@victframework/runtime 0.1.0

package/dist/agent-types.js

@@ -0,0 +1,480 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '@victframework/kernel';
+/**
+ * Neutral product-agent runtime boundary (Stage 06A).
+ *
+ * This module defines the activation/turn/governance vocabulary of the
+ * ProductAgent boundary. It is deliberately the agent framework-free (AI-002): no the agent framework
+ * type, package name, chunk type, or error type may appear here. The
+ * the adapter-backed implementation lives in the optional adapter package
+ * adapter, which implements `ProductAgentPort` against these neutral types.
+ *
+ * Snapshot discipline (AI-004, amendment §6.4):
+ * - activation resolves and deep-captures EVERY revisioned profile
+ *   component into an immutable VICT-owned snapshot;
+ * - required function references (helper-tool executes, processor
+ *   transforms, guardrail checks) are bound by reference and are never
+ *   hashed or serialized;
+ * - an in-flight turn receives ONLY the frozen snapshot — it cannot retain
+ *   or consult a live mutable registry, agent, processor list, model
+ *   profile, or tool map;
+ * - changed definitions apply only after explicit re-activation.
+ */
+/**
+ * Versioned marker of the agent-activation identity schema.
+ *
+ * `@2` records the normative corrective change of the canonical activation
+ * manifest: it now covers the complete resolved executable activation —
+ * every artifact binding (including a declared structured-output contract)
+ * AND the adapter compatibility metadata (id, revision, and every pinned
+ * runtime package version). `@1` records cannot be accepted under `@2`
+ * because their stored manifest bytes cannot match the reconstructed
+ * activation; restoration fails closed instead of substituting.
+ *
+ * `@3` records the further normative boundary-remediation correction: the
+ * manifest now ALSO carries the RESOLVED identity of every referenced
+ * sub-agent profile (`subagents: [{id, revision, agentProfileVersion}]`,
+ * canonically sorted). A stored activation therefore pins not only WHICH
+ * sub-agent revision it referenced but WHAT that resolved child profile
+ * identity was at activation time; restoration under a changed child
+ * profile rejects the record instead of accepting a silently different
+ * resolved executable activation. `@2` records cannot be accepted under
+ * `@3` (their stored manifest bytes cannot match the reconstructed
+ * activation); restoration and persistence both fail closed.
+ */
+export const AGENT_ACTIVATION_IDENTITY_SCHEMA = 'vict.agent-activation@3';
+/** Versioned marker of persisted agent-activation records. */
+export const AGENT_ACTIVATION_RECORD_SCHEMA = 'vict.agent-activation-record@1';
+/**
+ * The closed field set of a persisted activation record. Any additional
+ * member — including a smuggled secret-bearing field — fails validation.
+ */
+const ACTIVATION_RECORD_FIELDS = new Set([
+    'recordSchema',
+    'activationVersion',
+    'agentProfileVersion',
+    'agentId',
+    'agentRevision',
+    'canonicalManifest',
+    'artifacts',
+    'createdAt',
+]);
+const ACTIVATION_ARTIFACT_ENTRY_FIELDS = new Set(['kind', 'id', 'revision']);
+/** The closed field set of the canonical activation manifest (identity @3). */
+const ACTIVATION_MANIFEST_FIELDS = new Set([
+    'schema',
+    'agentProfileVersion',
+    'adapter',
+    'artifacts',
+    'subagents',
+]);
+/** The closed field set of the manifest adapter-compatibility entry. */
+const ACTIVATION_MANIFEST_ADAPTER_FIELDS = new Set([
+    'id',
+    'revision',
+    'runtimePackages',
+]);
+/** The closed field set of one manifest subagent-identity entry. */
+const ACTIVATION_MANIFEST_SUBAGENT_FIELDS = new Set([
+    'id',
+    'revision',
+    'agentProfileVersion',
+]);
+const VERSION_STRING_PATTERN = /^v1_[0-9a-f]{64}$/;
+/** Canonical order of activation-manifest artifact entries (mirror of the registry order). */
+function compareManifestArtifactEntries(a, b) {
+    if (a.kind !== b.kind) {
+        return a.kind < b.kind ? -1 : 1;
+    }
+    if (a.id !== b.id) {
+        return a.id < b.id ? -1 : 1;
+    }
+    if (a.revision === b.revision) {
+        return 0;
+    }
+    return a.revision < b.revision ? -1 : 1;
+}
+/**
+ * Validate a persisted activation record at the durable boundary (shared by
+ * restoration AND by every store adapter before persistence).
+ *
+ * STRUCTURAL validation: closed field sets, exact schema marker, canonical
+ * version forms, well-formed artifact entries with known kinds.
+ *
+ * CONTENT validation (the persistence-time gate): the canonical manifest is
+ * PARSED and validated against its closed schema; the manifest is recomputed
+ * into canonical form and compared byte-for-byte with the stored text; the
+ * activation identity is RECOMPUTED from the manifest bytes and cross-checked
+ * against the record's `activationVersion`; the manifest's profile version
+ * and artifact list are cross-checked against the record's own fields. A
+ * record with fabricated hashes, a fabricated or non-canonical manifest,
+ * contradictory identity fields, unknown manifest content, or hostile
+ * property access is rejected BEFORE storage — with stable, non-echoing
+ * diagnostics (no raw exceptions, no payload-derived text in reasons).
+ *
+ * This is structural/hash validation only: it does NOT resolve executable
+ * artifacts — that remains restoration's exclusive job (re-resolution plus
+ * byte-exact reconstruction comparison).
+ */
+export function validateAgentActivationRecord(record) {
+    try {
+        return validateActivationRecordShape(record);
+    }
+    catch {
+        // Hostile getters/proxies must never escape as raw exceptions, and no
+        // payload-derived text ever reaches the diagnostic.
+        return {
+            ok: false,
+            reason: 'The activation record could not be validated safely; hostile input is rejected.',
+        };
+    }
+}
+function validateActivationRecordShape(record) {
+    if (typeof record !== 'object' || record === null || Array.isArray(record)) {
+        return { ok: false, reason: 'The activation record must be a plain object.' };
+    }
+    const candidate = record;
+    for (const key of Object.keys(candidate)) {
+        if (!ACTIVATION_RECORD_FIELDS.has(key)) {
+            return {
+                ok: false,
+                reason: 'The activation record declares unknown fields; the record schema is closed.',
+            };
+        }
+    }
+    if (candidate.recordSchema !== 'vict.agent-activation-record@1') {
+        return { ok: false, reason: 'The activation record schema marker is not recognized.' };
+    }
+    for (const key of ['activationVersion', 'agentProfileVersion']) {
+        const value = candidate[key];
+        if (typeof value !== 'string' || !VERSION_STRING_PATTERN.test(value)) {
+            return {
+                ok: false,
+                reason: `The activation record '${key}' is not a canonical version string.`,
+            };
+        }
+    }
+    for (const key of ['agentId', 'agentRevision']) {
+        const value = candidate[key];
+        if (typeof value !== 'string' || value.length === 0 || value.length > 128) {
+            return { ok: false, reason: `The activation record '${key}' is missing or malformed.` };
+        }
+    }
+    if (typeof candidate.canonicalManifest !== 'string' || candidate.canonicalManifest.length === 0) {
+        return { ok: false, reason: 'The activation record canonical manifest is missing.' };
+    }
+    if (typeof candidate.createdAt !== 'number' ||
+        !Number.isFinite(candidate.createdAt) ||
+        candidate.createdAt < 0) {
+        return {
+            ok: false,
+            reason: 'The activation record createdAt is not a finite epoch-ms number.',
+        };
+    }
+    if (!Array.isArray(candidate.artifacts)) {
+        return { ok: false, reason: 'The activation record artifact list must be an array.' };
+    }
+    for (const entry of candidate.artifacts) {
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            return { ok: false, reason: 'The activation record artifact entries must be plain objects.' };
+        }
+        const artifact = entry;
+        for (const key of Object.keys(artifact)) {
+            if (!ACTIVATION_ARTIFACT_ENTRY_FIELDS.has(key)) {
+                return {
+                    ok: false,
+                    reason: 'The activation record artifact entry declares unknown fields.',
+                };
+            }
+        }
+        if (typeof artifact.kind !== 'string' || !VALID_RECORD_ARTIFACT_KINDS.has(artifact.kind)) {
+            return { ok: false, reason: 'The activation record artifact entry has an unknown kind.' };
+        }
+        for (const key of ['id', 'revision']) {
+            const value = artifact[key];
+            if (typeof value !== 'string' || value.length === 0 || value.length > 128) {
+                return {
+                    ok: false,
+                    reason: `The activation record artifact entry '${key}' is missing or malformed.`,
+                };
+            }
+        }
+    }
+    return validateActivationManifestContent(candidate, candidate.canonicalManifest);
+}
+/**
+ * Content validation of the canonical manifest: closed schema, canonical
+ * bytes, recomputed identity, and record/manifest cross-checks. The input
+ * is plain parsed JSON (and the record's own validated fields), so no
+ * getter can run here; the caller's try/catch still bounds every access.
+ */
+function validateActivationManifestContent(candidate, manifestText) {
+    let parsed;
+    try {
+        parsed = JSON.parse(manifestText);
+    }
+    catch {
+        return { ok: false, reason: 'The activation record canonical manifest is not valid JSON.' };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return {
+            ok: false,
+            reason: 'The activation record canonical manifest must be a JSON object.',
+        };
+    }
+    const manifest = parsed;
+    for (const key of Object.keys(manifest)) {
+        if (!ACTIVATION_MANIFEST_FIELDS.has(key)) {
+            return {
+                ok: false,
+                reason: 'The activation manifest declares unknown fields; the manifest schema is closed.',
+            };
+        }
+    }
+    if (manifest.schema !== AGENT_ACTIVATION_IDENTITY_SCHEMA) {
+        return { ok: false, reason: 'The activation manifest schema marker is not recognized.' };
+    }
+    if (typeof manifest.agentProfileVersion !== 'string' ||
+        !VERSION_STRING_PATTERN.test(manifest.agentProfileVersion)) {
+        return {
+            ok: false,
+            reason: 'The activation manifest profile version is not a canonical version string.',
+        };
+    }
+    if (manifest.agentProfileVersion !== candidate.agentProfileVersion) {
+        return {
+            ok: false,
+            reason: 'The activation manifest profile version contradicts the record profile version.',
+        };
+    }
+    const adapterValidation = validateManifestAdapterEntry(manifest.adapter);
+    if (!adapterValidation.ok) {
+        return adapterValidation;
+    }
+    const artifactsValidation = validateManifestArtifacts(manifest.artifacts, candidate.artifacts);
+    if (!artifactsValidation.ok) {
+        return artifactsValidation;
+    }
+    const subagentsValidation = validateManifestSubagents(manifest.subagents);
+    if (!subagentsValidation.ok) {
+        return subagentsValidation;
+    }
+    // Canonical bytes: the stored manifest text must be EXACTLY the canonical
+    // serialization of its own parsed content.
+    let reserialized;
+    try {
+        reserialized = canonicalJson(parsed);
+    }
+    catch {
+        return {
+            ok: false,
+            reason: 'The activation record canonical manifest is not canonical data.',
+        };
+    }
+    if (reserialized !== manifestText) {
+        return {
+            ok: false,
+            reason: 'The activation record canonical manifest is not in canonical form.',
+        };
+    }
+    // Identity recompute: the record version must be the canonical hash of
+    // the manifest bytes.
+    const recomputed = `v1_${createHash('sha256').update(manifestText, 'utf8').digest('hex')}`;
+    if (recomputed !== candidate.activationVersion) {
+        return {
+            ok: false,
+            reason: 'The activation record version does not match the recomputed activation identity.',
+        };
+    }
+    return { ok: true };
+}
+function validateManifestAdapterEntry(adapter) {
+    if (typeof adapter !== 'object' || adapter === null || Array.isArray(adapter)) {
+        return {
+            ok: false,
+            reason: 'The activation manifest adapter entry must be a plain object.',
+        };
+    }
+    const adapterRecord = adapter;
+    for (const key of Object.keys(adapterRecord)) {
+        if (!ACTIVATION_MANIFEST_ADAPTER_FIELDS.has(key)) {
+            return {
+                ok: false,
+                reason: 'The activation manifest adapter entry declares unknown fields.',
+            };
+        }
+    }
+    for (const key of ['id', 'revision']) {
+        const value = adapterRecord[key];
+        if (typeof value !== 'string' || value.length === 0 || value.length > 128) {
+            return {
+                ok: false,
+                reason: `The activation manifest adapter '${key}' is missing or malformed.`,
+            };
+        }
+    }
+    const runtimePackages = adapterRecord.runtimePackages;
+    if (typeof runtimePackages !== 'object' ||
+        runtimePackages === null ||
+        Array.isArray(runtimePackages)) {
+        return {
+            ok: false,
+            reason: 'The activation manifest adapter runtime packages must be a plain object.',
+        };
+    }
+    for (const key of Object.keys(runtimePackages)) {
+        const value = runtimePackages[key];
+        if (key.length === 0 ||
+            key.length > 128 ||
+            typeof value !== 'string' ||
+            value.length === 0 ||
+            value.length > 128) {
+            return {
+                ok: false,
+                reason: 'The activation manifest adapter runtime package entries are malformed.',
+            };
+        }
+    }
+    return { ok: true };
+}
+function validateManifestArtifacts(manifestArtifacts, recordArtifacts) {
+    if (!Array.isArray(manifestArtifacts)) {
+        return { ok: false, reason: 'The activation manifest artifact list must be an array.' };
+    }
+    if (!Array.isArray(recordArtifacts)) {
+        return { ok: false, reason: 'The activation record artifact list must be an array.' };
+    }
+    if (manifestArtifacts.length !== recordArtifacts.length) {
+        return {
+            ok: false,
+            reason: 'The activation manifest artifact list contradicts the record artifact list.',
+        };
+    }
+    for (let index = 0; index < manifestArtifacts.length; index += 1) {
+        const entry = manifestArtifacts[index];
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            return {
+                ok: false,
+                reason: 'The activation manifest artifact entries must be plain objects.',
+            };
+        }
+        const artifact = entry;
+        for (const key of Object.keys(artifact)) {
+            if (!ACTIVATION_ARTIFACT_ENTRY_FIELDS.has(key)) {
+                return {
+                    ok: false,
+                    reason: 'The activation manifest artifact entry declares unknown fields.',
+                };
+            }
+        }
+        if (typeof artifact.kind !== 'string' || !VALID_RECORD_ARTIFACT_KINDS.has(artifact.kind)) {
+            return { ok: false, reason: 'The activation manifest artifact entry has an unknown kind.' };
+        }
+        for (const key of ['id', 'revision']) {
+            const value = artifact[key];
+            if (typeof value !== 'string' || value.length === 0 || value.length > 128) {
+                return {
+                    ok: false,
+                    reason: `The activation manifest artifact entry '${key}' is missing or malformed.`,
+                };
+            }
+        }
+        const recordEntry = recordArtifacts[index];
+        if (artifact.kind !== recordEntry.kind ||
+            artifact.id !== recordEntry.id ||
+            artifact.revision !== recordEntry.revision) {
+            return {
+                ok: false,
+                reason: 'The activation manifest artifact list contradicts the record artifact list.',
+            };
+        }
+        if (index > 0 &&
+            compareManifestArtifactEntries(manifestArtifacts[index - 1], artifact) > 0) {
+            return {
+                ok: false,
+                reason: 'The activation manifest artifact list is not in canonical order.',
+            };
+        }
+    }
+    return { ok: true };
+}
+function validateManifestSubagents(subagents) {
+    // Resolved subagent identities: every referenced sub-agent's RESOLVED
+    // profile identity is part of the authoritative binding (closed fields,
+    // canonical versions, canonically sorted by id then revision).
+    if (!Array.isArray(subagents)) {
+        return { ok: false, reason: 'The activation manifest subagent list must be an array.' };
+    }
+    for (let index = 0; index < subagents.length; index += 1) {
+        const entry = subagents[index];
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            return {
+                ok: false,
+                reason: 'The activation manifest subagent entries must be plain objects.',
+            };
+        }
+        const subagent = entry;
+        for (const key of Object.keys(subagent)) {
+            if (!ACTIVATION_MANIFEST_SUBAGENT_FIELDS.has(key)) {
+                return {
+                    ok: false,
+                    reason: 'The activation manifest subagent entry declares unknown fields.',
+                };
+            }
+        }
+        for (const key of ['id', 'revision']) {
+            const value = subagent[key];
+            if (typeof value !== 'string' || value.length === 0 || value.length > 128) {
+                return {
+                    ok: false,
+                    reason: `The activation manifest subagent entry '${key}' is missing or malformed.`,
+                };
+            }
+        }
+        if (typeof subagent.agentProfileVersion !== 'string' ||
+            !VERSION_STRING_PATTERN.test(subagent.agentProfileVersion)) {
+            return {
+                ok: false,
+                reason: 'The activation manifest subagent resolved identity is not a canonical version string.',
+            };
+        }
+        if (index > 0 &&
+            compareManifestArtifactEntries(subagents[index - 1], subagent) > 0) {
+            return {
+                ok: false,
+                reason: 'The activation manifest subagent list is not in canonical order.',
+            };
+        }
+    }
+    return { ok: true };
+}
+/** Artifact kinds that may appear inside a persisted activation record. */
+const VALID_RECORD_ARTIFACT_KINDS = new Set([
+    'instructions',
+    'memory-policy',
+    'helper-tool',
+    'processor',
+    'guardrail',
+    'structured-output-contract',
+    'workflow',
+    'subagent',
+    'capability',
+]);
+/**
+ * Pin a ProductAgent port to one immutable activation snapshot. The runner
+ * captures the snapshot now: post-pin registry mutation or re-activation
+ * cannot affect turns it starts, and the port is refused when it is bound
+ * to a different profile identity (fail closed, never substitute).
+ */
+export function pinAgentTurnRunner(port, activation) {
+    if (port.agentProfileVersion !== activation.agentProfileVersion) {
+        throw new Error('VICT_AGENT_PORT_MISMATCH: the ProductAgent port is bound to a different agentProfileVersion than the pinned activation; refusing to substitute.');
+    }
+    return {
+        activation,
+        runTurn(request, context = {}) {
+            return port.runTurn(request, { ...context, activation });
+        },
+    };
+}
+//# sourceMappingURL=agent-types.js.map

package/dist/agent-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-types.js","sourceRoot":"","sources":["../src/agent-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAKtD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;AAE1E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,8BAA8B,GAAG,gCAAgC,CAAC;AA8R/E;;;GAGG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,cAAc;IACd,mBAAmB;IACnB,qBAAqB;IACrB,SAAS;IACT,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAElG,+EAA+E;AAC/E,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,QAAQ;IACR,qBAAqB;IACrB,SAAS;IACT,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IACtE,IAAI;IACJ,UAAU;IACV,iBAAiB;CAClB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,mCAAmC,GAAwB,IAAI,GAAG,CAAC;IACvE,IAAI;IACJ,UAAU;IACV,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAEnD,8FAA8F;AAC9F,SAAS,8BAA8B,CACrC,CAA0B,EAC1B,CAA0B;IAE1B,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,OAAQ,CAAC,CAAC,IAAe,GAAI,CAAC,CAAC,IAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAClB,OAAQ,CAAC,CAAC,EAAa,GAAI,CAAC,CAAC,EAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAQ,CAAC,CAAC,QAAmB,GAAI,CAAC,CAAC,QAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,IAAI,CAAC;QACH,OAAO,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,oDAAoD;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,MAAe;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,SAAS,GAAG,MAAiC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6EAA6E;aACtF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,KAAK,gCAAgC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAU,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0BAA0B,GAAG,sCAAsC;aAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAU,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,GAAG,4BAA4B,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACvF,CAAC;IACD,IACE,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QACrC,SAAS,CAAC,SAAS,GAAG,CAAC,EACvB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kEAAkE;SAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,+DAA+D;iBACxE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;QAC5F,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,yCAAyC,GAAG,4BAA4B;iBACjF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,iCAAiC,CAAC,SAAS,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAS,iCAAiC,CACxC,SAAkC,EAClC,YAAoB;IAEpB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iFAAiF;aAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,gCAAgC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;IAC3F,CAAC;IACD,IACE,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ;QAChD,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAC1D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,mBAAmB,KAAK,SAAS,CAAC,mBAAmB,EAAE,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;QAC1B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC/F,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC;QAC5B,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC;QAC5B,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oEAAoE;SAC7E,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,sBAAsB;IACtB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,IAAI,UAAU,KAAK,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kFAAkF;SAC3F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,OAAkC,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gEAAgE;aACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oCAAoC,GAAG,4BAA4B;aAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,aAAa,CAAC,eAAe,CAAC;IACtD,IACE,OAAO,eAAe,KAAK,QAAQ;QACnC,eAAe,KAAK,IAAI;QACxB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0EAA0E;SACnF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,eAA0C,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAI,eAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IACE,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,GAAG,CAAC,MAAM,GAAG,GAAG;YAChB,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,MAAM,GAAG,GAAG,EAClB,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wEAAwE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,yBAAyB,CAChC,iBAA0B,EAC1B,eAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,6EAA6E;SACtF,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iEAAiE;aAC1E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,iEAAiE;iBAC1E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;QAC9F,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,2CAA2C,GAAG,4BAA4B;iBACnF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAA4B,CAAC;QACtE,IACE,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;YAClC,QAAQ,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE;YAC9B,QAAQ,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ,EAC1C,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6EAA6E;aACtF,CAAC;QACJ,CAAC;QACD,IACE,KAAK,GAAG,CAAC;YACT,8BAA8B,CAC5B,iBAAiB,CAAC,KAAK,GAAG,CAAC,CAA4B,EACvD,QAAQ,CACT,GAAG,CAAC,EACL,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kEAAkE;aAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkB;IACnD,sEAAsE;IACtE,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;IAC1F,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iEAAiE;aAC1E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,iEAAiE;iBAC1E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,2CAA2C,GAAG,4BAA4B;iBACnF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ;YAChD,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAC1D,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,uFAAuF;aAC1F,CAAC;QACJ,CAAC;QACD,IACE,KAAK,GAAG,CAAC;YACT,8BAA8B,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAA4B,EAAE,QAAQ,CAAC,GAAG,CAAC,EAC7F,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kEAAkE;aAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,cAAc;IACd,eAAe;IACf,aAAa;IACb,WAAW;IACX,WAAW;IACX,4BAA4B;IAC5B,UAAU;IACV,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAiGH;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAsB,EACtB,UAAkC;IAElC,IAAI,IAAI,CAAC,mBAAmB,KAAK,UAAU,CAAC,mBAAmB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authority.d.ts

@@ -0,0 +1,83 @@
+import type { CapabilityDefinition } from '@victframework/sdk';
+/**
+ * Stage 04 least-authority boundary for capability packs.
+ *
+ * A capability NEVER receives a service locator, a store, a registry, or
+ * unrestricted mutation. It receives:
+ * - permission enforcement BEFORE invocation (declared grants must be
+ *   explicitly granted to the runtime);
+ * - eager resolution of required configuration/secret names BEFORE
+ *   invocation (a missing required value fails the invocation, never the
+ *   handler);
+ * - SCOPED, name-checked readers for declared configuration/secret names.
+ *   Undeclared names are unavailable: access throws a structured authority
+ *   error instead of silently returning empty.
+ *
+ * Audit remediation (HIGH-04-C / LOW-04-H):
+ * - The gate closes over COPIED + FROZEN declaration snapshots, never the
+ *   caller's arrays. Mutating a raw definition's `permissions` array after
+ *   registration (or after activation) cannot change enforcement.
+ * - Every configuration/secret name is resolved AT MOST ONCE per
+ *   invocation. Required names are resolved eagerly into the invocation's
+ *   own cache; optional declared names resolve lazily once per name and
+ *   are then cached for the REMAINDER OF THAT INVOCATION ONLY. The
+ *   handler's scoped reader returns the SAME checked value — the check and
+ *   the use are one consistent read.
+ * - The value caches and their resolver functions live INSIDE the
+ *   per-invocation execution boundary (HIGH-04-D remediation): every
+ *   invocation creates fresh private caches, so rotated configuration and
+ *   secret values are re-read on the next invocation, a rejected provider
+ *   promise can never poison a later invocation, and concurrent
+ *   invocations never share cached values or promises.
+ * - Provider exceptions are converted into sanitized, stable authority
+ *   failures; the provider's message never propagates.
+ * - Resolved values never enter events, traces, history, or activation
+ *   identity (they never leave this gate except through the handler's
+ *   scoped reader).
+ */
+/** Runtime port resolving declared configuration values. */
+export interface ConfigurationPort {
+    get(name: string): unknown;
+}
+/**
+ * Runtime port resolving declared secret references just in time. Values
+ * never enter manifests, events, or retained history; they are handed only
+ * to the declaring capability through the scoped reader.
+ */
+export interface SecretResolutionPort {
+    get(name: string): Promise<string | undefined>;
+}
+/** The authority granted to one runtime. */
+export interface CapabilityAuthority {
+    /** Explicitly granted permission ids. Absent means nothing is granted. */
+    readonly grants?: readonly string[];
+    readonly configuration?: ConfigurationPort;
+    readonly secrets?: SecretResolutionPort;
+}
+/** Immutable snapshot of the declared authority names of one capability. */
+export interface PinnedAuthorityDeclarations {
+    readonly permissions: readonly string[];
+    readonly configuration: readonly string[];
+    readonly requiredConfiguration: readonly string[];
+    readonly secrets: readonly string[];
+    readonly requiredSecrets: readonly string[];
+}
+/** The authority-name fields of a capability definition, in declaration order. */
+declare const AUTHORITY_FIELDS: readonly ["permissions", "configuration", "requiredConfiguration", "secrets", "requiredSecrets"];
+export type AuthorityFieldName = (typeof AUTHORITY_FIELDS)[number];
+/**
+ * Validate and PIN the authority declarations of a capability definition:
+ * every entry must be a non-empty, non-whitespace string; duplicates are
+ * rejected. Returns fresh frozen copies — the caller's arrays are never
+ * retained by reference.
+ */
+export declare function pinAuthorityDeclarations(definition: CapabilityDefinition): PinnedAuthorityDeclarations;
+/**
+ * Wrap a capability's invoke with the least-authority gate. The WRAPPED
+ * invoke is what the registry stores and what activations capture, so the
+ * gate is enforced identically by the sequential and the durable engines.
+ * The gate closes over the PINNED declaration snapshot and the runtime's
+ * grants — never over the caller's definition object.
+ */
+export declare function gateCapabilityInvoke(definition: CapabilityDefinition, authority?: CapabilityAuthority): CapabilityDefinition['invoke'];
+export {};