@xemahq/kernel-contracts 0.56.0 → 0.58.0

package/dist/capability/index.d.ts

@@ -2,6 +2,7 @@ export * from './lib/capability-ref';
 export * from './lib/connector-capability-ref';
 export * from './lib/capability-domain';
 export * from './lib/authority-effect';
+export * from './lib/capability-reach';
 export * from './lib/capability-grant';
 export * from './lib/capability-policy';
 export * from './lib/permission-profile';

package/dist/capability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,cAAc,CAAC"}

package/dist/capability/index.js

@@ -18,6 +18,7 @@ __exportStar(require("./lib/capability-ref"), exports);
 __exportStar(require("./lib/connector-capability-ref"), exports);
 __exportStar(require("./lib/capability-domain"), exports);
 __exportStar(require("./lib/authority-effect"), exports);
+__exportStar(require("./lib/capability-reach"), exports);
 __exportStar(require("./lib/capability-grant"), exports);
 __exportStar(require("./lib/capability-policy"), exports);
 __exportStar(require("./lib/permission-profile"), exports);

package/dist/capability/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,gEAA8C;AAC9C,+CAA6B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,gEAA8C;AAC9C,+CAA6B"}

package/dist/capability/lib/capability-contribution.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { type CapabilityRef } from './capability-ref';
 import { type CapabilityAuthorityEffect } from './authority-effect';
+import { type CapabilityReach } from './capability-reach';
 import { type CapabilityRiskTier } from './permission-profile';
 import { type DataClassification } from '../../space';
 export interface CapabilityContributionManifest {
@@ -17,6 +18,7 @@ export interface CapabilityContributionManifest {
     readonly defaultCredentialBindingRef?: string;
     readonly outputClassification?: DataClassification;
     readonly authorityEffect?: CapabilityAuthorityEffect;
+    readonly reach?: CapabilityReach;
 }
 export declare const CapabilityContributionManifestSchema: z.ZodType<CapabilityContributionManifest>;
 //# sourceMappingURL=capability-contribution.d.ts.map

package/dist/capability/lib/capability-contribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAsBrB,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAUvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAOrC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAoB9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAgBnD,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,CAAC;CACtD;AAcD,eAAO,MAAM,oCAAoC,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAkB1C,CAAC"}
+{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAsBrB,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAUvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAOrC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAoB9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAgBnD,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAqBrD,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AAcD,eAAO,MAAM,oCAAoC,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAmB1C,CAAC"}

package/dist/capability/lib/capability-contribution.js

@@ -4,6 +4,7 @@ exports.CapabilityContributionManifestSchema = void 0;
 const zod_1 = require("zod");
 const capability_ref_1 = require("./capability-ref");
 const authority_effect_1 = require("./authority-effect");
+const capability_reach_1 = require("./capability-reach");
 const permission_profile_1 = require("./permission-profile");
 const space_1 = require("../../space");
 exports.CapabilityContributionManifestSchema = zod_1.z.object({
@@ -23,5 +24,6 @@ exports.CapabilityContributionManifestSchema = zod_1.z.object({
     defaultCredentialBindingRef: zod_1.z.string().min(1).max(200).optional(),
     outputClassification: space_1.DataClassificationSchema.optional(),
     authorityEffect: authority_effect_1.CapabilityAuthorityEffectSchema.optional(),
+    reach: capability_reach_1.CapabilityReachSchema.optional(),
 });
 //# sourceMappingURL=capability-contribution.js.map

package/dist/capability/lib/capability-contribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,yDAG4B;AAC5B,6DAG8B;AAC9B,uCAGqB;AAkHR,QAAA,oCAAoC,GAC/C,OAAC,CAAC,MAAM,CAAC;IACP,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC;SACR,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,kDAA+B,CAAC,QAAQ,EAAE;CAC5D,CAA8C,CAAC"}
+{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,yDAG4B;AAC5B,yDAAiF;AACjF,6DAG8B;AAC9B,uCAGqB;AAuIR,QAAA,oCAAoC,GAC/C,OAAC,CAAC,MAAM,CAAC;IACP,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC;SACR,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,kDAA+B,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,wCAAqB,CAAC,QAAQ,EAAE;CACxC,CAA8C,CAAC"}

package/dist/capability/lib/capability-reach.d.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+export declare enum CapabilityReach {
+    Owner = "owner",
+    Integration = "integration",
+    Platform = "platform"
+}
+export declare const CapabilityReachSchema: z.ZodEnum<typeof CapabilityReach>;
+export declare const DEFAULT_CAPABILITY_REACH = CapabilityReach.Owner;
+export declare const REACH_RANK: Readonly<Record<CapabilityReach, number>>;
+export declare function reachWithin(candidate: CapabilityReach, ceiling: CapabilityReach): boolean;
+export declare function joinReach(derived: CapabilityReach, declared?: CapabilityReach | undefined): CapabilityReach;
+export declare function deriveCapabilityReach(input: {
+    readonly ref?: string;
+    readonly invocationKind?: string;
+}): CapabilityReach;
+//# sourceMappingURL=capability-reach.d.ts.map

package/dist/capability/lib/capability-reach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-reach.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-reach.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqCxB,oBAAY,eAAe;IAKzB,KAAK,UAAU;IAMf,WAAW,gBAAgB;IAM3B,QAAQ,aAAa;CACtB;AAED,eAAO,MAAM,qBAAqB,mCAAgC,CAAC;AAQnE,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAQ9D,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAI/D,CAAC;AAGH,wBAAgB,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAEzF;AAeD,wBAAgB,SAAS,CACvB,OAAO,EAAE,eAAe,EACxB,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,GACrC,eAAe,CAGjB;AA6BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAE3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,eAAe,CAWlB"}

package/dist/capability/lib/capability-reach.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REACH_RANK = exports.DEFAULT_CAPABILITY_REACH = exports.CapabilityReachSchema = exports.CapabilityReach = void 0;
+exports.reachWithin = reachWithin;
+exports.joinReach = joinReach;
+exports.deriveCapabilityReach = deriveCapabilityReach;
+const zod_1 = require("zod");
+const connector_capability_ref_1 = require("./connector-capability-ref");
+var CapabilityReach;
+(function (CapabilityReach) {
+    CapabilityReach["Owner"] = "owner";
+    CapabilityReach["Integration"] = "integration";
+    CapabilityReach["Platform"] = "platform";
+})(CapabilityReach || (exports.CapabilityReach = CapabilityReach = {}));
+exports.CapabilityReachSchema = zod_1.z.nativeEnum(CapabilityReach);
+exports.DEFAULT_CAPABILITY_REACH = CapabilityReach.Owner;
+exports.REACH_RANK = Object.freeze({
+    [CapabilityReach.Owner]: 0,
+    [CapabilityReach.Integration]: 1,
+    [CapabilityReach.Platform]: 2,
+});
+function reachWithin(candidate, ceiling) {
+    return exports.REACH_RANK[candidate] <= exports.REACH_RANK[ceiling];
+}
+function joinReach(derived, declared) {
+    if (declared === undefined)
+        return derived;
+    return exports.REACH_RANK[declared] > exports.REACH_RANK[derived] ? declared : derived;
+}
+function deriveCapabilityReach(input) {
+    if (input.invocationKind === 'connector') {
+        return CapabilityReach.Integration;
+    }
+    if (input.ref !== undefined &&
+        refDomain(input.ref) === connector_capability_ref_1.CONNECTOR_CAPABILITY_DOMAIN) {
+        return CapabilityReach.Integration;
+    }
+    return exports.DEFAULT_CAPABILITY_REACH;
+}
+function refDomain(ref) {
+    const separator = ref.indexOf(':');
+    if (separator <= 0) {
+        return undefined;
+    }
+    return ref.slice(0, separator);
+}
+//# sourceMappingURL=capability-reach.js.map

package/dist/capability/lib/capability-reach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-reach.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-reach.ts"],"names":[],"mappings":";;;AAgFA,kCAEC;AAeD,8BAMC;AA6BD,sDAgBC;AApJD,6BAAwB;AAExB,yEAAyE;AAmCzE,IAAY,eAkBX;AAlBD,WAAY,eAAe;IAKzB,kCAAe,CAAA;IAMf,8CAA2B,CAAA;IAM3B,wCAAqB,CAAA;AACvB,CAAC,EAlBW,eAAe,+BAAf,eAAe,QAkB1B;AAEY,QAAA,qBAAqB,GAAG,OAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAQtD,QAAA,wBAAwB,GAAG,eAAe,CAAC,KAAK,CAAC;AAQjD,QAAA,UAAU,GAA8C,MAAM,CAAC,MAAM,CAAC;IACjF,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1B,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;IAChC,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;CAC9B,CAAC,CAAC;AAGH,SAAgB,WAAW,CAAC,SAA0B,EAAE,OAAwB;IAC9E,OAAO,kBAAU,CAAC,SAAS,CAAC,IAAI,kBAAU,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAeD,SAAgB,SAAS,CACvB,OAAwB,EACxB,QAAsC;IAEtC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC3C,OAAO,kBAAU,CAAC,QAAQ,CAAC,GAAG,kBAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACzE,CAAC;AA6BD,SAAgB,qBAAqB,CAAC,KAKrC;IACC,IAAI,KAAK,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;QACzC,OAAO,eAAe,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,IACE,KAAK,CAAC,GAAG,KAAK,SAAS;QACvB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,sDAA2B,EACpD,CAAC;QACD,OAAO,eAAe,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,gCAAwB,CAAC;AAClC,CAAC;AAUD,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACjC,CAAC"}

package/dist/capability/lib/first-party-capability-domains.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare const FIRST_PARTY_CAPABILITY_DOMAINS: readonly ["xema-shell", "store", "biome", "connector", "kb", "agent", "memory", "model", "model-resolution", "mcp-tool", "workflow", "studio", "interactive-session", "agent-session", "document", "notification", "space", "mailops", "workspace", "worker-runtime", "artifact", "search", "app"];
+export type FirstPartyCapabilityDomain = (typeof FIRST_PARTY_CAPABILITY_DOMAINS)[number];
+export declare const FirstPartyCapabilityDomainSchema: z.ZodEnum<{
+    search: "search";
+    kb: "kb";
+    memory: "memory";
+    agent: "agent";
+    studio: "studio";
+    "agent-session": "agent-session";
+    document: "document";
+    artifact: "artifact";
+    app: "app";
+    workflow: "workflow";
+    connector: "connector";
+    biome: "biome";
+    model: "model";
+    "xema-shell": "xema-shell";
+    store: "store";
+    "model-resolution": "model-resolution";
+    "mcp-tool": "mcp-tool";
+    "interactive-session": "interactive-session";
+    notification: "notification";
+    space: "space";
+    mailops: "mailops";
+    workspace: "workspace";
+    "worker-runtime": "worker-runtime";
+}>;
+export declare function isFirstPartyCapabilityDomain(domain: string): domain is FirstPartyCapabilityDomain;
+//# sourceMappingURL=first-party-capability-domains.d.ts.map

package/dist/capability/lib/first-party-capability-domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-party-capability-domains.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/first-party-capability-domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0BxB,eAAO,MAAM,8BAA8B,oSAwBjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElD,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;EAK5C,CAAC;AAYF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,GACb,MAAM,IAAI,0BAA0B,CAEtC"}

package/dist/capability/lib/first-party-capability-domains.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FirstPartyCapabilityDomainSchema = exports.FIRST_PARTY_CAPABILITY_DOMAINS = void 0;
+exports.isFirstPartyCapabilityDomain = isFirstPartyCapabilityDomain;
+const zod_1 = require("zod");
+exports.FIRST_PARTY_CAPABILITY_DOMAINS = [
+    'xema-shell',
+    'store',
+    'biome',
+    'connector',
+    'kb',
+    'agent',
+    'memory',
+    'model',
+    'model-resolution',
+    'mcp-tool',
+    'workflow',
+    'studio',
+    'interactive-session',
+    'agent-session',
+    'document',
+    'notification',
+    'space',
+    'mailops',
+    'workspace',
+    'worker-runtime',
+    'artifact',
+    'search',
+    'app',
+];
+exports.FirstPartyCapabilityDomainSchema = zod_1.z.enum(exports.FIRST_PARTY_CAPABILITY_DOMAINS);
+const FIRST_PARTY_CAPABILITY_DOMAIN_SET = new Set(exports.FIRST_PARTY_CAPABILITY_DOMAINS);
+function isFirstPartyCapabilityDomain(domain) {
+    return FIRST_PARTY_CAPABILITY_DOMAIN_SET.has(domain);
+}
+//# sourceMappingURL=first-party-capability-domains.js.map

package/dist/capability/lib/first-party-capability-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-party-capability-domains.js","sourceRoot":"","sources":["../../../src/capability/lib/first-party-capability-domains.ts"],"names":[],"mappings":";;;AAwEA,oEAIC;AA5ED,6BAAwB;AA0BX,QAAA,8BAA8B,GAAG;IAC5C,YAAY;IACZ,OAAO;IACP,OAAO;IACP,WAAW;IACX,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,UAAU;IACV,UAAU;IACV,QAAQ;IACR,qBAAqB;IACrB,eAAe;IACf,UAAU;IACV,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,UAAU;IACV,QAAQ;IACR,KAAK;CACG,CAAC;AAKE,QAAA,gCAAgC,GAAG,OAAC,CAAC,IAAI,CACpD,sCAGC,CACF,CAAC;AAEF,MAAM,iCAAiC,GAAwB,IAAI,GAAG,CACpE,sCAA8B,CAC/B,CAAC;AAQF,SAAgB,4BAA4B,CAC1C,MAAc;IAEd,OAAO,iCAAiC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC"}

package/dist/contribution/lib/contribution-kind.d.ts

@@ -1,7 +1,6 @@
 import { z } from 'zod';
 export declare enum ContributionKind {
     MountSource = "mount-source",
-    McpTool = "mcp-tool",
     WorkflowStep = "workflow-step",
     AgentSkill = "agent-skill",
     AgentKernel = "agent-kernel",
@@ -19,7 +18,6 @@ export declare enum ContributionKind {
     WorkflowConfig = "workflow-config",
     DeliverableSpec = "deliverable-spec",
     WorkspaceManifest = "workspace-manifest",
-    WorkspaceManifestTemplate = "workspace-manifest-template",
     ToolProfile = "tool-profile",
     McpCatalog = "mcp-catalog",
     OpenCodeTool = "opencode-tool",

package/dist/contribution/lib/contribution-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoDxB,oBAAY,gBAAgB;IAS1B,WAAW,iBAAiB;IAO5B,OAAO,aAAa;IACpB,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAS5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAsB1B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAMlC,kBAAkB,yBAAyB;IAK3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAM1B,oBAAoB,0BAA0B;IAG9C,gBAAgB,sBAAsB;IAItC,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAMxC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAO1B,YAAY,kBAAkB;IAM9B,cAAc,oBAAoB;IAkBlC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;IAoB1B,kBAAkB,wBAAwB;IAmB1C,mBAAmB,0BAA0B;IAkB7C,eAAe,qBAAqB;CACrC;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsExB,oBAAY,gBAAgB;IAS1B,WAAW,iBAAiB;IAU5B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAS5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAsB1B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAclC,kBAAkB,yBAAyB;IAY3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAe1B,oBAAoB,0BAA0B;IAG9C,gBAAgB,sBAAsB;IAItC,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAaxC,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IA4C1B,YAAY,kBAAkB;IAuB9B,cAAc,oBAAoB;IAkBlC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;IAoB1B,kBAAkB,wBAAwB;IAmB1C,mBAAmB,0BAA0B;IAkB7C,eAAe,qBAAqB;CACrC;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/contribution/lib/contribution-kind.js

@@ -5,7 +5,6 @@ const zod_1 = require("zod");
 var ContributionKind;
 (function (ContributionKind) {
     ContributionKind["MountSource"] = "mount-source";
-    ContributionKind["McpTool"] = "mcp-tool";
     ContributionKind["WorkflowStep"] = "workflow-step";
     ContributionKind["AgentSkill"] = "agent-skill";
     ContributionKind["AgentKernel"] = "agent-kernel";
@@ -23,7 +22,6 @@ var ContributionKind;
     ContributionKind["WorkflowConfig"] = "workflow-config";
     ContributionKind["DeliverableSpec"] = "deliverable-spec";
     ContributionKind["WorkspaceManifest"] = "workspace-manifest";
-    ContributionKind["WorkspaceManifestTemplate"] = "workspace-manifest-template";
     ContributionKind["ToolProfile"] = "tool-profile";
     ContributionKind["McpCatalog"] = "mcp-catalog";
     ContributionKind["OpenCodeTool"] = "opencode-tool";

package/dist/contribution/lib/contribution-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAoDxB,IAAY,gBA8PX;AA9PD,WAAY,gBAAgB;IAS1B,gDAA4B,CAAA;IAO5B,wCAAoB,CAAA;IACpB,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAS5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAsB1B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAMlC,+DAA2C,CAAA;IAK3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAM1B,kEAA8C,CAAA;IAG9C,0DAAsC,CAAA;IAItC,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAMxC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAO1B,kDAA8B,CAAA;IAM9B,sDAAkC,CAAA;IAkBlC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;IAoB1B,8DAA0C,CAAA;IAmB1C,iEAA6C,CAAA;IAkB7C,wDAAoC,CAAA;AACtC,CAAC,EA9PW,gBAAgB,gCAAhB,gBAAgB,QA8P3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAsExB,IAAY,gBAmVX;AAnVD,WAAY,gBAAgB;IAS1B,gDAA4B,CAAA;IAU5B,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAS5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAsB1B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAclC,+DAA2C,CAAA;IAY3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAe1B,kEAA8C,CAAA;IAG9C,0DAAsC,CAAA;IAItC,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAaxC,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IA4C1B,kDAA8B,CAAA;IAuB9B,sDAAkC,CAAA;IAkBlC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;IAoB1B,8DAA0C,CAAA;IAmB1C,iEAA6C,CAAA;IAkB7C,wDAAoC,CAAA;AACtC,CAAC,EAnVW,gBAAgB,gCAAhB,gBAAgB,QAmV3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/search/lib/search-contribution.d.ts

@@ -16,7 +16,7 @@ export interface SearchTypeAuthzMapping {
 }
 export declare const SearchTypeAuthzMappingSchema: z.ZodType<SearchTypeAuthzMapping>;
 export interface SearchTypeContributionManifest {
-    readonly objectKind: XemaObjectKind;
+    readonly objectKind?: XemaObjectKind;
     readonly docType?: string;
     readonly renderHints: SearchTypeRenderHints;
     readonly searchableFields: readonly string[];
@@ -25,5 +25,5 @@ export interface SearchTypeContributionManifest {
     readonly searchReplayCapabilityRef?: CapabilityRef;
 }
 export declare const SearchTypeContributionManifestSchema: z.ZodType<SearchTypeContributionManifest>;
-export declare function searchTypeNaturalKey(objectKind: XemaObjectKind, docType?: string): string;
+export declare function searchTypeNaturalKey(objectKind?: XemaObjectKind, docType?: string): string;
 //# sourceMappingURL=search-contribution.d.ts.map

package/dist/search/lib/search-contribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search-contribution.d.ts","sourceRoot":"","sources":["../../../src/search/lib/search-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAwB,MAAM,cAAc,CAAC;AACpE,OAAO,EACL,yBAAyB,EAE1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,2BAA2B,EAE5B,MAAM,kBAAkB,CAAC;AA6B1B,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAevB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAiBhC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC/D;AASD,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CA2C/B,CAAC;AAW3C,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;CACvD;AAED,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAIlC,CAAC;AAiB1C,MAAM,WAAW,8BAA8B;IAK7C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IAMpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAK5C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAM7C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAE3C,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IAOvC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,aAAa,CAAC;CACpD;AASD,eAAO,MAAM,oCAAoC,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAY1C,CAAC;AAOlD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAER"}
+{"version":3,"file":"search-contribution.d.ts","sourceRoot":"","sources":["../../../src/search/lib/search-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAwB,MAAM,cAAc,CAAC;AACpE,OAAO,EACL,yBAAyB,EAE1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,2BAA2B,EAE5B,MAAM,kBAAkB,CAAC;AA6B1B,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAevB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAiBhC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC/D;AASD,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CA2C/B,CAAC;AAW3C,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;CACvD;AAED,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAIlC,CAAC;AAiB1C,MAAM,WAAW,8BAA8B;IAiB7C,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAMrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAK5C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAM7C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAE3C,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IAOvC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,aAAa,CAAC;CACpD;AASD,eAAO,MAAM,oCAAoC,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAsB9B,CAAC;AAY9D,wBAAgB,oBAAoB,CAClC,UAAU,CAAC,EAAE,cAAc,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CASR"}

package/dist/search/lib/search-contribution.js

@@ -55,8 +55,9 @@ exports.SearchTypeAuthzMappingSchema = zod_1.z.object({
     resourceType: zod_1.z.string().min(1).max(SEARCH_TYPE_STRING_MAX),
     defaultVisibility: resource_1.ResourceVisibilityPatternSchema,
 });
-exports.SearchTypeContributionManifestSchema = zod_1.z.object({
-    objectKind: object_1.XemaObjectKindSchema,
+exports.SearchTypeContributionManifestSchema = zod_1.z
+    .object({
+    objectKind: object_1.XemaObjectKindSchema.optional(),
     docType: zod_1.z.string().min(1).max(SEARCH_TYPE_STRING_MAX).optional(),
     renderHints: exports.SearchTypeRenderHintsSchema,
     searchableFields: zod_1.z
@@ -66,8 +67,16 @@ exports.SearchTypeContributionManifestSchema = zod_1.z.object({
     embeddingEligibleDefault: zod_1.z.boolean(),
     authz: exports.SearchTypeAuthzMappingSchema,
     searchReplayCapabilityRef: capability_1.CapabilityRefSchema.optional(),
-});
+})
+    .refine((m) => m.objectKind !== undefined || m.docType !== undefined, 'a search-type contribution must declare objectKind, docType, or both — ' +
+    'the natural key is (objectKind, docType) and cannot be empty');
 function searchTypeNaturalKey(objectKind, docType) {
+    if (objectKind === undefined && docType === undefined) {
+        throw new Error('searchTypeNaturalKey: neither objectKind nor docType was supplied — ' +
+            'a result-type must be addressable by at least one.');
+    }
+    if (objectKind === undefined)
+        return String(docType);
     return docType ? `${objectKind}/${docType}` : String(objectKind);
 }
 //# sourceMappingURL=search-contribution.js.map

package/dist/search/lib/search-contribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"search-contribution.js","sourceRoot":"","sources":["../../../src/search/lib/search-contribution.ts"],"names":[],"mappings":";;;AAwOA,oDAKC;AA7OD,6BAAwB;AAExB,iDAA2E;AAC3E,yCAAoE;AACpE,6CAGwB;AACxB,qDAK0B;AAO1B,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAOnC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAO3C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAoDnC,MAAM,4BAA4B,GAAG,iDAAgC,CAAC,IAAI,CAAC;AAE9D,QAAA,2BAA2B,GACtC,OAAC;KACE,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IAC9D,aAAa,EAAE,OAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,8BAA8B,CAAC;SACnC,QAAQ,EAAE;IACb,WAAW,EAAE,OAAC;SACX,KAAK,CAAC,OAAC,CAAC,UAAU,CAAC,4CAA2B,CAAC,CAAC;SAChD,GAAG,CAAC,4BAA4B,CAAC;SACjC,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,OAAO,EACL,wEAAwE;oBACxE,yDAAyD;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,IAAA,qDAAoC,EAClC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,IAAI,EAAE,CACxB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,yCAAwB,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAqC,CAAC;AAkB9B,QAAA,4BAA4B,GACvC,OAAC,CAAC,MAAM,CAAC;IACP,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC3D,iBAAiB,EAAE,0CAA+B;CACnD,CAAsC,CAAC;AA4D7B,QAAA,oCAAoC,GAC/C,OAAC,CAAC,MAAM,CAAC;IACP,UAAU,EAAE,6BAAoB;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACjE,WAAW,EAAE,mCAA2B;IACxC,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,sBAAsB,CAAC;IAC9B,wBAAwB,EAAE,OAAC,CAAC,OAAO,EAAE;IACrC,KAAK,EAAE,oCAA4B;IACnC,yBAAyB,EAAE,gCAAmB,CAAC,QAAQ,EAAE;CAC1D,CAA8C,CAAC;AAOlD,SAAgB,oBAAoB,CAClC,UAA0B,EAC1B,OAAgB;IAEhB,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"search-contribution.js","sourceRoot":"","sources":["../../../src/search/lib/search-contribution.ts"],"names":[],"mappings":";;;AAmQA,oDAYC;AA/QD,6BAAwB;AAExB,iDAA2E;AAC3E,yCAAoE;AACpE,6CAGwB;AACxB,qDAK0B;AAO1B,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAOnC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAO3C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAoDnC,MAAM,4BAA4B,GAAG,iDAAgC,CAAC,IAAI,CAAC;AAE9D,QAAA,2BAA2B,GACtC,OAAC;KACE,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IAC9D,aAAa,EAAE,OAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,8BAA8B,CAAC;SACnC,QAAQ,EAAE;IACb,WAAW,EAAE,OAAC;SACX,KAAK,CAAC,OAAC,CAAC,UAAU,CAAC,4CAA2B,CAAC,CAAC;SAChD,GAAG,CAAC,4BAA4B,CAAC;SACjC,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,OAAO,EACL,wEAAwE;oBACxE,yDAAyD;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,IAAA,qDAAoC,EAClC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,IAAI,EAAE,CACxB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,yCAAwB,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAqC,CAAC;AAkB9B,QAAA,4BAA4B,GACvC,OAAC,CAAC,MAAM,CAAC;IACP,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC3D,iBAAiB,EAAE,0CAA+B;CACnD,CAAsC,CAAC;AAwE7B,QAAA,oCAAoC,GAC/C,OAAC;KACE,MAAM,CAAC;IACN,UAAU,EAAE,6BAAoB,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACjE,WAAW,EAAE,mCAA2B;IACxC,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,sBAAsB,CAAC;IAC9B,wBAAwB,EAAE,OAAC,CAAC,OAAO,EAAE;IACrC,KAAK,EAAE,oCAA4B;IACnC,yBAAyB,EAAE,gCAAmB,CAAC,QAAQ,EAAE;CAC1D,CAAC;KAKD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAC5D,yEAAyE;IACvE,8DAA8D,CACT,CAAC;AAY9D,SAAgB,oBAAoB,CAClC,UAA2B,EAC3B,OAAgB;IAEhB,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACnE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",

package/src/capability/index.ts

@@ -2,6 +2,7 @@ export * from './lib/capability-ref';
 export * from './lib/connector-capability-ref';
 export * from './lib/capability-domain';
 export * from './lib/authority-effect';
+export * from './lib/capability-reach';
 export * from './lib/capability-grant';
 export * from './lib/capability-policy';
 export * from './lib/permission-profile';

package/src/capability/lib/capability-contribution.ts

@@ -5,6 +5,7 @@ import {
   CapabilityAuthorityEffectSchema,
   type CapabilityAuthorityEffect,
 } from './authority-effect';
+import { CapabilityReachSchema, type CapabilityReach } from './capability-reach';
 import {
   CapabilityRiskTierSchema,
   type CapabilityRiskTier,
@@ -112,6 +113,27 @@ export interface CapabilityContributionManifest {
    * and the denial message precise, not to obtain a bypass.
    */
   readonly authorityEffect?: CapabilityAuthorityEffect;
+  /**
+   * OPTIONAL declared answer to "how far outside the invoking subject does this
+   * capability reach?" — consumed by the `AgentReachTier` resolver to decide
+   * which capabilities the `connected` and `full` tiers open up.
+   *
+   * Absent ⇒ derived, and the derivation is the SAFE floor, not a guess: a
+   * `connector`-kind invocation binding reaches an external system by
+   * construction and derives {@link CapabilityReach.Integration}; everything
+   * else derives {@link CapabilityReach.Owner}, which grants nothing beyond
+   * what the owner already holds.
+   *
+   * Declare it to RAISE reach above that floor — an http-bound capability that
+   * nonetheless touches org-wide shared state (the knowledge base) or the
+   * control plane. A declaration cannot LOWER the derived reach, so a producer
+   * cannot opt its own connector out of the tier system.
+   *
+   * This replaced a hand-maintained roster in `authorization-api`. The fact now
+   * lives on the capability, so a new integration capability cannot be
+   * forgotten by a list in another repo.
+   */
+  readonly reach?: CapabilityReach;
 }
 
 /**
@@ -144,4 +166,5 @@ export const CapabilityContributionManifestSchema: z.ZodType<CapabilityContribut
     defaultCredentialBindingRef: z.string().min(1).max(200).optional(),
     outputClassification: DataClassificationSchema.optional(),
     authorityEffect: CapabilityAuthorityEffectSchema.optional(),
+    reach: CapabilityReachSchema.optional(),
   }) as z.ZodType<CapabilityContributionManifest>;

package/src/capability/lib/capability-reach.ts

@@ -0,0 +1,165 @@
+import { z } from 'zod';
+
+import { CONNECTOR_CAPABILITY_DOMAIN } from './connector-capability-ref';
+
+/**
+ * `CapabilityReach` — DECLARED answer to "how far outside the owner does
+ * invoking this capability reach?".
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * `AgentReachTier` (sandbox | as-owner | connected | full) is the CEILING a
+ * user picks for an agent. Turning that ceiling into a concrete capability set
+ * used to require a hand-maintained list in `authorization-api`
+ * (`CONNECTED_TIER_STARTER_CAPABILITIES`) — a central roster that every new
+ * integration capability had to be added to, in a different repo from the
+ * capability itself. That is the classic drift shape this platform has been
+ * removing everywhere else: the fact lives on the thing, not in a list about
+ * the thing.
+ *
+ * A capability now declares its own reach, and the tier resolves from the
+ * declarations. Adding an integration capability is a one-line declaration at
+ * the producer; no edit to `authorization-api`, and no way to forget one.
+ *
+ * PRECEDENCE — declared RAISES, derivation is the floor
+ * -----------------------------------------------------
+ * Absent ⇒ derived. A capability that is a connector — by its invocation
+ * binding OR by its ref domain, see {@link deriveCapabilityReach} — derives
+ * {@link CapabilityReach.Integration} with no declaration at all. Everything
+ * else derives {@link CapabilityReach.Owner}, which is the SAFE default: it
+ * grants nothing beyond what the owner already holds.
+ *
+ * A declaration may therefore only ever be needed to RAISE reach above the
+ * derived floor (an http-bound capability that nonetheless touches org-wide
+ * state, e.g. the knowledge base). It is deliberately NOT possible to declare
+ * a capability as lower-reach than its binding implies — that would let a
+ * producer opt its own connector out of the tier system.
+ */
+export enum CapabilityReach {
+  /**
+   * Confined to what the invoking subject already holds. The default, and the
+   * only reach an `as-owner` agent gets. Grants no additional authority.
+   */
+  Owner = 'owner',
+  /**
+   * Reaches a connected external system (SCM, tracker, mail, the governed
+   * public web) or org-wide shared state (the knowledge base). This is exactly
+   * the set the `connected` tier opens up.
+   */
+  Integration = 'integration',
+  /**
+   * Reaches the Xema control plane itself — installing biomes, minting
+   * credentials, altering grants. Only the `full` tier admits these, and the
+   * self-escalation guard applies independently.
+   */
+  Platform = 'platform',
+}
+
+export const CapabilityReachSchema = z.nativeEnum(CapabilityReach);
+
+/**
+ * The reach a capability has when it declares none. Kept as a named constant so
+ * the projector, the tier resolver and any future consumer cannot disagree
+ * about what "absent" means — and so the safe value is stated once, not
+ * repeated at each call site.
+ */
+export const DEFAULT_CAPABILITY_REACH = CapabilityReach.Owner;
+
+/**
+ * Which reaches a given {@link CapabilityReach} tier admits, most-restrictive
+ * first. Exported so the tier resolver reads a declared table rather than
+ * re-deriving the ordering, and so a new reach member is a compile error at
+ * every consumer rather than a silent omission.
+ */
+export const REACH_RANK: Readonly<Record<CapabilityReach, number>> = Object.freeze({
+  [CapabilityReach.Owner]: 0,
+  [CapabilityReach.Integration]: 1,
+  [CapabilityReach.Platform]: 2,
+});
+
+/** True when `candidate` is within `ceiling`. Total over the closed set. */
+export function reachWithin(candidate: CapabilityReach, ceiling: CapabilityReach): boolean {
+  return REACH_RANK[candidate] <= REACH_RANK[ceiling];
+}
+
+/**
+ * Combine a DERIVED reach with an optional DECLARED one, taking the wider of
+ * the two.
+ *
+ * This is a monotone join, NOT `declared ?? derived`, and the asymmetry is the
+ * whole safety property: a declaration may RAISE reach (the knowledge base is
+ * `Integration` despite riding an ordinary http route) but can never LOWER it.
+ * Without that, a producer could declare its own connector as `Owner` and quietly
+ * escape the tier system — the same bypass `joinAuthorityEffect` exists to
+ * prevent for the self-escalation guard.
+ *
+ * Absent declaration ⇒ the derived value, unchanged.
+ */
+export function joinReach(
+  derived: CapabilityReach,
+  declared?: CapabilityReach | undefined,
+): CapabilityReach {
+  if (declared === undefined) return derived;
+  return REACH_RANK[declared] > REACH_RANK[derived] ? declared : derived;
+}
+
+/**
+ * The reach a capability has by construction, before any declaration.
+ *
+ * TWO independent structural signals, either of which is sufficient. Both are
+ * facts about the capability that the platform already holds — neither is a
+ * guess, and neither needs an author to remember anything:
+ *
+ *  1. **The invocation binding kind.** A `connector`-kind binding reaches a
+ *     connected external system — that is what a connector IS.
+ *  2. **The ref domain.** A ref in the `connector` domain
+ *     ({@link CONNECTOR_CAPABILITY_DOMAIN}) is a connector capability by the
+ *     ref grammar itself, which is a typed contract, not a naming convention.
+ *
+ * Signal 2 is not redundant, and leaving it out was a real bug: connector
+ * capabilities are today published with `http` invocation bindings (they are
+ * invoked through the connector gateway over HTTP), so binding-kind alone
+ * derives `owner` and every `connector:*` ref silently drops out of the
+ * `connected` reach tier. That is the exact failure mode — a capability quietly
+ * outside the tier that names it — this whole mechanism replaced a
+ * hand-maintained roster to prevent.
+ *
+ * Everything else derives the safe floor; raising it is the author's explicit
+ * act via a declared `reach`.
+ *
+ * Kept here, beside the enum, so the projector, the registry and the tier
+ * resolver cannot drift on what "derived" means.
+ */
+export function deriveCapabilityReach(input: {
+  /** Canonical capability ref. Unparseable refs contribute no signal. */
+  readonly ref?: string;
+  /** `CapabilityInvocationBinding.kind`, when the capability declares one. */
+  readonly invocationKind?: string;
+}): CapabilityReach {
+  if (input.invocationKind === 'connector') {
+    return CapabilityReach.Integration;
+  }
+  if (
+    input.ref !== undefined &&
+    refDomain(input.ref) === CONNECTOR_CAPABILITY_DOMAIN
+  ) {
+    return CapabilityReach.Integration;
+  }
+  return DEFAULT_CAPABILITY_REACH;
+}
+
+/**
+ * Domain segment of a capability ref, or `undefined` when the ref does not
+ * parse.
+ *
+ * Deliberately does NOT throw: this is a derivation input, and a malformed ref
+ * must contribute no reach signal rather than abort the read path that is
+ * validating it. The ref's own validation happens where it is written.
+ */
+function refDomain(ref: string): string | undefined {
+  const separator = ref.indexOf(':');
+  if (separator <= 0) {
+    return undefined;
+  }
+  return ref.slice(0, separator);
+}

package/src/contribution/lib/contribution-kind.ts

@@ -29,13 +29,22 @@ import { z } from 'zod';
  *          parser.
  *   3. RESERVED — declared for protocol/catalog completeness but with NO
  *      contribution-protocol ingestion path today. Every remaining RESERVED
- *      member has a REAL delivery path through the convention CONTENT-DIRECTORY
- *      seeder (on-disk presence — see the manifest reference); the four members
- *      that had NO delivery path at all (`GateAction`, `ChartRuntime`,
- *      `WorkspaceSpecOverlay`, `SystemOverlayContribution`) were DELETED rather
- *      than left as decoration. Do NOT assume a biome-host parser exists for a
- *      RESERVED member, and do not ship a biome contribution of that kind
- *      expecting it to be ingested.
+ *      member has a REAL, verified delivery path that is deliberately NOT the
+ *      contribution protocol — either a biome-host-api HTTP content endpoint
+ *      that reads the biome's convention directory off disk ON DEMAND
+ *      (`Icon`, `BiomeInstallSchema`, `ProvisioningScaffold`), or a build-time
+ *      bake into the agent-runtime image (`OpenCodeTool`, `OpenCodePlugin`).
+ *      None of them is "seeded": nothing walks those directories at boot.
+ *      A member with NO delivery path at all is DELETED rather than left as
+ *      decoration — `GateAction`, `ChartRuntime`, `WorkspaceSpecOverlay` and
+ *      `SystemOverlayContribution` in the first cleanup; `McpTool` and
+ *      `WorkspaceManifestTemplate` in the second (each had zero readers, zero
+ *      on-disk instances anywhere in the tree, no manifest schema, and a live
+ *      superseding kind — `McpCatalog` and `AgentSkill` respectively). Do NOT
+ *      assume a biome-host parser exists for a RESERVED member, and do not
+ *      ship a biome contribution of that kind expecting it to be ingested —
+ *      biome-host's `assertContributionKindsAreIngestable` coverage guard
+ *      rejects it fail-fast, naming the file.
  *
  * This doc-comment is kept HONEST by review: a member with no biome-host parser
  * MUST be annotated with its true category (2 or 3). An earlier revision falsely
@@ -48,7 +57,16 @@ import { z } from 'zod';
  * Enum string values match the slug spoken by the rest of the protocol
  * (Capability References, manifest declarations) so that round-tripping
  * between the enum and the wire is lossless. The values themselves are a WIRE
- * CONTRACT — never rename or delete a member without a migration plan.
+ * CONTRACT — never rename or delete a member without a migration plan. The
+ * migration plan for the two deletions above is EMPTY BY CONSTRUCTION, and that
+ * is the bar any future deletion must clear: neither value had a producer (no
+ * biome ships the directory, no parser emits the envelope), a consumer (no
+ * routing-table row, no sync handler), or a persisted row (the contribution-sync
+ * store's `kind` column is an open `string`, and biome-host's coverage guard has
+ * been rejecting envelopes of both kinds fail-fast). The only downstream churn is
+ * mechanical regeneration: biome-host-api's `openapi.public.json`, the generated
+ * `@xemahq/biome-host-api-client` `contributionKind` model, and the frontend
+ * mirror of both (via `pnpm sync:frontend`).
  */
 export enum ContributionKind {
   // -- v1 seed ---------------------------------------------------------------
@@ -60,13 +78,15 @@ export enum ContributionKind {
    * stays the authoritative owner and read path; there is NO biome-host parser.
    */
   MountSource = 'mount-source',
-  /**
-   * RESERVED (category 3). No contribution-protocol parser. MCP tool
-   * descriptors ship today via the convention `mcpTools/` content directory
-   * (on-disk presence seeder). The enum-dispatched contribution path for MCP is
-   * `McpCatalog`, which HAS a parser — do not expect one here.
-   */
-  McpTool = 'mcp-tool',
+  // `McpTool = 'mcp-tool'` was DELETED here. It claimed delivery through a
+  // `mcp-tools/` convention directory that NO biome ships and NO code reads:
+  // the only references were the `CONTENT_KIND_DIR` / `CONTENT_KIND_EXTENSIONS`
+  // table rows and biome-host's generic presence loop. There was no manifest
+  // schema (kernel or SDK), no owning registry, and no sync handler. The live
+  // MCP contribution path is `McpCatalog` (parser + routes to BOTH
+  // llm-registry-api and mcp-gateway-api); the live per-biome code-tool
+  // declaration is the manifest block `xema.mcpTools[]`, which is unrelated to
+  // this enum despite the shared name.
   WorkflowStep = 'workflow-step',
   AgentSkill = 'agent-skill',
   AgentKernel = 'agent-kernel',
@@ -128,22 +148,46 @@ export enum ContributionKind {
   /** A role capability bundle contributed by a biome. */
   RoleCapability = 'role-capability',
   /**
-   * RESERVED (category 3). No contribution-protocol parser. The install-wizard
-   * resource-selection schema ships via the convention `biomeInstallSchema/`
-   * content directory (on-disk presence seeder), not the enum-dispatched path.
+   * RESERVED (category 3). No parser, and none is wanted: the install-wizard
+   * resource-selection schema is an OPAQUE, browser-facing JSON Schema that
+   * biome-host-api serves on demand from the biome's convention
+   * `install-schema/` directory (`install.json` plus an optional
+   * `ui-schema.json`) via `GET /platform/biomes/server/:id/install-schema`. It
+   * is not seeded at boot and never crosses a service boundary as a
+   * contribution — the only consumer is the frontend install wizard, which
+   * pulls it over HTTP and renders it with rjsf. There is nothing for a kernel
+   * manifest schema to validate: the body is an arbitrary draft-2020-12 JSON
+   * Schema, and a parser could only pass it through verbatim to a registry
+   * that does not exist.
    */
   BiomeInstallSchema = 'biome-install-schema',
   /**
-   * RESERVED (category 3). No parser. Icon assets ship via the convention
-   * `icons/` content directory (on-disk presence seeder).
+   * RESERVED (category 3). No parser, and none is wanted: icons are BYTE
+   * ASSETS, not manifests — biome-host-api serves each one straight off disk
+   * from the biome's convention `icons/` directory via the public CDN-asset
+   * route `GET /platform/biomes/server/:id/icons/:slug.svg`, discovered by
+   * on-disk presence and never indexed. Nothing queries "which icons exist":
+   * the caller already knows the slug (it is the workflow activity kind) and
+   * builds the URL deterministically, so a third-party biome overrides an icon
+   * simply by shipping the file. Routing SVG bytes through the contribution
+   * outbox would mean base64-in-JSON into a database row only to re-serve it.
    */
   Icon = 'icon',
   /** A project-kit bundle contributed by a biome. */
   ProjectKit = 'project-kit',
   /**
-   * RESERVED (category 3). No parser. Provisioning scaffolds ship via the
-   * convention `provisioning/` content directory (declared in
-   * `xema.provisioning[]`, parity-checked at boot), not the contribution path.
+   * RESERVED (category 3). No parser: a provisioning scaffold is declared in
+   * the manifest's `xema.provisioning[]` and authored as
+   * `provisioning/<id>.yaml` plus an optional `provisioning/<id>/` template
+   * tree, and agent-session-api's `provisioning-plan-resolver` PULLS it over
+   * HTTP per session bootstrap from biome-host-api's
+   * `GET /platform/biomes/server/:id/provisioning-scaffolds`. The render
+   * depends on that session's runtime `customConfig`, so there is no static
+   * descriptor to upsert into a registry, and agent-session-api has no
+   * contribution-sync seam. NOTE the declaration-vs-disk parity check is LAZY,
+   * not boot-time: it runs inside `loadProvisioningScaffolds` when the
+   * scaffolds are fetched, so a biome whose `provisioning[]` disagrees with its
+   * `provisioning/` directory boots green and fails at first provision.
    */
   ProvisioningScaffold = 'provisioning-scaffold',
   /** A concrete connector provider contributed by a biome inside an
@@ -157,29 +201,88 @@ export enum ContributionKind {
   DeliverableSpec = 'deliverable-spec',
   /** A workspace manifest contributed by a biome. */
   WorkspaceManifest = 'workspace-manifest',
-  /**
-   * RESERVED (category 3). No parser (distinct from `WorkspaceManifest`, which
-   * HAS one). Reusable workspace-manifest templates ship via the convention
-   * `workspaceManifestTemplates/` content directory (on-disk presence seeder).
-   */
-  WorkspaceManifestTemplate = 'workspace-manifest-template',
+  // `WorkspaceManifestTemplate = 'workspace-manifest-template'` was DELETED
+  // here. It claimed delivery through a `workspace-manifest-templates/`
+  // convention directory that NOTHING reads — no seeder, no endpoint, and no
+  // `walkContent` call for that kind exists anywhere. The manifest templates a
+  // workspace actually renders (`spec.seedFiles[].template`) are resolved at
+  // compose time by `buildSkillBundleTemplateResolver` from SKILL BUNDLE
+  // resources at `assets/templates/<name>.hbs`, fetched from
+  // skill-registry-api — i.e. they ship as `AgentSkill`, which HAS a parser and
+  // a route. Re-adding a second delivery path for the same artifact would fork
+  // ownership away from skill-registry (bundle fetch, 5-tier scope ladder,
+  // shared Handlebars compile) for no gain.
   /** A tool-profile contributed by a biome. */
   ToolProfile = 'tool-profile',
-  /** An MCP catalog entry contributed by a biome. Distinct from `McpTool`,
-   * which is a single tool descriptor; an `McpCatalog` entry is a catalog
-   * manifest. */
+  /** An MCP catalog entry contributed by a biome — a catalog manifest naming a
+   * connectable MCP service and the tools it exposes. This is the ONLY
+   * enum-dispatched MCP contribution path. */
   McpCatalog = 'mcp-catalog',
   /**
-   * RESERVED (category 3). No contribution-protocol parser. Agent-runtime
-   * custom tools ship via the convention `openCodeTools/` content directory,
-   * baked into the opencode-worker image at build time — not the
-   * enum-dispatched contribution path.
+   * RESERVED (category 3). No parser, and one CANNOT be shipped without first
+   * closing the build-time gap tracked as H10 in
+   * `.claude/plans/canopy-universal-agent.md` §11.1, which carries the full,
+   * component-by-component write-down of what a runtime path would require;
+   * this note is the summary. Agent-runtime custom tools are EXECUTABLE
+   * `.ts`/`.js` files that reach an agent ONLY by being copied into the
+   * agent-runtime worker image at build time — every kernel biome that ships a
+   * tools directory has its own explicit `COPY` line in that image's
+   * Dockerfile, landing the files in the runtime's tool slot, which the runtime
+   * auto-discovers when its process starts. So a third-party biome tool costs a
+   * Dockerfile edit plus an image rebuild. The one runtime seam that exists is
+   * a WHOLE-DIRECTORY swap, not a merge: when the templates read-only volume is
+   * mounted, workspace-proxy deletes the image-baked tool directory and
+   * symlinks that volume's copy in its place — and the volume is populated
+   * entirely out of band.
+   *
+   * Do NOT ship a parser that fakes the missing half. A real runtime path needs
+   * FOUR things, none of which exists:
+   *   1. An owning registry that stores tool SOURCE and can be reconciled by
+   *      the contribution outbox. It cannot be a plain descriptor table: the
+   *      payload is code, so the store has to carry the bytes AND the trust
+   *      decision (signature verification + static analysis — the pipeline
+   *      `biome-fetcher-api` already runs for biome bundles), not just a row.
+   *   2. Materialization in the workspace composer, which starts with a new
+   *      `WorkspaceMount` slot: that enum is CLOSED and has no tools entry, and
+   *      workspace-proxy rejects a mount whose slot is not in it. The composer
+   *      (`@xemahq/agent-session-runtime`) already writes the skill-bundle and
+   *      slash-command slots the same way; a tools slot additionally needs
+   *      biome-NAMESPACED filenames (two biomes must not collide on a tool
+   *      name) that stay FLAT — the runtime's discovery glob is one level deep,
+   *      so a nested directory is invisible — and it must compose with, not be
+   *      clobbered by, the templates-volume symlink above.
+   *   3. A per-session tool allow/deny decision. Filtering is static today,
+   *      baked into the image's runtime config, so a dynamically mounted tool
+   *      has no visibility story.
+   *   4. Sandboxing/permission review, because a contributed tool executes in
+   *      the agent's workspace with the agent's credentials.
+   *
+   * Timing is the one part already solved: discovery runs once per runtime
+   * PROCESS, and workspace-proxy already restarts that process after every
+   * session-bundle apply.
    */
   OpenCodeTool = 'opencode-tool',
   /**
-   * RESERVED (category 3). No parser — the contribution-registrar explicitly
-   * does NOT route this kind. Agent-runtime plugins ship via the convention
-   * `openCodePlugins/` content directory, baked into the opencode-worker image.
+   * RESERVED (category 3). No parser, and the contribution-registrar
+   * deliberately does NOT route this kind — its own unit test uses this member
+   * as the canonical "not routed" fixture. Plugins are baked harder than tools:
+   * a kernel biome's plugin directory is installed under a read-only `/opt`
+   * prefix during the image build, with its dependency tree resolved there, and
+   * the generated runtime config references it by ABSOLUTE IMAGE PATH. That
+   * `/opt` location is load-bearing — plugins once lived under the workspace
+   * root, where the per-session volume mount SHADOWED them and both shipped
+   * plugins silently failed to load.
+   *
+   * On top of the four prerequisites listed on
+   * {@link ContributionKind.OpenCodeTool}, a runtime plugin path additionally
+   * needs (a) the plugin list in the generated runtime config to become
+   * per-session paths instead of image constants, (b) a dependency story, since
+   * a plugin's dependencies are installed at image-build time and the runtime
+   * workspace has neither an install step nor network egress for one, and (c) a
+   * process restart, because the runtime resolves plugins once at process
+   * start. Until all of that lands, treat plugins as an image concern — tools
+   * are the cheaper half to make runtime-loadable first. See
+   * `.claude/plans/canopy-universal-agent.md` §11.1.
    */
   OpenCodePlugin = 'opencode-plugin',
   // -- Capability self-registration ------------------------------------------

package/src/search/lib/search-contribution.ts

@@ -170,14 +170,26 @@ export const SearchTypeAuthzMappingSchema: z.ZodType<SearchTypeAuthzMapping> =
  */
 export interface SearchTypeContributionManifest {
   /**
-   * The `XemaObjectKind` this result-type covers. The object model is the
-   * identity/scope backbone — every result addresses through it.
+   * The `XemaObjectKind` this result-type covers, when one genuinely applies.
+   *
+   * OPTIONAL BY DESIGN. `XemaObjectKind` is a CLOSED kernel enum; a biome
+   * concept that has no kernel kind (an email, a backlog item, a design idea)
+   * must not be forced to mislabel itself as the nearest neighbour. Four of the
+   * five first-party contributions did exactly that — all declaring `artifact`
+   * as a closest fit — which is worse than declaring nothing: it makes the
+   * object registry claim kinds it cannot enumerate, and it reads as a real
+   * classification to anything that consumes it.
+   *
+   * Absent ⇒ the result-type is discriminated by the OPEN `docType` alone,
+   * which is what `IndexableDocument.kind` being optional already anticipates.
+   * The natural key remains `(objectKind, docType)`; a contribution must carry
+   * at least one of the two, enforced by the schema below.
    */
-  readonly objectKind: XemaObjectKind;
+  readonly objectKind?: XemaObjectKind;
   /**
-   * Optional biome sub-facet under `objectKind` (e.g. `kb_page` under
-   * `knowledge-page`). Absent ⇒ the result-type covers the kind as a whole.
-   * The natural key of a result-type is `(objectKind, docType)`.
+   * Biome sub-facet under `objectKind` (e.g. `kb_page` under `knowledge-page`),
+   * or — when no kernel kind applies — the sole discriminator for this
+   * result-type. The natural key of a result-type is `(objectKind, docType)`.
    */
   readonly docType?: string;
   /** Generic render/route hints so the frontend presents hits without a per-kind switch. */
@@ -212,27 +224,49 @@ export interface SearchTypeContributionManifest {
  * `CapabilityContributionManifestSchema`).
  */
 export const SearchTypeContributionManifestSchema: z.ZodType<SearchTypeContributionManifest> =
-  z.object({
-    objectKind: XemaObjectKindSchema,
-    docType: z.string().min(1).max(SEARCH_TYPE_STRING_MAX).optional(),
-    renderHints: SearchTypeRenderHintsSchema,
-    searchableFields: z
-      .array(z.string().min(1).max(SEARCH_TYPE_STRING_MAX))
-      .min(1)
-      .max(SEARCH_TYPE_FIELDS_MAX),
-    embeddingEligibleDefault: z.boolean(),
-    authz: SearchTypeAuthzMappingSchema,
-    searchReplayCapabilityRef: CapabilityRefSchema.optional(),
-  }) as z.ZodType<SearchTypeContributionManifest>;
+  z
+    .object({
+      objectKind: XemaObjectKindSchema.optional(),
+      docType: z.string().min(1).max(SEARCH_TYPE_STRING_MAX).optional(),
+      renderHints: SearchTypeRenderHintsSchema,
+      searchableFields: z
+        .array(z.string().min(1).max(SEARCH_TYPE_STRING_MAX))
+        .min(1)
+        .max(SEARCH_TYPE_FIELDS_MAX),
+      embeddingEligibleDefault: z.boolean(),
+      authz: SearchTypeAuthzMappingSchema,
+      searchReplayCapabilityRef: CapabilityRefSchema.optional(),
+    })
+    // Both may not be absent: the natural key is `(objectKind, docType)`, so a
+    // contribution declaring neither has no identity at all. Making `objectKind`
+    // optional must not open a hole where a result-type is unaddressable —
+    // fail fast at the boundary, exactly as before.
+    .refine(
+      (m) => m.objectKind !== undefined || m.docType !== undefined,
+      'a search-type contribution must declare objectKind, docType, or both — ' +
+        'the natural key is (objectKind, docType) and cannot be empty',
+    ) as unknown as z.ZodType<SearchTypeContributionManifest>;
 
 /**
- * The stable natural key of a result-type: `objectKind` when no `docType`, else
+ * The stable natural key of a result-type: `objectKind` when no `docType`,
+ * `docType` when no `objectKind` (a biome concept with no kernel kind), else
  * `objectKind/docType`. Centralized so the parser slug, the DB unique key, and
  * the reconciler's `seenKeyOf` all agree.
+ *
+ * The schema guarantees at least one is present; this throws rather than
+ * returning `"undefined"` if that guarantee is ever bypassed, because a
+ * silently-stringified key would collide every unkeyed result-type into one row.
  */
 export function searchTypeNaturalKey(
-  objectKind: XemaObjectKind,
+  objectKind?: XemaObjectKind,
   docType?: string,
 ): string {
+  if (objectKind === undefined && docType === undefined) {
+    throw new Error(
+      'searchTypeNaturalKey: neither objectKind nor docType was supplied — ' +
+        'a result-type must be addressable by at least one.',
+    );
+  }
+  if (objectKind === undefined) return String(docType);
   return docType ? `${objectKind}/${docType}` : String(objectKind);
 }