@xemahq/kernel-contracts 0.49.3 → 0.56.0

package/dist/surface/lib/surface-contribution.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SurfaceKindSourceSchema = exports.SurfaceKindSource = exports.SurfaceContributionManifestSchema = void 0;
+const zod_1 = require("zod");
+const SURFACE_KIND_SLUG_REGEX = /^[a-z][a-z0-9-]*$/;
+exports.SurfaceContributionManifestSchema = zod_1.z.object({
+    kind: zod_1.z
+        .string()
+        .min(1)
+        .max(100)
+        .regex(SURFACE_KIND_SLUG_REGEX, 'Surface kind slug must be lowercase letters, digits, and hyphens (start with a letter).'),
+    version: zod_1.z.number().int().positive(),
+    displayName: zod_1.z.string().min(1).max(200),
+    summary: zod_1.z.string().min(1).max(1000),
+    payloadSchema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+});
+var SurfaceKindSource;
+(function (SurfaceKindSource) {
+    SurfaceKindSource["FirstParty"] = "first-party";
+    SurfaceKindSource["Biome"] = "biome";
+})(SurfaceKindSource || (exports.SurfaceKindSource = SurfaceKindSource = {}));
+exports.SurfaceKindSourceSchema = zod_1.z.nativeEnum(SurfaceKindSource);
+//# sourceMappingURL=surface-contribution.js.map

package/dist/surface/lib/surface-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-contribution.js","sourceRoot":"","sources":["../../../src/surface/lib/surface-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAgDxB,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAQvC,QAAA,iCAAiC,GAC5C,OAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CACJ,uBAAuB,EACvB,yFAAyF,CAC1F;IACH,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,aAAa,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;CACjD,CAA2C,CAAC;AAG/C,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,+CAA0B,CAAA;IAC1B,oCAAe,CAAA;AACjB,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/surface/lib/surface-kind.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export declare enum SurfaceKind {
+    Url = "url",
+    Web = "web",
+    Html = "html",
+    Markdown = "markdown",
+    Code = "code",
+    Diff = "diff",
+    Json = "json",
+    Table = "table",
+    Chart = "chart",
+    Pdf = "pdf",
+    Image = "image",
+    Media = "media",
+    Object = "object",
+    BiomeRoute = "biome-route",
+    Form = "form",
+    App = "app",
+    Files = "files",
+    Graph = "graph"
+}
+export declare const SurfaceKindSchema: z.ZodEnum<typeof SurfaceKind>;
+//# sourceMappingURL=surface-kind.d.ts.map

package/dist/surface/lib/surface-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-kind.d.ts","sourceRoot":"","sources":["../../../src/surface/lib/surface-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,oBAAY,WAAW;IAErB,GAAG,QAAQ;IAEX,GAAG,QAAQ;IAEX,IAAI,SAAS;IAEb,QAAQ,aAAa;IAErB,IAAI,SAAS;IAEb,IAAI,SAAS;IAEb,IAAI,SAAS;IAEb,KAAK,UAAU;IAEf,KAAK,UAAU;IAEf,GAAG,QAAQ;IAEX,KAAK,UAAU;IAEf,KAAK,UAAU;IAEf,MAAM,WAAW;IAEjB,UAAU,gBAAgB;IAE1B,IAAI,SAAS;IAEb,GAAG,QAAQ;IAEX,KAAK,UAAU;IAEf,KAAK,UAAU;CAChB;AAGD,eAAO,MAAM,iBAAiB,+BAA4B,CAAC"}

package/dist/surface/lib/surface-kind.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SurfaceKindSchema = exports.SurfaceKind = void 0;
+const zod_1 = require("zod");
+var SurfaceKind;
+(function (SurfaceKind) {
+    SurfaceKind["Url"] = "url";
+    SurfaceKind["Web"] = "web";
+    SurfaceKind["Html"] = "html";
+    SurfaceKind["Markdown"] = "markdown";
+    SurfaceKind["Code"] = "code";
+    SurfaceKind["Diff"] = "diff";
+    SurfaceKind["Json"] = "json";
+    SurfaceKind["Table"] = "table";
+    SurfaceKind["Chart"] = "chart";
+    SurfaceKind["Pdf"] = "pdf";
+    SurfaceKind["Image"] = "image";
+    SurfaceKind["Media"] = "media";
+    SurfaceKind["Object"] = "object";
+    SurfaceKind["BiomeRoute"] = "biome-route";
+    SurfaceKind["Form"] = "form";
+    SurfaceKind["App"] = "app";
+    SurfaceKind["Files"] = "files";
+    SurfaceKind["Graph"] = "graph";
+})(SurfaceKind || (exports.SurfaceKind = SurfaceKind = {}));
+exports.SurfaceKindSchema = zod_1.z.nativeEnum(SurfaceKind);
+//# sourceMappingURL=surface-kind.js.map

package/dist/surface/lib/surface-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-kind.js","sourceRoot":"","sources":["../../../src/surface/lib/surface-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAwBxB,IAAY,WAqCX;AArCD,WAAY,WAAW;IAErB,0BAAW,CAAA;IAEX,0BAAW,CAAA;IAEX,4BAAa,CAAA;IAEb,oCAAqB,CAAA;IAErB,4BAAa,CAAA;IAEb,4BAAa,CAAA;IAEb,4BAAa,CAAA;IAEb,8BAAe,CAAA;IAEf,8BAAe,CAAA;IAEf,0BAAW,CAAA;IAEX,8BAAe,CAAA;IAEf,8BAAe,CAAA;IAEf,gCAAiB,CAAA;IAEjB,yCAA0B,CAAA;IAE1B,4BAAa,CAAA;IAEb,0BAAW,CAAA;IAEX,8BAAe,CAAA;IAEf,8BAAe,CAAA;AACjB,CAAC,EArCW,WAAW,2BAAX,WAAW,QAqCtB;AAGY,QAAA,iBAAiB,GAAG,OAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC"}

package/dist/surface/lib/vista-surface.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+export interface VistaSurface {
+    readonly tabId: string;
+    readonly kind: string;
+    readonly version: number;
+    readonly title: string;
+    readonly payload: unknown;
+    readonly pinned?: boolean;
+}
+export declare const VistaSurfaceSchema: z.ZodType<VistaSurface>;
+//# sourceMappingURL=vista-surface.d.ts.map

package/dist/surface/lib/vista-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vista-surface.d.ts","sourceRoot":"","sources":["../../../src/surface/lib/vista-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,MAAM,WAAW,YAAY;IAE3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAGD,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAO1B,CAAC"}

package/dist/surface/lib/vista-surface.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VistaSurfaceSchema = void 0;
+const zod_1 = require("zod");
+exports.VistaSurfaceSchema = zod_1.z.object({
+    tabId: zod_1.z.string().min(1),
+    kind: zod_1.z.string().min(1),
+    version: zod_1.z.number().int().positive(),
+    title: zod_1.z.string().min(1),
+    payload: zod_1.z.unknown(),
+    pinned: zod_1.z.boolean().optional(),
+});
+//# sourceMappingURL=vista-surface.js.map

package/dist/surface/lib/vista-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vista-surface.js","sourceRoot":"","sources":["../../../src/surface/lib/vista-surface.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAoCX,QAAA,kBAAkB,GAA4B,OAAC,CAAC,MAAM,CAAC;IAClE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAA4B,CAAC"}

package/dist/widget/lib/chat-widget-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-widget-envelope.d.ts","sourceRoot":"","sources":["../../../src/widget/lib/chat-widget-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAGD,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAIjE,CAAC;AAOH,oBAAY,wBAAwB;IAClC,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,kBAAkB,wBAAwB;CAC3C"}
+{"version":3,"file":"chat-widget-envelope.d.ts","sourceRoot":"","sources":["../../../src/widget/lib/chat-widget-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAGD,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAIjE,CAAC;AAWH,oBAAY,wBAAwB;IAClC,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,kBAAkB,wBAAwB;CAC3C"}

package/dist/widget/lib/chat-widget-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat-widget-envelope.js","sourceRoot":"","sources":["../../../src/widget/lib/chat-widget-envelope.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAyBX,QAAA,wBAAwB,GAAkC,OAAC,CAAC,MAAM,CAAC;IAC9E,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAOH,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,wDAA4B,CAAA;IAC5B,8DAAkC,CAAA;IAClC,sEAA0C,CAAA;AAC5C,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC"}
+{"version":3,"file":"chat-widget-envelope.js","sourceRoot":"","sources":["../../../src/widget/lib/chat-widget-envelope.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAyBX,QAAA,wBAAwB,GAAkC,OAAC,CAAC,MAAM,CAAC;IAC9E,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAWH,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,wDAA4B,CAAA;IAC5B,8DAAkC,CAAA;IAClC,sEAA0C,CAAA;AAC5C,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC"}

package/dist/workflow/lib/enums.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/enums.ts"],"names":[],"mappings":"AASA,oBAAY,mBAAmB;IAC7B,iBAAiB,sBAAsB;IACvC,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAGD,oBAAY,eAAe;IACzB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,kBAAkB,uBAAuB;IACzC,IAAI,SAAS;CACd;AAGD,oBAAY,eAAe;IACzB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,KAAK,UAAU;CAChB;AAGD,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,EAAE,OAAO;IACT,OAAO,YAAY;IACnB,YAAY,eAAe;IAC3B,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAGD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,cAAc,mBAAmB;CAClC;AAcD,oBAAY,UAAU;IAEpB,KAAK,UAAU;IAEf,MAAM,WAAW;IAEjB,IAAI,SAAS;IAGb,KAAK,UAAU;IAEf,SAAS,cAAc;IAEvB,QAAQ,aAAa;IAErB,MAAM,WAAW;IAEjB,IAAI,SAAS;IAEb,OAAO,YAAY;IAEnB,MAAM,WAAW;IAGjB,OAAO,YAAY;IAEnB,KAAK,UAAU;IAEf,SAAS,cAAc;IAEvB,QAAQ,aAAa;IAGrB,SAAS,cAAc;IAEvB,OAAO,YAAY;CACpB;AAYD,oBAAY,YAAY;IACtB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,mBAAmB,wBAAwB;IAC3C,oBAAoB,yBAAyB;IAC7C,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,aAAa,kBAAkB;IAC/B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,aAAa;IACvB,OAAO,iBAAiB;IACxB,KAAK,eAAe;IACpB,KAAK,eAAe;CACrB;AAGD,oBAAY,kBAAkB;IAE5B,MAAM,WAAW;IAEjB,MAAM,WAAW;IAEjB,OAAO,YAAY;CACpB;AAGD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,qBAAqB,0BAA0B;CAChD;AAGD,eAAO,MAAM,8BAA8B,EAAE,SAAS,iBAAiB,EAK7D,CAAC;AAGX,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAGD,oBAAY,aAAa;IACvB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAcD,oBAAY,eAAe;IACzB,KAAK,eAAe;IACpB,MAAM,gBAAgB;IAMtB,aAAa,uBAAuB;IASpC,cAAc,wBAAwB;IACtC,qBAAqB,+BAA+B;IACpD,UAAU,oBAAoB;IAC9B,YAAY,8BAA8B;IAC1C,SAAS,2BAA2B;IAQpC,UAAU,4BAA4B;IAOtC,WAAW,6BAA6B;IASxC,gBAAgB,kCAAkC;IAQlD,QAAQ,0BAA0B;IAQlC,YAAY,8BAA8B;IAC1C,OAAO,iBAAiB;IACxB,IAAI,cAAc;IAClB,IAAI,cAAc;IAClB,aAAa,uBAAuB;IAQpC,aAAa,uBAAuB;IACpC,cAAc,wBAAwB;IACtC,eAAe,iCAAiC;IAChD,iBAAiB,2BAA2B;IAM5C,YAAY,2BAA2B;IAiBvC,iBAAiB,oBAAoB;IAUrC,cAAc,wBAAwB;CACvC;AAGD,oBAAY,iBAAiB;IAC3B,cAAc,mBAAmB;CAClC"}
+{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/enums.ts"],"names":[],"mappings":"AASA,oBAAY,mBAAmB;IAC7B,iBAAiB,sBAAsB;IACvC,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAGD,oBAAY,eAAe;IACzB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,kBAAkB,uBAAuB;IACzC,IAAI,SAAS;CACd;AAGD,oBAAY,eAAe;IACzB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,KAAK,UAAU;CAChB;AAGD,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,EAAE,OAAO;IACT,OAAO,YAAY;IACnB,YAAY,eAAe;IAC3B,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAGD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,cAAc,mBAAmB;CAClC;AAcD,oBAAY,UAAU;IAEpB,KAAK,UAAU;IAEf,MAAM,WAAW;IAEjB,IAAI,SAAS;IAGb,KAAK,UAAU;IAEf,SAAS,cAAc;IAEvB,QAAQ,aAAa;IAErB,MAAM,WAAW;IAEjB,IAAI,SAAS;IAEb,OAAO,YAAY;IAEnB,MAAM,WAAW;IAGjB,OAAO,YAAY;IAEnB,KAAK,UAAU;IAEf,SAAS,cAAc;IAEvB,QAAQ,aAAa;IAGrB,SAAS,cAAc;IAEvB,OAAO,YAAY;CACpB;AAYD,oBAAY,YAAY;IACtB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,mBAAmB,wBAAwB;IAC3C,oBAAoB,yBAAyB;IAC7C,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,aAAa,kBAAkB;IAC/B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,aAAa;IACvB,OAAO,iBAAiB;IACxB,KAAK,eAAe;IACpB,KAAK,eAAe;CACrB;AAGD,oBAAY,kBAAkB;IAE5B,MAAM,WAAW;IAEjB,MAAM,WAAW;IAEjB,OAAO,YAAY;CACpB;AAGD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,qBAAqB,0BAA0B;CAChD;AAGD,eAAO,MAAM,8BAA8B,EAAE,SAAS,iBAAiB,EAK7D,CAAC;AAGX,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAGD,oBAAY,aAAa;IACvB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAcD,oBAAY,eAAe;IACzB,KAAK,eAAe;IACpB,MAAM,gBAAgB;IAMtB,aAAa,uBAAuB;IASpC,cAAc,wBAAwB;IACtC,qBAAqB,+BAA+B;IACpD,UAAU,oBAAoB;IAC9B,YAAY,8BAA8B;IAC1C,SAAS,2BAA2B;IAQpC,UAAU,4BAA4B;IAOtC,WAAW,6BAA6B;IASxC,gBAAgB,kCAAkC;IAQlD,QAAQ,0BAA0B;IAQlC,YAAY,8BAA8B;IAC1C,OAAO,iBAAiB;IACxB,IAAI,cAAc;IAClB,IAAI,cAAc;IAClB,aAAa,uBAAuB;IAQpC,aAAa,uBAAuB;IACpC,cAAc,wBAAwB;IACtC,eAAe,iCAAiC;IAChD,iBAAiB,2BAA2B;IAM5C,YAAY,2BAA2B;IAgBvC,iBAAiB,oBAAoB;IAUrC,cAAc,wBAAwB;CACvC;AAGD,oBAAY,iBAAiB;IAC3B,cAAc,mBAAmB;CAClC"}

package/dist/workflow/lib/enums.js.map

@@ -1 +1 @@
-{"version":3,"file":"enums.js","sourceRoot":"","sources":["../../../src/workflow/lib/enums.ts"],"names":[],"mappings":";;;AASA,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,8DAAuC,CAAA;IACvC,4CAAqB,CAAA;IACrB,0CAAmB,CAAA;IACnB,sDAA+B,CAAA;AACjC,CAAC,EALW,mBAAmB,mCAAnB,mBAAmB,QAK9B;AAGD,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,kCAAe,CAAA;IACf,kCAAe,CAAA;IACf,4DAAyC,CAAA;IACzC,gCAAa,CAAA;AACf,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAGD,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,gCAAa,CAAA;IACb,gCAAa,CAAA;IACb,sCAAmB,CAAA;IACnB,kCAAe,CAAA;AACjB,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAGD,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,+BAAS,CAAA;IACT,yCAAmB,CAAA;IACnB,iDAA2B,CAAA;IAC3B,6CAAuB,CAAA;IACvB,uCAAiB,CAAA;AACnB,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAGD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wDAAiC,CAAA;AACnC,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAcD,IAAY,UAoCX;AApCD,WAAY,UAAU;IAEpB,6BAAe,CAAA;IAEf,+BAAiB,CAAA;IAEjB,2BAAa,CAAA;IAGb,6BAAe,CAAA;IAEf,qCAAuB,CAAA;IAEvB,mCAAqB,CAAA;IAErB,+BAAiB,CAAA;IAEjB,2BAAa,CAAA;IAEb,iCAAmB,CAAA;IAEnB,+BAAiB,CAAA;IAGjB,iCAAmB,CAAA;IAEnB,6BAAe,CAAA;IAEf,qCAAuB,CAAA;IAEvB,mCAAqB,CAAA;IAGrB,qCAAuB,CAAA;IAEvB,iCAAmB,CAAA;AACrB,CAAC,EApCW,UAAU,0BAAV,UAAU,QAoCrB;AAYD,IAAY,YAkBX;AAlBD,WAAY,YAAY;IACtB,2CAA2B,CAAA;IAC3B,+CAA+B,CAAA;IAC/B,yCAAyB,CAAA;IACzB,+CAA+B,CAAA;IAC/B,2CAA2B,CAAA;IAC3B,+CAA+B,CAAA;IAC/B,yCAAyB,CAAA;IACzB,2CAA2B,CAAA;IAC3B,2DAA2C,CAAA;IAC3C,6DAA6C,CAAA;IAC7C,iDAAiC,CAAA;IACjC,iDAAiC,CAAA;IACjC,uDAAuC,CAAA;IACvC,+CAA+B,CAAA;IAC/B,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;IACnB,mCAAmB,CAAA;AACrB,CAAC,EAlBW,YAAY,4BAAZ,YAAY,QAkBvB;AAGD,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,yCAAwB,CAAA;IACxB,qCAAoB,CAAA;IACpB,qCAAoB,CAAA;AACtB,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB;AAGD,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAE5B,uCAAiB,CAAA;IAEjB,uCAAiB,CAAA;IAEjB,yCAAmB,CAAA;AACrB,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAGD,IAAY,iBAUX;AAVD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;IACnB,gEAA2C,CAAA;IAC3C,0DAAqC,CAAA;IACrC,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;IACvB,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;IACvB,oEAA+C,CAAA;AACjD,CAAC,EAVW,iBAAiB,iCAAjB,iBAAiB,QAU5B;AAGY,QAAA,8BAA8B,GAAiC;IAC1E,iBAAiB,CAAC,SAAS;IAC3B,iBAAiB,CAAC,MAAM;IACxB,iBAAiB,CAAC,SAAS;IAC3B,iBAAiB,CAAC,qBAAqB;CAC/B,CAAC;AAGX,IAAY,YAQX;AARD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,mCAAmB,CAAA;IACnB,mCAAmB,CAAA;IACnB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,mCAAmB,CAAA;AACrB,CAAC,EARW,YAAY,4BAAZ,YAAY,QAQvB;AAGD,IAAY,aAOX;AAPD,WAAY,aAAa;IACvB,oCAAmB,CAAA;IACnB,oCAAmB,CAAA;IACnB,wCAAuB,CAAA;IACvB,kCAAiB,CAAA;IACjB,wCAAuB,CAAA;IACvB,sCAAqB,CAAA;AACvB,CAAC,EAPW,aAAa,6BAAb,aAAa,QAOxB;AAcD,IAAY,eA8GX;AA9GD,WAAY,eAAe;IACzB,uCAAoB,CAAA;IACpB,yCAAsB,CAAA;IAMtB,uDAAoC,CAAA;IASpC,yDAAsC,CAAA;IACtC,uEAAoD,CAAA;IACpD,iDAA8B,CAAA;IAC9B,6DAA0C,CAAA;IAC1C,uDAAoC,CAAA;IAQpC,yDAAsC,CAAA;IAOtC,2DAAwC,CAAA;IASxC,qEAAkD,CAAA;IAQlD,qDAAkC,CAAA;IAQlC,6DAA0C,CAAA;IAC1C,2CAAwB,CAAA;IACxB,qCAAkB,CAAA;IAClB,qCAAkB,CAAA;IAClB,uDAAoC,CAAA;IAQpC,uDAAoC,CAAA;IACpC,yDAAsC,CAAA;IACtC,mEAAgD,CAAA;IAChD,+DAA4C,CAAA;IAM5C,0DAAuC,CAAA;IAiBvC,wDAAqC,CAAA;IAUrC,yDAAsC,CAAA;AACxC,CAAC,EA9GW,eAAe,+BAAf,eAAe,QA8G1B;AAGD,IAAY,iBAEX;AAFD,WAAY,iBAAiB;IAC3B,sDAAiC,CAAA;AACnC,CAAC,EAFW,iBAAiB,iCAAjB,iBAAiB,QAE5B"}
+{"version":3,"file":"enums.js","sourceRoot":"","sources":["../../../src/workflow/lib/enums.ts"],"names":[],"mappings":";;;AASA,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,8DAAuC,CAAA;IACvC,4CAAqB,CAAA;IACrB,0CAAmB,CAAA;IACnB,sDAA+B,CAAA;AACjC,CAAC,EALW,mBAAmB,mCAAnB,mBAAmB,QAK9B;AAGD,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,kCAAe,CAAA;IACf,kCAAe,CAAA;IACf,4DAAyC,CAAA;IACzC,gCAAa,CAAA;AACf,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAGD,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,gCAAa,CAAA;IACb,gCAAa,CAAA;IACb,sCAAmB,CAAA;IACnB,kCAAe,CAAA;AACjB,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAGD,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,+BAAS,CAAA;IACT,yCAAmB,CAAA;IACnB,iDAA2B,CAAA;IAC3B,6CAAuB,CAAA;IACvB,uCAAiB,CAAA;AACnB,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAGD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wDAAiC,CAAA;AACnC,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAcD,IAAY,UAoCX;AApCD,WAAY,UAAU;IAEpB,6BAAe,CAAA;IAEf,+BAAiB,CAAA;IAEjB,2BAAa,CAAA;IAGb,6BAAe,CAAA;IAEf,qCAAuB,CAAA;IAEvB,mCAAqB,CAAA;IAErB,+BAAiB,CAAA;IAEjB,2BAAa,CAAA;IAEb,iCAAmB,CAAA;IAEnB,+BAAiB,CAAA;IAGjB,iCAAmB,CAAA;IAEnB,6BAAe,CAAA;IAEf,qCAAuB,CAAA;IAEvB,mCAAqB,CAAA;IAGrB,qCAAuB,CAAA;IAEvB,iCAAmB,CAAA;AACrB,CAAC,EApCW,UAAU,0BAAV,UAAU,QAoCrB;AAYD,IAAY,YAkBX;AAlBD,WAAY,YAAY;IACtB,2CAA2B,CAAA;IAC3B,+CAA+B,CAAA;IAC/B,yCAAyB,CAAA;IACzB,+CAA+B,CAAA;IAC/B,2CAA2B,CAAA;IAC3B,+CAA+B,CAAA;IAC/B,yCAAyB,CAAA;IACzB,2CAA2B,CAAA;IAC3B,2DAA2C,CAAA;IAC3C,6DAA6C,CAAA;IAC7C,iDAAiC,CAAA;IACjC,iDAAiC,CAAA;IACjC,uDAAuC,CAAA;IACvC,+CAA+B,CAAA;IAC/B,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;IACnB,mCAAmB,CAAA;AACrB,CAAC,EAlBW,YAAY,4BAAZ,YAAY,QAkBvB;AAGD,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,yCAAwB,CAAA;IACxB,qCAAoB,CAAA;IACpB,qCAAoB,CAAA;AACtB,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB;AAGD,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAE5B,uCAAiB,CAAA;IAEjB,uCAAiB,CAAA;IAEjB,yCAAmB,CAAA;AACrB,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAGD,IAAY,iBAUX;AAVD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;IACnB,gEAA2C,CAAA;IAC3C,0DAAqC,CAAA;IACrC,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;IACvB,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;IACvB,oEAA+C,CAAA;AACjD,CAAC,EAVW,iBAAiB,iCAAjB,iBAAiB,QAU5B;AAGY,QAAA,8BAA8B,GAAiC;IAC1E,iBAAiB,CAAC,SAAS;IAC3B,iBAAiB,CAAC,MAAM;IACxB,iBAAiB,CAAC,SAAS;IAC3B,iBAAiB,CAAC,qBAAqB;CAC/B,CAAC;AAGX,IAAY,YAQX;AARD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,mCAAmB,CAAA;IACnB,mCAAmB,CAAA;IACnB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,mCAAmB,CAAA;AACrB,CAAC,EARW,YAAY,4BAAZ,YAAY,QAQvB;AAGD,IAAY,aAOX;AAPD,WAAY,aAAa;IACvB,oCAAmB,CAAA;IACnB,oCAAmB,CAAA;IACnB,wCAAuB,CAAA;IACvB,kCAAiB,CAAA;IACjB,wCAAuB,CAAA;IACvB,sCAAqB,CAAA;AACvB,CAAC,EAPW,aAAa,6BAAb,aAAa,QAOxB;AAcD,IAAY,eA6GX;AA7GD,WAAY,eAAe;IACzB,uCAAoB,CAAA;IACpB,yCAAsB,CAAA;IAMtB,uDAAoC,CAAA;IASpC,yDAAsC,CAAA;IACtC,uEAAoD,CAAA;IACpD,iDAA8B,CAAA;IAC9B,6DAA0C,CAAA;IAC1C,uDAAoC,CAAA;IAQpC,yDAAsC,CAAA;IAOtC,2DAAwC,CAAA;IASxC,qEAAkD,CAAA;IAQlD,qDAAkC,CAAA;IAQlC,6DAA0C,CAAA;IAC1C,2CAAwB,CAAA;IACxB,qCAAkB,CAAA;IAClB,qCAAkB,CAAA;IAClB,uDAAoC,CAAA;IAQpC,uDAAoC,CAAA;IACpC,yDAAsC,CAAA;IACtC,mEAAgD,CAAA;IAChD,+DAA4C,CAAA;IAM5C,0DAAuC,CAAA;IAgBvC,wDAAqC,CAAA;IAUrC,yDAAsC,CAAA;AACxC,CAAC,EA7GW,eAAe,+BAAf,eAAe,QA6G1B;AAGD,IAAY,iBAEX;AAFD,WAAY,iBAAiB;IAC3B,sDAAiC,CAAA;AACnC,CAAC,EAFW,iBAAiB,iCAAjB,iBAAiB,QAE5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.49.3",
+  "version": "0.56.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",

package/src/app-definition/lib/automation.ts

@@ -9,8 +9,9 @@
  *
  * - `recordCreated` / `recordUpdated` fire transactionally-adjacent to a record
  *   write, against the written record.
- * - `scheduled` fires on a cluster-singleton Temporal Schedule and runs its
- *   action against every record of the bound entity on each tick.
+ * - `scheduled` fires on a cluster-singleton schedule owned by the workflow
+ *   runtime, and runs its action against every record of the bound entity on
+ *   each tick.
  */
 export enum AppAutomationTrigger {
   RecordCreated = 'recordCreated',

package/src/biome/lib/biome-manifest.ts

@@ -3,7 +3,10 @@ import {
   FilterExprSchema,
 } from '../../connector';
 import { ContributionKindSchema } from '../../contribution';
-import { CapabilityRefSchema } from '../../capability';
+import {
+  CapabilityDomainSchema,
+  CapabilityRefSchema,
+} from '../../capability';
 import {
   ProvisioningGuardSchema,
   ProvisioningStepKindSchema,
@@ -503,6 +506,9 @@ export type BiomeManifestRequires = Readonly<Record<string, string>>;
  *   to grant before any of its handlers/contributions execute.
  * - `exposesCapabilities[]` — capability refs the biome itself
  *   implements and offers to others.
+ * - `ownsCapabilityDomains[]` — capability DOMAINS the biome owns outright.
+ *   Materialized into the distribution lock, from which the first-party
+ *   (un-shadowable) domain set is derived.
  * - `permissions` — install-time consent metadata (default profile +
  *   per-ref hints + UX groupings) for `requiresCapabilities[]`.
  * - `lifecycle` — module paths the host invokes on
@@ -526,6 +532,23 @@ const XsiManifestExtensionsShape = {
   contributions: BiomeContributionsSchema.optional(),
   requiresCapabilities: z.array(CapabilityRefSchema).optional(),
   exposesCapabilities: z.array(CapabilityRefSchema).optional(),
+  /**
+   * Capability DOMAINS this biome OWNS — the `<domain>` segment, not refs.
+   *
+   * Distinct from `exposesCapabilities`, which lists individual refs a biome
+   * happens to implement. Ownership is a claim over the whole domain: "every
+   * ref under `kb:` is mine". It is what the distribution resolver materializes
+   * into `LockedBiome.ownsCapabilityDomains`, from which
+   * `FirstPartyCapabilityDomains` derives the set of domains an org may NOT
+   * shadow with a `CapabilityProviderBinding`.
+   *
+   * Declaring it here is necessary but NOT sufficient: a claim only becomes
+   * first-party by being resolved into a distribution lock. A biome installed
+   * at runtime from npm/OCI/git never enters a lock, so it can never mint
+   * itself first-party by editing this field. Two biomes in the SAME
+   * distribution claiming the same domain is a fail-fast packaging error.
+   */
+  ownsCapabilityDomains: z.array(CapabilityDomainSchema).optional(),
   permissions: BiomePermissionsManifestSchema.optional(),
   lifecycle: BiomeLifecycleHooksSchema.optional(),
   engines: BiomeEnginesSchema.optional(),
@@ -820,6 +843,23 @@ const ServerBiomeXemaSchema = z
     ...BiomeTagsShape,
     scope: ManifestBiomeScopeSchema,
     target: z.literal('server'),
+    /**
+     * The `<domain>` segment every capability PROJECTED from this biome's
+     * services is filed under — the `domain` of
+     * `<domain>:<resource>.<verb>@<major>`.
+     *
+     * This is the ONE per-biome declaration the HTTP capability projector
+     * needs; everything else it derives from metadata the platform already
+     * computes (`x-xema-resource` / `x-xema-action` on the generated spec).
+     * Optional: when absent the projector uses {@link BiomeIdSchema} `id`,
+     * which is grammar-identical to a capability domain. Declare it only when
+     * the biome's capability vocabulary should differ from its id (e.g. the
+     * `knowledge-base` biome filing capabilities under the `kb` domain).
+     *
+     * NOT a fallback for a missing id — `id` is required, so the default is
+     * always a real declared value, never a guess.
+     */
+    capabilityDomain: BiomeIdSchema.optional(),
     /**
      * What this biome needs from the runtime/runner that executes it
      * (labels, resources, isolation, locality, trust). Requirements only —

package/src/capability/index.ts

@@ -1,6 +1,7 @@
 export * from './lib/capability-ref';
 export * from './lib/connector-capability-ref';
-export * from './lib/first-party-capability-domains';
+export * from './lib/capability-domain';
+export * from './lib/authority-effect';
 export * from './lib/capability-grant';
 export * from './lib/capability-policy';
 export * from './lib/permission-profile';

package/src/capability/lib/authority-effect.ts

@@ -0,0 +1,88 @@
+import { z } from 'zod';
+
+/**
+ * ═══════════════════════════════════════════════════════════════════════════
+ * `CapabilityAuthorityEffect` — DECLARED answer to "does invoking this
+ * capability grant, expand or reassign somebody's authority?"
+ * ═══════════════════════════════════════════════════════════════════════════
+ *
+ * WHY THIS IS DECLARED AND NOT ONLY INFERRED.
+ *
+ * The capability-router's self-escalation guard refuses an authority-expanding
+ * invocation whose subject resolves to the calling agent or its owner. Until
+ * this field existed, "authority-expanding" was decided ENTIRELY by a closed
+ * noun/verb VOCABULARY over the ref grammar (`authorization` as a domain,
+ * `grant`/`role`/`team`/… as resource nouns, `grant`/`revoke`/`delegate`/… as
+ * verbs). That vocabulary is pinned by a test over `authorization-api`'s whole
+ * public spec, so it is airtight for FIRST-PARTY refs.
+ *
+ * It is NOT airtight for a third party. A biome shipping
+ * `acme:widget.frobnicate@1` — unknown domain, unknown noun, unknown verb —
+ * escapes every vocabulary rule and classifies as authority-neutral, even if
+ * what it actually does is hand somebody an ACME admin seat. Xema's whole
+ * premise is that ANY biome is a first-class extension, so a guard that only
+ * covers the vocabulary we happened to enumerate is not a guarantee.
+ *
+ * Hence: an EXPLICIT field on the capability descriptor, which the author (or
+ * the projector, on the author's behalf) declares.
+ *
+ * ── FAIL-CLOSED, IN BOTH DIRECTIONS ────────────────────────────────────────
+ *
+ * 1. ABSENT ⇒ NOT "neutral". A consumer that finds no declaration MUST fall
+ *    back to a fail-closed derivation, never to {@link CapabilityAuthorityEffect.None}.
+ *    Concretely, the router treats an undeclared MUTATING capability in a
+ *    NON-first-party domain as {@link CapabilityAuthorityEffect.Expanding} —
+ *    the any-biome guarantee — while an undeclared capability in a first-party
+ *    domain falls back to the vocabulary, which the spec test pins.
+ *
+ *    This is the OPPOSITE default from the neighbouring `outputClassification`
+ *    field, whose absent case deliberately passes every cap. Do not copy that
+ *    field's "absent ⇒ permissive" reasoning onto this one.
+ *
+ * 2. A DECLARATION MAY RAISE, NEVER LOWER. A descriptor declaring
+ *    `Expanding` is honoured unconditionally. A descriptor declaring `None` is
+ *    honoured ONLY where the fail-closed derivation also says `None` — a
+ *    self-declared value must never be able to switch a security guard off for
+ *    a capability the platform already identified as authority-bearing.
+ *    Effect resolution is therefore a MONOTONE join
+ *    (`Expanding > None`), not a precedence ladder.
+ *
+ * Over-classifying is visible and correctable; under-classifying is a silent
+ * privilege-escalation hole.
+ */
+export enum CapabilityAuthorityEffect {
+  /**
+   * Provably cannot change who holds authority. Only claim this when the
+   * capability neither writes an authorization decision nor hands out a
+   * credential, seat, membership, ownership or delegation.
+   */
+  None = 'none',
+  /**
+   * Grants, expands, reassigns or delegates authority — to anybody, in any
+   * authority system, including a system this platform does not model. The
+   * self-escalation guard treats this exactly like a proven grant write.
+   */
+  Expanding = 'expanding',
+}
+
+export const CapabilityAuthorityEffectSchema = z.nativeEnum(
+  CapabilityAuthorityEffect,
+);
+
+/**
+ * Monotone join over {@link CapabilityAuthorityEffect} — `Expanding` absorbs.
+ *
+ * THE single place the "declared may raise, never lower" rule is implemented.
+ * Every consumer combining a declared value with a derived one MUST go through
+ * this function rather than writing `declared ?? derived`, which would let a
+ * declared `none` silently disable the guard.
+ */
+export function joinAuthorityEffect(
+  ...effects: readonly (CapabilityAuthorityEffect | undefined)[]
+): CapabilityAuthorityEffect {
+  return effects.some(
+    (effect) => effect === CapabilityAuthorityEffect.Expanding,
+  )
+    ? CapabilityAuthorityEffect.Expanding
+    : CapabilityAuthorityEffect.None;
+}

package/src/capability/lib/capability-contribution.ts

@@ -1,10 +1,18 @@
 import { z } from 'zod';
 
 import { CapabilityRefSchema, type CapabilityRef } from './capability-ref';
+import {
+  CapabilityAuthorityEffectSchema,
+  type CapabilityAuthorityEffect,
+} from './authority-effect';
 import {
   CapabilityRiskTierSchema,
   type CapabilityRiskTier,
 } from './permission-profile';
+import {
+  DataClassificationSchema,
+  type DataClassification,
+} from '../../space';
 
 /**
  * Manifest shape carried by every `ContributionKind.Capability` envelope.
@@ -68,6 +76,42 @@ export interface CapabilityContributionManifest {
    * broker), NEVER a secret. Only meaningful alongside `externalServiceRef`.
    */
   readonly defaultCredentialBindingRef?: string;
+  /**
+   * OPTIONAL declared classification of the data this capability RETURNS.
+   *
+   * It is the static value the capability-router's
+   * `restrict-output-classification` policy obligation compares against: if a
+   * capability DECLARES an output classification that is strictly more
+   * restrictive than the invocation context's cap, the invocation is REFUSED —
+   * a comparison of two declared values, with no need to inspect response
+   * bytes.
+   *
+   * Optional BY DESIGN — this is the load-bearing safety rule, not a silent
+   * default. An UNDECLARED classification means the capability makes NO claim to
+   * return restricted data, so it "does not exceed" any cap and PASSES every
+   * clamp. Only a capability that EXPLICITLY declares a classification above the
+   * cap fails closed. This keeps re-enabling the obligation additive: a
+   * capability that declares nothing (every capability today) is never newly
+   * refused. Do NOT change the absent case to fail closed — that would reproduce
+   * the mass-denial that removing the obligation fixed.
+   */
+  readonly outputClassification?: DataClassification;
+  /**
+   * OPTIONAL declared answer to "does invoking this capability grant, expand
+   * or reassign somebody's authority?" — consumed by the capability-router's
+   * self-escalation guard.
+   *
+   * ⚠️ THE ABSENT CASE IS FAIL-CLOSED, unlike `outputClassification` directly
+   * above. An undeclared capability is NOT assumed authority-neutral: the
+   * router falls back to a fail-closed derivation which treats an undeclared
+   * MUTATING capability in a non-first-party domain as
+   * {@link CapabilityAuthorityEffect.Expanding}. Declaring
+   * {@link CapabilityAuthorityEffect.None} does NOT switch the guard off — the
+   * declared value may only RAISE the derived one (monotone join, see
+   * `joinAuthorityEffect`). Declare it because it makes the descriptor honest
+   * and the denial message precise, not to obtain a bypass.
+   */
+  readonly authorityEffect?: CapabilityAuthorityEffect;
 }
 
 /**
@@ -98,4 +142,6 @@ export const CapabilityContributionManifestSchema: z.ZodType<CapabilityContribut
       .optional(),
     externalServiceRef: z.string().min(1).max(200).optional(),
     defaultCredentialBindingRef: z.string().min(1).max(200).optional(),
+    outputClassification: DataClassificationSchema.optional(),
+    authorityEffect: CapabilityAuthorityEffectSchema.optional(),
   }) as z.ZodType<CapabilityContributionManifest>;

package/src/capability/lib/capability-domain.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+
+/**
+ * The `<domain>` segment of a `CapabilityRef` (`<domain>:<resource>.<verb>@<major>`)
+ * as a value in its OWN right.
+ *
+ * A domain is the unit of capability OWNERSHIP: `kb`, `agent`, `web`, … Refs
+ * are owned per-domain, never per-ref, because the ref corpus is projected and
+ * unbounded (a service growing a route mints a ref with nobody editing
+ * anything) while the domain set is declared and small.
+ *
+ * The grammar is byte-identical to the `<domain>` production in
+ * `capability-ref.ts` — kebab, must start with a letter, lowercase only. Both
+ * derive from the same source of truth so a domain that parses here always
+ * parses as the domain of a ref, and vice versa.
+ */
+const CAPABILITY_DOMAIN_REGEX = /^[a-z][a-z0-9-]*$/;
+
+export type CapabilityDomain = string & {
+  readonly __capabilityDomain?: never;
+};
+
+export const CapabilityDomainSchema: z.ZodType<CapabilityDomain> = z
+  .string()
+  .regex(CAPABILITY_DOMAIN_REGEX, {
+    message:
+      'CapabilityDomain must match ^[a-z][a-z0-9-]*$ (lowercase kebab, starting with a letter).',
+  }) as unknown as z.ZodType<CapabilityDomain>;
+
+/** `true` iff `value` is a syntactically valid capability domain. */
+export function isCapabilityDomain(value: string): value is CapabilityDomain {
+  return CAPABILITY_DOMAIN_REGEX.test(value);
+}
+
+/**
+ * Extract the domain from a capability ref WITHOUT running the full ref
+ * grammar. Used by guards that branch on ownership before the ref has been
+ * parsed (and by call sites that hold an already-validated ref).
+ *
+ * Returns `null` when the string carries no `:` separator or when the leading
+ * segment is not a valid domain — a caller must treat `null` as "undecidable",
+ * never as "not owned".
+ */
+export function capabilityDomainOf(ref: string): CapabilityDomain | null {
+  const colonIdx = ref.indexOf(':');
+  if (colonIdx <= 0) {
+    return null;
+  }
+  const domain = ref.slice(0, colonIdx);
+  return isCapabilityDomain(domain) ? domain : null;
+}

package/src/capability/lib/capability-grant.ts

@@ -70,7 +70,7 @@ export interface CapabilityGrant {
   subject: SubjectRef;
   capability: CapabilityRef;
   /**
-   * Glob over XVFS resource refs, e.g. `xema://org/acme/project/*\/kb/**`.
+   * Glob over XVFS resource refs, e.g. `xema://orgs/acme/project/*\/kb/**`.
    * Authorization-api owns glob semantics.
    */
   resourceGlob: string;