dna-sdk 0.1.0

package/dist/extensions/agentskills.js

@@ -0,0 +1,252 @@
+/**
+ * AgentSkillsExtension — Skill kind + SkillReader.
+ *
+ * 1:1 parity with Python dna.v3.extensions.agentskills.
+ */
+import yaml from "js-yaml";
+import { deriveFirstLine } from "../kernel/_text.js";
+import { SkillSchema, SkillSpecSchema, zodSpecToJsonSchema } from "../kernel/models.js";
+import { KindBase } from "../kernel/kind_base.js";
+import { SD } from "../kernel/protocols.js";
+import { nodeFS, readTextSafe, collectDir } from "../kernel/fs.js";
+// ---------------------------------------------------------------------------
+// SkillKind
+// ---------------------------------------------------------------------------
+class SkillKind extends KindBase {
+    apiVersion = "agentskills.io/v1";
+    kind = "Skill";
+    alias = "agentskills-skill";
+    isSchemaAffecting = true;
+    origin = "agentskills.io";
+    isPromptTarget = false;
+    promptTargetPriority = 0;
+    flattenInContext = false;
+    descriptionFallbackField = "instruction";
+    storage = SD.bundle("skills", "SKILL.md");
+    graphStyle = { fill: "#10B981", stroke: "#059669", textColor: "#fff" };
+    asciiIcon = "📖";
+    displayLabel = "Skills";
+    _sourceUrl = import.meta.url;
+    docs = "A Skill is a modular, progressively-disclosed unit of know-how stored " +
+        "as a bundle rooted on SKILL.md with optional scripts/, references/, " +
+        "assets/. Skills are NOT flattened into prompts; the harness exposes a " +
+        "catalogue and agents read full SKILL.md on demand.";
+    uiSchema = {
+        instruction: {
+            widget: "markdown-toc",
+            label: "SKILL.md",
+            help: "The skill's instruction body (progressive disclosure, ≤500 lines).",
+            height: 520,
+            order: 10,
+        },
+        scripts: { widget: "readonly", label: "scripts/", help: "Bundled scripts directory. Edit on disk.", order: 20 },
+        references: { widget: "readonly", label: "references/", help: "Bundled reference files. Edit on disk.", order: 30 },
+        assets: { widget: "readonly", label: "assets/", help: "Binary/static assets. Edit on disk.", order: 40 },
+    };
+    schema() { return zodSpecToJsonSchema(SkillSpecSchema); }
+    parse(raw) {
+        return SkillSchema.parse(raw);
+    }
+    summary() { return null; }
+    preview(doc) {
+        const spec = (doc.spec ?? {});
+        const instruction = typeof spec.instruction === "string" ? spec.instruction : "";
+        if (!instruction) {
+            return [{ kind: "empty", title: "Skill (empty)" }];
+        }
+        return [
+            {
+                kind: "markdown",
+                title: "SKILL.md",
+                body: instruction,
+            },
+        ];
+    }
+}
+// ---------------------------------------------------------------------------
+// SkillReader
+// ---------------------------------------------------------------------------
+const KNOWN_DIRS = new Set(["scripts", "references", "assets"]);
+export class SkillReader {
+    fs;
+    constructor(fs) {
+        this.fs = fs;
+    }
+    detect(bundle) {
+        const path = bundle.path ?? "";
+        return this.fs.exists(`${path}/SKILL.md`);
+    }
+    read(bundle) {
+        const path = bundle.path ?? "";
+        const skillMd = this.fs.readFile(`${path}/SKILL.md`);
+        const metadata = parseFrontmatter(skillMd);
+        const name = (typeof metadata.name === "string" && metadata.name) ||
+            path.split("/").pop() ||
+            "";
+        const description = typeof metadata.description === "string" ? metadata.description : "";
+        // Extract body (after frontmatter) — F3 market fidelity: keep the
+        // tail byte-exact except the ONE leading newline the writer
+        // canonically re-emits ("---\\n\\n"). Trailing newlines and extra
+        // blank lines are part of the artifact.
+        const fmMatch = skillMd.match(/^---\n[\s\S]*?---(?:\n|$)/);
+        const tail = fmMatch ? skillMd.slice(fmMatch[0].length) : skillMd;
+        const body = tail.startsWith("\n") ? tail.slice(1) : tail;
+        const spec = { instruction: body };
+        // Collect known subdirectories (scripts/, references/, assets/)
+        for (const dirName of KNOWN_DIRS) {
+            const sub = `${path}/${dirName}`;
+            if (this.fs.isDirectory(sub)) {
+                const files = collectDir(this.fs, sub, sub);
+                if (Object.keys(files).length > 0) {
+                    spec[dirName] = files;
+                }
+            }
+        }
+        // Single readDir call, reused for extras + root files
+        const entries = this.fs.readDir(path);
+        // Collect ALL other subdirectories as extra bundles
+        const extras = {};
+        for (const entry of entries) {
+            const full = `${path}/${entry}`;
+            if (!this.fs.isDirectory(full) || KNOWN_DIRS.has(entry))
+                continue;
+            const files = collectDir(this.fs, full, full);
+            if (Object.keys(files).length > 0) {
+                extras[entry] = files;
+            }
+        }
+        if (Object.keys(extras).length > 0) {
+            spec.extras = extras;
+        }
+        // Collect root-level extra files (not SKILL.md)
+        const rootFiles = {};
+        for (const entry of entries) {
+            const full = `${path}/${entry}`;
+            if (!this.fs.isFile(full) || entry === "SKILL.md")
+                continue;
+            const text = readTextSafe(this.fs, full);
+            if (text !== null) {
+                rootFiles[entry] = text;
+            }
+        }
+        if (Object.keys(rootFiles).length > 0) {
+            spec.root_files = rootFiles;
+        }
+        // Preserve all frontmatter keys (tags, owner, priority, …). SkillWriter
+        // already round-trips extras; spreading metadata first then overriding
+        // name/description defaults closes the asymmetry on the reader side.
+        return {
+            apiVersion: "agentskills.io/v1",
+            kind: "Skill",
+            metadata: { ...metadata, name, description },
+            spec,
+        };
+    }
+}
+function parseFrontmatter(text) {
+    const match = text.match(/^---\n([\s\S]*?)---\n?/);
+    if (!match)
+        return {};
+    try {
+        const parsed = yaml.load(match[1]);
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch { }
+    return {};
+}
+// ---------------------------------------------------------------------------
+// SkillWriter
+// ---------------------------------------------------------------------------
+export class SkillWriter {
+    fs;
+    constructor(fs) {
+        this.fs = fs;
+    }
+    canWrite(raw) {
+        return raw.kind === "Skill";
+    }
+    write(bundle, raw) {
+        const path = bundle.path ?? "";
+        this.fs.mkdir(path);
+        for (const f of this.serialize(raw)) {
+            this.fs.writeFile(`${path}/${f.relativePath}`, f.content ?? "");
+        }
+    }
+    serialize(raw) {
+        const files = [];
+        const meta = (raw.metadata ?? {});
+        const spec = (raw.spec ?? {});
+        // SKILL.md with frontmatter + instruction body
+        const fm = {};
+        if (meta.name)
+            fm.name = meta.name;
+        if (meta.description)
+            fm.description = meta.description;
+        // Preserve extra metadata (e.g. tenant for RLS) — frontmatter is the
+        // authoritative metadata block for bundle kinds.
+        for (const [key, value] of Object.entries(meta)) {
+            if (key === "name" || key === "description")
+                continue;
+            if (value == null)
+                continue;
+            fm[key] = value;
+        }
+        // F3 market fidelity: metadata.description may have been ENRICHED at
+        // parse time (deriveFirstLine of the body). Persisting it would emit
+        // frontmatter the source bundle never had — elide when derivable.
+        if (typeof fm.description === "string" && fm.description === deriveFirstLine(spec.instruction ?? "")) {
+            delete fm.description;
+        }
+        // lineWidth: real marketplace skills author description as ONE long
+        // line — the default width 80 would wrap it (not byte-faithful).
+        const frontmatter = yaml.dump(fm, { flowLevel: -1, sortKeys: false, lineWidth: -1 });
+        const instruction = spec.instruction ?? "";
+        files.push({ relativePath: "SKILL.md", content: `---\n${frontmatter}---\n\n${instruction}` });
+        // Sub-directories: scripts, references, assets
+        for (const dirName of ["scripts", "references", "assets"]) {
+            const dirFiles = spec[dirName];
+            if (dirFiles != null && typeof dirFiles === "object") {
+                for (const [fname, fcontent] of Object.entries(dirFiles)) {
+                    files.push({ relativePath: `${dirName}/${fname}`, content: fcontent });
+                }
+            }
+        }
+        // Extras
+        const extras = spec.extras;
+        if (extras != null && typeof extras === "object") {
+            for (const [dirName, dirFiles] of Object.entries(extras)) {
+                if (typeof dirFiles === "object") {
+                    for (const [fname, fcontent] of Object.entries(dirFiles)) {
+                        files.push({ relativePath: `${dirName}/${fname}`, content: fcontent });
+                    }
+                }
+            }
+        }
+        // Root files
+        const rootFiles = spec.root_files;
+        if (rootFiles != null && typeof rootFiles === "object") {
+            for (const [fname, fcontent] of Object.entries(rootFiles)) {
+                files.push({ relativePath: fname, content: fcontent });
+            }
+        }
+        return files;
+    }
+}
+// ---------------------------------------------------------------------------
+// Extension
+// ---------------------------------------------------------------------------
+export class AgentSkillsExtension {
+    fs;
+    name = "agentskills";
+    version = "1.0.0";
+    constructor(fs = nodeFS) {
+        this.fs = fs;
+    }
+    register(kernel) {
+        kernel.kind(new SkillKind());
+        kernel.reader(new SkillReader(this.fs));
+        kernel.writer(new SkillWriter(this.fs));
+    }
+}

package/dist/extensions/agentsmd/DOCS.md

@@ -0,0 +1,18 @@
+# AgentDefinition (AGENTS.md)
+
+AgentDefinition wraps a standalone `AGENTS.md` file as a first-class document
+kind. `AGENTS.md` is an emerging community convention
+(https://agents.md) for giving coding agents repo-level instructions —
+similar in spirit to `README.md` but targeted at autonomous agents rather than
+human readers.
+
+The AgentsMdExtension scans for a top-level `AGENTS.md` in the manifest scope
+and exposes its content as a document. It is NOT a prompt target on its own;
+it is context material that agents and tooling can surface when operating in
+that repository.
+
+**When to use:** drop an `AGENTS.md` alongside your module manifest to record
+repo-wide conventions, coding style, test commands, or operational notes that
+any agent working in the scope should respect. Unlike Souls (which describe
+voice) and Skills (which describe procedures), AgentContext describes the
+environment the agent is working in.

package/dist/extensions/agentsmd.d.ts

@@ -0,0 +1,22 @@
+/**
+ * AgentsMdExtension — AgentDefinition kind + AgentDefinitionReader + Writer.
+ *
+ * 1:1 parity with Python dna.v3.extensions.agentsmd.
+ */
+import type { BundleHandle } from "../kernel/bundle-handle.js";
+import type { FSLike } from "../kernel/fs.js";
+import type { ExtensionHost, Extension, SerializedFile, WriterPort } from "../kernel/protocols.js";
+export declare class AgentDefinitionWriter implements WriterPort {
+    private fs;
+    constructor(fs?: FSLike);
+    canWrite(raw: Record<string, unknown>): boolean;
+    write(bundle: BundleHandle, raw: Record<string, unknown>): void;
+    serialize(raw: Record<string, unknown>): SerializedFile[];
+}
+export declare class AgentsMdExtension implements Extension {
+    private fs;
+    readonly name = "agentsmd";
+    readonly version = "1.0.0";
+    constructor(fs?: FSLike);
+    register(kernel: ExtensionHost): void;
+}

package/dist/extensions/agentsmd.js

@@ -0,0 +1,170 @@
+/**
+ * AgentsMdExtension — AgentDefinition kind + AgentDefinitionReader + Writer.
+ *
+ * 1:1 parity with Python dna.v3.extensions.agentsmd.
+ */
+import yaml from "js-yaml";
+import { deriveFirstLine } from "../kernel/_text.js";
+import { nodeFS } from "../kernel/fs.js";
+import { KindBase } from "../kernel/kind_base.js";
+import { AgentDefinitionSchema, AgentDefinitionSpecSchema, zodSpecToJsonSchema } from "../kernel/models.js";
+import { SD } from "../kernel/protocols.js";
+// ---------------------------------------------------------------------------
+// Frontmatter helpers
+// ---------------------------------------------------------------------------
+function parseAgentsFrontmatter(text) {
+    const match = text.match(/^---\n([\s\S]*?)---\n?([\s\S]*)$/);
+    if (!match)
+        return { metadata: {}, body: text };
+    try {
+        const parsed = yaml.load(match[1]);
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            return {
+                metadata: parsed,
+                body: match[2].replace(/^\n+/, ""),
+            };
+        }
+    }
+    catch { }
+    return { metadata: {}, body: text };
+}
+// ---------------------------------------------------------------------------
+// AgentDefinitionKind
+// ---------------------------------------------------------------------------
+class AgentDefinitionKind extends KindBase {
+    apiVersion = "agents.md/v1";
+    kind = "AgentDefinition";
+    alias = "agentsmd-agent";
+    origin = "agents.md";
+    isPromptTarget = true;
+    promptTargetPriority = 1;
+    flattenInContext = true;
+    descriptionFallbackField = "content";
+    storage = SD.standalone("AGENTS.md");
+    graphStyle = { fill: "#6366F1", stroke: "#4F46E5", textColor: "#fff" };
+    asciiIcon = "📝";
+    displayLabel = "AGENTS.md";
+    _sourceUrl = import.meta.url;
+    docs = "AgentDefinition wraps a standalone AGENTS.md file — the emerging " +
+        "community convention (https://agents.md) for repo-level coding-agent " +
+        "instructions. Flattened into context for agents working in the scope.";
+    schema() { return zodSpecToJsonSchema(AgentDefinitionSpecSchema); }
+    parse(raw) {
+        return AgentDefinitionSchema.parse(raw);
+    }
+    summary() { return null; }
+    promptTemplate() {
+        return "{{{content}}}";
+    }
+    preview(doc) {
+        const spec = (doc.spec ?? {});
+        const content = typeof spec.content === "string" ? spec.content : "";
+        if (!content) {
+            return [{ kind: "empty", title: "AGENTS.md (empty)" }];
+        }
+        return [{ kind: "markdown", title: "AGENTS.md", body: content }];
+    }
+}
+// ---------------------------------------------------------------------------
+// AgentDefinitionReader
+// ---------------------------------------------------------------------------
+class AgentDefinitionReader {
+    fs;
+    constructor(fs) {
+        this.fs = fs;
+    }
+    detect(bundle) {
+        const path = bundle.path ?? "";
+        if (!this.fs.exists(`${path}/AGENTS.md`))
+            return false;
+        // Skip if inside a soul bundle
+        if (this.fs.exists(`${path}/SOUL.md`) || this.fs.exists(`${path}/soul.json`)) {
+            return false;
+        }
+        return true;
+    }
+    read(bundle) {
+        const path = bundle.path ?? "";
+        const text = this.fs.readFile(`${path}/AGENTS.md`);
+        const name = path.split("/").pop() || "";
+        const { metadata: fm, body } = parseAgentsFrontmatter(text);
+        const metadata = { ...fm };
+        if (metadata.name == null)
+            metadata.name = name;
+        // When no frontmatter was present, preserve the full original text
+        // (byte-compat). When frontmatter IS present, spec.content is the body
+        // after it.
+        const hasFm = Object.keys(fm).length > 0;
+        const content = hasFm ? body : text;
+        return {
+            apiVersion: "agents.md/v1",
+            kind: "AgentDefinition",
+            metadata,
+            spec: { content },
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// AgentDefinitionWriter
+// ---------------------------------------------------------------------------
+export class AgentDefinitionWriter {
+    fs;
+    constructor(fs = nodeFS) {
+        this.fs = fs;
+    }
+    canWrite(raw) {
+        return raw.kind === "AgentDefinition";
+    }
+    write(bundle, raw) {
+        const path = bundle.path ?? "";
+        this.fs.mkdir(path);
+        for (const f of this.serialize(raw)) {
+            this.fs.writeFile(`${path}/${f.relativePath}`, f.content ?? "");
+        }
+    }
+    serialize(raw) {
+        const spec = (raw.spec ?? {});
+        const meta = (raw.metadata ?? {});
+        const body = (spec.content ?? "") || "";
+        // Drop null/undefined before deciding whether to emit frontmatter.
+        const fm = {};
+        for (const [k, v] of Object.entries(meta)) {
+            if (v == null)
+                continue;
+            fm[k] = v;
+        }
+        // F3 market fidelity: metadata.description may have been ENRICHED at
+        // parse time (deriveFirstLine of the body). Persisting it would emit
+        // frontmatter the source bundle never had — elide when derivable.
+        if (typeof fm.description === "string" && fm.description === deriveFirstLine(body)) {
+            delete fm.description;
+        }
+        const bodyHasFm = body.trimStart().startsWith("---");
+        const fmKeys = Object.keys(fm);
+        // Byte-compat for the simple "only name" case — previous writer emitted
+        // just the body. Keeps existing fixture AGENTS.md files from diffing.
+        const onlyName = fmKeys.length === 0 || (fmKeys.length === 1 && fmKeys[0] === "name");
+        const needsFm = fmKeys.length > 0 && !bodyHasFm && !onlyName;
+        if (needsFm) {
+            const fmBody = yaml.dump(fm, { flowLevel: -1, sortKeys: false, lineWidth: -1 }).replace(/\n+$/, "");
+            return [{ relativePath: "AGENTS.md", content: `---\n${fmBody}\n---\n${body}` }];
+        }
+        return [{ relativePath: "AGENTS.md", content: body }];
+    }
+}
+// ---------------------------------------------------------------------------
+// Extension
+// ---------------------------------------------------------------------------
+export class AgentsMdExtension {
+    fs;
+    name = "agentsmd";
+    version = "1.0.0";
+    constructor(fs = nodeFS) {
+        this.fs = fs;
+    }
+    register(kernel) {
+        kernel.kind(new AgentDefinitionKind());
+        kernel.reader(new AgentDefinitionReader(this.fs));
+        kernel.writer(new AgentDefinitionWriter(this.fs));
+    }
+}

package/dist/extensions/audit/kinds/audit-log.kind.yaml

@@ -0,0 +1,148 @@
+# AuditLog — immutable record of a role-gated HTTP endpoint invocation
+# (record plane, runtime artifact; written by emit_audit() from gated handlers).
+#
+# expr batch A (plan 2026-06-11-descriptor-expressiveness, Chunk 3): the
+# twin AuditLogKind classes (Py+TS) were DELETED — this descriptor is the
+# single source. First builtin Kind to carry the new D2 `ui:` descriptor
+# field (StudioUIMetadata reconstructed by DeclarativeKindPort and served
+# by kinds-api's /kinds/manifest verbatim — the class's `ui` block).
+# PARITY-CRITICAL package data: the byte-identical mirror lives at
+# packages/sdk-{py,ts}/{dna/extensions,src/extensions}/audit/kinds/
+# audit-log.kind.yaml (tests/test_descriptor_hash_parity.py enforces).
+# Equivalence with the extinct class frozen in
+# tests/test_expr_batch_a_equivalence.py.
+#
+# tenant_scope: tenanted is DECLARED — the class set scope=TenantScope.TENANTED
+# explicitly (each tenant sees only their own audit trail; platform admins
+# query cross-tenant). This is NOT the permissive-undeclared case.
+apiVersion: github.com/ruinosus/dna/core/v1
+kind: KindDefinition
+metadata:
+  name: audit-log
+spec:
+  target_api_version: github.com/ruinosus/dna/audit/v1
+  target_kind: AuditLog
+  alias: audit-auditlog
+  origin: github.com/ruinosus/dna/audit
+  tenant_scope: tenanted
+  plane: record
+  prompt_target: false
+  flatten_in_context: false
+  prompt_target_priority: 0
+  is_runtime_artifact: true
+  storage:
+    type: yaml
+    container: audit-log
+  schema:
+    type: object
+    required:
+    - actor
+    - roles
+    - operation
+    - outcome
+    - captured_at
+    additionalProperties: true
+    properties:
+      actor:
+        type: string
+        description: Identity that made the request. From claims.email > claims.sub.
+          'dev-user' in dev-bypass, 'test-user' in test-header mode.
+      roles:
+        type: array
+        items:
+          type: string
+        description: Roles claimed at request time (from JWT or DNA_DEV_ROLES). Snapshot
+          — does NOT reflect later role revocations.
+      operation:
+        type: string
+        description: HTTP method + path template, e.g. 'PUT /scopes/{scope}/docs/Agent/{name}'
+          or 'POST /assessments/{name}/run'.
+      target_kind:
+        type: string
+        description: Kind of doc affected (when applicable). Null for non-doc ops like
+          POST /sync/replicate.
+      target_name:
+        type: string
+        description: Name of doc affected, when applicable.
+      target_scope:
+        type: string
+        description: Scope of doc affected, when applicable.
+      target_tenant:
+        type:
+        - string
+        - 'null'
+        description: Tenant the operation routed to (claims.tenant + overrides resolved).
+          Null = base layer write.
+      outcome:
+        type: string
+        enum:
+        - success
+        - denied
+        - error
+        description: 'success = decorator + handler ran clean. denied = 403 from require_role.
+          error = handler raised (500/422/...).'
+      captured_at:
+        type: string
+        format: date-time
+        description: UTC ISO-8601 timestamp.
+      request_id:
+        type: string
+        description: Correlation ID (UUIDv4) — joins logs.
+      remote_ip:
+        type: string
+        description: Best-effort client IP (X-Forwarded-For aware).
+      user_agent:
+        type: string
+        description: HTTP User-Agent header.
+      detail:
+        type: object
+        description: 'Free-form context: which required roles failed, body size, durations,
+          errors. Defensive about PII — don''t include request bodies verbatim.'
+  # Curated list-endpoint projection. The extinct Py class declared NO
+  # summary() (KindBase whole-spec echo); the TS class returned null. Both
+  # are replaced by this curated projection (intentional delta — precedent
+  # VoiceEpisode/SynthesizerState in F3 lote-3). The manifest does NOT carry
+  # summary, so this choice is manifest-neutral.
+  summary:
+    actor: ''
+    operation: ''
+    outcome: ''
+    target_kind: ''
+    captured_at: ''
+  # P2L2 — AuditLog is Govern-mode (compliance + tenant-admin only). Sidebar
+  # entry visible to those roles. Read-only — no create/edit exposed in UI
+  # (writes happen via emit_audit() from gated handlers).
+  ui:
+    mode: govern
+    label:
+      en: Audit Log
+      pt-BR: Trilha de Auditoria
+    icon: 🔒
+    description:
+      en: Forensic trail of every role-gated mutation.
+      pt-BR: Trilha forense de toda mutação com role.
+    breadcrumb:
+    - Govern
+    - Audit Log
+    routes:
+      list: docs/AuditLog
+      detail: docs/AuditLog/:name
+    permissions:
+      list:
+      - compliance
+      - tenant-admin
+      detail:
+      - compliance
+      - tenant-admin
+    in_sidebar: true
+    display_order: 40
+  graph_style:
+    fill: '#475569'
+    stroke: '#334155'
+    text_color: '#fff'
+  ascii_icon: 🔍
+  display_label: Audit Log
+  docs: Immutable record of a role-gated HTTP endpoint invocation. Captures actor,
+    roles claimed, operation, target Kind/name, scope/tenant, request_id, outcome,
+    and timestamp. Used by compliance auditors + admins to answer 'who did what when'
+    without parsing application logs.

package/dist/extensions/audit.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AuditExtension — RBAC audit-trail Kinds.
+ *
+ * 1:1 parity with Python dna.extensions.audit
+ * (s-port-missing-ts-extensions). Registers:
+ *   - AuditLog (audit-auditlog) — immutable record of a role-gated endpoint
+ *     call. MIGRATED to a descriptor in expr batch A (plan
+ *     2026-06-11-descriptor-expressiveness): the twin AuditLogKind classes
+ *     (Py+TS) were DELETED — kinds/audit-log.kind.yaml is the single source,
+ *     registered via the loadDescriptors loop in register(). The descriptor
+ *     carries the D2 `ui:` block (now expressible Py↔TS), which the old TS
+ *     class intentionally omitted — so the TS runtime now exposes the same
+ *     Studio sidebar metadata the Python side always had.
+ *   - UserRoleAssignment (audit-userroleassignment) — user→roles within a
+ *     tenant (still a class).
+ *
+ * UserRoleAssignment is TENANTED (the KindBase default) with no reader/writer
+ * (plain YAML).
+ */
+import type { ExtensionHost, Extension } from "../kernel/protocols.js";
+export declare class AuditExtension implements Extension {
+    readonly name = "audit";
+    readonly version = "1.0.0";
+    register(kernel: ExtensionHost): void;
+}