
+ * - validateScope(): Reject unbounded wildcards like 'table:*'
+ *
+ * @see plans/active/permission/CAPABILITY-TAXONOMY.md
+ */
+/**
+ * Resource scope for a capability.
+ *
+ * Format: "resource_type:resource_id" or "resource_type:pattern"
+ *
+ * Examples:
+ * - "table:contacts" - Only the 'contacts' table
+ * - "table:sales_*" - Tables matching prefix pattern
+ * - "sheet:Sheet1" - Only Sheet1
+ * - "domain:api.example.com" - Only this domain
+ * - "domain:*.example.com" - Subdomains of example.com (one level)
+ * - "domain:**.example.com" - example.com AND all subdomains
+ *
+ * Multiple scopes can be comma-separated:
+ * - "table:contacts,table:deals,table:activities"
+ */
+export type CapabilityScope = string & {
+    readonly __brand?: 'CapabilityScope';
+};
+/**
+ * Parsed scope component.
+ */
+export interface ParsedScope {
+    /** Resource type (e.g., 'table', 'sheet', 'domain') */
+    readonly resourceType: string;
+    /** Resource identifier or pattern */
+    readonly pattern: string;
+    /** Whether the pattern contains a wildcard */
+    readonly hasWildcard: boolean;
+    /** Whether the wildcard is unbounded (requires allXxx capability) */
+    readonly isUnbounded: boolean;
+}
+/**
+ * Scope validation result.
+ */
+export interface ScopeValidationResult {
+    /** Whether the scope is valid */
+    readonly valid: boolean;
+    /** Error message if invalid */
+    readonly error?: string;
+    /** Parsed scopes if valid */
+    readonly scopes?: readonly ParsedScope[];
+}
+//# sourceMappingURL=scope.d.ts.map

package/dist/capabilities/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/capabilities/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C"}

package/dist/capabilities/sensitive.d.ts

@@ -0,0 +1,279 @@
+/**
+ * Sensitive Capability Handling - Types Only
+ *
+ * Type definitions for session management and re-authentication.
+ * Runtime code (requiresReAuth, isSessionOnlyCapability, getDefaultSessionDuration,
+ * getExpiryWarningThresholds, getRateLimitCooldown) has been moved to
+ * @mog/kernel/services/capabilities (sensitive.ts).
+ *
+ * @see plans/active/permission/CAPABILITY-TAXONOMY.md
+ * @see plans/active/permission/CAPABILITY-IMPLEMENTATION.md
+ */
+import type { AppId, CapabilityGrant } from './grants';
+import type { CapabilityType } from './types';
+/**
+ * A session-only capability grant with expiration.
+ *
+ * Session grants:
+ * - Expire after a set duration (default: 30 minutes)
+ * - Are not persisted to storage
+ * - Require re-authentication to renew
+ * - Emit warnings before expiration
+ */
+export interface SessionGrant {
+    /** The underlying capability grant */
+    readonly grant: CapabilityGrant;
+    /** When the session started (Unix ms) */
+    readonly sessionStart: number;
+    /** When the session will expire (Unix ms) */
+    readonly expiresAt: number;
+    /** Session duration in milliseconds */
+    readonly duration: number;
+    /** Whether extension is allowed (some caps may not allow) */
+    readonly extensionAllowed: boolean;
+    /** Number of times this session has been extended */
+    readonly extensionCount: number;
+    /** Maximum number of extensions allowed (default: 3) */
+    readonly maxExtensions: number;
+}
+/**
+ * Expiry warning callback parameters.
+ */
+export interface ExpiryWarning {
+    /** The app with the expiring capability */
+    readonly appId: AppId;
+    /** The capability that is expiring */
+    readonly capability: CapabilityType;
+    /** The grant that is expiring */
+    readonly grant: CapabilityGrant;
+    /** Seconds remaining until expiration */
+    readonly secondsRemaining: number;
+    /** Warning level based on time remaining */
+    readonly level: 'info' | 'warning' | 'critical';
+}
+/**
+ * Rate limit status for capability requests.
+ */
+export interface RateLimitStatus {
+    /** Whether a request can be made now */
+    readonly canRequest: boolean;
+    /** If rate limited, when the request can be retried (Unix ms) */
+    readonly retryAfter?: number;
+    /** Seconds until retry is allowed */
+    readonly retryInSeconds?: number;
+    /** Number of requests made in the cooldown period */
+    readonly requestCount: number;
+}
+/**
+ * Interface for managing sensitive capabilities.
+ *
+ * The handler provides:
+ * - Session management (create, validate, extend)
+ * - Expiry warnings (callbacks before expiration)
+ * - Rate limiting (prevent spam of permission dialogs)
+ */
+export interface ISensitiveCapabilityHandler {
+    /**
+     * Create a session grant for a sensitive capability.
+     *
+     * @param appId - The app to create a session for
+     * @param capability - The sensitive capability
+     * @param options - Optional session configuration
+     * @returns The created session grant
+     */
+    createSession(appId: AppId, capability: CapabilityType, options?: SessionOptions): SessionGrant;
+    /**
+     * Check if a session grant is still valid.
+     *
+     * @param session - The session to check
+     * @returns True if the session is valid and not expired
+     */
+    isSessionValid(session: SessionGrant): boolean;
+    /**
+     * Get the current session for an app and capability.
+     *
+     * @param appId - The app to get session for
+     * @param capability - The capability to get session for
+     * @returns The session if active, undefined otherwise
+     */
+    getSession(appId: AppId, capability: CapabilityType): SessionGrant | undefined;
+    /**
+     * Get all active sessions for an app.
+     *
+     * @param appId - The app to get sessions for
+     * @returns Array of active sessions
+     */
+    getActiveSessions(appId: AppId): readonly SessionGrant[];
+    /**
+     * Extend a session grant's expiration.
+     *
+     * Requires re-authentication.
+     *
+     * @param session - The session to extend
+     * @param duration - Optional custom duration (uses default if not provided)
+     * @returns The extended session, or null if extension not allowed
+     */
+    extendSession(session: SessionGrant, duration?: number): SessionGrant | null;
+    /**
+     * End a session early.
+     *
+     * @param appId - The app ID
+     * @param capability - The capability
+     */
+    endSession(appId: AppId, capability: CapabilityType): void;
+    /**
+     * End all sessions for an app.
+     *
+     * @param appId - The app ID
+     */
+    endAllSessions(appId: AppId): void;
+    /**
+     * Subscribe to capability expiration warnings.
+     *
+     * Warnings are issued at:
+     * - 5 minutes before expiration (info)
+     * - 1 minute before expiration (warning)
+     * - 60 seconds before expiration (critical)
+     *
+     * @param callback - Called when a capability is expiring
+     * @returns Unsubscribe function
+     */
+    onCapabilityExpiring(callback: (warning: ExpiryWarning) => void): () => void;
+    /**
+     * Subscribe to capability expiration (when it actually expires).
+     *
+     * @param callback - Called when a capability expires
+     * @returns Unsubscribe function
+     */
+    onCapabilityExpired(callback: (appId: AppId, capability: CapabilityType) => void): () => void;
+    /**
+     * Get the remaining time for a session in milliseconds.
+     *
+     * @param appId - The app ID
+     * @param capability - The capability
+     * @returns Remaining time in ms, or undefined if no active session
+     */
+    getRemainingTime(appId: AppId, capability: CapabilityType): number | undefined;
+    /**
+     * Check if a capability can be requested (not rate limited).
+     *
+     * Rate limiting:
+     * - 30-second cooldown per capability per app
+     * - Prevents apps from spamming permission dialogs
+     *
+     * @param appId - The app making the request
+     * @param capability - The capability being requested
+     * @returns Rate limit status
+     */
+    canRequestAgain(appId: AppId, capability: CapabilityType): RateLimitStatus;
+    /**
+     * Record a capability request for rate limiting.
+     *
+     * Call this after each request attempt (granted or denied).
+     *
+     * @param appId - The app that made the request
+     * @param capability - The capability that was requested
+     */
+    recordRequest(appId: AppId, capability: CapabilityType): void;
+    /**
+     * Clear rate limiting for a specific capability.
+     *
+     * Used when user explicitly clears denial from settings.
+     *
+     * @param appId - The app ID
+     * @param capability - The capability to clear rate limit for
+     */
+    clearRateLimit(appId: AppId, capability: CapabilityType): void;
+    /**
+     * Start the handler (begins monitoring sessions).
+     */
+    start(): void;
+    /**
+     * Stop the handler (stops monitoring).
+     */
+    stop(): void;
+    /**
+     * Dispose the handler (cleanup all resources).
+     */
+    dispose(): void;
+}
+/**
+ * Options for creating a session.
+ */
+export interface SessionOptions {
+    /** Session duration in milliseconds (default: 30 minutes) */
+    readonly duration?: number;
+    /** Whether extensions are allowed (default: true) */
+    readonly extensionAllowed?: boolean;
+    /** Maximum number of extensions (default: 3) */
+    readonly maxExtensions?: number;
+}
+/**
+ * Type of authentication method.
+ */
+export type AuthMethod = 'biometric' | 'password';
+/**
+ * Re-authentication result.
+ */
+export interface ReAuthResult {
+    /** Whether authentication succeeded */
+    readonly success: boolean;
+    /** The method that was used */
+    readonly method: AuthMethod;
+    /** Error message if failed */
+    readonly error?: string;
+    /** Timestamp of the authentication */
+    readonly timestamp: number;
+}
+/**
+ * Options for re-authentication.
+ */
+export interface ReAuthOptions {
+    /** The capability that requires authentication */
+    readonly capability: CapabilityType;
+    /** The app requesting authentication */
+    readonly appId: AppId;
+    /** User-facing reason for authentication */
+    readonly reason: string;
+    /** Preferred authentication method */
+    readonly preferredMethod?: AuthMethod;
+    /** Fallback method if preferred is unavailable */
+    readonly fallbackMethod?: AuthMethod;
+    /** Timeout for the authentication (default: 60 seconds) */
+    readonly timeout?: number;
+}
+/**
+ * Interface for re-authentication providers.
+ *
+ * Platform-specific implementations:
+ * - Desktop: Touch ID, Windows Hello, or password
+ * - Web: Password re-entry
+ */
+export interface IReAuthProvider {
+    /**
+     * Check if re-authentication is available.
+     */
+    isAvailable(): boolean;
+    /**
+     * Get available authentication methods.
+     */
+    getAvailableMethods(): readonly AuthMethod[];
+    /**
+     * Check if a specific method is available.
+     *
+     * @param method - The method to check
+     */
+    isMethodAvailable(method: AuthMethod): boolean;
+    /**
+     * Perform re-authentication.
+     *
+     * @param options - Authentication options
+     * @returns Result of the authentication
+     */
+    authenticate(options: ReAuthOptions): Promise<ReAuthResult>;
+    /**
+     * Cancel an in-progress authentication.
+     */
+    cancel(): void;
+}
+//# sourceMappingURL=sensitive.d.ts.map

package/dist/capabilities/sensitive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../../src/capabilities/sensitive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAM9C;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC,yCAAyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,6DAA6D;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC,qDAAqD;IACrD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IAEpC,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC,yCAAyC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,qCAAqC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAK1C;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,YAAY,CAAC;IAEhG;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC;IAE/C;;;;;;OAMG;IACH,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,GAAG,YAAY,GAAG,SAAS,CAAC;IAE/E;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,YAAY,EAAE,CAAC;IAEzD;;;;;;;;OAQG;IACH,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IAE7E;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAE3D;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAMnC;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAE7E;;;;;OAKG;IACH,mBAAmB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAE9F;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAAC;IAM/E;;;;;;;;;;OAUG;IACH,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,GAAG,eAAe,CAAC;IAE3E;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAE9D;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAM/D;;OAEG;IACH,KAAK,IAAI,IAAI,CAAC;IAEd;;OAEG;IACH,IAAI,IAAI,IAAI,CAAC;IAEb;;OAEG;IACH,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,qDAAqD;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAEpC,gDAAgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAE5B,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IAEpC,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,sCAAsC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;IAEtC,kDAAkD;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC;IAErC,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,mBAAmB,IAAI,SAAS,UAAU,EAAE,CAAC;IAE7C;;;;OAIG;IACH,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IAE/C;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE5D;;OAEG;IACH,MAAM,IAAI,IAAI,CAAC;CAChB"}

package/dist/capabilities/taxonomy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Capability Taxonomy Types
+ *
+ * Type definitions for the capability taxonomy system.
+ * Runtime values (CAPABILITY_IMPLIES, COMPOSITE_CAPABILITIES) have been moved
+ * to @mog/spreadsheet-utils/capabilities/taxonomy.
+ *
+ * @see plans/active/permission/CAPABILITY-TAXONOMY.md
+ */
+/**
+ * Composite capability identifier type.
+ * These are shortcuts that expand to multiple capabilities.
+ */
+export type CompositeCapability = 'spreadsheet:full' | 'spreadsheet:readonly' | 'tables:full' | 'tables:readwrite' | 'tables:readonly' | 'filesystem:full' | 'filesystem:readwrite' | 'services:basic';
+//# sourceMappingURL=taxonomy.d.ts.map

package/dist/capabilities/taxonomy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.d.ts","sourceRoot":"","sources":["../../src/capabilities/taxonomy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,kBAAkB,GAClB,sBAAsB,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,GACjB,iBAAiB,GACjB,sBAAsB,GACtB,gBAAgB,CAAC"}

package/dist/capabilities/types.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Capability Types - Core type definitions for capability-based permissioning
+ *
+ * This file defines ONLY type definitions:
+ * - CapabilityType union type (all ~40 capabilities from tiers 0-5)
+ * - CapabilityInfo interface (name, description, tier, risk level)
+ *
+ * Runtime code (CAPABILITY_REGISTRY, helper functions) has been moved to
+ * @mog/kernel/services/capabilities (cap-types.ts).
+ *
+ * @see plans/active/permission/CAPABILITY-SYSTEM.md
+ * @see plans/active/permission/CAPABILITY-TAXONOMY.md
+ */
+/**
+ * Risk level for a capability.
+ * Affects UI presentation (warning colors, confirmation dialogs).
+ */
+export type CapabilityRiskLevel = 'low' | 'medium' | 'high' | 'critical';
+/**
+ * Capability tier determines the security boundary and UI treatment.
+ *
+ * - Tier 0-2: Core spreadsheet and data operations
+ * - Tier 3: Platform/filesystem access
+ * - Tier 4: External network/database access
+ * - Tier 5: Sensitive operations requiring re-authentication
+ */
+export type CapabilityTier = 0 | 1 | 2 | 3 | 4 | 5;
+/**
+ * Tier 0: Spreadsheet Core
+ * Basic spreadsheet operations - cells, sheets, formulas, formatting.
+ */
+export type Tier0Capability = 'cells:read' | 'cells:write' | 'sheets:read' | 'sheets:create' | 'sheets:delete' | 'sheets:rename' | 'formulas:read' | 'formulas:write' | 'formatting:read' | 'formatting:write' | 'recalc:trigger';
+/**
+ * Tier 1: Data
+ * Table and record operations.
+ */
+export type Tier1Capability = 'tables:read' | 'tables:write' | 'tables:create' | 'tables:delete' | 'tables:schema';
+/**
+ * Tier 2: Services
+ * Platform services - events, clipboard, undo, notifications, checkpoints.
+ */
+export type Tier2Capability = 'events:subscribe' | 'clipboard:read' | 'clipboard:write' | 'undo:read' | 'undo:write' | 'notifications:send' | 'checkpoints:read' | 'checkpoints:create' | 'checkpoints:restore';
+/**
+ * Tier 3: Platform
+ * Filesystem and shell access.
+ */
+export type Tier3Capability = 'filesystem:read' | 'filesystem:write' | 'filesystem:delete' | 'dialogs:open' | 'dialogs:save' | 'shell:windowTitle' | 'shell:openExternal';
+/**
+ * Tier 4: External
+ * Network and external database access.
+ */
+export type Tier4Capability = 'connections:read' | 'connections:write' | 'connections:create' | 'connections:native' | 'network:sameorigin' | 'network:allowlist' | 'network:localhost' | 'network:any';
+/**
+ * Tier 5: Sensitive
+ * Operations requiring re-authentication.
+ */
+export type Tier5Capability = 'credentials:use' | 'allTables:read' | 'allTables:write' | 'allCells:read' | 'allCells:write';
+/**
+ * Union of all capability types.
+ * This is the primary type used throughout the system.
+ */
+export type CapabilityType = Tier0Capability | Tier1Capability | Tier2Capability | Tier3Capability | Tier4Capability | Tier5Capability;
+/**
+ * Metadata about a capability for UI and documentation.
+ */
+export interface CapabilityInfo {
+    /** Display name for UI */
+    readonly name: string;
+    /** User-facing description of what this capability grants */
+    readonly description: string;
+    /** Security tier (0-5) */
+    readonly tier: CapabilityTier;
+    /** Risk level for UI treatment */
+    readonly riskLevel: CapabilityRiskLevel;
+    /**
+     * Whether this capability requires re-authentication.
+     * Only applies to Tier 5 capabilities.
+     */
+    readonly requiresAuth?: boolean;
+    /**
+     * Whether grants of this capability should be session-only (not persisted).
+     * Used for highly sensitive operations like credentials:use.
+     */
+    readonly sessionOnly?: boolean;
+    /**
+     * Default session duration in milliseconds for session-only grants.
+     * Default: 30 minutes (1800000ms)
+     */
+    readonly sessionDuration?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/capabilities/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/capabilities/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAMzE;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAMnD;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,aAAa,GACb,aAAa,GACb,eAAe,GACf,eAAe,GACf,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,aAAa,GACb,cAAc,GACd,eAAe,GACf,eAAe,GACf,eAAe,CAAC;AAEpB;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,WAAW,GACX,YAAY,GACZ,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,CAAC;AAElB;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,CAAC;AAErB;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,eAAe,GACf,eAAe,GACf,eAAe,GACf,eAAe,GACf,eAAe,GACf,eAAe,CAAC;AAMpB;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B,kCAAkC;IAClC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAExC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC"}