tracegrove 0.0.0-stage → 0.3.0

package/dist/core/capabilityBoundary.d.ts

@@ -0,0 +1,1452 @@
+/** Experimental, pure admission/readback helpers; no provider dispatch or lifecycle effects. */
+import { z } from 'zod';
+import { CapabilityBinding, CapabilityOperation, ScopedResource, CapabilityInput, type Ref } from '../protocol/index.ts';
+export declare class CapabilityBoundaryError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+/** Preserve the complete existing typed step, including captures/retries/auth/predicates. */
+export declare function mapExistingStep(value: unknown): CapabilityInput;
+/** Keep full frozen fixture identity while projecting the existing application-API operation. */
+export declare function mapExistingApiFixture(planValue: unknown, payloadValue: unknown, entityKey: string, action: 'seed' | 'readback' | 'cleanup'): {
+    fixtureRef: {
+        id: string;
+        revision: string;
+        digest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+    };
+    definitionScope: {
+        ownerId: string;
+        tenantId: string | null;
+        visibility: "public" | "owner_private" | "tenant_private";
+    };
+    input: {
+        kind: "resource.lifecycle";
+        version: 1;
+        action: "provision" | "reset" | "teardown";
+        resourceKind: "application" | "worker" | "database" | "broker" | "contract_fake" | "pipeline";
+        planRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+    } | {
+        kind: "http.step";
+        version: 1;
+        step: {
+            kind: "http.request";
+            method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD";
+            path: string;
+            headers: Record<string, string>;
+            body: unknown;
+            auth: {
+                kind: "none";
+            } | {
+                kind: "persona";
+            } | {
+                kind: "credential";
+                name: string;
+            };
+            expectStatus: number | null;
+            captures: {
+                name: string;
+                from: "status" | "json" | "header";
+                path: string | null;
+            }[];
+            id: string;
+            timeoutMs: number;
+            inputs: Record<string, {
+                kind: "literal";
+                value: unknown;
+            } | {
+                kind: "fixture";
+                entityKey: string;
+                outputName: string;
+            } | {
+                kind: "capture";
+                stepId: string;
+                name: string;
+            } | {
+                kind: "credential";
+                name: string;
+            } | {
+                kind: "runtime";
+                name: "execution_nonce" | "lease_namespace" | "target_origin";
+            }>;
+            retry: {
+                attempts: number;
+            };
+        } | {
+            kind: "observe";
+            readback: {
+                kind: "http";
+                method: "GET" | "HEAD";
+                path: string;
+                auth: {
+                    kind: "none";
+                } | {
+                    kind: "persona";
+                } | {
+                    kind: "credential";
+                    name: string;
+                };
+            };
+            predicate: import("../protocol/index.ts").PredicateT;
+            pollIntervalMs: number;
+            captures: {
+                name: string;
+                from: "status" | "json" | "header";
+                path: string | null;
+            }[];
+            id: string;
+            timeoutMs: number;
+            inputs: Record<string, {
+                kind: "literal";
+                value: unknown;
+            } | {
+                kind: "fixture";
+                entityKey: string;
+                outputName: string;
+            } | {
+                kind: "capture";
+                stepId: string;
+                name: string;
+            } | {
+                kind: "credential";
+                name: string;
+            } | {
+                kind: "runtime";
+                name: "execution_nonce" | "lease_namespace" | "target_origin";
+            }>;
+            retry: {
+                attempts: number;
+            };
+        };
+    } | {
+        kind: "browser.step";
+        version: 1;
+        step: {
+            kind: "ui.navigate";
+            path: string;
+            id: string;
+            timeoutMs: number;
+            inputs: Record<string, {
+                kind: "literal";
+                value: unknown;
+            } | {
+                kind: "fixture";
+                entityKey: string;
+                outputName: string;
+            } | {
+                kind: "capture";
+                stepId: string;
+                name: string;
+            } | {
+                kind: "credential";
+                name: string;
+            } | {
+                kind: "runtime";
+                name: "execution_nonce" | "lease_namespace" | "target_origin";
+            }>;
+            retry: {
+                attempts: number;
+            };
+        } | {
+            kind: "ui.action";
+            command: {
+                kind: "click";
+                target: {
+                    by: "role";
+                    role: "status" | "link" | "button" | "textbox" | "checkbox" | "heading";
+                    name: string;
+                } | {
+                    by: "label";
+                    name: string;
+                } | {
+                    by: "testId";
+                    name: string;
+                };
+            } | {
+                kind: "fill";
+                target: {
+                    by: "role";
+                    role: "status" | "link" | "button" | "textbox" | "checkbox" | "heading";
+                    name: string;
+                } | {
+                    by: "label";
+                    name: string;
+                } | {
+                    by: "testId";
+                    name: string;
+                };
+                value: string;
+            };
+            id: string;
+            timeoutMs: number;
+            inputs: Record<string, {
+                kind: "literal";
+                value: unknown;
+            } | {
+                kind: "fixture";
+                entityKey: string;
+                outputName: string;
+            } | {
+                kind: "capture";
+                stepId: string;
+                name: string;
+            } | {
+                kind: "credential";
+                name: string;
+            } | {
+                kind: "runtime";
+                name: "execution_nonce" | "lease_namespace" | "target_origin";
+            }>;
+            retry: {
+                attempts: number;
+            };
+        } | {
+            kind: "ui.observe";
+            target: {
+                by: "role";
+                role: "status" | "link" | "button" | "textbox" | "checkbox" | "heading";
+                name: string;
+            } | {
+                by: "label";
+                name: string;
+            } | {
+                by: "testId";
+                name: string;
+            };
+            predicate: import("../protocol/index.ts").PredicateT;
+            pollIntervalMs: number;
+            id: string;
+            timeoutMs: number;
+            inputs: Record<string, {
+                kind: "literal";
+                value: unknown;
+            } | {
+                kind: "fixture";
+                entityKey: string;
+                outputName: string;
+            } | {
+                kind: "capture";
+                stepId: string;
+                name: string;
+            } | {
+                kind: "credential";
+                name: string;
+            } | {
+                kind: "runtime";
+                name: "execution_nonce" | "lease_namespace" | "target_origin";
+            }>;
+            retry: {
+                attempts: number;
+            };
+        };
+    } | {
+        kind: "api.fixture";
+        version: 1;
+        recipeRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        logicalPayloadRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        entityKey: string;
+        action: "seed" | "readback" | "cleanup";
+    } | {
+        kind: "worker.job";
+        version: 1;
+        action: "submit" | "cancel" | "observe";
+        jobTypeRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        inputRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        jobId: string | null;
+        idempotencyKey: string;
+        observationMode: "non_consuming";
+    } | {
+        kind: "wiremock.contract";
+        version: 1;
+        action: "observe" | "reset" | "install";
+        contractRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        mappingRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        interactionId: string;
+        fidelity: "deterministic_fake";
+    } | {
+        kind: "database.fixture";
+        version: 1;
+        action: "seed" | "observe" | "reset";
+        migrationRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        datasetRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        queryRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+    } | {
+        kind: "pipeline.check";
+        version: 1;
+        tool: "dbt" | "great_expectations";
+        projectRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        suiteRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        selection: string[];
+    } | {
+        kind: "protocol.session";
+        version: 1;
+        transport: "sse" | "ndjson" | "websocket" | "mcp.stdio" | "mcp.streamable_http" | "app.bridge";
+        protocolVersion: string;
+        requiredFeatures: string[];
+        action: "request" | "cancel" | "observe" | "initialize";
+        requestRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        requestId: string | number | null;
+        semantics: "generic_stream" | "mcp.initialize" | "mcp.tools" | "mcp.resources" | "mcp.progress" | "mcp.cancel" | "app.tool_result" | "app.widget_interaction";
+        evidenceClass: "deterministic_fake" | "sanitized_recording" | "provider_sandbox" | "protocol_client" | "widget_bridge_fixture" | "signed_in_host";
+    };
+};
+export declare function mutates(input: CapabilityInput): boolean;
+export type ExtensionRegistration = {
+    namespace: string;
+    version: number;
+    schemaRef: Ref;
+    schema: z.ZodType;
+};
+export type BoundaryPorts = {
+    resolveOperation(operationId: string, binding: CapabilityBinding): Promise<unknown>;
+    resolveResource(ref: Ref): Promise<unknown>;
+    authorize(operation: CapabilityOperation, resource: ScopedResource, mutation: boolean): Promise<void>;
+    readArtifact(ref: Ref): Promise<Uint8Array>;
+    extensions: readonly ExtensionRegistration[];
+};
+export declare function negotiateCapabilities(requirements: unknown[], descriptorValues: unknown[]): {
+    descriptors: {
+        schemaVersion: "workflow.capability-descriptor/v1";
+        id: string;
+        version: number;
+        producer: {
+            adapterId: string;
+            adapterVersion: string;
+            tool: string;
+            toolVersion: string;
+        };
+        semantics: string[];
+        inputSchemaRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        resultSchemaRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        evidenceClasses: ("local_real" | "deterministic_fake" | "sanitized_recording" | "provider_sandbox" | "protocol_client" | "widget_bridge_fixture" | "signed_in_host")[];
+        protocols: {
+            transport: "sse" | "ndjson" | "websocket" | "mcp.stdio" | "mcp.streamable_http" | "app.bridge";
+            version: string;
+            features: string[];
+            semantics: string[];
+        }[];
+        availability: "declared" | "unsupported" | "temporarily_unavailable" | "observed_supported";
+        evidenceRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        extensions: {
+            namespace: string;
+            version: number;
+            schemaRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+        }[];
+    }[];
+    omitted: string[];
+};
+/** Host-supplied descriptor/resource ports are the trust boundary, never producer claims. */
+export declare function admitCapabilityOperation(value: unknown, currentValue: unknown, descriptorValue: unknown, ports: BoundaryPorts, now?: number): Promise<{
+    operation: {
+        schemaVersion: "workflow.capability-operation/v1";
+        binding: {
+            campaignId: string;
+            executionId: string;
+            attemptId: string;
+            generation: number;
+            requestRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            sourceSelectionRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+            caseRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            personaRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            targetRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            environmentRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            scope: {
+                ownerId: string;
+                tenantId: string | null;
+                visibility: "public" | "owner_private" | "tenant_private";
+            };
+        };
+        operationId: string;
+        logicalOperationId: string;
+        idempotencyKey: string | null;
+        retryOf: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        phase: "seed" | "observe" | "provision" | "reset" | "teardown" | "execute" | "assert";
+        capability: {
+            id: string;
+            version: number;
+            required: boolean;
+        };
+        resourceRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        deadlineAt: string;
+        fixtureRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        input: {
+            kind: "resource.lifecycle";
+            version: 1;
+            action: "provision" | "reset" | "teardown";
+            resourceKind: "application" | "worker" | "database" | "broker" | "contract_fake" | "pipeline";
+            planRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+        } | {
+            kind: "http.step";
+            version: 1;
+            step: {
+                kind: "http.request";
+                method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD";
+                path: string;
+                headers: Record<string, string>;
+                body: unknown;
+                auth: {
+                    kind: "none";
+                } | {
+                    kind: "persona";
+                } | {
+                    kind: "credential";
+                    name: string;
+                };
+                expectStatus: number | null;
+                captures: {
+                    name: string;
+                    from: "status" | "json" | "header";
+                    path: string | null;
+                }[];
+                id: string;
+                timeoutMs: number;
+                inputs: Record<string, {
+                    kind: "literal";
+                    value: unknown;
+                } | {
+                    kind: "fixture";
+                    entityKey: string;
+                    outputName: string;
+                } | {
+                    kind: "capture";
+                    stepId: string;
+                    name: string;
+                } | {
+                    kind: "credential";
+                    name: string;
+                } | {
+                    kind: "runtime";
+                    name: "execution_nonce" | "lease_namespace" | "target_origin";
+                }>;
+                retry: {
+                    attempts: number;
+                };
+            } | {
+                kind: "observe";
+                readback: {
+                    kind: "http";
+                    method: "GET" | "HEAD";
+                    path: string;
+                    auth: {
+                        kind: "none";
+                    } | {
+                        kind: "persona";
+                    } | {
+                        kind: "credential";
+                        name: string;
+                    };
+                };
+                predicate: import("../protocol/index.ts").PredicateT;
+                pollIntervalMs: number;
+                captures: {
+                    name: string;
+                    from: "status" | "json" | "header";
+                    path: string | null;
+                }[];
+                id: string;
+                timeoutMs: number;
+                inputs: Record<string, {
+                    kind: "literal";
+                    value: unknown;
+                } | {
+                    kind: "fixture";
+                    entityKey: string;
+                    outputName: string;
+                } | {
+                    kind: "capture";
+                    stepId: string;
+                    name: string;
+                } | {
+                    kind: "credential";
+                    name: string;
+                } | {
+                    kind: "runtime";
+                    name: "execution_nonce" | "lease_namespace" | "target_origin";
+                }>;
+                retry: {
+                    attempts: number;
+                };
+            };
+        } | {
+            kind: "browser.step";
+            version: 1;
+            step: {
+                kind: "ui.navigate";
+                path: string;
+                id: string;
+                timeoutMs: number;
+                inputs: Record<string, {
+                    kind: "literal";
+                    value: unknown;
+                } | {
+                    kind: "fixture";
+                    entityKey: string;
+                    outputName: string;
+                } | {
+                    kind: "capture";
+                    stepId: string;
+                    name: string;
+                } | {
+                    kind: "credential";
+                    name: string;
+                } | {
+                    kind: "runtime";
+                    name: "execution_nonce" | "lease_namespace" | "target_origin";
+                }>;
+                retry: {
+                    attempts: number;
+                };
+            } | {
+                kind: "ui.action";
+                command: {
+                    kind: "click";
+                    target: {
+                        by: "role";
+                        role: "status" | "link" | "button" | "textbox" | "checkbox" | "heading";
+                        name: string;
+                    } | {
+                        by: "label";
+                        name: string;
+                    } | {
+                        by: "testId";
+                        name: string;
+                    };
+                } | {
+                    kind: "fill";
+                    target: {
+                        by: "role";
+                        role: "status" | "link" | "button" | "textbox" | "checkbox" | "heading";
+                        name: string;
+                    } | {
+                        by: "label";
+                        name: string;
+                    } | {
+                        by: "testId";
+                        name: string;
+                    };
+                    value: string;
+                };
+                id: string;
+                timeoutMs: number;
+                inputs: Record<string, {
+                    kind: "literal";
+                    value: unknown;
+                } | {
+                    kind: "fixture";
+                    entityKey: string;
+                    outputName: string;
+                } | {
+                    kind: "capture";
+                    stepId: string;
+                    name: string;
+                } | {
+                    kind: "credential";
+                    name: string;
+                } | {
+                    kind: "runtime";
+                    name: "execution_nonce" | "lease_namespace" | "target_origin";
+                }>;
+                retry: {
+                    attempts: number;
+                };
+            } | {
+                kind: "ui.observe";
+                target: {
+                    by: "role";
+                    role: "status" | "link" | "button" | "textbox" | "checkbox" | "heading";
+                    name: string;
+                } | {
+                    by: "label";
+                    name: string;
+                } | {
+                    by: "testId";
+                    name: string;
+                };
+                predicate: import("../protocol/index.ts").PredicateT;
+                pollIntervalMs: number;
+                id: string;
+                timeoutMs: number;
+                inputs: Record<string, {
+                    kind: "literal";
+                    value: unknown;
+                } | {
+                    kind: "fixture";
+                    entityKey: string;
+                    outputName: string;
+                } | {
+                    kind: "capture";
+                    stepId: string;
+                    name: string;
+                } | {
+                    kind: "credential";
+                    name: string;
+                } | {
+                    kind: "runtime";
+                    name: "execution_nonce" | "lease_namespace" | "target_origin";
+                }>;
+                retry: {
+                    attempts: number;
+                };
+            };
+        } | {
+            kind: "api.fixture";
+            version: 1;
+            recipeRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            logicalPayloadRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            entityKey: string;
+            action: "seed" | "readback" | "cleanup";
+        } | {
+            kind: "worker.job";
+            version: 1;
+            action: "submit" | "cancel" | "observe";
+            jobTypeRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            inputRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+            jobId: string | null;
+            idempotencyKey: string;
+            observationMode: "non_consuming";
+        } | {
+            kind: "wiremock.contract";
+            version: 1;
+            action: "observe" | "reset" | "install";
+            contractRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            mappingRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            interactionId: string;
+            fidelity: "deterministic_fake";
+        } | {
+            kind: "database.fixture";
+            version: 1;
+            action: "seed" | "observe" | "reset";
+            migrationRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            datasetRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            queryRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+        } | {
+            kind: "pipeline.check";
+            version: 1;
+            tool: "dbt" | "great_expectations";
+            projectRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            suiteRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            selection: string[];
+        } | {
+            kind: "protocol.session";
+            version: 1;
+            transport: "sse" | "ndjson" | "websocket" | "mcp.stdio" | "mcp.streamable_http" | "app.bridge";
+            protocolVersion: string;
+            requiredFeatures: string[];
+            action: "request" | "cancel" | "observe" | "initialize";
+            requestRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+            requestId: string | number | null;
+            semantics: "generic_stream" | "mcp.initialize" | "mcp.tools" | "mcp.resources" | "mcp.progress" | "mcp.cancel" | "app.tool_result" | "app.widget_interaction";
+            evidenceClass: "deterministic_fake" | "sanitized_recording" | "provider_sandbox" | "protocol_client" | "widget_bridge_fixture" | "signed_in_host";
+        };
+        extensions: {
+            namespace: string;
+            version: number;
+            schemaRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            required: boolean;
+            payloadRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+        }[];
+    };
+    descriptor: {
+        schemaVersion: "workflow.capability-descriptor/v1";
+        id: string;
+        version: number;
+        producer: {
+            adapterId: string;
+            adapterVersion: string;
+            tool: string;
+            toolVersion: string;
+        };
+        semantics: string[];
+        inputSchemaRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        resultSchemaRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        evidenceClasses: ("local_real" | "deterministic_fake" | "sanitized_recording" | "provider_sandbox" | "protocol_client" | "widget_bridge_fixture" | "signed_in_host")[];
+        protocols: {
+            transport: "sse" | "ndjson" | "websocket" | "mcp.stdio" | "mcp.streamable_http" | "app.bridge";
+            version: string;
+            features: string[];
+            semantics: string[];
+        }[];
+        availability: "declared" | "unsupported" | "temporarily_unavailable" | "observed_supported";
+        evidenceRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        extensions: {
+            namespace: string;
+            version: number;
+            schemaRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+        }[];
+    };
+    omittedExtensions: string[];
+}>;
+export type VerifiedCapabilityObservation = {
+    readonly validated: true;
+};
+/** Capture a verified immutable snapshot; callers cannot mutate its backing record. */
+export declare function verifyCapabilityObservation(value: unknown, operationValue: unknown, descriptorValue: unknown, readArtifact: BoundaryPorts['readArtifact']): Promise<VerifiedCapabilityObservation>;
+/** Evidence admissibility is separate from execution status and from product assertions. */
+export declare function assessCapabilityEvidence(token: VerifiedCapabilityObservation): {
+    executionStatus: "failed" | "unsupported" | "cancelled" | "completed" | "timed_out";
+    evidenceVerdict: "inconclusive" | "admissible" | "untrusted_inference";
+    observation: {
+        schemaVersion: "workflow.capability-observation/v1";
+        binding: {
+            campaignId: string;
+            executionId: string;
+            attemptId: string;
+            generation: number;
+            requestRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            sourceSelectionRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+            caseRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            personaRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            targetRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            environmentRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            scope: {
+                ownerId: string;
+                tenantId: string | null;
+                visibility: "public" | "owner_private" | "tenant_private";
+            };
+        };
+        operationId: string;
+        eventId: string;
+        sequence: number;
+        inputDigest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+        producer: {
+            adapterId: string;
+            adapterVersion: string;
+            tool: string;
+            toolVersion: string;
+        };
+        source: "observation" | "inference";
+        evidenceClass: "local_real" | "deterministic_fake" | "sanitized_recording" | "provider_sandbox" | "protocol_client" | "widget_bridge_fixture" | "signed_in_host";
+        executionStatus: "failed" | "unsupported" | "cancelled" | "completed" | "timed_out";
+        completeness: "complete" | "partial" | "missing";
+        captureFailures: string[];
+        facts: {
+            kind: "http";
+            status: number;
+            bodyRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+            requestId: string | number | null;
+        } | {
+            kind: "browser";
+            observation: {
+                kind: "fill" | "click" | "navigate" | "read";
+                url: string;
+                status: number | null;
+                text: string | null;
+                textTruncated: boolean;
+            };
+        } | {
+            kind: "resource";
+            state: "present" | "absent";
+            resourceRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+        } | {
+            kind: "worker";
+            jobId: string;
+            state: "failed" | "queued" | "running" | "succeeded" | "cancelled";
+            resultRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+            terminalReceiptRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+        } | {
+            kind: "contract";
+            contractRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            matched: number;
+            unmatched: number;
+            fidelity: "deterministic_fake";
+        } | {
+            kind: "database";
+            queryRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            rowCount: number;
+            rowsRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            schemaRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+        } | {
+            kind: "pipeline";
+            suiteRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            passed: number;
+            failed: number;
+            skipped: number;
+            nativeReportRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+        } | {
+            kind: "protocol_message";
+            requestId: string | number | null;
+            nativeMessageRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            resultState: "unsupported" | "result" | "protocol_error" | "tool_error" | "progress" | "cancel_observed";
+            nativeErrorCode: string | number | null;
+            bridgeState: "error" | "pending" | "ready" | "tool_result_received" | "widget_interaction_observed" | null;
+        } | {
+            kind: "stream";
+            transcriptRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            logicalMessageRefs: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            }[];
+            completion: "failed" | "cancelled" | "completed" | "transport_closed" | "timed_out";
+        };
+        factsRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        evidence: {
+            ref: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            mediaType: string;
+            byteCount: number;
+            producer: {
+                adapterId: string;
+                adapterVersion: string;
+                tool: string;
+                toolVersion: string;
+            };
+            redaction: "not_required" | "applied" | "unavailable";
+            redactionPolicyRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+        }[];
+        correlations: {
+            kind: "message" | "request" | "job" | "parent" | "span_link" | "entity";
+            namespace: string;
+            id: string | number;
+            relationship: "declared" | "observed";
+            evidenceRefs: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            }[];
+        }[];
+    };
+    verificationVerdict: "not_evaluated";
+};
+/** Bounded per-attempt accumulator. Redelivery is idempotent; conflicting identities fail. */
+export declare class CapabilityEventIndex {
+    private readonly rows;
+    private readonly ids;
+    private readonly binding;
+    private readonly maxEvents;
+    constructor(binding: CapabilityBinding, maxEvents?: number);
+    append(value: unknown): 'added' | 'duplicate';
+}
+/** Verify wire ordering and byte assembly without asserting protocol/business acceptance. */
+export declare function verifyCapabilityStream(value: unknown, operationValue: unknown, readArtifact: BoundaryPorts['readArtifact']): Promise<{
+    transcript: {
+        schemaVersion: "workflow.stream-transcript/v1";
+        binding: {
+            campaignId: string;
+            executionId: string;
+            attemptId: string;
+            generation: number;
+            requestRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            sourceSelectionRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            } | null;
+            caseRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            personaRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            targetRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            environmentRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            scope: {
+                ownerId: string;
+                tenantId: string | null;
+                visibility: "public" | "owner_private" | "tenant_private";
+            };
+        };
+        operationId: string;
+        connectionId: string;
+        streamId: string;
+        requestId: string | number | null;
+        reconnectAttemptId: string;
+        transport: "sse" | "ndjson" | "websocket" | "mcp.stdio" | "mcp.streamable_http" | "app.bridge";
+        protocolVersion: string;
+        negotiatedFeatures: string[];
+        resume: {
+            priorTranscriptRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            lastEventId: string;
+            lastProviderEventId: string | null;
+            lastSequence: number;
+        } | null;
+        events: ({
+            kind: "chunk";
+            messageId: string;
+            index: number;
+            payloadRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            eventId: string;
+            sequence: number;
+            direction: "client_to_server" | "server_to_client" | "internal";
+            providerEventId: string | null;
+        } | {
+            kind: "message";
+            messageId: string;
+            chunkCount: number;
+            payloadRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            eventId: string;
+            sequence: number;
+            direction: "client_to_server" | "server_to_client" | "internal";
+            providerEventId: string | null;
+        } | {
+            kind: "progress";
+            requestId: string | number;
+            progressRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            eventId: string;
+            sequence: number;
+            direction: "client_to_server" | "server_to_client" | "internal";
+            providerEventId: string | null;
+        } | {
+            kind: "control";
+            action: "cancel_requested" | "cancel_observed" | "transport_closed" | "backpressure_paused" | "backpressure_resumed";
+            requestId: string | number | null;
+            evidenceRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            eventId: string;
+            sequence: number;
+            direction: "client_to_server" | "server_to_client" | "internal";
+            providerEventId: string | null;
+        } | {
+            kind: "terminal";
+            status: "failed" | "cancelled" | "completed" | "transport_closed" | "timed_out";
+            reasonCode: string | null;
+            eventId: string;
+            sequence: number;
+            direction: "client_to_server" | "server_to_client" | "internal";
+            providerEventId: string | null;
+        })[];
+        completeness: "complete" | "partial" | "missing";
+    };
+    evidenceVerdict: "inconclusive" | "admissible";
+    verificationVerdict: "not_evaluated";
+}>;