@slaw-ai/server 2026.611.0

package/dist/services/operator-auth.js

@@ -0,0 +1,361 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { and, eq, gt, isNull, or, sql } from "drizzle-orm";
+import { authUsers, operatorApiKeys, cliAuthChallenges, squads, squadMemberships, instanceUserRoles, } from "@slaw-ai/db";
+import { conflict, forbidden, notFound } from "../errors.js";
+export const OPERATOR_API_KEY_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const CLI_AUTH_CHALLENGE_TTL_MS = 10 * 60 * 1000;
+export function hashBearerToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+export function tokenHashesMatch(left, right) {
+    const leftBytes = Buffer.from(left, "utf8");
+    const rightBytes = Buffer.from(right, "utf8");
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+export function createOperatorApiToken() {
+    return `slaw_op_${randomBytes(24).toString("hex")}`;
+}
+export function createCliAuthSecret() {
+    return `pcp_cli_auth_${randomBytes(24).toString("hex")}`;
+}
+export function operatorApiKeyExpiresAt(nowMs = Date.now()) {
+    return new Date(nowMs + OPERATOR_API_KEY_TTL_MS);
+}
+export function cliAuthChallengeExpiresAt(nowMs = Date.now()) {
+    return new Date(nowMs + CLI_AUTH_CHALLENGE_TTL_MS);
+}
+function challengeStatusForRow(row) {
+    if (row.cancelledAt)
+        return "cancelled";
+    if (row.expiresAt.getTime() <= Date.now())
+        return "expired";
+    if (row.approvedAt && row.operatorApiKeyId)
+        return "approved";
+    return "pending";
+}
+export function operatorAuthService(db) {
+    async function resolveOperatorAccess(userId) {
+        const [user, memberships, adminRole] = await Promise.all([
+            db
+                .select({
+                id: authUsers.id,
+                name: authUsers.name,
+                email: authUsers.email,
+            })
+                .from(authUsers)
+                .where(eq(authUsers.id, userId))
+                .then((rows) => rows[0] ?? null),
+            db
+                .select({
+                squadId: squadMemberships.squadId,
+                membershipRole: squadMemberships.membershipRole,
+                status: squadMemberships.status,
+            })
+                .from(squadMemberships)
+                .where(and(eq(squadMemberships.principalType, "user"), eq(squadMemberships.principalId, userId), eq(squadMemberships.status, "active")))
+                .then((rows) => rows),
+            db
+                .select({ id: instanceUserRoles.id })
+                .from(instanceUserRoles)
+                .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+                .then((rows) => rows[0] ?? null),
+        ]);
+        return {
+            user,
+            squadIds: memberships.map((row) => row.squadId),
+            memberships,
+            isInstanceAdmin: Boolean(adminRole),
+        };
+    }
+    async function resolveOperatorActivitySquadIds(input) {
+        const access = await resolveOperatorAccess(input.userId);
+        const squadIds = new Set(access.squadIds);
+        if (squadIds.size === 0 && input.requestedSquadId?.trim()) {
+            squadIds.add(input.requestedSquadId.trim());
+        }
+        if (squadIds.size === 0 && input.operatorApiKeyId?.trim()) {
+            const challengeSquadIds = await db
+                .select({ requestedSquadId: cliAuthChallenges.requestedSquadId })
+                .from(cliAuthChallenges)
+                .where(eq(cliAuthChallenges.operatorApiKeyId, input.operatorApiKeyId.trim()))
+                .then((rows) => rows
+                .map((row) => row.requestedSquadId?.trim() ?? null)
+                .filter((value) => Boolean(value)));
+            for (const squadId of challengeSquadIds) {
+                squadIds.add(squadId);
+            }
+        }
+        if (squadIds.size === 0 && access.isInstanceAdmin) {
+            const allSquadIds = await db
+                .select({ id: squads.id })
+                .from(squads)
+                .then((rows) => rows.map((row) => row.id));
+            for (const squadId of allSquadIds) {
+                squadIds.add(squadId);
+            }
+        }
+        return Array.from(squadIds);
+    }
+    async function findOperatorApiKeyByToken(token) {
+        const tokenHash = hashBearerToken(token);
+        const now = new Date();
+        return db
+            .select()
+            .from(operatorApiKeys)
+            .where(and(eq(operatorApiKeys.keyHash, tokenHash), isNull(operatorApiKeys.revokedAt)))
+            .then((rows) => rows.find((row) => !row.expiresAt || row.expiresAt.getTime() > now.getTime()) ?? null);
+    }
+    async function touchOperatorApiKey(id) {
+        await db.update(operatorApiKeys).set({ lastUsedAt: new Date() }).where(eq(operatorApiKeys.id, id));
+    }
+    async function revokeOperatorApiKey(id) {
+        const now = new Date();
+        return db
+            .update(operatorApiKeys)
+            .set({ revokedAt: now, lastUsedAt: now })
+            .where(and(eq(operatorApiKeys.id, id), isNull(operatorApiKeys.revokedAt)))
+            .returning()
+            .then((rows) => rows[0] ?? null);
+    }
+    async function createNamedOperatorApiKey(input) {
+        const token = createOperatorApiToken();
+        const created = await db
+            .insert(operatorApiKeys)
+            .values({
+            userId: input.userId,
+            name: input.name.trim(),
+            keyHash: hashBearerToken(token),
+            expiresAt: input.expiresAt === undefined ? operatorApiKeyExpiresAt() : input.expiresAt,
+        })
+            .returning()
+            .then((rows) => rows[0]);
+        return {
+            id: created.id,
+            name: created.name,
+            token,
+            createdAt: created.createdAt,
+            lastUsedAt: created.lastUsedAt,
+            revokedAt: created.revokedAt,
+            expiresAt: created.expiresAt,
+        };
+    }
+    async function listOperatorApiKeys(userId, opts = {}) {
+        const conditions = [eq(operatorApiKeys.userId, userId)];
+        if (!opts.includeInactive) {
+            const activeExpirationCondition = or(isNull(operatorApiKeys.expiresAt), gt(operatorApiKeys.expiresAt, new Date()));
+            conditions.push(isNull(operatorApiKeys.revokedAt));
+            if (activeExpirationCondition)
+                conditions.push(activeExpirationCondition);
+        }
+        return db
+            .select({
+            id: operatorApiKeys.id,
+            name: operatorApiKeys.name,
+            createdAt: operatorApiKeys.createdAt,
+            lastUsedAt: operatorApiKeys.lastUsedAt,
+            revokedAt: operatorApiKeys.revokedAt,
+            expiresAt: operatorApiKeys.expiresAt,
+        })
+            .from(operatorApiKeys)
+            .where(and(...conditions))
+            .orderBy(sql `${operatorApiKeys.createdAt} desc`);
+    }
+    async function getOperatorApiKeyForUser(keyId, userId) {
+        return db
+            .select({
+            id: operatorApiKeys.id,
+            userId: operatorApiKeys.userId,
+            name: operatorApiKeys.name,
+            createdAt: operatorApiKeys.createdAt,
+            lastUsedAt: operatorApiKeys.lastUsedAt,
+            revokedAt: operatorApiKeys.revokedAt,
+            expiresAt: operatorApiKeys.expiresAt,
+        })
+            .from(operatorApiKeys)
+            .where(and(eq(operatorApiKeys.id, keyId), eq(operatorApiKeys.userId, userId)))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function createCliAuthChallenge(input) {
+        const challengeSecret = createCliAuthSecret();
+        const pendingOperatorToken = createOperatorApiToken();
+        const expiresAt = cliAuthChallengeExpiresAt();
+        const labelBase = input.clientName?.trim() || "slaw cli";
+        const pendingKeyName = input.requestedAccess === "instance_admin_required"
+            ? `${labelBase} (instance admin)`
+            : `${labelBase} (operator)`;
+        const created = await db
+            .insert(cliAuthChallenges)
+            .values({
+            secretHash: hashBearerToken(challengeSecret),
+            command: input.command.trim(),
+            clientName: input.clientName?.trim() || null,
+            requestedAccess: input.requestedAccess,
+            requestedSquadId: input.requestedSquadId?.trim() || null,
+            pendingKeyHash: hashBearerToken(pendingOperatorToken),
+            pendingKeyName,
+            expiresAt,
+        })
+            .returning()
+            .then((rows) => rows[0]);
+        return {
+            challenge: created,
+            challengeSecret,
+            pendingOperatorToken,
+        };
+    }
+    async function getCliAuthChallenge(id) {
+        return db
+            .select()
+            .from(cliAuthChallenges)
+            .where(eq(cliAuthChallenges.id, id))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function getCliAuthChallengeBySecret(id, token) {
+        const challenge = await getCliAuthChallenge(id);
+        if (!challenge)
+            return null;
+        if (!tokenHashesMatch(challenge.secretHash, hashBearerToken(token)))
+            return null;
+        return challenge;
+    }
+    async function describeCliAuthChallenge(id, token) {
+        const challenge = await getCliAuthChallengeBySecret(id, token);
+        if (!challenge)
+            return null;
+        const [squad, approvedBy] = await Promise.all([
+            challenge.requestedSquadId
+                ? db
+                    .select({ id: squads.id, name: squads.name })
+                    .from(squads)
+                    .where(eq(squads.id, challenge.requestedSquadId))
+                    .then((rows) => rows[0] ?? null)
+                : Promise.resolve(null),
+            challenge.approvedByUserId
+                ? db
+                    .select({ id: authUsers.id, name: authUsers.name, email: authUsers.email })
+                    .from(authUsers)
+                    .where(eq(authUsers.id, challenge.approvedByUserId))
+                    .then((rows) => rows[0] ?? null)
+                : Promise.resolve(null),
+        ]);
+        return {
+            id: challenge.id,
+            status: challengeStatusForRow(challenge),
+            command: challenge.command,
+            clientName: challenge.clientName ?? null,
+            requestedAccess: challenge.requestedAccess,
+            requestedSquadId: challenge.requestedSquadId ?? null,
+            requestedSquadName: squad?.name ?? null,
+            approvedAt: challenge.approvedAt?.toISOString() ?? null,
+            cancelledAt: challenge.cancelledAt?.toISOString() ?? null,
+            expiresAt: challenge.expiresAt.toISOString(),
+            approvedByUser: approvedBy
+                ? {
+                    id: approvedBy.id,
+                    name: approvedBy.name,
+                    email: approvedBy.email,
+                }
+                : null,
+        };
+    }
+    async function approveCliAuthChallenge(id, token, userId) {
+        const access = await resolveOperatorAccess(userId);
+        return db.transaction(async (tx) => {
+            await tx.execute(sql `select ${cliAuthChallenges.id} from ${cliAuthChallenges} where ${cliAuthChallenges.id} = ${id} for update`);
+            const challenge = await tx
+                .select()
+                .from(cliAuthChallenges)
+                .where(eq(cliAuthChallenges.id, id))
+                .then((rows) => rows[0] ?? null);
+            if (!challenge || !tokenHashesMatch(challenge.secretHash, hashBearerToken(token))) {
+                throw notFound("CLI auth challenge not found");
+            }
+            const status = challengeStatusForRow(challenge);
+            if (status === "expired")
+                return { status, challenge };
+            if (status === "cancelled")
+                return { status, challenge };
+            if (challenge.requestedAccess === "instance_admin_required" && !access.isInstanceAdmin) {
+                throw forbidden("Instance admin required");
+            }
+            let operatorKeyId = challenge.operatorApiKeyId;
+            if (!operatorKeyId) {
+                const createdKey = await tx
+                    .insert(operatorApiKeys)
+                    .values({
+                    userId,
+                    name: challenge.pendingKeyName,
+                    keyHash: challenge.pendingKeyHash,
+                    expiresAt: operatorApiKeyExpiresAt(),
+                })
+                    .returning()
+                    .then((rows) => rows[0]);
+                operatorKeyId = createdKey.id;
+            }
+            const approvedAt = challenge.approvedAt ?? new Date();
+            const updated = await tx
+                .update(cliAuthChallenges)
+                .set({
+                approvedByUserId: userId,
+                operatorApiKeyId: operatorKeyId,
+                approvedAt,
+                updatedAt: new Date(),
+            })
+                .where(eq(cliAuthChallenges.id, challenge.id))
+                .returning()
+                .then((rows) => rows[0] ?? challenge);
+            return { status: "approved", challenge: updated };
+        });
+    }
+    async function cancelCliAuthChallenge(id, token) {
+        const challenge = await getCliAuthChallengeBySecret(id, token);
+        if (!challenge)
+            throw notFound("CLI auth challenge not found");
+        const status = challengeStatusForRow(challenge);
+        if (status === "approved")
+            return { status, challenge };
+        if (status === "expired")
+            return { status, challenge };
+        if (status === "cancelled")
+            return { status, challenge };
+        const updated = await db
+            .update(cliAuthChallenges)
+            .set({
+            cancelledAt: new Date(),
+            updatedAt: new Date(),
+        })
+            .where(eq(cliAuthChallenges.id, challenge.id))
+            .returning()
+            .then((rows) => rows[0] ?? challenge);
+        return { status: "cancelled", challenge: updated };
+    }
+    async function assertCurrentOperatorKey(keyId, userId) {
+        if (!keyId || !userId)
+            throw conflict("Operator API key context is required");
+        const key = await db
+            .select()
+            .from(operatorApiKeys)
+            .where(and(eq(operatorApiKeys.id, keyId), eq(operatorApiKeys.userId, userId)))
+            .then((rows) => rows[0] ?? null);
+        if (!key || key.revokedAt)
+            throw notFound("Operator API key not found");
+        return key;
+    }
+    return {
+        resolveOperatorAccess,
+        findOperatorApiKeyByToken,
+        touchOperatorApiKey,
+        revokeOperatorApiKey,
+        createNamedOperatorApiKey,
+        listOperatorApiKeys,
+        getOperatorApiKeyForUser,
+        createCliAuthChallenge,
+        getCliAuthChallengeBySecret,
+        describeCliAuthChallenge,
+        approveCliAuthChallenge,
+        cancelCliAuthChallenge,
+        assertCurrentOperatorKey,
+        resolveOperatorActivitySquadIds,
+    };
+}
+//# sourceMappingURL=operator-auth.js.map

package/dist/services/operator-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-auth.js","sourceRoot":"","sources":["../../src/services/operator-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,MAAM,EACN,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAIxD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAChE,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,uBAAuB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAClE,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,yBAAyB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA0C;IACvE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,UAAU,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAM;IACxC,KAAK,UAAU,qBAAqB,CAAC,MAAc;QACjD,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,EAAE;iBACC,MAAM,CAAC;gBACN,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC;iBACD,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAClC,EAAE;iBACC,MAAM,CAAC;gBACN,OAAO,EAAE,gBAAgB,CAAC,OAAO;gBACjC,cAAc,EAAE,gBAAgB,CAAC,cAAc;gBAC/C,MAAM,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC;iBACD,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC1C,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACtC,CACF;iBACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;YACvB,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;iBACpC,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;iBAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;SACnC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;YAC/C,WAAW;YACX,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,+BAA+B,CAAC,KAI9C;QACC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1D,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1D,MAAM,iBAAiB,GAAG,MAAM,EAAE;iBAC/B,MAAM,CAAC,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;iBAChE,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;iBAC5E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACb,IAAI;iBACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;iBAClD,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CAAC;YACJ,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBACzB,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,yBAAyB,CAAC,KAAa;QACpD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EACtC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,EAAU;QAC3C,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,EAAU;QAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE;aACN,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aACxC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACzE,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;QACC,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;SACvF,CAAC;aACD,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3B,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,mBAAmB,CAChC,MAAc,EACd,OAAsC,EAAE;QAExC,MAAM,UAAU,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,yBAAyB,GAAG,EAAE,CAClC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EACjC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAC1C,CAAC;YACF,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CAAC;YACF,IAAI,yBAAyB;gBAAE,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;aACzB,OAAO,CAAC,GAAG,CAAA,GAAG,eAAe,CAAC,SAAS,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,KAAa,EAAE,MAAc;QACnE,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,KAKrC;QACC,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;QAC9C,MAAM,oBAAoB,GAAG,sBAAsB,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,yBAAyB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC;QACzD,MAAM,cAAc,GAClB,KAAK,CAAC,eAAe,KAAK,yBAAyB;YACjD,CAAC,CAAC,GAAG,SAAS,mBAAmB;YACjC,CAAC,CAAC,GAAG,SAAS,aAAa,CAAC;QAEhC,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,IAAI;YACxD,cAAc,EAAE,eAAe,CAAC,oBAAoB,CAAC;YACrD,cAAc;YACd,SAAS;SACV,CAAC;aACD,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3B,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,eAAe;YACf,oBAAoB;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,EAAU;QAC3C,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,2BAA2B,CAAC,EAAU,EAAE,KAAa;QAClE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,EAAU,EAAE,KAAa;QAC/D,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,SAAS,CAAC,gBAAgB;gBACxB,CAAC,CAAC,EAAE;qBACC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;qBAC5C,IAAI,CAAC,MAAM,CAAC;qBACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;qBAChD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,SAAS,CAAC,gBAAgB;gBACxB,CAAC,CAAC,EAAE;qBACC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;qBAC1E,IAAI,CAAC,SAAS,CAAC;qBACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;qBACnD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC;YACxC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;YACxC,eAAe,EAAE,SAAS,CAAC,eAAyD;YACpF,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,IAAI,IAAI;YACpD,kBAAkB,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI;YACvC,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;YACvD,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;YACzD,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE;YAC5C,cAAc,EAAE,UAAU;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,UAAU,CAAC,EAAE;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,EAAU,EAAE,KAAa,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,UAAU,iBAAiB,CAAC,EAAE,SAAS,iBAAiB,UAAU,iBAAiB,CAAC,EAAE,MAAM,EAAE,aAAa,CAC/G,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClF,MAAM,QAAQ,CAAC,8BAA8B,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAEzD,IAAI,SAAS,CAAC,eAAe,KAAK,yBAAyB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBACvF,MAAM,SAAS,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC;YAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,UAAU,GAAG,MAAM,EAAE;qBACxB,MAAM,CAAC,eAAe,CAAC;qBACvB,MAAM,CAAC;oBACN,MAAM;oBACN,IAAI,EAAE,SAAS,CAAC,cAAc;oBAC9B,OAAO,EAAE,SAAS,CAAC,cAAc;oBACjC,SAAS,EAAE,uBAAuB,EAAE;iBACrC,CAAC;qBACD,SAAS,EAAE;qBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3B,aAAa,GAAG,UAAU,CAAC,EAAE,CAAC;YAChC,CAAC;YAED,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC;gBACH,gBAAgB,EAAE,MAAM;gBACxB,gBAAgB,EAAE,aAAa;gBAC/B,UAAU;gBACV,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;iBAC7C,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;YAExC,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,EAAU,EAAE,KAAa;QAC7D,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEzD,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC7C,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;QAExC,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,KAAyB,EAAE,MAA0B;QAC3F,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,qBAAqB;QACrB,yBAAyB;QACzB,mBAAmB;QACnB,oBAAoB;QACpB,yBAAyB;QACzB,mBAAmB;QACnB,wBAAwB;QACxB,sBAAsB;QACtB,2BAA2B;QAC3B,wBAAwB;QACxB,uBAAuB;QACvB,sBAAsB;QACtB,wBAAwB;QACxB,+BAA+B;KAChC,CAAC;AACJ,CAAC"}

package/dist/services/plugin-capability-validator.d.ts

@@ -0,0 +1,108 @@
+/**
+ * PluginCapabilityValidator — enforces the capability model at both
+ * install-time and runtime.
+ *
+ * Every plugin declares the capabilities it requires in its manifest
+ * (`manifest.capabilities`). This service checks those declarations
+ * against a mapping of operations → required capabilities so that:
+ *
+ * 1. **Install-time validation** — `validateManifestCapabilities()`
+ *    ensures that declared features (tools, jobs, webhooks, UI slots)
+ *    have matching capability entries, giving operators clear feedback
+ *    before a plugin is activated.
+ *
+ * 2. **Runtime gating** — `checkOperation()` / `assertOperation()` are
+ *    called on every worker→host bridge call to enforce least-privilege
+ *    access. If a plugin attempts an operation it did not declare, the
+ *    call is rejected with a 403 error.
+ *
+ * @see PLUGIN_SPEC.md §15 — Capability Model
+ * @see host-client-factory.ts — SDK-side capability gating
+ */
+import type { PluginCapability, SlawPluginManifestV1, PluginUiSlotType } from "@slaw-ai/shared";
+/**
+ * Result of a capability check. When `allowed` is false, `missing` contains
+ * the capabilities that the plugin does not declare but the operation requires.
+ */
+export interface CapabilityCheckResult {
+    allowed: boolean;
+    missing: PluginCapability[];
+    operation?: string;
+    pluginId?: string;
+}
+export interface PluginCapabilityValidator {
+    /**
+     * Check whether a plugin has a specific capability.
+     */
+    hasCapability(manifest: SlawPluginManifestV1, capability: PluginCapability): boolean;
+    /**
+     * Check whether a plugin has all of the specified capabilities.
+     */
+    hasAllCapabilities(manifest: SlawPluginManifestV1, capabilities: PluginCapability[]): CapabilityCheckResult;
+    /**
+     * Check whether a plugin has at least one of the specified capabilities.
+     */
+    hasAnyCapability(manifest: SlawPluginManifestV1, capabilities: PluginCapability[]): boolean;
+    /**
+     * Check whether a plugin is allowed to perform the named operation.
+     *
+     * Operations are mapped to required capabilities via OPERATION_CAPABILITIES.
+     * Unknown operations are rejected by default.
+     */
+    checkOperation(manifest: SlawPluginManifestV1, operation: string): CapabilityCheckResult;
+    /**
+     * Assert that a plugin is allowed to perform an operation.
+     * Throws a 403 HttpError if the capability check fails.
+     */
+    assertOperation(manifest: SlawPluginManifestV1, operation: string): void;
+    /**
+     * Assert that a plugin has a specific capability.
+     * Throws a 403 HttpError if the capability is missing.
+     */
+    assertCapability(manifest: SlawPluginManifestV1, capability: PluginCapability): void;
+    /**
+     * Check whether a plugin can register the given UI slot type.
+     */
+    checkUiSlot(manifest: SlawPluginManifestV1, slotType: PluginUiSlotType): CapabilityCheckResult;
+    /**
+     * Validate that a manifest's declared capabilities are consistent with its
+     * declared features (tools, jobs, webhooks, UI slots).
+     *
+     * Returns all missing capabilities rather than failing on the first one.
+     * This is useful for install-time validation to give comprehensive feedback.
+     */
+    validateManifestCapabilities(manifest: SlawPluginManifestV1): CapabilityCheckResult;
+    /**
+     * Get the capabilities required for a named operation.
+     * Returns an empty array if the operation is unknown.
+     */
+    getRequiredCapabilities(operation: string): readonly PluginCapability[];
+    /**
+     * Get the capability required for a UI slot type.
+     */
+    getUiSlotCapability(slotType: PluginUiSlotType): PluginCapability;
+}
+/**
+ * Create a PluginCapabilityValidator.
+ *
+ * This service enforces capability gates for plugin operations.  The host
+ * uses it to verify that a plugin's declared capabilities permit the
+ * operation it is attempting, both at install time (manifest validation)
+ * and at runtime (bridge call gating).
+ *
+ * Usage:
+ * ```ts
+ * const validator = pluginCapabilityValidator();
+ *
+ * // Runtime: gate a bridge call
+ * validator.assertOperation(plugin.manifestJson, "issues.create");
+ *
+ * // Install time: validate manifest consistency
+ * const result = validator.validateManifestCapabilities(manifest);
+ * if (!result.allowed) {
+ *   throw badRequest("Missing capabilities", result.missing);
+ * }
+ * ```
+ */
+export declare function pluginCapabilityValidator(): PluginCapabilityValidator;
+//# sourceMappingURL=plugin-capability-validator.d.ts.map

package/dist/services/plugin-capability-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-capability-validator.d.ts","sourceRoot":"","sources":["../../src/services/plugin-capability-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,iBAAiB,CAAC;AAyKzB;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,oBAAoB,EAC9B,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC;IAEX;;OAEG;IACH,kBAAkB,CAChB,QAAQ,EAAE,oBAAoB,EAC9B,YAAY,EAAE,gBAAgB,EAAE,GAC/B,qBAAqB,CAAC;IAEzB;;OAEG;IACH,gBAAgB,CACd,QAAQ,EAAE,oBAAoB,EAC9B,YAAY,EAAE,gBAAgB,EAAE,GAC/B,OAAO,CAAC;IAEX;;;;;OAKG;IACH,cAAc,CACZ,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,GAChB,qBAAqB,CAAC;IAEzB;;;OAGG;IACH,eAAe,CACb,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,GAChB,IAAI,CAAC;IAER;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,oBAAoB,EAC9B,UAAU,EAAE,gBAAgB,GAC3B,IAAI,CAAC;IAER;;OAEG;IACH,WAAW,CACT,QAAQ,EAAE,oBAAoB,EAC9B,QAAQ,EAAE,gBAAgB,GACzB,qBAAqB,CAAC;IAEzB;;;;;;OAMG;IACH,4BAA4B,CAC1B,QAAQ,EAAE,oBAAoB,GAC7B,qBAAqB,CAAC;IAEzB;;;OAGG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,gBAAgB,EAAE,CAAC;IAExE;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,CAAC;CACnE;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,IAAI,yBAAyB,CA8KrE"}