niceeval 0.12.1 → 0.12.2-canary.31

package/dist/plugins/record/capability.cjs

@@ -0,0 +1,258 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.declarePluginAttachment = declarePluginAttachment;
+exports.linkPluginRecordAttachments = linkPluginRecordAttachments;
+exports.makePluginAttachmentWrite = makePluginAttachmentWrite;
+exports.createPluginRecordContext = createPluginRecordContext;
+exports.pluginAttachmentCapabilityDefinition = pluginAttachmentCapabilityDefinition;
+exports.pluginAttachmentCapabilityFamily = pluginAttachmentCapabilityFamily;
+exports.isLinkedPluginRecordAttachment = isLinkedPluginRecordAttachment;
+exports.isLinkedPluginRecordAttachments = isLinkedPluginRecordAttachments;
+exports.linkedPluginRecordAttachmentsOwner = linkedPluginRecordAttachmentsOwner;
+exports.pluginRecordAttachmentAcceptanceCapability = pluginRecordAttachmentAcceptanceCapability;
+exports.pluginRecordAttachmentAcceptanceLinked = pluginRecordAttachmentAcceptanceLinked;
+const effect_1 = require("effect");
+const index_ts_1 = require("../../record/attachment/index.cjs");
+const internal_ts_1 = require("../../record/attachment/internal.cjs");
+const identifiers_ts_1 = require("../../record/model/identifiers.cjs");
+const pluginAttachmentCapabilityTypeId = Symbol("@niceeval/plugins/PluginAttachmentCapability");
+const linkedPluginRecordAttachmentsTypeId = Symbol("@niceeval/plugins/LinkedPluginRecordAttachments");
+const pluginRecordAttachmentAcceptanceTypeId = Symbol("@niceeval/plugins/PluginRecordAttachmentAcceptance");
+const capabilities = new WeakMap();
+const linkedAttachments = new WeakMap();
+const capabilityWrites = new WeakMap();
+const acceptedWrites = new WeakMap();
+const CLOSED_ERROR = Object.freeze({
+    code: "plugin-record-closed",
+});
+const WRONG_OWNER_ERROR = Object.freeze({
+    code: "plugin-record-wrong-owner",
+});
+const UNDECLARED_ERROR = Object.freeze({
+    code: "plugin-record-attachment-undeclared",
+});
+const DUPLICATE_ERROR = Object.freeze({
+    code: "plugin-record-attachment-duplicate",
+});
+function isObject(value) {
+    return typeof value === "object" && value !== null;
+}
+function isPluginRecordOwner(value) {
+    return value === "run" || value === "attempt";
+}
+function capabilityRuntime(capability) {
+    return isObject(capability) ? capabilities.get(capability) : undefined;
+}
+function linkedRuntime(linked) {
+    return isObject(linked) ? linkedAttachments.get(linked) : undefined;
+}
+function throwInvalidCapabilityDeclaration() {
+    throw new TypeError("declarePluginAttachment requires a genuine RecordAttachment family.");
+}
+function mintPluginRecordAttachmentAcceptance(capability, linked) {
+    const acceptance = {
+        [pluginRecordAttachmentAcceptanceTypeId]: () => {
+            throw new Error("PluginRecordAttachmentAcceptance type witness is never callable.");
+        },
+    };
+    acceptedWrites.set(acceptance, Object.freeze({ capability, linked }));
+    return Object.freeze(acceptance);
+}
+/**
+ * Declares a typed capability without exposing an owner, name, schema id, path,
+ * JSON route, or mutable family metadata to lifecycle code.
+ */
+function declarePluginAttachment(input) {
+    const family = input.family;
+    if (!(0, internal_ts_1.isRecordAttachmentFamily)(family)) {
+        return throwInvalidCapabilityDeclaration();
+    }
+    const owner = (0, internal_ts_1.recordAttachmentFamilyOwner)(family);
+    const definition = (0, internal_ts_1.recordAttachmentFamilyCurrentDefinition)(family);
+    if (owner === undefined || definition === undefined) {
+        return throwInvalidCapabilityDeclaration();
+    }
+    if ((0, identifiers_ts_1.isNiceEvalRecordAttachmentName)(definition.name)) {
+        throw new TypeError("declarePluginAttachment cannot grant a Plugin a framework-owned Attachment family.");
+    }
+    const capability = {
+        [pluginAttachmentCapabilityTypeId]: () => {
+            throw new Error("PluginAttachmentCapability type witness is never callable.");
+        },
+    };
+    capabilities.set(capability, Object.freeze({
+        owner,
+        family,
+        definition,
+    }));
+    return Object.freeze(capability);
+}
+/**
+ * Link only Record declarations. This intentionally does not implement Plugin
+ * discovery, lifecycle, Sandbox, or definition composition.
+ */
+function linkPluginRecordAttachments(input) {
+    if (!isPluginRecordOwner(input.owner)) {
+        return effect_1.Either.left(WRONG_OWNER_ERROR);
+    }
+    if (!Array.isArray(input.attachments)) {
+        return effect_1.Either.left(UNDECLARED_ERROR);
+    }
+    const capabilityObjects = new Set();
+    const familyObjects = new Set();
+    for (const capability of input.attachments) {
+        const runtime = capabilityRuntime(capability);
+        if (runtime === undefined) {
+            return effect_1.Either.left(UNDECLARED_ERROR);
+        }
+        if (runtime.owner !== input.owner) {
+            return effect_1.Either.left(WRONG_OWNER_ERROR);
+        }
+        if (capabilityObjects.has(capability)) {
+            return effect_1.Either.left(DUPLICATE_ERROR);
+        }
+        if (familyObjects.has(runtime.family)) {
+            return effect_1.Either.left(DUPLICATE_ERROR);
+        }
+        capabilityObjects.add(capability);
+        familyObjects.add(runtime.family);
+    }
+    const linked = {
+        [linkedPluginRecordAttachmentsTypeId]: () => {
+            throw new Error("LinkedPluginRecordAttachments type witness is never callable.");
+        },
+    };
+    linkedAttachments.set(linked, Object.freeze({
+        owner: input.owner,
+        capabilities: capabilityObjects,
+        families: familyObjects,
+    }));
+    return effect_1.Either.right(Object.freeze(linked));
+}
+/**
+ * Capability-specific write construction records the exact family object that
+ * minted the write. A generic write from another family therefore cannot be
+ * transplanted into this capability, even when the schemas look identical.
+ */
+function makePluginAttachmentWrite(capability, build) {
+    const runtime = capabilityRuntime(capability);
+    if (runtime === undefined) {
+        return throwInvalidCapabilityDeclaration();
+    }
+    const family = runtime.family;
+    const write = (0, index_ts_1.makeRecordAttachmentWrite)(family, build);
+    capabilityWrites.set(write, Object.freeze({
+        capability,
+        family: runtime.family,
+        owner: runtime.owner,
+    }));
+    return write;
+}
+/**
+ * Build a narrow owner-local context. Its sole operation is the typed write;
+ * raw names, schema ids, paths, payload JSON, and Group context do not exist.
+ */
+function createPluginRecordContext(input) {
+    const linked = linkedRuntime(input.linked);
+    if (linked === undefined) {
+        throw new TypeError("createPluginRecordContext requires a genuine linked Record allowlist.");
+    }
+    let closed = false;
+    const acceptedFamilies = new Set();
+    const pendingFamilies = new Set();
+    const context = Object.freeze({
+        record(capability, write) {
+            return effect_1.Effect.suspend(() => {
+                if (closed) {
+                    return effect_1.Effect.fail(CLOSED_ERROR);
+                }
+                const capabilityInfo = capabilityRuntime(capability);
+                if (capabilityInfo === undefined) {
+                    return effect_1.Effect.fail(UNDECLARED_ERROR);
+                }
+                if (capabilityInfo.owner !== linked.owner) {
+                    return effect_1.Effect.fail(WRONG_OWNER_ERROR);
+                }
+                if (!linked.capabilities.has(capability)) {
+                    return effect_1.Effect.fail(UNDECLARED_ERROR);
+                }
+                const writeInfo = isObject(write) ? capabilityWrites.get(write) : undefined;
+                if (writeInfo !== undefined && writeInfo.owner !== linked.owner) {
+                    return effect_1.Effect.fail(WRONG_OWNER_ERROR);
+                }
+                if (writeInfo === undefined ||
+                    writeInfo.capability !== capability ||
+                    writeInfo.family !== capabilityInfo.family) {
+                    return effect_1.Effect.fail(UNDECLARED_ERROR);
+                }
+                if (writeInfo.owner !== linked.owner) {
+                    return effect_1.Effect.fail(WRONG_OWNER_ERROR);
+                }
+                if (acceptedFamilies.has(capabilityInfo.family) ||
+                    pendingFamilies.has(capabilityInfo.family)) {
+                    return effect_1.Effect.fail(DUPLICATE_ERROR);
+                }
+                pendingFamilies.add(capabilityInfo.family);
+                let accepted = false;
+                return input.sink.record(write).pipe(effect_1.Effect.tap(() => effect_1.Effect.sync(() => {
+                    pendingFamilies.delete(capabilityInfo.family);
+                    acceptedFamilies.add(capabilityInfo.family);
+                    accepted = true;
+                    input.onAccepted?.(mintPluginRecordAttachmentAcceptance(capability, input.linked));
+                })), effect_1.Effect.ensuring(effect_1.Effect.sync(() => {
+                    if (!accepted) {
+                        pendingFamilies.delete(capabilityInfo.family);
+                    }
+                })));
+            });
+        },
+    });
+    return Object.freeze({
+        context,
+        close: () => {
+            closed = true;
+        },
+    });
+}
+/** @internal Framework provenance code uses this without opening a JSON route. */
+function pluginAttachmentCapabilityDefinition(capability) {
+    const runtime = capabilityRuntime(capability);
+    return runtime === undefined
+        ? undefined
+        : runtime.definition;
+}
+/** @internal Explicit registry adaptation retains the genuine family object. */
+function pluginAttachmentCapabilityFamily(capability) {
+    const runtime = capabilityRuntime(capability);
+    return runtime === undefined
+        ? undefined
+        : runtime.family;
+}
+/** @internal Provenance minting checks the exact linked declaration token. */
+function isLinkedPluginRecordAttachment(linked, capability) {
+    const linkedInfo = linkedRuntime(linked);
+    const capabilityInfo = capabilityRuntime(capability);
+    return (linkedInfo !== undefined &&
+        capabilityInfo !== undefined &&
+        linkedInfo.owner === capabilityInfo.owner &&
+        linkedInfo.capabilities.has(capability));
+}
+/** @internal Runtime guard for framework provenance and lifecycle integration. */
+function isLinkedPluginRecordAttachments(value) {
+    return linkedRuntime(value) !== undefined;
+}
+/** @internal Provenance validates that its builder and link have one exact owner. */
+function linkedPluginRecordAttachmentsOwner(linked) {
+    return linkedRuntime(linked)?.owner;
+}
+/** @internal A provenance ref may only derive from this post-acceptance receipt. */
+function pluginRecordAttachmentAcceptanceCapability(acceptance) {
+    const runtime = isObject(acceptance) ? acceptedWrites.get(acceptance) : undefined;
+    return runtime?.capability;
+}
+/** @internal Provenance must bind a receipt to its exact lifecycle allowlist. */
+function pluginRecordAttachmentAcceptanceLinked(acceptance) {
+    const runtime = isObject(acceptance) ? acceptedWrites.get(acceptance) : undefined;
+    return runtime?.linked;
+}
+//# sourceMappingURL=capability.cjs.map

package/dist/plugins/record/capability.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["capability.ts"],"names":[],"mappings":";;AAsHA,0DA0BC;AAKD,kEAwCC;AAMD,8DAaC;AAKD,8DA6DC;AAED,oFAKC;AAED,4EAKC;AAED,wEAOC;AAED,0EAEC;AAED,gFAEC;AAED,gGAGC;AAED,wFAGC;AA3TD,mCAAwC;AACxC,+DAAoR;AACpR,qEAAsJ;AACtJ,sEAAmF;AAGnF,MAAM,gCAAgC,GAAkB,MAAM,CAAC,8CAA8C,CAAC,CAAC;AAC/G,MAAM,mCAAmC,GAAkB,MAAM,CAAC,iDAAiD,CAAC,CAAC;AACrH,MAAM,sCAAsC,GAAkB,MAAM,CAAC,oDAAoD,CAAC,CAAC;AAkE3H,MAAM,YAAY,GAAG,IAAI,OAAO,EAA6B,CAAC;AAC9D,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAAyB,CAAC;AAC/D,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAkC,CAAC;AACvE,MAAM,cAAc,GAAG,IAAI,OAAO,EAA6B,CAAC;AAChE,MAAM,YAAY,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjE,IAAI,EAAE,sBAAsB;CAC/B,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACtE,IAAI,EAAE,2BAA2B;CACpC,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACrE,IAAI,EAAE,qCAAqC;CAC9C,CAAC,CAAC;AACH,MAAM,eAAe,GAAqC,MAAM,CAAC,MAAM,CAAC;IACpE,IAAI,EAAE,oCAAoC;CAC7C,CAAC,CAAC;AACH,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACvD,CAAC;AACD,SAAS,mBAAmB,CAAC,KAAc;IACvC,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC;AAClD,CAAC;AACD,SAAS,iBAAiB,CAAC,UAAmB;IAC1C,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AACD,SAAS,aAAa,CAAC,MAAe;IAClC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AACD,SAAS,iCAAiC;IACtC,MAAM,IAAI,SAAS,CAAC,qEAAqE,CAAC,CAAC;AAC/F,CAAC;AACD,SAAS,oCAAoC,CAAkC,UAAsD,EAAE,MAA4C;IAC/K,MAAM,UAAU,GAAG;QACf,CAAC,sCAAsC,CAAC,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACxF,CAAC;KACkD,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AACD;;;GAGG;AACH,SAAgB,uBAAuB,CAAiD,KAEvF;IACG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,IAAA,sCAAwB,EAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,iCAAiC,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yCAA2B,EAAC,MAAM,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAA,qDAAuC,EAAC,MAAM,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,iCAAiC,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,IAAA,+CAA8B,EAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,oFAAoF,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,UAAU,GAAG;QACf,CAAC,gCAAgC,CAAC,EAAE,GAAG,EAAE;YACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;KACqD,CAAC;IAC3D,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,KAAK;QACL,MAAM;QACN,UAAU;KACb,CAAC,CAAC,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AACD;;;GAGG;AACH,SAAgB,2BAA2B,CAAkC,KAG5E;IACG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,eAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO,eAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,OAAO,eAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,eAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG;QACX,CAAC,mCAAmC,CAAC,EAAE,GAAG,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACrF,CAAC;KAC+C,CAAC;IACrD,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,aAAa;KAC1B,CAAC,CAAC,CAAC;IACJ,OAAO,eAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC;AACD;;;;GAIG;AACH,SAAgB,yBAAyB,CAAiF,UAAsD,EAAE,KAAwF;IACtQ,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,iCAAiC,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAgD,CAAC;IACxE,MAAM,KAAK,GAAG,IAAA,oCAAyB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,UAAU;QACV,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;KACvB,CAAC,CAAC,CAAC;IACJ,OAAO,KAAK,CAAC;AACjB,CAAC;AACD;;;GAGG;AACH,SAAgB,yBAAyB,CAA+D,KAAyE;IAC7K,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,uEAAuE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,OAAO,GAA4D,MAAM,CAAC,MAAM,CAAC;QACnF,MAAM,CAAgB,UAAsD,EAAE,KAAyC;YACnH,OAAO,eAAM,CAAC,OAAO,CAA+E,GAAG,EAAE;gBACrG,IAAI,MAAM,EAAE,CAAC;oBACT,OAAO,eAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACrD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBAC/B,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,cAAc,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;oBACxC,OAAO,eAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBACvC,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC9D,OAAO,eAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,SAAS,KAAK,SAAS;oBACvB,SAAS,CAAC,UAAU,KAAK,UAAU;oBACnC,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;oBAC7C,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;oBACnC,OAAO,eAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC;oBAC3C,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,OAAO,eAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACxC,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBACnE,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;oBAC9C,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;oBAC5C,QAAQ,GAAG,IAAI,CAAC;oBAChB,KAAK,CAAC,UAAU,EAAE,CAAC,oCAAoC,CAAC,UAAwD,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrI,CAAC,CAAC,CAAC,EAAE,eAAM,CAAC,QAAQ,CAAC,eAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACZ,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;oBAClD,CAAC;gBACL,CAAC,CAAC,CAAC,CAAC,CAAC;YACT,CAAC,CAAC,CAAC;QACP,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,OAAO;QACP,KAAK,EAAE,GAAG,EAAE;YACR,MAAM,GAAG,IAAI,CAAC;QAClB,CAAC;KACJ,CAAC,CAAC;AACP,CAAC;AACD,kFAAkF;AAClF,SAAgB,oCAAoC,CAA2C,UAAsD;IACjJ,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAE,OAAO,CAAC,UAA6D,CAAC;AACjF,CAAC;AACD,gFAAgF;AAChF,SAAgB,gCAAgC,CAA2C,UAAsD;IAC7I,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAE,OAAO,CAAC,MAAiD,CAAC;AACrE,CAAC;AACD,8EAA8E;AAC9E,SAAgB,8BAA8B,CAAkC,MAA4C,EAAE,UAAsD;IAChL,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO,CAAC,UAAU,KAAK,SAAS;QAC5B,cAAc,KAAK,SAAS;QAC5B,UAAU,CAAC,KAAK,KAAK,cAAc,CAAC,KAAK;QACzC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACjD,CAAC;AACD,kFAAkF;AAClF,SAAgB,+BAA+B,CAAC,KAAc;IAC1D,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;AAC9C,CAAC;AACD,qFAAqF;AACrF,SAAgB,kCAAkC,CAAC,MAAwD;IACvG,OAAO,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;AACxC,CAAC;AACD,oFAAoF;AACpF,SAAgB,0CAA0C,CAAkC,UAAmD;IAC3I,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,OAAO,OAAO,EAAE,UAAoE,CAAC;AACzF,CAAC;AACD,iFAAiF;AACjF,SAAgB,sCAAsC,CAAkC,UAAmD;IACvI,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,OAAO,OAAO,EAAE,MAA0D,CAAC;AAC/E,CAAC","sourcesContent":["import { Effect, Either } from \"effect\";\nimport { makeRecordAttachmentWrite, type RecordAttachmentBlobBuild, type RecordAttachmentBlobBuilder, type RecordAttachmentFamily, type RecordAttachmentWrite, type RecordBlobDrafts, type RecordBlobErrors, type RecordBlobRequirements, } from \"../../record/attachment/index.ts\";\nimport { isRecordAttachmentFamily, recordAttachmentFamilyCurrentDefinition, recordAttachmentFamilyOwner, } from \"../../record/attachment/internal.ts\";\nimport { isNiceEvalRecordAttachmentName } from \"../../record/model/identifiers.ts\";\nimport type { JsonRecordAttachmentDefinition } from \"../../record/attachment/types.ts\";\nimport type { PluginRecordOwner } from \"./model.ts\";\nconst pluginAttachmentCapabilityTypeId: unique symbol = Symbol(\"@niceeval/plugins/PluginAttachmentCapability\");\nconst linkedPluginRecordAttachmentsTypeId: unique symbol = Symbol(\"@niceeval/plugins/LinkedPluginRecordAttachments\");\nconst pluginRecordAttachmentAcceptanceTypeId: unique symbol = Symbol(\"@niceeval/plugins/PluginRecordAttachmentAcceptance\");\n/**\n * A declaration is an opaque authority token. Its family and owner live in a\n * module-private WeakMap, so copying fields or transplanting the nominal brand\n * cannot grant Record write access.\n */\nexport interface PluginAttachmentCapability<out Owner extends PluginRecordOwner, out Payload> {\n    readonly [pluginAttachmentCapabilityTypeId]: () => {\n        readonly owner: Owner;\n        readonly payload: Payload;\n    };\n}\n/** A link-owned allowlist. There is intentionally no Group specialization. */\nexport interface LinkedPluginRecordAttachments<out Owner extends PluginRecordOwner> {\n    readonly [linkedPluginRecordAttachmentsTypeId]: () => Owner;\n}\n/** A receipt minted only after the generic Record writer accepted one write. */\nexport interface PluginRecordAttachmentAcceptance<out Owner extends PluginRecordOwner> {\n    readonly [pluginRecordAttachmentAcceptanceTypeId]: () => Owner;\n}\nexport type PluginRecordAttachmentWriteError = {\n    readonly code: \"plugin-record-closed\";\n} | {\n    readonly code: \"plugin-record-wrong-owner\";\n} | {\n    readonly code: \"plugin-record-attachment-undeclared\";\n} | {\n    readonly code: \"plugin-record-attachment-duplicate\";\n};\nexport type PluginRecordAttachmentLinkError = PluginRecordAttachmentWriteError;\nexport interface PluginRecordSink<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {\n    readonly record: <E, R>(write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, SinkError | E, SinkRequirements | R>;\n}\nexport interface PluginRecordContext<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {\n    readonly record: <Payload, E, R>(capability: PluginAttachmentCapability<Owner, Payload>, write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, PluginRecordAttachmentWriteError | SinkError | E, SinkRequirements | R>;\n}\n/** Framework code keeps the lease and passes only `context` to a lifecycle. */\nexport interface PluginRecordContextLease<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {\n    readonly context: PluginRecordContext<Owner, SinkError, SinkRequirements>;\n    readonly close: () => void;\n}\nexport interface CreatePluginRecordContextInput<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {\n    readonly linked: LinkedPluginRecordAttachments<Owner>;\n    readonly sink: PluginRecordSink<Owner, SinkError, SinkRequirements>;\n    /** Framework-only hook; invoked after the generic writer accepts a write. */\n    readonly onAccepted?: (acceptance: PluginRecordAttachmentAcceptance<Owner>) => void;\n}\ninterface CapabilityRuntime {\n    readonly owner: PluginRecordOwner;\n    readonly family: object;\n    readonly definition: object;\n}\ninterface LinkedRuntime {\n    readonly owner: PluginRecordOwner;\n    readonly capabilities: ReadonlySet<object>;\n    readonly families: ReadonlySet<object>;\n}\ninterface CapabilityWriteRuntime {\n    readonly capability: object;\n    readonly family: object;\n    readonly owner: PluginRecordOwner;\n}\ninterface AcceptanceRuntime {\n    readonly capability: object;\n    readonly linked: object;\n}\nconst capabilities = new WeakMap<object, CapabilityRuntime>();\nconst linkedAttachments = new WeakMap<object, LinkedRuntime>();\nconst capabilityWrites = new WeakMap<object, CapabilityWriteRuntime>();\nconst acceptedWrites = new WeakMap<object, AcceptanceRuntime>();\nconst CLOSED_ERROR: PluginRecordAttachmentWriteError = Object.freeze({\n    code: \"plugin-record-closed\",\n});\nconst WRONG_OWNER_ERROR: PluginRecordAttachmentWriteError = Object.freeze({\n    code: \"plugin-record-wrong-owner\",\n});\nconst UNDECLARED_ERROR: PluginRecordAttachmentWriteError = Object.freeze({\n    code: \"plugin-record-attachment-undeclared\",\n});\nconst DUPLICATE_ERROR: PluginRecordAttachmentWriteError = Object.freeze({\n    code: \"plugin-record-attachment-duplicate\",\n});\nfunction isObject(value: unknown): value is object {\n    return typeof value === \"object\" && value !== null;\n}\nfunction isPluginRecordOwner(value: unknown): value is PluginRecordOwner {\n    return value === \"run\" || value === \"attempt\";\n}\nfunction capabilityRuntime(capability: unknown): CapabilityRuntime | undefined {\n    return isObject(capability) ? capabilities.get(capability) : undefined;\n}\nfunction linkedRuntime(linked: unknown): LinkedRuntime | undefined {\n    return isObject(linked) ? linkedAttachments.get(linked) : undefined;\n}\nfunction throwInvalidCapabilityDeclaration(): never {\n    throw new TypeError(\"declarePluginAttachment requires a genuine RecordAttachment family.\");\n}\nfunction mintPluginRecordAttachmentAcceptance<Owner extends PluginRecordOwner>(capability: PluginAttachmentCapability<Owner, unknown>, linked: LinkedPluginRecordAttachments<Owner>): PluginRecordAttachmentAcceptance<Owner> {\n    const acceptance = {\n        [pluginRecordAttachmentAcceptanceTypeId]: () => {\n            throw new Error(\"PluginRecordAttachmentAcceptance type witness is never callable.\");\n        },\n    } as unknown as PluginRecordAttachmentAcceptance<Owner>;\n    acceptedWrites.set(acceptance, Object.freeze({ capability, linked }));\n    return Object.freeze(acceptance);\n}\n/**\n * Declares a typed capability without exposing an owner, name, schema id, path,\n * JSON route, or mutable family metadata to lifecycle code.\n */\nexport function declarePluginAttachment<const Owner extends PluginRecordOwner, Payload>(input: {\n    readonly family: RecordAttachmentFamily<Owner, Payload>;\n}): PluginAttachmentCapability<Owner, Payload> {\n    const family = input.family;\n    if (!isRecordAttachmentFamily(family)) {\n        return throwInvalidCapabilityDeclaration();\n    }\n    const owner = recordAttachmentFamilyOwner(family);\n    const definition = recordAttachmentFamilyCurrentDefinition(family);\n    if (owner === undefined || definition === undefined) {\n        return throwInvalidCapabilityDeclaration();\n    }\n    if (isNiceEvalRecordAttachmentName(definition.name)) {\n        throw new TypeError(\"declarePluginAttachment cannot grant a Plugin a framework-owned Attachment family.\");\n    }\n    const capability = {\n        [pluginAttachmentCapabilityTypeId]: () => {\n            throw new Error(\"PluginAttachmentCapability type witness is never callable.\");\n        },\n    } as unknown as PluginAttachmentCapability<Owner, Payload>;\n    capabilities.set(capability, Object.freeze({\n        owner,\n        family,\n        definition,\n    }));\n    return Object.freeze(capability);\n}\n/**\n * Link only Record declarations. This intentionally does not implement Plugin\n * discovery, lifecycle, Sandbox, or definition composition.\n */\nexport function linkPluginRecordAttachments<Owner extends PluginRecordOwner>(input: {\n    readonly owner: Owner;\n    readonly attachments: readonly PluginAttachmentCapability<Owner, unknown>[];\n}): Either.Either<LinkedPluginRecordAttachments<Owner>, PluginRecordAttachmentLinkError> {\n    if (!isPluginRecordOwner(input.owner)) {\n        return Either.left(WRONG_OWNER_ERROR);\n    }\n    if (!Array.isArray(input.attachments)) {\n        return Either.left(UNDECLARED_ERROR);\n    }\n    const capabilityObjects = new Set<object>();\n    const familyObjects = new Set<object>();\n    for (const capability of input.attachments) {\n        const runtime = capabilityRuntime(capability);\n        if (runtime === undefined) {\n            return Either.left(UNDECLARED_ERROR);\n        }\n        if (runtime.owner !== input.owner) {\n            return Either.left(WRONG_OWNER_ERROR);\n        }\n        if (capabilityObjects.has(capability)) {\n            return Either.left(DUPLICATE_ERROR);\n        }\n        if (familyObjects.has(runtime.family)) {\n            return Either.left(DUPLICATE_ERROR);\n        }\n        capabilityObjects.add(capability);\n        familyObjects.add(runtime.family);\n    }\n    const linked = {\n        [linkedPluginRecordAttachmentsTypeId]: () => {\n            throw new Error(\"LinkedPluginRecordAttachments type witness is never callable.\");\n        },\n    } as unknown as LinkedPluginRecordAttachments<Owner>;\n    linkedAttachments.set(linked, Object.freeze({\n        owner: input.owner,\n        capabilities: capabilityObjects,\n        families: familyObjects,\n    }));\n    return Either.right(Object.freeze(linked));\n}\n/**\n * Capability-specific write construction records the exact family object that\n * minted the write. A generic write from another family therefore cannot be\n * transplanted into this capability, even when the schemas look identical.\n */\nexport function makePluginAttachmentWrite<Owner extends PluginRecordOwner, Payload, const Blobs extends RecordBlobDrafts>(capability: PluginAttachmentCapability<Owner, Payload>, build: (blobs: RecordAttachmentBlobBuilder) => RecordAttachmentBlobBuild<Payload, Blobs>): RecordAttachmentWrite<Owner, RecordBlobErrors<Blobs>, RecordBlobRequirements<Blobs>> {\n    const runtime = capabilityRuntime(capability);\n    if (runtime === undefined) {\n        return throwInvalidCapabilityDeclaration();\n    }\n    const family = runtime.family as RecordAttachmentFamily<Owner, Payload>;\n    const write = makeRecordAttachmentWrite(family, build);\n    capabilityWrites.set(write, Object.freeze({\n        capability,\n        family: runtime.family,\n        owner: runtime.owner,\n    }));\n    return write;\n}\n/**\n * Build a narrow owner-local context. Its sole operation is the typed write;\n * raw names, schema ids, paths, payload JSON, and Group context do not exist.\n */\nexport function createPluginRecordContext<Owner extends PluginRecordOwner, SinkError, SinkRequirements>(input: CreatePluginRecordContextInput<Owner, SinkError, SinkRequirements>): PluginRecordContextLease<Owner, SinkError, SinkRequirements> {\n    const linked = linkedRuntime(input.linked);\n    if (linked === undefined) {\n        throw new TypeError(\"createPluginRecordContext requires a genuine linked Record allowlist.\");\n    }\n    let closed = false;\n    const acceptedFamilies = new Set<object>();\n    const pendingFamilies = new Set<object>();\n    const context: PluginRecordContext<Owner, SinkError, SinkRequirements> = Object.freeze({\n        record<Payload, E, R>(capability: PluginAttachmentCapability<Owner, Payload>, write: RecordAttachmentWrite<Owner, E, R>): Effect.Effect<void, PluginRecordAttachmentWriteError | SinkError | E, SinkRequirements | R> {\n            return Effect.suspend<void, PluginRecordAttachmentWriteError | SinkError | E, SinkRequirements | R>(() => {\n                if (closed) {\n                    return Effect.fail(CLOSED_ERROR);\n                }\n                const capabilityInfo = capabilityRuntime(capability);\n                if (capabilityInfo === undefined) {\n                    return Effect.fail(UNDECLARED_ERROR);\n                }\n                if (capabilityInfo.owner !== linked.owner) {\n                    return Effect.fail(WRONG_OWNER_ERROR);\n                }\n                if (!linked.capabilities.has(capability)) {\n                    return Effect.fail(UNDECLARED_ERROR);\n                }\n                const writeInfo = isObject(write) ? capabilityWrites.get(write) : undefined;\n                if (writeInfo !== undefined && writeInfo.owner !== linked.owner) {\n                    return Effect.fail(WRONG_OWNER_ERROR);\n                }\n                if (writeInfo === undefined ||\n                    writeInfo.capability !== capability ||\n                    writeInfo.family !== capabilityInfo.family) {\n                    return Effect.fail(UNDECLARED_ERROR);\n                }\n                if (writeInfo.owner !== linked.owner) {\n                    return Effect.fail(WRONG_OWNER_ERROR);\n                }\n                if (acceptedFamilies.has(capabilityInfo.family) ||\n                    pendingFamilies.has(capabilityInfo.family)) {\n                    return Effect.fail(DUPLICATE_ERROR);\n                }\n                pendingFamilies.add(capabilityInfo.family);\n                let accepted = false;\n                return input.sink.record(write).pipe(Effect.tap(() => Effect.sync(() => {\n                    pendingFamilies.delete(capabilityInfo.family);\n                    acceptedFamilies.add(capabilityInfo.family);\n                    accepted = true;\n                    input.onAccepted?.(mintPluginRecordAttachmentAcceptance(capability as PluginAttachmentCapability<Owner, unknown>, input.linked));\n                })), Effect.ensuring(Effect.sync(() => {\n                    if (!accepted) {\n                        pendingFamilies.delete(capabilityInfo.family);\n                    }\n                })));\n            });\n        },\n    });\n    return Object.freeze({\n        context,\n        close: () => {\n            closed = true;\n        },\n    });\n}\n/** @internal Framework provenance code uses this without opening a JSON route. */\nexport function pluginAttachmentCapabilityDefinition<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): JsonRecordAttachmentDefinition<Owner, Payload> | undefined {\n    const runtime = capabilityRuntime(capability);\n    return runtime === undefined\n        ? undefined\n        : (runtime.definition as JsonRecordAttachmentDefinition<Owner, Payload>);\n}\n/** @internal Explicit registry adaptation retains the genuine family object. */\nexport function pluginAttachmentCapabilityFamily<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): RecordAttachmentFamily<Owner, Payload> | undefined {\n    const runtime = capabilityRuntime(capability);\n    return runtime === undefined\n        ? undefined\n        : (runtime.family as RecordAttachmentFamily<Owner, Payload>);\n}\n/** @internal Provenance minting checks the exact linked declaration token. */\nexport function isLinkedPluginRecordAttachment<Owner extends PluginRecordOwner>(linked: LinkedPluginRecordAttachments<Owner>, capability: PluginAttachmentCapability<Owner, unknown>): boolean {\n    const linkedInfo = linkedRuntime(linked);\n    const capabilityInfo = capabilityRuntime(capability);\n    return (linkedInfo !== undefined &&\n        capabilityInfo !== undefined &&\n        linkedInfo.owner === capabilityInfo.owner &&\n        linkedInfo.capabilities.has(capability));\n}\n/** @internal Runtime guard for framework provenance and lifecycle integration. */\nexport function isLinkedPluginRecordAttachments(value: unknown): value is LinkedPluginRecordAttachments<PluginRecordOwner> {\n    return linkedRuntime(value) !== undefined;\n}\n/** @internal Provenance validates that its builder and link have one exact owner. */\nexport function linkedPluginRecordAttachmentsOwner(linked: LinkedPluginRecordAttachments<PluginRecordOwner>): PluginRecordOwner | undefined {\n    return linkedRuntime(linked)?.owner;\n}\n/** @internal A provenance ref may only derive from this post-acceptance receipt. */\nexport function pluginRecordAttachmentAcceptanceCapability<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): PluginAttachmentCapability<Owner, unknown> | undefined {\n    const runtime = isObject(acceptance) ? acceptedWrites.get(acceptance) : undefined;\n    return runtime?.capability as PluginAttachmentCapability<Owner, unknown> | undefined;\n}\n/** @internal Provenance must bind a receipt to its exact lifecycle allowlist. */\nexport function pluginRecordAttachmentAcceptanceLinked<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): LinkedPluginRecordAttachments<Owner> | undefined {\n    const runtime = isObject(acceptance) ? acceptedWrites.get(acceptance) : undefined;\n    return runtime?.linked as LinkedPluginRecordAttachments<Owner> | undefined;\n}\n"]}

package/dist/plugins/record/capability.d.cts

@@ -0,0 +1,94 @@
+import { Effect, Either } from "effect";
+import { type RecordAttachmentBlobBuild, type RecordAttachmentBlobBuilder, type RecordAttachmentFamily, type RecordAttachmentWrite, type RecordBlobDrafts, type RecordBlobErrors, type RecordBlobRequirements } from "../../record/attachment/index.cjs";
+import type { JsonRecordAttachmentDefinition } from "../../record/attachment/types.cjs";
+import type { PluginRecordOwner } from "./model.cjs";
+declare const pluginAttachmentCapabilityTypeId: unique symbol;
+declare const linkedPluginRecordAttachmentsTypeId: unique symbol;
+declare const pluginRecordAttachmentAcceptanceTypeId: unique symbol;
+/**
+ * A declaration is an opaque authority token. Its family and owner live in a
+ * module-private WeakMap, so copying fields or transplanting the nominal brand
+ * cannot grant Record write access.
+ */
+export interface PluginAttachmentCapability<out Owner extends PluginRecordOwner, out Payload> {
+    readonly [pluginAttachmentCapabilityTypeId]: () => {
+        readonly owner: Owner;
+        readonly payload: Payload;
+    };
+}
+/** A link-owned allowlist. There is intentionally no Group specialization. */
+export interface LinkedPluginRecordAttachments<out Owner extends PluginRecordOwner> {
+    readonly [linkedPluginRecordAttachmentsTypeId]: () => Owner;
+}
+/** A receipt minted only after the generic Record writer accepted one write. */
+export interface PluginRecordAttachmentAcceptance<out Owner extends PluginRecordOwner> {
+    readonly [pluginRecordAttachmentAcceptanceTypeId]: () => Owner;
+}
+export type PluginRecordAttachmentWriteError = {
+    readonly code: "plugin-record-closed";
+} | {
+    readonly code: "plugin-record-wrong-owner";
+} | {
+    readonly code: "plugin-record-attachment-undeclared";
+} | {
+    readonly code: "plugin-record-attachment-duplicate";
+};
+export type PluginRecordAttachmentLinkError = PluginRecordAttachmentWriteError;
+export interface PluginRecordSink<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {
+    readonly record: <E, R>(write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, SinkError | E, SinkRequirements | R>;
+}
+export interface PluginRecordContext<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {
+    readonly record: <Payload, E, R>(capability: PluginAttachmentCapability<Owner, Payload>, write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, PluginRecordAttachmentWriteError | SinkError | E, SinkRequirements | R>;
+}
+/** Framework code keeps the lease and passes only `context` to a lifecycle. */
+export interface PluginRecordContextLease<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {
+    readonly context: PluginRecordContext<Owner, SinkError, SinkRequirements>;
+    readonly close: () => void;
+}
+export interface CreatePluginRecordContextInput<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {
+    readonly linked: LinkedPluginRecordAttachments<Owner>;
+    readonly sink: PluginRecordSink<Owner, SinkError, SinkRequirements>;
+    /** Framework-only hook; invoked after the generic writer accepts a write. */
+    readonly onAccepted?: (acceptance: PluginRecordAttachmentAcceptance<Owner>) => void;
+}
+/**
+ * Declares a typed capability without exposing an owner, name, schema id, path,
+ * JSON route, or mutable family metadata to lifecycle code.
+ */
+export declare function declarePluginAttachment<const Owner extends PluginRecordOwner, Payload>(input: {
+    readonly family: RecordAttachmentFamily<Owner, Payload>;
+}): PluginAttachmentCapability<Owner, Payload>;
+/**
+ * Link only Record declarations. This intentionally does not implement Plugin
+ * discovery, lifecycle, Sandbox, or definition composition.
+ */
+export declare function linkPluginRecordAttachments<Owner extends PluginRecordOwner>(input: {
+    readonly owner: Owner;
+    readonly attachments: readonly PluginAttachmentCapability<Owner, unknown>[];
+}): Either.Either<LinkedPluginRecordAttachments<Owner>, PluginRecordAttachmentLinkError>;
+/**
+ * Capability-specific write construction records the exact family object that
+ * minted the write. A generic write from another family therefore cannot be
+ * transplanted into this capability, even when the schemas look identical.
+ */
+export declare function makePluginAttachmentWrite<Owner extends PluginRecordOwner, Payload, const Blobs extends RecordBlobDrafts>(capability: PluginAttachmentCapability<Owner, Payload>, build: (blobs: RecordAttachmentBlobBuilder) => RecordAttachmentBlobBuild<Payload, Blobs>): RecordAttachmentWrite<Owner, RecordBlobErrors<Blobs>, RecordBlobRequirements<Blobs>>;
+/**
+ * Build a narrow owner-local context. Its sole operation is the typed write;
+ * raw names, schema ids, paths, payload JSON, and Group context do not exist.
+ */
+export declare function createPluginRecordContext<Owner extends PluginRecordOwner, SinkError, SinkRequirements>(input: CreatePluginRecordContextInput<Owner, SinkError, SinkRequirements>): PluginRecordContextLease<Owner, SinkError, SinkRequirements>;
+/** @internal Framework provenance code uses this without opening a JSON route. */
+export declare function pluginAttachmentCapabilityDefinition<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): JsonRecordAttachmentDefinition<Owner, Payload> | undefined;
+/** @internal Explicit registry adaptation retains the genuine family object. */
+export declare function pluginAttachmentCapabilityFamily<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): RecordAttachmentFamily<Owner, Payload> | undefined;
+/** @internal Provenance minting checks the exact linked declaration token. */
+export declare function isLinkedPluginRecordAttachment<Owner extends PluginRecordOwner>(linked: LinkedPluginRecordAttachments<Owner>, capability: PluginAttachmentCapability<Owner, unknown>): boolean;
+/** @internal Runtime guard for framework provenance and lifecycle integration. */
+export declare function isLinkedPluginRecordAttachments(value: unknown): value is LinkedPluginRecordAttachments<PluginRecordOwner>;
+/** @internal Provenance validates that its builder and link have one exact owner. */
+export declare function linkedPluginRecordAttachmentsOwner(linked: LinkedPluginRecordAttachments<PluginRecordOwner>): PluginRecordOwner | undefined;
+/** @internal A provenance ref may only derive from this post-acceptance receipt. */
+export declare function pluginRecordAttachmentAcceptanceCapability<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): PluginAttachmentCapability<Owner, unknown> | undefined;
+/** @internal Provenance must bind a receipt to its exact lifecycle allowlist. */
+export declare function pluginRecordAttachmentAcceptanceLinked<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): LinkedPluginRecordAttachments<Owner> | undefined;
+export {};

package/dist/plugins/record/capability.d.mts

@@ -0,0 +1,94 @@
+import { Effect, Either } from "effect";
+import { type RecordAttachmentBlobBuild, type RecordAttachmentBlobBuilder, type RecordAttachmentFamily, type RecordAttachmentWrite, type RecordBlobDrafts, type RecordBlobErrors, type RecordBlobRequirements } from "../../record/attachment/index.mjs";
+import type { JsonRecordAttachmentDefinition } from "../../record/attachment/types.mjs";
+import type { PluginRecordOwner } from "./model.mjs";
+declare const pluginAttachmentCapabilityTypeId: unique symbol;
+declare const linkedPluginRecordAttachmentsTypeId: unique symbol;
+declare const pluginRecordAttachmentAcceptanceTypeId: unique symbol;
+/**
+ * A declaration is an opaque authority token. Its family and owner live in a
+ * module-private WeakMap, so copying fields or transplanting the nominal brand
+ * cannot grant Record write access.
+ */
+export interface PluginAttachmentCapability<out Owner extends PluginRecordOwner, out Payload> {
+    readonly [pluginAttachmentCapabilityTypeId]: () => {
+        readonly owner: Owner;
+        readonly payload: Payload;
+    };
+}
+/** A link-owned allowlist. There is intentionally no Group specialization. */
+export interface LinkedPluginRecordAttachments<out Owner extends PluginRecordOwner> {
+    readonly [linkedPluginRecordAttachmentsTypeId]: () => Owner;
+}
+/** A receipt minted only after the generic Record writer accepted one write. */
+export interface PluginRecordAttachmentAcceptance<out Owner extends PluginRecordOwner> {
+    readonly [pluginRecordAttachmentAcceptanceTypeId]: () => Owner;
+}
+export type PluginRecordAttachmentWriteError = {
+    readonly code: "plugin-record-closed";
+} | {
+    readonly code: "plugin-record-wrong-owner";
+} | {
+    readonly code: "plugin-record-attachment-undeclared";
+} | {
+    readonly code: "plugin-record-attachment-duplicate";
+};
+export type PluginRecordAttachmentLinkError = PluginRecordAttachmentWriteError;
+export interface PluginRecordSink<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {
+    readonly record: <E, R>(write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, SinkError | E, SinkRequirements | R>;
+}
+export interface PluginRecordContext<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {
+    readonly record: <Payload, E, R>(capability: PluginAttachmentCapability<Owner, Payload>, write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, PluginRecordAttachmentWriteError | SinkError | E, SinkRequirements | R>;
+}
+/** Framework code keeps the lease and passes only `context` to a lifecycle. */
+export interface PluginRecordContextLease<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {
+    readonly context: PluginRecordContext<Owner, SinkError, SinkRequirements>;
+    readonly close: () => void;
+}
+export interface CreatePluginRecordContextInput<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {
+    readonly linked: LinkedPluginRecordAttachments<Owner>;
+    readonly sink: PluginRecordSink<Owner, SinkError, SinkRequirements>;
+    /** Framework-only hook; invoked after the generic writer accepts a write. */
+    readonly onAccepted?: (acceptance: PluginRecordAttachmentAcceptance<Owner>) => void;
+}
+/**
+ * Declares a typed capability without exposing an owner, name, schema id, path,
+ * JSON route, or mutable family metadata to lifecycle code.
+ */
+export declare function declarePluginAttachment<const Owner extends PluginRecordOwner, Payload>(input: {
+    readonly family: RecordAttachmentFamily<Owner, Payload>;
+}): PluginAttachmentCapability<Owner, Payload>;
+/**
+ * Link only Record declarations. This intentionally does not implement Plugin
+ * discovery, lifecycle, Sandbox, or definition composition.
+ */
+export declare function linkPluginRecordAttachments<Owner extends PluginRecordOwner>(input: {
+    readonly owner: Owner;
+    readonly attachments: readonly PluginAttachmentCapability<Owner, unknown>[];
+}): Either.Either<LinkedPluginRecordAttachments<Owner>, PluginRecordAttachmentLinkError>;
+/**
+ * Capability-specific write construction records the exact family object that
+ * minted the write. A generic write from another family therefore cannot be
+ * transplanted into this capability, even when the schemas look identical.
+ */
+export declare function makePluginAttachmentWrite<Owner extends PluginRecordOwner, Payload, const Blobs extends RecordBlobDrafts>(capability: PluginAttachmentCapability<Owner, Payload>, build: (blobs: RecordAttachmentBlobBuilder) => RecordAttachmentBlobBuild<Payload, Blobs>): RecordAttachmentWrite<Owner, RecordBlobErrors<Blobs>, RecordBlobRequirements<Blobs>>;
+/**
+ * Build a narrow owner-local context. Its sole operation is the typed write;
+ * raw names, schema ids, paths, payload JSON, and Group context do not exist.
+ */
+export declare function createPluginRecordContext<Owner extends PluginRecordOwner, SinkError, SinkRequirements>(input: CreatePluginRecordContextInput<Owner, SinkError, SinkRequirements>): PluginRecordContextLease<Owner, SinkError, SinkRequirements>;
+/** @internal Framework provenance code uses this without opening a JSON route. */
+export declare function pluginAttachmentCapabilityDefinition<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): JsonRecordAttachmentDefinition<Owner, Payload> | undefined;
+/** @internal Explicit registry adaptation retains the genuine family object. */
+export declare function pluginAttachmentCapabilityFamily<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): RecordAttachmentFamily<Owner, Payload> | undefined;
+/** @internal Provenance minting checks the exact linked declaration token. */
+export declare function isLinkedPluginRecordAttachment<Owner extends PluginRecordOwner>(linked: LinkedPluginRecordAttachments<Owner>, capability: PluginAttachmentCapability<Owner, unknown>): boolean;
+/** @internal Runtime guard for framework provenance and lifecycle integration. */
+export declare function isLinkedPluginRecordAttachments(value: unknown): value is LinkedPluginRecordAttachments<PluginRecordOwner>;
+/** @internal Provenance validates that its builder and link have one exact owner. */
+export declare function linkedPluginRecordAttachmentsOwner(linked: LinkedPluginRecordAttachments<PluginRecordOwner>): PluginRecordOwner | undefined;
+/** @internal A provenance ref may only derive from this post-acceptance receipt. */
+export declare function pluginRecordAttachmentAcceptanceCapability<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): PluginAttachmentCapability<Owner, unknown> | undefined;
+/** @internal Provenance must bind a receipt to its exact lifecycle allowlist. */
+export declare function pluginRecordAttachmentAcceptanceLinked<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): LinkedPluginRecordAttachments<Owner> | undefined;
+export {};

package/dist/plugins/record/capability.d.ts

@@ -0,0 +1,94 @@
+import { Effect, Either } from "effect";
+import { type RecordAttachmentBlobBuild, type RecordAttachmentBlobBuilder, type RecordAttachmentFamily, type RecordAttachmentWrite, type RecordBlobDrafts, type RecordBlobErrors, type RecordBlobRequirements } from "../../record/attachment/index.js";
+import type { JsonRecordAttachmentDefinition } from "../../record/attachment/types.js";
+import type { PluginRecordOwner } from "./model.js";
+declare const pluginAttachmentCapabilityTypeId: unique symbol;
+declare const linkedPluginRecordAttachmentsTypeId: unique symbol;
+declare const pluginRecordAttachmentAcceptanceTypeId: unique symbol;
+/**
+ * A declaration is an opaque authority token. Its family and owner live in a
+ * module-private WeakMap, so copying fields or transplanting the nominal brand
+ * cannot grant Record write access.
+ */
+export interface PluginAttachmentCapability<out Owner extends PluginRecordOwner, out Payload> {
+    readonly [pluginAttachmentCapabilityTypeId]: () => {
+        readonly owner: Owner;
+        readonly payload: Payload;
+    };
+}
+/** A link-owned allowlist. There is intentionally no Group specialization. */
+export interface LinkedPluginRecordAttachments<out Owner extends PluginRecordOwner> {
+    readonly [linkedPluginRecordAttachmentsTypeId]: () => Owner;
+}
+/** A receipt minted only after the generic Record writer accepted one write. */
+export interface PluginRecordAttachmentAcceptance<out Owner extends PluginRecordOwner> {
+    readonly [pluginRecordAttachmentAcceptanceTypeId]: () => Owner;
+}
+export type PluginRecordAttachmentWriteError = {
+    readonly code: "plugin-record-closed";
+} | {
+    readonly code: "plugin-record-wrong-owner";
+} | {
+    readonly code: "plugin-record-attachment-undeclared";
+} | {
+    readonly code: "plugin-record-attachment-duplicate";
+};
+export type PluginRecordAttachmentLinkError = PluginRecordAttachmentWriteError;
+export interface PluginRecordSink<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {
+    readonly record: <E, R>(write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, SinkError | E, SinkRequirements | R>;
+}
+export interface PluginRecordContext<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {
+    readonly record: <Payload, E, R>(capability: PluginAttachmentCapability<Owner, Payload>, write: RecordAttachmentWrite<Owner, E, R>) => Effect.Effect<void, PluginRecordAttachmentWriteError | SinkError | E, SinkRequirements | R>;
+}
+/** Framework code keeps the lease and passes only `context` to a lifecycle. */
+export interface PluginRecordContextLease<Owner extends PluginRecordOwner, SinkError = never, SinkRequirements = never> {
+    readonly context: PluginRecordContext<Owner, SinkError, SinkRequirements>;
+    readonly close: () => void;
+}
+export interface CreatePluginRecordContextInput<Owner extends PluginRecordOwner, SinkError, SinkRequirements> {
+    readonly linked: LinkedPluginRecordAttachments<Owner>;
+    readonly sink: PluginRecordSink<Owner, SinkError, SinkRequirements>;
+    /** Framework-only hook; invoked after the generic writer accepts a write. */
+    readonly onAccepted?: (acceptance: PluginRecordAttachmentAcceptance<Owner>) => void;
+}
+/**
+ * Declares a typed capability without exposing an owner, name, schema id, path,
+ * JSON route, or mutable family metadata to lifecycle code.
+ */
+export declare function declarePluginAttachment<const Owner extends PluginRecordOwner, Payload>(input: {
+    readonly family: RecordAttachmentFamily<Owner, Payload>;
+}): PluginAttachmentCapability<Owner, Payload>;
+/**
+ * Link only Record declarations. This intentionally does not implement Plugin
+ * discovery, lifecycle, Sandbox, or definition composition.
+ */
+export declare function linkPluginRecordAttachments<Owner extends PluginRecordOwner>(input: {
+    readonly owner: Owner;
+    readonly attachments: readonly PluginAttachmentCapability<Owner, unknown>[];
+}): Either.Either<LinkedPluginRecordAttachments<Owner>, PluginRecordAttachmentLinkError>;
+/**
+ * Capability-specific write construction records the exact family object that
+ * minted the write. A generic write from another family therefore cannot be
+ * transplanted into this capability, even when the schemas look identical.
+ */
+export declare function makePluginAttachmentWrite<Owner extends PluginRecordOwner, Payload, const Blobs extends RecordBlobDrafts>(capability: PluginAttachmentCapability<Owner, Payload>, build: (blobs: RecordAttachmentBlobBuilder) => RecordAttachmentBlobBuild<Payload, Blobs>): RecordAttachmentWrite<Owner, RecordBlobErrors<Blobs>, RecordBlobRequirements<Blobs>>;
+/**
+ * Build a narrow owner-local context. Its sole operation is the typed write;
+ * raw names, schema ids, paths, payload JSON, and Group context do not exist.
+ */
+export declare function createPluginRecordContext<Owner extends PluginRecordOwner, SinkError, SinkRequirements>(input: CreatePluginRecordContextInput<Owner, SinkError, SinkRequirements>): PluginRecordContextLease<Owner, SinkError, SinkRequirements>;
+/** @internal Framework provenance code uses this without opening a JSON route. */
+export declare function pluginAttachmentCapabilityDefinition<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): JsonRecordAttachmentDefinition<Owner, Payload> | undefined;
+/** @internal Explicit registry adaptation retains the genuine family object. */
+export declare function pluginAttachmentCapabilityFamily<Owner extends PluginRecordOwner, Payload>(capability: PluginAttachmentCapability<Owner, Payload>): RecordAttachmentFamily<Owner, Payload> | undefined;
+/** @internal Provenance minting checks the exact linked declaration token. */
+export declare function isLinkedPluginRecordAttachment<Owner extends PluginRecordOwner>(linked: LinkedPluginRecordAttachments<Owner>, capability: PluginAttachmentCapability<Owner, unknown>): boolean;
+/** @internal Runtime guard for framework provenance and lifecycle integration. */
+export declare function isLinkedPluginRecordAttachments(value: unknown): value is LinkedPluginRecordAttachments<PluginRecordOwner>;
+/** @internal Provenance validates that its builder and link have one exact owner. */
+export declare function linkedPluginRecordAttachmentsOwner(linked: LinkedPluginRecordAttachments<PluginRecordOwner>): PluginRecordOwner | undefined;
+/** @internal A provenance ref may only derive from this post-acceptance receipt. */
+export declare function pluginRecordAttachmentAcceptanceCapability<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): PluginAttachmentCapability<Owner, unknown> | undefined;
+/** @internal Provenance must bind a receipt to its exact lifecycle allowlist. */
+export declare function pluginRecordAttachmentAcceptanceLinked<Owner extends PluginRecordOwner>(acceptance: PluginRecordAttachmentAcceptance<Owner>): LinkedPluginRecordAttachments<Owner> | undefined;
+export {};

package/dist/plugins/record/capability.js

@@ -0,0 +1,26 @@
+import { createRequire as __niceevalCreateRequire } from "node:module";
+const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
+const __niceevalCanonical = __niceevalRequire("./capability.cjs");
+const __niceevalExport0 = __niceevalCanonical["createPluginRecordContext"];
+export { __niceevalExport0 as createPluginRecordContext };
+const __niceevalExport1 = __niceevalCanonical["declarePluginAttachment"];
+export { __niceevalExport1 as declarePluginAttachment };
+const __niceevalExport2 = __niceevalCanonical["isLinkedPluginRecordAttachment"];
+export { __niceevalExport2 as isLinkedPluginRecordAttachment };
+const __niceevalExport3 = __niceevalCanonical["isLinkedPluginRecordAttachments"];
+export { __niceevalExport3 as isLinkedPluginRecordAttachments };
+const __niceevalExport4 = __niceevalCanonical["linkPluginRecordAttachments"];
+export { __niceevalExport4 as linkPluginRecordAttachments };
+const __niceevalExport5 = __niceevalCanonical["linkedPluginRecordAttachmentsOwner"];
+export { __niceevalExport5 as linkedPluginRecordAttachmentsOwner };
+const __niceevalExport6 = __niceevalCanonical["makePluginAttachmentWrite"];
+export { __niceevalExport6 as makePluginAttachmentWrite };
+const __niceevalExport7 = __niceevalCanonical["pluginAttachmentCapabilityDefinition"];
+export { __niceevalExport7 as pluginAttachmentCapabilityDefinition };
+const __niceevalExport8 = __niceevalCanonical["pluginAttachmentCapabilityFamily"];
+export { __niceevalExport8 as pluginAttachmentCapabilityFamily };
+const __niceevalExport9 = __niceevalCanonical["pluginRecordAttachmentAcceptanceCapability"];
+export { __niceevalExport9 as pluginRecordAttachmentAcceptanceCapability };
+const __niceevalExport10 = __niceevalCanonical["pluginRecordAttachmentAcceptanceLinked"];
+export { __niceevalExport10 as pluginRecordAttachmentAcceptanceLinked };
+//# sourceMappingURL=capability.js.map

package/dist/plugins/record/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sources":[],"names":[],"mappings":""}