@daftarai/capabilities

Capability vocabulary, adjudication primitives, and audit hooks for the Daftarai plugin SDK v3.

This package defines the closed-set capability vocabulary every Daftarai plugin must declare from. It is the security floor — adding a new capability is an intentional process that touches the adjudicator, the manifest schema, and (for OAuth providers) the v2 OAuth config.

Install

pnpm add @daftarai/capabilities
# or npm install @daftarai/capabilities
# or yarn add @daftarai/capabilities

Usually you don't install this directly — @daftarai/sdk depends on it and re-exports the relevant types. You may install it directly when authoring a plugin manifest that declares capabilities.

What's exported

Plugin-developer surface (the part you'll use):

import {
  ALL_CAPABILITIES,
  SIMPLE_CAPABILITIES,
  OAUTH_PROVIDERS,
  CULTURAL_CATEGORIES,
  capabilityRefSchema,
  type CapabilityRef,
  type CulturalCategory,
  type OauthProvider,
} from "@daftarai/capabilities";

• ALL_CAPABILITIES — the full closed-set array (simple + oauth + methodology)
• SIMPLE_CAPABILITIES — the 12 verb:resource capabilities (e.g. read:ledger.balance, write:notes)
• OAUTH_PROVIDERS — supported OAuth providers (google, github, notion)
• CULTURAL_CATEGORIES — methodology categories (zakat, hijri, prayer-times, fasting, halal)
• capabilityRefSchema — zod schema for validating a capability declaration in a manifest
• CapabilityRef — the discriminated union type of every valid capability string

Host-runtime surface (not for plugins — for the Daftarai server runtime itself):

CapabilityAdjudicatorImpl, CachingGrantStore, InMemoryProducerRegistry, InProcessProducerInvoker, BatchingAuditWriter, and related types. Plugin developers should not import these — they are exported for the Daftarai server runtime and may change without semver-major bumps.

Versioning

This package is published in lockstep with @daftarai/sdk. The major version corresponds to the Plugin SDK major version (3.x.x = Plugin SDK v3).

Adding a capability is a minor version bump. Removing or renaming a capability is major.

License

MIT — see LICENSE.