dna-sdk 0.11.0 → 0.12.0

package/dist/bootstrap.js

@@ -42,6 +42,7 @@ import { CloudExtension } from "./extensions/cloud.js";
 import { AutomationExtension } from "./extensions/automation.js";
 import { EvalExtension } from "./extensions/eval.js";
 import { IntelExtension } from "./extensions/intel.js";
+import { PortfolioExtension } from "./extensions/portfolio.js";
 import { loadConfig } from "./config.js";
 import { resolveDefaultFsUrl, sourceFromUrl } from "./adapters/source-url.js";
 /**
@@ -75,6 +76,7 @@ function loadBuiltins(target) {
         new AutomationExtension(),
         new EvalExtension(),
         new IntelExtension(),
+        new PortfolioExtension(),
     ]) {
         target.load(ext);
     }

package/dist/extensions/guardrails.js

@@ -21,6 +21,10 @@ class GuardrailKind extends KindBase {
     promptTargetPriority = 0;
     flattenInContext = false;
     descriptionFallbackField = "instruction";
+    // Validate on read/compose, not only on write (i-validation-shallow) — parity
+    // with Python GuardrailKind.validate_on_parse. parse() below already throws on
+    // a bad severity/scope via GuardrailSchema (z.enum); this declares the intent.
+    validateOnParse = true;
     storage = SD.bundle("guardrails", "GUARDRAIL.md", "list", "rules");
     graphStyle = { fill: "#EF4444", stroke: "#DC2626", textColor: "#fff" };
     asciiIcon = "🛡️";

package/dist/extensions/helix.js

@@ -30,11 +30,23 @@ const GUARDRAILS_BLOCK = "{{#guardrails-guardrail}}" +
     "{{#description}}_{{description}}_\n\n{{/description}}" +
     "{{#rules}}- {{{.}}}\n{{/rules}}\n" +
     "{{/guardrails-guardrail}}";
+// Skills block (i-031) — a referenced Skill COMPOSES into the system prompt,
+// exactly like Guardrails: a Mustache section over the dep-filtered
+// `agentskills-skill` list, inlining each skill's SKILL.md body. Before this
+// fix a wired Skill was inert (in context, rendered by no layout). Skills
+// land AFTER the soul and BEFORE guardrails; a skill-less agent renders the
+// empty section to nothing, composing byte-identically to before. 1:1 with
+// Python `_SKILLS_BLOCK`.
+const SKILLS_BLOCK = "{{#agentskills-skill}}" +
+    "## Skill: {{name}}\n" +
+    "{{#description}}_{{description}}_\n\n{{/description}}" +
+    "{{{instruction}}}\n\n" +
+    "{{/agentskills-skill}}";
 // instruction-first (a.k.a. "default") — historic order: instruction, soul,
-// guardrails. IS the kind default template.
-const LAYOUT_INSTRUCTION_FIRST = "{{{agent.instruction}}}\n\n{{{soul_content}}}\n\n" + GUARDRAILS_BLOCK;
-// persona-first — Soul leads, then instruction, then guardrails.
-const LAYOUT_PERSONA_FIRST = "{{{soul_content}}}\n\n{{{agent.instruction}}}\n\n" + GUARDRAILS_BLOCK;
+// skills, guardrails. IS the kind default template.
+const LAYOUT_INSTRUCTION_FIRST = "{{{agent.instruction}}}\n\n{{{soul_content}}}\n\n" + SKILLS_BLOCK + GUARDRAILS_BLOCK;
+// persona-first — Soul leads, then instruction, then skills, then guardrails.
+const LAYOUT_PERSONA_FIRST = "{{{soul_content}}}\n\n{{{agent.instruction}}}\n\n" + SKILLS_BLOCK + GUARDRAILS_BLOCK;
 const AGENT_LAYOUTS = {
     default: LAYOUT_INSTRUCTION_FIRST,
     "instruction-first": LAYOUT_INSTRUCTION_FIRST,
@@ -342,8 +354,9 @@ class AgentKind extends KindBase {
     promptTemplate() {
         // IS the `instruction-first` / `default` named layout — the kind default
         // template and the `default` layout are one string, so an agent with no
-        // `layout:` composes identically. (Now includes the guardrails block,
-        // matching Python — see the layout-constants comment above.)
+        // `layout:` composes identically. Includes the skills block (i-031) and
+        // the guardrails block — Soul, Skills, and Guardrails all compose into the
+        // prompt. See the layout-constants comment above.
         return LAYOUT_INSTRUCTION_FIRST;
     }
     layoutTemplate(name) {

package/dist/extensions/portfolio/kinds/membership.kind.yaml

@@ -0,0 +1,114 @@
+# Membership — the RBAC join (record plane): a user's role at an org- or
+# project-scope. Named `Membership` (NOT the bare tenant Kind `TenantMembership`,
+# alias tenant-membership, which links a user to a platform-level Tenant) — this
+# one is the portfolio access grant a user holds within a tenant's own
+# Organization / Project graph. The role names mirror the standard ladder
+# (owner / admin / member / guest, highest-role-wins, org-owner superuser); a
+# custom-role follow-up would relax this enum to a free reference into the Role
+# Kind (see role.kind.yaml — the ladder is data so it can be extended).
+#
+# TENANTED — a membership is per-tenant access data, NOT a shared `_lib` default.
+# Deliberately NOT inheritable (never in DEFAULT_INHERITABLE_KINDS_V1); TENANTED
+# is correct.
+#
+# PARITY-CRITICAL package data: the byte-identical mirror lives at
+# packages/sdk-{py,ts}/{dna/extensions,src/extensions}/portfolio/kinds/
+# membership.kind.yaml (tests/test_descriptor_hash_parity.py enforces).
+apiVersion: github.com/ruinosus/dna/core/v1
+kind: KindDefinition
+metadata:
+  name: membership
+spec:
+  target_api_version: github.com/ruinosus/dna/portfolio/v1
+  target_kind: Membership
+  alias: portfolio-membership
+  origin: github.com/ruinosus/dna/portfolio
+  tenant_scope: tenanted
+  plane: record
+  prompt_target: false
+  flatten_in_context: false
+  prompt_target_priority: 0
+  storage:
+    type: yaml
+    container: memberships
+  schema:
+    type: object
+    additionalProperties: false
+    required:
+    - user
+    - scope_type
+    - scope_ref
+    - role
+    properties:
+      user:
+        type: string
+        description: The member's identity — an email or stable user id.
+      scope_type:
+        type: string
+        enum:
+        - org
+        - project
+        description: What the grant is scoped to — an Organization (org) or a single
+          Project (project).
+      scope_ref:
+        type: string
+        description: The Organization or Project name this grant applies to (paired
+          with scope_type).
+      role:
+        type: string
+        enum:
+        - owner
+        - admin
+        - member
+        - guest
+        description: The role granted at this scope — the standard ladder
+          (owner > admin > member > guest). Resolution is highest-role-wins across
+          a user's memberships, with the org owner a superuser.
+      status:
+        type: string
+        enum:
+        - invited
+        - active
+        default: invited
+        description: Invitation lifecycle — invited (pending acceptance) or active.
+      invited_at:
+        type:
+        - string
+        - 'null'
+        description: ISO-8601 timestamp of the invite, stamped by the writer (not
+          defaulted here).
+  describe: '{user} → {scope_ref} ({role})'
+  summary:
+    user: ''
+    scope_type: ''
+    scope_ref: ''
+    role: ''
+    status: invited
+  ui:
+    mode: govern
+    label:
+      en: Memberships
+      pt-BR: Membros
+    icon: 👤
+    description:
+      en: RBAC grants — a user's role at an org or project scope (highest-role-wins).
+      pt-BR: Concessões RBAC — o papel de um usuário num escopo de org ou projeto
+        (maior-papel-vence).
+    routes:
+      list: docs/Membership
+      detail: docs/Membership/:name
+    permissions:
+      list: any
+      detail: any
+    in_sidebar: true
+    display_order: 61
+  ascii_icon: 👤
+  display_label: Memberships
+  docs: A Membership is the RBAC join — a user's role at an org- or project-scope
+    within a tenant's portfolio. It carries the user (email / id), the scope_type
+    (org / project) and scope_ref it applies to, the role from the standard ladder
+    (owner > admin > member > guest, highest-role-wins, org-owner superuser), and
+    an invitation status (invited / active), as per-tenant declarative data. It is
+    distinct from the platform-level TenantMembership (which links a user to a
+    provisioning Tenant); this grants access inside the tenant's own Organization /
+    Project graph.

package/dist/extensions/portfolio/kinds/organization.kind.yaml

@@ -0,0 +1,99 @@
+# Organization — a tenant's org profile (record plane; the top-level container).
+# One doc per tenant: the human-facing identity of the organization whose
+# portfolio of Projects the DNA Cloud console aggregates. Named `Organization`
+# (the enterprise-familiar top-level term — GitHub/Azure DevOps) so procurement
+# recognizes it; it is the tenant's OWN profile, distinct from the platform-level
+# `Tenant` provisioning identity Kind (GLOBAL, `_lib`) — this one is the editable
+# org profile that lives inside the tenant's own portfolio.
+#
+# TENANTED — the org profile is per-tenant user data (one Organization per
+# tenant), NOT a shared `_lib` default consumed by other scopes. It is
+# deliberately NOT inheritable (never in DEFAULT_INHERITABLE_KINDS_V1); TENANTED
+# is the correct tenancy for per-tenant data without a platform default.
+#
+# PARITY-CRITICAL package data: the byte-identical mirror lives at
+# packages/sdk-{py,ts}/{dna/extensions,src/extensions}/portfolio/kinds/
+# organization.kind.yaml (tests/test_descriptor_hash_parity.py enforces).
+apiVersion: github.com/ruinosus/dna/core/v1
+kind: KindDefinition
+metadata:
+  name: organization
+spec:
+  target_api_version: github.com/ruinosus/dna/portfolio/v1
+  target_kind: Organization
+  alias: portfolio-org
+  origin: github.com/ruinosus/dna/portfolio
+  tenant_scope: tenanted
+  plane: record
+  prompt_target: false
+  flatten_in_context: false
+  prompt_target_priority: 0
+  storage:
+    type: yaml
+    container: organizations
+  schema:
+    type: object
+    additionalProperties: false
+    required:
+    - name
+    - slug
+    properties:
+      name:
+        type: string
+        description: The organization's canonical name. The doc name SHOULD equal
+          this.
+      slug:
+        type: string
+        description: URL-safe identity for the org, e.g. acme-corp. Used in routes
+          and as a stable handle for the tenant's portfolio.
+      display_name:
+        type:
+        - string
+        - 'null'
+        description: Human-facing name shown in the console. Falls back to name.
+      plan_ref:
+        type:
+        - string
+        - 'null'
+        description: The DNA Cloud Tier / TenantPlan this org is on (a Tier tier_id
+          or TenantPlan name). Null falls back to Free. The billing→enforcement
+          bridge reads it; the OSS SDK only stores it.
+      created_at:
+        type:
+        - string
+        - 'null'
+        description: ISO-8601 timestamp, stamped by the writer (not defaulted here).
+  describe: '{name}'
+  summary:
+    name: ''
+    slug: ''
+    plan_ref: null
+  ui:
+    mode: govern
+    label:
+      en: Organizations
+      pt-BR: Organizações
+    icon: 🏛️
+    description:
+      en: The tenant's org profile (the top-level container the portfolio console
+        aggregates).
+      pt-BR: O perfil da organização do tenant (o container de topo que o console
+        de portfólio agrega).
+    routes:
+      list: docs/Organization
+      detail: docs/Organization/:name
+    permissions:
+      list: any
+      detail: any
+    in_sidebar: true
+    display_order: 58
+  ascii_icon: 🏛️
+  display_label: Organizations
+  docs: An Organization is the tenant's own org profile — the enterprise-familiar
+    top-level container (as in GitHub / Azure DevOps) whose portfolio of Projects
+    the DNA Cloud console aggregates. It carries the org name, a URL-safe slug, an
+    optional display name, and a plan_ref to the DNA Cloud Tier / TenantPlan the
+    org is on, as per-tenant declarative data. One Organization per tenant; it is
+    distinct from the platform-level Tenant provisioning identity Kind (the
+    editable org profile inside the tenant's own portfolio, not the GLOBAL
+    identity row).

package/dist/extensions/portfolio/kinds/project.kind.yaml

@@ -0,0 +1,124 @@
+# Project — the multi-repo development-space container (record plane; the KEY
+# Kind of the portfolio model). Formalizes the marriage of three primitives the
+# DNA already has: (a) a SDLC board scope (convention <slug>-development), (b) one
+# or more IntelSources (the intelligence layer observes them), and (c) scoped
+# memory. This is the Azure DevOps-style container: a Project OWNS its board +
+# intel + memory and is the permission boundary; repos are ATTACHED BY REFERENCE.
+#
+# N—N Repo↔Project (decided with the owner): the edge lives HERE, as `repo_refs`
+# (a list of Repo names). A repo can belong to MULTIPLE Projects without being
+# duplicated; the Repo Kind deliberately carries NO project back-ref (single
+# source of truth for the edge — the Project side). Modelling the reverse as a
+# join Kind was considered and rejected as premature: a list of names on the
+# Project is the smallest thing that expresses N—N here.
+#
+# TENANTED — a Project is the tenant's own development space (per-tenant data),
+# NOT a shared `_lib` default. Deliberately NOT inheritable (never in
+# DEFAULT_INHERITABLE_KINDS_V1); TENANTED is correct.
+#
+# PARITY-CRITICAL package data: the byte-identical mirror lives at
+# packages/sdk-{py,ts}/{dna/extensions,src/extensions}/portfolio/kinds/
+# project.kind.yaml (tests/test_descriptor_hash_parity.py enforces).
+apiVersion: github.com/ruinosus/dna/core/v1
+kind: KindDefinition
+metadata:
+  name: project
+spec:
+  target_api_version: github.com/ruinosus/dna/portfolio/v1
+  target_kind: Project
+  alias: portfolio-project
+  origin: github.com/ruinosus/dna/portfolio
+  tenant_scope: tenanted
+  plane: record
+  prompt_target: false
+  flatten_in_context: false
+  prompt_target_priority: 0
+  storage:
+    type: yaml
+    container: projects
+  schema:
+    type: object
+    additionalProperties: false
+    required:
+    - name
+    - slug
+    properties:
+      name:
+        type: string
+        description: The project's canonical name. The doc name SHOULD equal this.
+      slug:
+        type: string
+        description: URL-safe identity for the project, e.g. copiloto-medico. Used
+          in routes and to derive the board_scope by convention.
+      org_ref:
+        type:
+        - string
+        - 'null'
+        description: The Organization (name) this project belongs to. Null while
+          unassigned.
+      repo_refs:
+        type: array
+        items:
+          type: string
+        description: Repo names attached to this project (the N—N edge — a repo may
+          appear on multiple projects). The edge lives on the Project side only.
+      board_scope:
+        type:
+        - string
+        - 'null'
+        description: The SDLC scope this project owns (convention <slug>-development).
+          Where its Stories / Issues / Epics live.
+      intel_source_refs:
+        type: array
+        items:
+          type: string
+        description: IntelSource names the intelligence layer observes for this
+          project (the sources feeding its insight stream).
+      visibility:
+        type: string
+        enum:
+        - private
+        - shared
+        default: private
+        description: Who can see the project — private (org-internal) or shared
+          (visible across the portfolio).
+      created_at:
+        type:
+        - string
+        - 'null'
+        description: ISO-8601 timestamp, stamped by the writer (not defaulted here).
+  describe: '{name}'
+  summary:
+    name: ''
+    slug: ''
+    org_ref: null
+    visibility: private
+  ui:
+    mode: govern
+    label:
+      en: Projects
+      pt-BR: Projetos
+    icon: 📁
+    description:
+      en: Multi-repo development-space containers (board + intel + memory; repos
+        attached by reference).
+      pt-BR: Containers de espaço-de-desenvolvimento multi-repo (board + inteligência
+        + memória; repos anexados por referência).
+    routes:
+      list: docs/Project
+      detail: docs/Project/:name
+    permissions:
+      list: any
+      detail: any
+    in_sidebar: true
+    display_order: 59
+  ascii_icon: 📁
+  display_label: Projects
+  docs: A Project is the multi-repo development-space container — the key Kind of
+    the portfolio model. It owns a SDLC board scope (convention <slug>-development),
+    one or more IntelSources the intelligence layer observes, and scoped memory,
+    and it is the permission boundary. Repos are attached BY REFERENCE via repo_refs
+    (an N—N edge kept on the Project side — a repo can belong to many projects
+    without duplication; Repo carries no project back-ref). A Project has a
+    visibility (private / shared) and an org_ref to its Organization, as per-tenant
+    declarative data.

package/dist/extensions/portfolio/kinds/repo.kind.yaml

@@ -0,0 +1,99 @@
+# Repo — a code repository the portfolio references (record plane). A source of
+# code attached to N Projects via Project.repo_refs (the N—N edge lives on the
+# Project side). A Repo deliberately carries NO project back-ref: the edge has a
+# single source of truth (the Project), so a repo shared across projects is never
+# duplicated and never carries a stale reverse list. Resolving "which projects
+# reference this repo" is a query over Projects, not a stored field.
+#
+# TENANTED — a repo is part of the tenant's own portfolio (per-tenant data), NOT
+# a shared `_lib` default. Deliberately NOT inheritable (never in
+# DEFAULT_INHERITABLE_KINDS_V1); TENANTED is correct.
+#
+# PARITY-CRITICAL package data: the byte-identical mirror lives at
+# packages/sdk-{py,ts}/{dna/extensions,src/extensions}/portfolio/kinds/
+# repo.kind.yaml (tests/test_descriptor_hash_parity.py enforces).
+apiVersion: github.com/ruinosus/dna/core/v1
+kind: KindDefinition
+metadata:
+  name: repo
+spec:
+  target_api_version: github.com/ruinosus/dna/portfolio/v1
+  target_kind: Repo
+  alias: portfolio-repo
+  origin: github.com/ruinosus/dna/portfolio
+  tenant_scope: tenanted
+  plane: record
+  prompt_target: false
+  flatten_in_context: false
+  prompt_target_priority: 0
+  storage:
+    type: yaml
+    container: repos
+  schema:
+    type: object
+    additionalProperties: false
+    required:
+    - name
+    properties:
+      name:
+        type: string
+        description: The repo name, e.g. copiloto-medico. The doc name SHOULD equal
+          this; Project.repo_refs point at it.
+      url:
+        type:
+        - string
+        - 'null'
+        description: Clone / browse URL of the repository. Null when the name alone
+          identifies it.
+      provider:
+        type: string
+        enum:
+        - github
+        - gitlab
+        - azure-devops
+        - other
+        default: github
+        description: Where the repo is hosted — github, gitlab, azure-devops, or
+          other.
+      default_branch:
+        type:
+        - string
+        - 'null'
+        description: The repo's default branch, e.g. main. Null when unknown.
+      created_at:
+        type:
+        - string
+        - 'null'
+        description: ISO-8601 timestamp, stamped by the writer (not defaulted here).
+  describe: '{name}'
+  summary:
+    name: ''
+    provider: ''
+    default_branch: null
+  ui:
+    mode: govern
+    label:
+      en: Repos
+      pt-BR: Repositórios
+    icon: 📦
+    description:
+      en: Code repositories the portfolio references (attached to projects by
+        reference, N—N).
+      pt-BR: Repositórios de código que o portfólio referencia (anexados a projetos
+        por referência, N—N).
+    routes:
+      list: docs/Repo
+      detail: docs/Repo/:name
+    permissions:
+      list: any
+      detail: any
+    in_sidebar: true
+    display_order: 60
+  ascii_icon: 📦
+  display_label: Repos
+  docs: A Repo is a code repository the portfolio references — its name, url,
+    provider (github / gitlab / azure-devops / other) and default_branch, as
+    per-tenant declarative data. It is attached to N Projects via Project.repo_refs
+    (the N—N edge lives on the Project side); a Repo carries no project back-ref,
+    so a repo shared across projects is never duplicated. "Which projects use this
+    repo" is a query over Projects, not a stored reverse list.

package/dist/extensions/portfolio/kinds/role.kind.yaml

@@ -0,0 +1,96 @@
+# Role — the RBAC role ladder AS DATA (record plane; the DNA thesis: everything
+# declarative). Instead of a hardcoded enum, each rung of the ladder is a Role
+# doc carrying its rank (higher = more access) and the capabilities it grants, so
+# the ladder is EXTENSIBLE — a tenant can add a custom role between member and
+# admin without a code change. The four standard rungs (owner / admin / member /
+# guest) ship as seed / example docs (examples/dna-cloud/.dna/.../roles/).
+# highest-role-wins compares `rank`; the org owner is a superuser above the ladder.
+#
+# TENANTED — a tenant owns its OWN role set (seeded from the standard ladder, then
+# customizable), NOT a shared `_lib` default. Deliberately NOT inheritable (never
+# in DEFAULT_INHERITABLE_KINDS_V1); TENANTED is correct — this is why the standard
+# rungs ship as per-tenant seed docs rather than a GLOBAL registry.
+#
+# PARITY-CRITICAL package data: the byte-identical mirror lives at
+# packages/sdk-{py,ts}/{dna/extensions,src/extensions}/portfolio/kinds/
+# role.kind.yaml (tests/test_descriptor_hash_parity.py enforces).
+apiVersion: github.com/ruinosus/dna/core/v1
+kind: KindDefinition
+metadata:
+  name: role
+spec:
+  target_api_version: github.com/ruinosus/dna/portfolio/v1
+  target_kind: Role
+  alias: portfolio-role
+  origin: github.com/ruinosus/dna/portfolio
+  tenant_scope: tenanted
+  plane: record
+  prompt_target: false
+  flatten_in_context: false
+  prompt_target_priority: 0
+  storage:
+    type: yaml
+    container: roles
+  schema:
+    type: object
+    additionalProperties: false
+    required:
+    - role_id
+    - display_name
+    - rank
+    properties:
+      role_id:
+        type: string
+        description: Canonical role id, e.g. owner / admin / member / guest. The doc
+          name SHOULD equal this; Membership.role references it.
+      display_name:
+        type: string
+        description: Human-facing role name, e.g. Owner, Admin, Member, Guest.
+      rank:
+        type: integer
+        description: Ladder rank — higher = more access. highest-role-wins compares
+          this across a user's memberships.
+      capabilities:
+        type: array
+        items:
+          type: string
+        description: The grants this role unlocks (e.g. project.write, member.invite,
+          billing.manage). The permission checker reads them from here.
+      can_delete:
+        type: boolean
+        default: true
+        description: False for the built-in ladder rungs that must not be removed
+          (e.g. owner); true for custom roles a tenant adds.
+  describe: '{display_name} (rank {rank})'
+  summary:
+    role_id: ''
+    display_name: ''
+    rank: 0
+    can_delete: true
+  ui:
+    mode: govern
+    label:
+      en: Roles
+      pt-BR: Papéis
+    icon: 🎚️
+    description:
+      en: The RBAC role ladder as data (extensible — add a custom rung without code).
+      pt-BR: A escada de papéis RBAC como dado (extensível — adicione um degrau sem
+        código).
+    routes:
+      list: docs/Role
+      detail: docs/Role/:name
+    permissions:
+      list: any
+      detail: any
+    in_sidebar: true
+    display_order: 62
+  ascii_icon: 🎚️
+  display_label: Roles
+  docs: A Role is one rung of the RBAC ladder expressed as data — its role_id,
+    display_name, rank (higher = more access), the capabilities it grants, and a
+    can_delete flag protecting built-in rungs. Modelling the ladder as data (not a
+    hardcoded enum) makes it extensible — a tenant can add a custom role without a
+    code change, and highest-role-wins simply compares rank. The four standard
+    rungs (owner / admin / member / guest) ship as per-tenant seed docs; the org
+    owner is a superuser above the ladder.

package/dist/extensions/portfolio.d.ts

@@ -0,0 +1,45 @@
+/**
+ * PortfolioExtension — DNA Cloud portfolio-console data foundation.
+ *
+ * 1:1 parity with Python `dna.extensions.portfolio`.
+ *
+ * Registers 5 record Kinds, from descriptors (F3 — record Kinds are data, not
+ * classes). The accepted model (adr-portfolio-project-model): an Organization
+ * (the tenant boundary) owns Projects; a Project is a multi-repo CONTAINER that
+ * owns its board scope + intel sources + memory; RBAC is the standard ladder.
+ *
+ *   - Organization (`portfolio-org`) — the tenant's org profile, the
+ *     enterprise-familiar top-level container the console aggregates. One per
+ *     tenant. Distinct from the platform-level `Tenant` provisioning identity
+ *     Kind (GLOBAL); this is the editable profile inside the tenant's portfolio.
+ *   - Project (`portfolio-project`) — the KEY Kind: the multi-repo
+ *     development-space container that OWNS a board scope (`<slug>-development`),
+ *     IntelSources and memory, and is the permission boundary. Repos are
+ *     attached BY REFERENCE via `repo_refs` (the N—N edge lives on the Project
+ *     side).
+ *   - Repo (`portfolio-repo`) — a code repository the portfolio references.
+ *     Attached to N Projects via `Project.repo_refs`; carries NO project
+ *     back-ref (single source of truth for the N—N edge → no duplication).
+ *   - Membership (`portfolio-membership`) — the RBAC join: a user's role at an
+ *     org- or project-scope (standard ladder owner > admin > member > guest,
+ *     highest-role-wins, org-owner superuser). Distinct from the tenant Kind
+ *     `TenantMembership` (which links a user to a provisioning Tenant).
+ *   - Role (`portfolio-role`) — the role ladder AS DATA (the DNA thesis):
+ *     each rung a doc with `rank` + `capabilities`, so the ladder is extensible
+ *     (custom roles) rather than a hardcoded enum. The four standard rungs ship
+ *     as per-tenant seed docs (examples/dna-cloud/.dna/.../roles/).
+ *
+ * All 5 are TENANTED — per-tenant portfolio data, NOT shared `_lib` defaults,
+ * and deliberately NOT inheritable (never in DEFAULT_INHERITABLE_KINDS_V1), so
+ * TENANTED is the correct tenancy.
+ *
+ * This is the data foundation ONLY — the console UI, the resolve_role helper
+ * (highest-role-wins + org-owner superuser) and the enterprise SSO/SCIM layer
+ * land in later stories; here we ship just the five data Kinds.
+ */
+import type { ExtensionHost, Extension } from "../kernel/protocols.js";
+export declare class PortfolioExtension implements Extension {
+    name: string;
+    version: string;
+    register(kernel: ExtensionHost): void;
+}