@procedures/client 0.1.0 → 0.2.0

package/src/procedures/effects.ts

@@ -0,0 +1,24 @@
+/**
+ * Effect declarations for groups of procedures (CAPABILITIES-2026-10). This file imports only
+ * types, so each file of procedures can use it without an import cycle.
+ */
+
+import type { AnyProcedure, Effects } from "./types.js";
+
+/** The effects of a procedure that reads and changes nothing: its output comes from its input. */
+export const PURE_EFFECTS: Effects = Object.freeze({ reads: Object.freeze([]), writes: Object.freeze([]) });
+
+/** The effects of a procedure that reads the procedure registry and changes nothing. */
+export const REGISTRY_READ_EFFECTS: Effects = Object.freeze({ reads: Object.freeze(["registry"]), writes: Object.freeze([]) });
+
+/**
+ * This function gives copies of the procedures with the effects in their metadata. A procedure
+ * that declares its own effects keeps them.
+ */
+export function withEffects<T extends AnyProcedure>(effects: Effects, procedures: readonly T[]): T[] {
+  return procedures.map((procedure) =>
+    (procedure.metadata as { effects?: unknown } | undefined)?.effects !== undefined
+      ? procedure
+      : ({ ...procedure, metadata: { ...procedure.metadata, effects } } as T)
+  );
+}

package/src/procedures/index.ts

@@ -24,11 +24,39 @@ export type {
   ProcedureModule,
   RegistrationOptions,
   ProcedureRegistryLike,
+  Effects,
+  PermittedEffects,
+  Register,
+  ClearanceOf,
+  ResourcesOf,
+  Capability,
+  CapabilityRequest,
+  ClearanceOrder,
+  NestedCallOptions,
 } from "./types.js";
 
 // Type utilities
 export { pathToKey, keyToPath } from "./types.js";
 
+// Capabilities (CAPABILITIES-2026-10)
+export {
+  STANDARD_RESOURCES,
+  UNLIMITED_CAPABILITY,
+  ladder,
+  effectsOf,
+  isReadOnly,
+  isDestructive,
+  isOpenWorld,
+  toolHints,
+  narrowCapability,
+  capabilityRefusal,
+  examinesNestedCall,
+  explainInvocation,
+  checkEffects,
+} from "./capability.js";
+export { PURE_EFFECTS, REGISTRY_READ_EFFECTS, withEffects } from "./effects.js";
+export type { ToolHints, CapabilityRefusal, CapabilityRefusalReason, InvocationExplanation, EffectsViolation } from "./capability.js";
+
 // Registry
 export { ProcedureRegistry, RegistryError, PROCEDURE_REGISTRY, assertValidPath } from "./registry.js";
 
@@ -61,6 +89,7 @@ export {
   moduleClosure,
   registerModules,
   createRegistry,
+  registerClientProcedures,
 } from "./module.js";
 export type { ModuleInput } from "./module.js";
 
@@ -202,27 +231,9 @@ export type {
 // procedures moved to @procedures/store (roadmap 3.2): the program store.
 
 // =============================================================================
-// Auto-register core procedures
+// Registration
 // =============================================================================
 
-import { coreProcedures as _coreProcedures } from "./core/index.js";
-import { metaProcedures as _metaProcedures } from "./define-procedure.js";
-import { PROCEDURE_REGISTRY } from "./registry.js";
-
-// Register core procedures when this module is imported
-// This ensures client.* procedures are available without explicit registration
-try {
-  for (const proc of _coreProcedures) {
-    if (!PROCEDURE_REGISTRY.has(proc.path)) {
-      PROCEDURE_REGISTRY.register(proc);
-    }
-  }
-  // Also register meta-procedures
-  for (const proc of _metaProcedures) {
-    if (!PROCEDURE_REGISTRY.has(proc.path)) {
-      PROCEDURE_REGISTRY.register(proc);
-    }
-  }
-} catch {
-  // Ignore errors during auto-registration (e.g., if already registered)
-}
+// Importing this package registers nothing (ARCHITECTURE-PROPOSALS-2026-10, P9). The
+// "./register" entry registers the procedures of `clientModule` in the global registry, and
+// `createRegistry()` adds them to each new registry.

package/src/procedures/interceptors.ts

@@ -98,7 +98,8 @@ export function timeoutInterceptor(options: TimeoutInterceptorOptions): Intercep
 
     let output: ProcedureOutput<unknown>;
     try {
-      output = await Promise.race([next({ signal }), deadline]);
+      // The deadline goes into the capability: the nested calls and the remote calls see it
+      output = await Promise.race([next({ signal, capability: { timeoutMs: ms } }), deadline]);
     } catch (error) {
       stop();
       throw error;

package/src/procedures/invoke.ts

@@ -13,14 +13,24 @@
  * Interceptors run around each invocation, the nested calls too (roadmap 1.2): policy, tracing,
  * timeouts and metrics for every host. `interceptors.ts` has a timeout, a tracing and a metrics
  * interceptor.
+ *
+ * Each invocation operates with a capability (CAPABILITIES-2026-10, `capability.ts`). A nested
+ * call gets the same capability or a narrower one. The admission refuses a procedure whose
+ * declared effects the capability does not permit (`FORBIDDEN`). The host can give resources
+ * for the capability (`ctx.resources`) and a filter of the output that leaves the host.
  */
 
 import type {
   AnyProcedure,
+  Capability,
+  CapabilityRequest,
+  ClearanceOrder,
+  NestedCallOptions,
   ProcedureClient,
   ProcedureContext,
   ProcedurePath,
   RepositoryProvider,
+  ResourcesOf,
 } from "./types.js";
 import { pathToKey } from "./types.js";
 import { validateSchema } from "./schema.js";
@@ -28,6 +38,8 @@ import type { ProcedureRegistry } from "./registry.js";
 import { PROCEDURE_REGISTRY } from "./registry.js";
 import { nestedCallRefusal } from "./policy.js";
 import { scopeOf, withScope, type HydrationEvent } from "./ref.js";
+import { UNLIMITED_CAPABILITY, capabilityRefusal, examinesNestedCall, narrowCapability, type CapabilityRefusalReason } from "./capability.js";
+import { timeoutInterceptor } from "./interceptors.js";
 import type { EventBus } from "../events/types.js";
 import { getGlobalEventBus, withEventBusSignal } from "../events/bus.js";
 
@@ -45,7 +57,9 @@ export type InvocationErrorCode =
   | "OUTPUT_VALIDATION_ERROR"
   | "NO_OUTPUT"
   | "ABORTED"
-  | "TIMEOUT";
+  | "TIMEOUT"
+  /** The capability of the call does not permit it (CAPABILITIES-2026-10). `reason` tells why. */
+  | "FORBIDDEN";
 
 /** An error of the invocation itself. An error that the handler throws passes through unchanged. */
 export class InvocationError extends Error {
@@ -53,11 +67,14 @@ export class InvocationError extends Error {
   readonly code: InvocationErrorCode;
   readonly path: ProcedurePath;
   readonly retryable: boolean = false;
+  /** The reason of a `FORBIDDEN` error: `effects-undeclared`, `effects-exceeded` or `clearance`. */
+  readonly reason: CapabilityRefusalReason | undefined;
 
-  constructor(code: InvocationErrorCode, message: string, path: ProcedurePath) {
+  constructor(code: InvocationErrorCode, message: string, path: ProcedurePath, reason?: CapabilityRefusalReason) {
     super(message);
     this.code = code;
     this.path = path;
+    this.reason = reason;
   }
 }
 
@@ -108,6 +125,20 @@ export interface InvokeOptions {
   interceptors?: readonly Interceptor[] | undefined;
   /** The invocation whose handler makes this call. The context client sets it for a nested call. */
   parent?: Invocation | undefined;
+  /**
+   * The capability of the call: its clearance, permitted effects and deadline. The host makes it
+   * from its authentication. The nested calls get it, or a narrower one. Absent: no limits.
+   */
+  capability?: Capability | undefined;
+  /** The order of the clearance values. Narrowing two different clearances needs it. */
+  clearanceOrder?: ClearanceOrder | undefined;
+  /** The resources of an invocation for its capability (`ctx.resources`). */
+  resources?: ((invocation: Invocation) => ResourcesOf) | undefined;
+  /**
+   * The filter of the output that leaves the host (the call of the host, not its nested calls).
+   * It drops a refused stream item. A refused value gives `FORBIDDEN` (reason `clearance`).
+   */
+  admitItem?: ((item: unknown, invocation: Invocation) => boolean) | undefined;
 }
 
 // =============================================================================
@@ -130,12 +161,16 @@ export interface Invocation {
   readonly parent: Invocation | undefined;
   /** 0 for a call of a host, 1 for its nested calls, and so on. */
   readonly depth: number;
+  /** The capability of the invocation (frozen). */
+  readonly capability: Capability;
 }
 
 /** The changes that an interceptor gives to the next step: the handler and the nested calls get them. */
 export interface InvocationChanges {
   signal?: AbortSignal | undefined;
   metadata?: Record<string, unknown> | undefined;
+  /** A request for a narrower capability. The framework calculates the result: it is never wider. */
+  capability?: CapabilityRequest | undefined;
 }
 
 /** The rest of the chain: the next interceptors, then the validation and the handler. */
@@ -256,8 +291,15 @@ export async function invokeProcedure<TOutput = unknown>(
     signal: options.signal,
     parent: options.parent,
     depth: options.parent ? options.parent.depth + 1 : 0,
+    capability: options.capability ?? UNLIMITED_CAPABILITY,
   };
-  const interceptors = options.interceptors ?? [];
+  // A deadline that the parent does not have (from a host, a request or a narrowed nested call)
+  // ends the invocation at that time, as the timeout interceptor does
+  const deadline = invocation.capability.deadline;
+  const ownDeadline = deadline !== undefined && options.parent?.capability.deadline !== deadline;
+  const interceptors = ownDeadline
+    ? [timeoutInterceptor({ ms: Math.max(0, deadline - Date.now()), appliesTo: () => true }), ...(options.interceptors ?? [])]
+    : (options.interceptors ?? []);
   if (interceptors.length === 0) return runInvocation<TOutput>(invocation, options);
 
   const dispatch = (index: number, current: Invocation, currentOptions: InvokeOptions): Promise<ProcedureOutput<unknown>> => {
@@ -269,8 +311,16 @@ export async function invokeProcedure<TOutput = unknown>(
         ...current,
         signal: changes.signal ?? current.signal,
         metadata: changes.metadata ?? current.metadata,
+        capability: changes.capability
+          ? narrowCapability(current.capability, changes.capability, currentOptions.clearanceOrder)
+          : current.capability,
       };
-      return dispatch(index + 1, changed, { ...currentOptions, signal: changed.signal, metadata: changed.metadata });
+      return dispatch(index + 1, changed, {
+        ...currentOptions,
+        signal: changed.signal,
+        metadata: changed.metadata,
+        capability: changed.capability,
+      });
     });
   };
   return dispatch(0, invocation, options) as Promise<ProcedureOutput<TOutput>>;
@@ -282,6 +332,14 @@ async function runInvocation<TOutput>(invocation: Invocation, options: InvokeOpt
   const handler = procedure.handler!;
   if (options.signal?.aborted) throw abortError(path);
 
+  // The admission: before the input validation, so a refused call learns nothing from its input
+  const parent = invocation.parent;
+  if (!parent || examinesNestedCall(parent.procedure, parent.capability, invocation.capability)) {
+    const refusal = capabilityRefusal(procedure, invocation.capability);
+    if (refusal?.reason === "deadline") throw new InvocationError("TIMEOUT", refusal.message, path);
+    if (refusal) throw new InvocationError("FORBIDDEN", refusal.message, path, refusal.reason);
+  }
+
   let data: unknown = input;
   if (!options.inputValidated) {
     // A synchronous schema gives its result at once, so the handler starts before an await
@@ -301,11 +359,32 @@ async function runInvocation<TOutput>(invocation: Invocation, options: InvokeOpt
   }
 
   // The handler starts here, before the first await (the site's trace depends on it)
-  const result: unknown = await handler(data, createProcedureContext(procedure, options, invocation));
+  const result: unknown = await handler(data, createProcedureContext(procedure, { ...options, capability: invocation.capability }, invocation));
+  // The output filter examines only what leaves the host
+  const admit = invocation.depth === 0 ? options.admitItem : undefined;
   if (isAsyncIterable(result)) {
-    return { kind: "stream", items: validatedItems(procedure, result, options.signal) as AsyncGenerator<TOutput, void, undefined> };
+    const items = validatedItems(procedure, result, options.signal);
+    return {
+      kind: "stream",
+      items: (admit ? admittedItems(items, admit, invocation) : items) as AsyncGenerator<TOutput, void, undefined>,
+    };
+  }
+  const value = await validateOutput(procedure, result);
+  if (admit && !admit(value, invocation)) {
+    throw new InvocationError("FORBIDDEN", `The clearance of the call does not permit the output of ${pathToKey(path)}`, path, "clearance");
+  }
+  return { kind: "value", value: value as TOutput };
+}
+
+/** The items that the output filter of the host admits. */
+async function* admittedItems(
+  items: AsyncGenerator<unknown, void, undefined>,
+  admit: (item: unknown, invocation: Invocation) => boolean,
+  invocation: Invocation,
+): AsyncGenerator<unknown, void, undefined> {
+  for await (const item of items) {
+    if (admit(item, invocation)) yield item;
   }
-  return { kind: "value", value: (await validateOutput(procedure, result)) as TOutput };
 }
 
 /** This function finds the procedure at a path in the registry of the options, then runs it. */
@@ -379,6 +458,8 @@ export function createProcedureContext(
     path: procedure.path,
     client,
     registry: options.registry ?? PROCEDURE_REGISTRY,
+    capability: options.capability ?? UNLIMITED_CAPABILITY,
+    resources: invocation && options.resources ? options.resources(invocation) : (EMPTY_RESOURCES as ResourcesOf),
   };
   if (options.signal) context.signal = options.signal;
   if (options.repository) context.repository = options.repository;
@@ -391,23 +472,35 @@ export function createProcedureContext(
   return context;
 }
 
+/** The resources of an invocation when the host gives none. */
+const EMPTY_RESOURCES = Object.freeze({});
+
 /** The client of a procedure's context: it runs the nested calls from the registry. */
 function registryClient(caller: AnyProcedure, options: InvokeOptions): ProcedureClient {
-  const start = <TOutput>(path: ProcedurePath, input: unknown): Promise<ProcedureOutput<TOutput>> => {
+  const start = <TOutput>(path: ProcedurePath, input: unknown, callOptions?: NestedCallOptions): Promise<ProcedureOutput<TOutput>> => {
     // The call policy of the host, with the immediate caller (BUGS-2026-07 H18, deep dive MCP-3).
     // It runs before the lookup, so a refused path tells nothing about the procedure.
     const refusal = nestedCallRefusal(caller, path, options);
     if (refusal) {
       return Promise.reject(new InvocationError(refusal.code, refusal.message, path));
     }
-    return invokePath<TOutput>(path, input, options);
+    // A nested call gets the capability of its caller, or a narrower one that it asks for
+    const narrow = callOptions?.narrow;
+    if (!narrow) return invokePath<TOutput>(path, input, options);
+    let capability: Capability;
+    try {
+      capability = narrowCapability(options.capability, narrow, options.clearanceOrder);
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    return invokePath<TOutput>(path, input, { ...options, capability });
   };
   return {
-    async call<TInput, TOutput>(path: ProcedurePath, input: TInput): Promise<TOutput> {
-      return outputValue(await start<TOutput>(path, input), path);
+    async call<TInput, TOutput>(path: ProcedurePath, input: TInput, callOptions?: NestedCallOptions): Promise<TOutput> {
+      return outputValue(await start<TOutput>(path, input, callOptions), path);
     },
-    stream<TInput, TOutput>(path: ProcedurePath, input: TInput): AsyncIterable<TOutput> {
-      return streamOutput(() => start<TOutput>(path, input));
+    stream<TInput, TOutput>(path: ProcedurePath, input: TInput, callOptions?: NestedCallOptions): AsyncIterable<TOutput> {
+      return streamOutput(() => start<TOutput>(path, input, callOptions));
     },
   };
 }

package/src/procedures/module.ts

@@ -1,10 +1,10 @@
 /**
  * Procedure modules and explicit registries (architecture review, roadmap 3.1).
  *
- * Importing a package root registers its procedures in the global `PROCEDURE_REGISTRY`
- * (DECISIONS-2026-10, "Every package root registers its procedures"). That stays. A host that
- * wants its own registry uses the module of each package instead: the `./module` entry of a
- * package exports its procedures as data, and importing it registers nothing.
+ * Importing a package registers nothing (ARCHITECTURE-PROPOSALS-2026-10, P9). A host with its own
+ * registry gives it the module of each package: the `./module` entry exports the procedures as
+ * data. The global `PROCEDURE_REGISTRY` gets the procedures of a package from its `./register`
+ * entry (`import "@procedures/git/register"`).
  *
  * ```ts
  * import { createRegistry, Client, LocalTransport } from "@procedures/client";
@@ -18,16 +18,15 @@
  * rule of a server all use the registry of the invocation (`ctx.registry`).
  */
 
-import { ProcedureRegistry, RegistryError } from "./registry.js";
+import { PROCEDURE_REGISTRY, ProcedureRegistry, RegistryError } from "./registry.js";
 import { coreProcedures } from "./core/index.js";
 import { metaProcedures as definitionProcedures } from "./define-procedure.js";
 import type { AnyProcedure, ProcedureModule, RegistrationOptions } from "./types.js";
 
 /**
- * The procedures that `@procedures/client` registers in the global registry when it is
- * imported: the control flow (`client.chain`, `client.map` and the others) and
- * `procedure.define`/`get`/`list`/`delete`. `createRegistry()` always registers this module, so an
- * explicit registry has what the global registry has.
+ * The procedures of `@procedures/client`: the control flow (`client.chain`, `client.map` and the
+ * others) and `procedure.define`/`get`/`list`/`delete`. `createRegistry()` always registers this
+ * module. `import "@procedures/client/register"` registers it in the global registry.
  */
 export const clientModule: ProcedureModule = {
   name: "@procedures/client",
@@ -105,3 +104,14 @@ export function registerModules(
 export function createRegistry(...modules: ModuleInput[]): ProcedureRegistry {
   return registerModules(new ProcedureRegistry(), [clientModule, ...modules]);
 }
+
+/**
+ * This function registers the procedures of `clientModule` in a registry: the global registry by
+ * default. A procedure that the registry has already stays. The `./register` entry of the package
+ * starts this function.
+ */
+export function registerClientProcedures(registry: ProcedureRegistry = PROCEDURE_REGISTRY): void {
+  for (const procedure of clientModule.procedures) {
+    if (!registry.has(procedure.path)) registry.register(procedure);
+  }
+}

package/src/procedures/types.ts

@@ -69,10 +69,101 @@ export interface ProcedureMetadata {
    */
   calls?: readonly string[];
 
+  /**
+   * The side effects of the procedure (CAPABILITIES-2026-10). A host with a restriction of
+   * effects refuses a procedure without this declaration.
+   */
+  effects?: Effects;
+
   /** Custom metadata fields */
   [key: string]: unknown;
 }
 
+// =============================================================================
+// Capabilities (CAPABILITIES-2026-10)
+// =============================================================================
+
+/**
+ * The side effects of a procedure. The resource names are strings that the application chooses.
+ * The standard names are `fs` (the files of the host), `network` (systems outside the host),
+ * `process` (it starts any program) and `registry` (the procedure registry).
+ */
+export interface Effects {
+  /** The resources that the procedure reads. Absent: not known. */
+  readonly reads?: readonly string[];
+  /** The resources that the procedure changes. An empty list: it changes nothing. Absent: not known. */
+  readonly writes?: readonly string[];
+  /** True: a second call with the same input changes nothing more. The default is false. */
+  readonly idempotent?: boolean;
+  /**
+   * True: the procedure can delete or overwrite data that it did not make. The default is true for
+   * a procedure that writes, as in MCP. A procedure that writes only new data declares false.
+   */
+  readonly destructive?: boolean;
+}
+
+/** The effects that a capability permits. An absent field permits everything of its kind. */
+export interface PermittedEffects {
+  /** The resources that a call can read: names, or `"any"`. */
+  readonly reads?: readonly string[] | "any";
+  /** The resources that a call can change: names, or `"any"`. An empty list: no change. */
+  readonly writes?: readonly string[] | "any";
+  /** False: a call cannot start a destructive procedure. */
+  readonly destructive?: boolean;
+}
+
+/**
+ * The types that an application gives to the framework, by declaration merging:
+ *
+ * ```ts
+ * declare module "@procedures/client" {
+ *   interface Register {
+ *     clearance: "public" | "shared" | "private";
+ *     resources: { world: World };
+ *   }
+ * }
+ * ```
+ */
+export interface Register {}
+
+/** The type of a clearance value: `Register["clearance"]`, or `unknown`. */
+export type ClearanceOf = Register extends { clearance: infer C } ? C : unknown;
+
+/** The type of `ctx.resources`: `Register["resources"]`, or a record of unknown values. */
+export type ResourcesOf = Register extends { resources: infer R } ? R : Readonly<Record<string, unknown>>;
+
+/**
+ * The permissions of one invocation. A nested call gets the same capability or a narrower one,
+ * and only the host makes a capability (from its authentication). The object is frozen.
+ */
+export interface Capability<C = ClearanceOf> {
+  /** The data that the call can see. Absent: no limit. The application gives the order. */
+  readonly clearance?: C;
+  /** The effects that the call and its nested calls can have. Absent: all effects. */
+  readonly effects?: PermittedEffects;
+  /** The time (milliseconds since the epoch) at which the call and its nested calls stop. */
+  readonly deadline?: number;
+}
+
+/**
+ * A request for a narrower capability (a nested call, an interceptor). The framework calculates
+ * the result, so a request for more has no effect.
+ */
+export interface CapabilityRequest<C = ClearanceOf> {
+  clearance?: C;
+  effects?: PermittedEffects;
+  /** The time from now, in milliseconds. The result is the earlier of the two deadlines. */
+  timeoutMs?: number;
+}
+
+/** The order of clearance values: a partial order with a meet (the highest common lower value). */
+export interface ClearanceOrder<C = ClearanceOf> {
+  /** True when `a` is the same as or lower than `b`. */
+  leq(a: C, b: C): boolean;
+  /** The highest value that is the same as or lower than both. */
+  meet(a: C, b: C): C;
+}
+
 // =============================================================================
 // Procedure Context
 // =============================================================================
@@ -172,6 +263,18 @@ export interface ProcedureContext {
    * `hydrateInput`, so a trace sees the events of its own program only.
    */
   onRef?: ((event: HydrationEvent) => void) | undefined;
+
+  /**
+   * The capability of this invocation (CAPABILITIES-2026-10): its clearance, permitted effects
+   * and deadline. The nested calls of `ctx.client` get it, or a narrower one. Frozen.
+   */
+  capability: Capability;
+
+  /**
+   * The resources that the host gives to this invocation, for its capability: a view of a
+   * database for a lower clearance, for example. Empty when the host gives none.
+   */
+  resources: ResourcesOf;
 }
 
 /**
@@ -195,7 +298,8 @@ export interface ProcedureClient {
    */
   call<TInput = unknown, TOutput = unknown>(
     path: ProcedurePath,
-    input: TInput
+    input: TInput,
+    options?: NestedCallOptions
   ): Promise<TOutput>;
 
   /**
@@ -205,10 +309,17 @@ export interface ProcedureClient {
    */
   stream?<TInput = unknown, TOutput = unknown>(
     path: ProcedurePath,
-    input: TInput
+    input: TInput,
+    options?: NestedCallOptions
   ): AsyncIterable<TOutput>;
 }
 
+/** The options of one nested call. */
+export interface NestedCallOptions {
+  /** A narrower capability for the nested call. A request for more has no effect. */
+  narrow?: CapabilityRequest | undefined;
+}
+
 // =============================================================================
 // Procedure Handler
 // =============================================================================

package/src/register.ts

@@ -0,0 +1,10 @@
+/**
+ * Importing this file registers the procedures of `@procedures/client` in the global registry:
+ * `import "@procedures/client/register"`. These are the control flow (`client.chain`, `client.map`
+ * and the others) and `procedure.define`/`get`/`list`/`delete`. The other entries of the package
+ * register nothing (ARCHITECTURE-PROPOSALS-2026-10, P9).
+ */
+
+import { registerClientProcedures } from "./procedures/module.js";
+
+registerClientProcedures();

package/src/server/host-policy.ts

@@ -12,10 +12,14 @@
  *   procedures (a host for an outside caller sets it).
  * - `timeoutMs`: the time limit of each call from a caller (not of its nested calls).
  * - `token`, `browser`: the checks of the network transports (`client-server` applies them).
+ * - `capability`, `readOnly`, `clearanceOrder`, `resources`, `admitItem`: the capability of each
+ *   call and what the host gives for it (CAPABILITIES-2026-10).
  */
 
-import type { ProcedurePath } from "../procedures/types.js";
-import type { Interceptor } from "../procedures/invoke.js";
+import type { Capability, ClearanceOrder, ProcedurePath, ResourcesOf } from "../procedures/types.js";
+import type { Interceptor, Invocation } from "../procedures/invoke.js";
+import { narrowCapability } from "../procedures/capability.js";
+import type { ServerRequest } from "./types.js";
 import { timeoutInterceptor } from "../procedures/interceptors.js";
 import type { BrowserGuardOptions } from "./browser-guard.js";
 import type { ProcedureRegistry } from "../procedures/registry.js";
@@ -67,6 +71,20 @@ export interface HostPolicyOptions {
   token?: string | undefined;
   /** The browser checks of the network transports (`allowedOrigins`, `allowedHosts`, `allowGet`). */
   browser?: BrowserGuardOptions | undefined;
+  /**
+   * The capability of each call from a caller: one value, or a function of the request. The
+   * function reads only what the transport authenticated (the token, a session), not a claim of
+   * the caller. Without it: no limits.
+   */
+  capability?: Capability | ((request: ServerRequest<unknown>) => Capability | undefined) | undefined;
+  /** True: the callers start only the procedures that change nothing (`effects.writes` is empty). */
+  readOnly?: boolean | undefined;
+  /** The order of the clearance values. */
+  clearanceOrder?: ClearanceOrder | undefined;
+  /** The resources of each invocation for its capability (`ctx.resources`). */
+  resources?: ((invocation: Invocation) => ResourcesOf) | undefined;
+  /** The filter of the output that leaves the host. */
+  admitItem?: ((item: unknown, invocation: Invocation) => boolean) | undefined;
 }
 
 /** What a host lets its callers do. */
@@ -76,6 +94,22 @@ export interface HostPolicy {
   readonly interceptors: readonly Interceptor[];
   readonly token: string | undefined;
   readonly browser: BrowserGuardOptions;
+  /** The capability of a call from a caller, or undefined for no limits. */
+  readonly capabilityOf: ((request?: ServerRequest<unknown>) => Capability | undefined) | undefined;
+  readonly clearanceOrder: ClearanceOrder | undefined;
+  readonly resources: ((invocation: Invocation) => ResourcesOf) | undefined;
+  readonly admitItem: ((item: unknown, invocation: Invocation) => boolean) | undefined;
+}
+
+/** The capability function of a policy: the capability of the options, narrowed by `readOnly`. */
+function capabilityOfOptions(options: HostPolicyOptions): HostPolicy["capabilityOf"] {
+  const { capability, readOnly } = options;
+  if (capability === undefined && !readOnly) return undefined;
+  const readOnlyRequest = readOnly ? { effects: { writes: [] as readonly string[] } } : undefined;
+  return (request) => {
+    const base = typeof capability === "function" ? (request ? capability(request) : undefined) : capability;
+    return readOnlyRequest ? narrowCapability(base, readOnlyRequest, options.clearanceOrder) : base;
+  };
 }
 
 function exposeOf(options: HostPolicyOptions): ((path: ProcedurePath) => boolean) | undefined {
@@ -106,6 +140,10 @@ export function hostPolicy(options: HostPolicyOptions = {}): HostPolicy {
     interceptors,
     token: options.token,
     browser: options.browser ?? {},
+    capabilityOf: capabilityOfOptions(options),
+    clearanceOrder: options.clearanceOrder,
+    resources: options.resources,
+    admitItem: options.admitItem,
   };
 }
 
@@ -117,5 +155,9 @@ export function procedureServerOptions(policy: HostPolicy, registry?: ProcedureR
     ...(policy.expose ? { expose: policy.expose } : {}),
     strictCalls: policy.strictCalls,
     ...(policy.interceptors.length > 0 ? { interceptors: policy.interceptors } : {}),
+    ...(policy.capabilityOf ? { capability: policy.capabilityOf } : {}),
+    ...(policy.clearanceOrder ? { clearanceOrder: policy.clearanceOrder } : {}),
+    ...(policy.resources ? { resources: policy.resources } : {}),
+    ...(policy.admitItem ? { admitItem: policy.admitItem } : {}),
   };
 }