SharedOS API v0.1.0-alpha.0

---

SharedOS API / @aicoo/sharedos-core

@aicoo/sharedos-core

The deny-by-default SharedOS authorization and dispatch kernel.

npm install @aicoo/sharedos-core@next

The kernel filters tool discovery, re-authorizes exact invocations, binds resource ownership, and emits structured audit events. Embedded hosts must construct access contexts from authenticated identity and trusted grant state.

Tool use requires registration, namespace enablement, and capability authority. Static handlers use ToolRegistry; user-specific MCP catalogs use ContextToolProvider. A host implements ToolNamespaceSettingsStore for atomic, durable namespace updates while keeping its database and product policy.

SharedOS is currently an 0.x prerelease.

Classes

CapabilityAuthorizer

Defined in: packages/core/src/authorization.ts:73

Constructors

Constructor

new CapabilityAuthorizer(options?): CapabilityAuthorizer

Defined in: packages/core/src/authorization.ts:77

Parameters

Parameter	Type
options	CapabilityAuthorizerOptions

Returns

CapabilityAuthorizer

Methods

authorize()

authorize(context, request, options?): Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

Defined in: packages/core/src/authorization.ts:82

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
request	AuthorizationRequest
options	AuthorizeOptions

Returns

Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

canDiscover()

canDiscover(context, ceiling): Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

Defined in: packages/core/src/authorization.ts:95

Non-consuming catalog check. A narrow grant can discover a tool whose declared resource is a broader ceiling; invocation still checks the exact argument-selected resource.

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
ceiling	AuthorizationRequest

Returns

Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

---

CompositeAuditSink

Defined in: packages/core/src/audit.ts:46

Implements

• AuditSink

Constructors

Constructor

new CompositeAuditSink(sinks): CompositeAuditSink

Defined in: packages/core/src/audit.ts:49

Parameters

Parameter	Type
sinks	readonly AuditSink[]

Returns

CompositeAuditSink

Methods

record()

record(event): Promise<void>>

Defined in: packages/core/src/audit.ts:53

Parameters

Parameter	Type
event	AuditEvent

Returns

Promise<void>

Implementation of

AuditSink.record

---

DuplicateRegistrationError

Defined in: packages/core/src/errors.ts:1

Extends

• Error

Constructors

Constructor

new DuplicateRegistrationError(kind, identifier): DuplicateRegistrationError

Defined in: packages/core/src/errors.ts:4

Parameters

Parameter	Type
kind	"tool" | "resource namespace" | "tool provider" | "tool namespace settings"
identifier	string

Returns

DuplicateRegistrationError

Overrides

Error.constructor

Properties

Property	Modifier	Type	Default value	Description	Overrides	Inherited from	Defined in
<a id="property-cause"></a> cause?	public	unknown	undefined	-	-	Error.cause	node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.error.d.ts:26
<a id="property-message"></a> message	public	string	undefined	-	-	Error.message	node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts:1077
<a id="property-name"></a> name	readonly	"DuplicateRegistrationError"	"DuplicateRegistrationError"	-	Error.name	-	packages/core/src/errors.ts:2
<a id="property-stack"></a> stack?	public	string	undefined	-	-	Error.stack	node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts:1078
<a id="property-stacktracelimit"></a> stackTraceLimit	static	number	undefined	The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)). The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed. If set to a non-number value, or set to a negative number, stack traces will not capture any frames.	-	Error.stackTraceLimit	node_modules/.pnpm/@types+node@22.20.1/node_modules/@types/node/globals.d.ts:68

Methods

captureStackTrace()

static captureStackTrace(targetObject, constructorOpt?): void

Defined in: node_modules/.pnpm/@types+node@22.20.1/node_modules/@types/node/globals.d.ts:52

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack; // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters

Parameter	Type
targetObject	object
constructorOpt?	Function

Returns

void

Inherited from

Error.captureStackTrace

prepareStackTrace()

static prepareStackTrace(err, stackTraces): any

Defined in: node_modules/.pnpm/@types+node@22.20.1/node_modules/@types/node/globals.d.ts:56

Parameters

Parameter	Type
err	Error
stackTraces	CallSite[]

Returns

any

See

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from

Error.prepareStackTrace

---

InMemoryGrantUsageStore

Defined in: packages/core/src/authorization.ts:49

An atomic, process-local usage store suitable for tests and single-process hosts. Distributed hosts should inject a durable compare-and-set store.

Implements

• GrantUsageStore

Constructors

Constructor

new InMemoryGrantUsageStore(): InMemoryGrantUsageStore

Returns

InMemoryGrantUsageStore

Methods

getUsage()

getUsage(namespaceId, grantId): Promise<number>>

Defined in: packages/core/src/authorization.ts:52

Parameters

Parameter	Type
namespaceId	string
grantId	string

Returns

Promise<number>

Implementation of

GrantUsageStore.getUsage

tryConsume()

tryConsume(namespaceId, grantId, maximumUses): Promise<boolean>>

Defined in: packages/core/src/authorization.ts:56

Parameters

Parameter	Type
namespaceId	string
grantId	string
maximumUses	number

Returns

Promise<boolean>

Implementation of

GrantUsageStore.tryConsume

---

MissingRegistrationError

Defined in: packages/core/src/errors.ts:12

Extends

• Error

Constructors

Constructor

new MissingRegistrationError(kind, identifier): MissingRegistrationError

Defined in: packages/core/src/errors.ts:15

Parameters

Parameter	Type
kind	"tool" | "resource namespace" | "tool provider" | "tool namespace settings"
identifier	string

Returns

MissingRegistrationError

Overrides

Error.constructor

Properties

Property	Modifier	Type	Default value	Description	Overrides	Inherited from	Defined in
<a id="property-cause-1"></a> cause?	public	unknown	undefined	-	-	Error.cause	node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.error.d.ts:26
<a id="property-message-1"></a> message	public	string	undefined	-	-	Error.message	node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts:1077
<a id="property-name-1"></a> name	readonly	"MissingRegistrationError"	"MissingRegistrationError"	-	Error.name	-	packages/core/src/errors.ts:13
<a id="property-stack-1"></a> stack?	public	string	undefined	-	-	Error.stack	node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts:1078
<a id="property-stacktracelimit-1"></a> stackTraceLimit	static	number	undefined	The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)). The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed. If set to a non-number value, or set to a negative number, stack traces will not capture any frames.	-	Error.stackTraceLimit	node_modules/.pnpm/@types+node@22.20.1/node_modules/@types/node/globals.d.ts:68

Methods

captureStackTrace()

static captureStackTrace(targetObject, constructorOpt?): void

Defined in: node_modules/.pnpm/@types+node@22.20.1/node_modules/@types/node/globals.d.ts:52

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack; // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters

Parameter	Type
targetObject	object
constructorOpt?	Function

Returns

void

Inherited from

Error.captureStackTrace

prepareStackTrace()

static prepareStackTrace(err, stackTraces): any

Defined in: node_modules/.pnpm/@types+node@22.20.1/node_modules/@types/node/globals.d.ts:56

Parameters

Parameter	Type
err	Error
stackTraces	CallSite[]

Returns

any

See

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from

Error.prepareStackTrace

---

NoopAuditSink

Defined in: packages/core/src/audit.ts:40

Implements

• AuditSink

Constructors

Constructor

new NoopAuditSink(): NoopAuditSink

Returns

NoopAuditSink

Methods

record()

record(_event): Promise<void>>

Defined in: packages/core/src/audit.ts:41

Parameters

Parameter	Type
_event	AuditEvent

Returns

Promise<void>

Implementation of

AuditSink.record

---

RecipientScopedMessageCapabilityResolver

Defined in: packages/core/src/message-service.ts:39

Implements

• MessageCapabilityResolver

Constructors

Constructor

new RecipientScopedMessageCapabilityResolver(namespace?): RecipientScopedMessageCapabilityResolver

Defined in: packages/core/src/message-service.ts:42

Parameters

Parameter	Type	Default value
namespace	string	MESSAGING_NAMESPACE

Returns

RecipientScopedMessageCapabilityResolver

Methods

resolve()

resolve(context, envelope): AuthorizationRequest

Defined in: packages/core/src/message-service.ts:46

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
envelope	{ createdAt: string; id: string; intent: string; payload: JsonValue; provenance?: { metadata?: JsonObject; parentIds: string[]; source: string; }; purpose: string; receiver: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; replyTo?: string; sender: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; traceId: string; version: "1"; }
envelope.createdAt	string
envelope.id	string
envelope.intent	string
envelope.payload	JsonValue
envelope.provenance?	{ metadata?: JsonObject; parentIds: string[]; source: string; }
envelope.provenance.metadata?	JsonObject
envelope.provenance.parentIds	string[]
envelope.provenance.source	string
envelope.purpose	string
envelope.receiver	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.replyTo?	string
envelope.sender	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.traceId	string
envelope.version	"1"

Returns

AuthorizationRequest

Implementation of

MessageCapabilityResolver.resolve

---

ResourceProviderRegistry

Defined in: packages/core/src/resource-registry.ts:23

Constructors

Constructor

new ResourceProviderRegistry(): ResourceProviderRegistry

Returns

ResourceProviderRegistry

Methods

get()

get(namespace): ResourceProvider | undefined

Defined in: packages/core/src/resource-registry.ts:37

Parameters

Parameter	Type
namespace	string

Returns

ResourceProvider | undefined

has()

has(namespace): boolean

Defined in: packages/core/src/resource-registry.ts:41

Parameters

Parameter	Type
namespace	string

Returns

boolean

namespaces()

namespaces(): readonly string[]

Defined in: packages/core/src/resource-registry.ts:45

Returns

readonly string[]

register()

register(provider): void

Defined in: packages/core/src/resource-registry.ts:26

Parameters

Parameter	Type
provider	ResourceProvider

Returns

void

---

SharedOSKernel

Defined in: packages/core/src/kernel.ts:84

Host-neutral facade for every permission-controlled SharedOS operation. AccessContext is a trusted host-created boundary; never construct it from an unverified request body.

Constructors

Constructor

new SharedOSKernel(options?): SharedOSKernel

Defined in: packages/core/src/kernel.ts:95

Parameters

Parameter	Type
options	SharedOSKernelOptions

Returns

SharedOSKernel

Methods

admitTurn()

admitTurn(context, agent, options?): Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

Defined in: packages/core/src/kernel.ts:142

Consume permission to invoke exactly one target agent turn.

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
agent	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
options	KernelOperationOptions

Returns

Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

authorize()

authorize(context, request, options?): Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

Defined in: packages/core/src/kernel.ts:130

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
request	AuthorizationRequest
options	KernelOperationOptions

Returns

Promise<{ allowed: boolean; matchedGrantId?: string; metadata?: JsonObject; reasonCode: string; }>

invokeResource()

invokeResource(context, request, options?): Promise<{ completedAt: string; metadata?: JsonObject; operationId: string; output: JsonValue; status: "succeeded"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "denied"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "failed"; }>

Defined in: packages/core/src/kernel.ts:452

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
request	ResourceInvocationRequest
options	KernelOperationOptions

Returns

Promise<{ completedAt: string; metadata?: JsonObject; operationId: string; output: JsonValue; status: "succeeded"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "denied"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "failed"; }>

invokeTool()

invokeTool(context, call, options?): Promise<{ callId: string; completedAt: string; metadata?: JsonObject; output: JsonValue; status: "succeeded"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "denied"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "failed"; tool: string; }>

Defined in: packages/core/src/kernel.ts:270

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
call	{ arguments: JsonObject; id: string; requestedAt: string; tool: string; traceId: string; }
call.arguments	JsonObject
call.id	string
call.requestedAt	string
call.tool	string
call.traceId	string
options	KernelOperationOptions

Returns

Promise<{ callId: string; completedAt: string; metadata?: JsonObject; output: JsonValue; status: "succeeded"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "denied"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "failed"; tool: string; }>

listToolNamespaces()

listToolNamespaces(context, options?): Promise<{ namespaces: object[]; summary: { disabled: number; enabled: number; total: number; }; }>

Defined in: packages/core/src/kernel.ts:199

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
options	KernelOperationOptions

Returns

Promise<{ namespaces: object[]; summary: { disabled: number; enabled: number; total: number; }; }>

listTools()

listTools(context, options?): Promise<readonly object[]>

Defined in: packages/core/src/kernel.ts:164

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
options	KernelOperationOptions

Returns

Promise<readonly object[]>

registerResourceProvider()

registerResourceProvider(provider): void

Defined in: packages/core/src/kernel.ts:111

Parameters

Parameter	Type
provider	ResourceProvider

Returns

void

registerTool()

registerTool(handler): void

Defined in: packages/core/src/kernel.ts:115

Parameters

Parameter	Type
handler	ToolHandler

Returns

void

registerToolProvider()

registerToolProvider(provider): void

Defined in: packages/core/src/kernel.ts:119

Parameters

Parameter	Type
provider	ContextToolProvider

Returns

void

sendMessage()

sendMessage(context, envelope, options?): Promise<{ messageId: string; metadata?: JsonObject; status: "accepted"; timestamp: string; } | { messageId: string; metadata?: JsonObject; status: "delivered"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "denied"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "failed"; timestamp: string; }>

Defined in: packages/core/src/kernel.ts:562

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
envelope	{ createdAt: string; id: string; intent: string; payload: JsonValue; provenance?: { metadata?: JsonObject; parentIds: string[]; source: string; }; purpose: string; receiver: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; replyTo?: string; sender: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; traceId: string; version: "1"; }
envelope.createdAt	string
envelope.id	string
envelope.intent	string
envelope.payload	JsonValue
envelope.provenance?	{ metadata?: JsonObject; parentIds: string[]; source: string; }
envelope.provenance.metadata?	JsonObject
envelope.provenance.parentIds	string[]
envelope.provenance.source	string
envelope.purpose	string
envelope.receiver	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.replyTo?	string
envelope.sender	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.traceId	string
envelope.version	"1"
options	KernelOperationOptions

Returns

Promise<{ messageId: string; metadata?: JsonObject; status: "accepted"; timestamp: string; } | { messageId: string; metadata?: JsonObject; status: "delivered"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "denied"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "failed"; timestamp: string; }>

updateToolNamespaces()

updateToolNamespaces(context, update, options?): Promise<{ namespaces: object[]; summary: { disabled: number; enabled: number; total: number; }; }>

Defined in: packages/core/src/kernel.ts:222

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
update	{ disable?: string[]; enable?: string[]; }
update.disable?	string[]
update.enable?	string[]
options	KernelOperationOptions

Returns

Promise<{ namespaces: object[]; summary: { disabled: number; enabled: number; total: number; }; }>

---

ToolRegistry

Defined in: packages/core/src/tool-registry.ts:34

Constructors

Constructor

new ToolRegistry(): ToolRegistry

Returns

ToolRegistry

Methods

definitions()

definitions(): readonly object[]

Defined in: packages/core/src/tool-registry.ts:78

Returns

readonly object[]

get()

get(name): ToolHandler | undefined

Defined in: packages/core/src/tool-registry.ts:70

Parameters

Parameter	Type
name	string

Returns

ToolHandler | undefined

handlers()

handlers(): readonly ToolHandler[]

Defined in: packages/core/src/tool-registry.ts:84

Returns

readonly ToolHandler[]

has()

has(name): boolean

Defined in: packages/core/src/tool-registry.ts:74

Parameters

Parameter	Type
name	string

Returns

boolean

namespaceCatalog()

namespaceCatalog(enabledToolNamespaces): object

Defined in: packages/core/src/tool-registry.ts:90

Parameters

Parameter	Type
enabledToolNamespaces	readonly string[]

Returns

object

namespaces

namespaces: object[]

summary

summary: object

summary.disabled

disabled: number

summary.enabled

enabled: number

summary.total

total: number

register()

register(handler): void

Defined in: packages/core/src/tool-registry.ts:37

Parameters

Parameter	Type
handler	ToolHandler

Returns

void

Interfaces

AuditEvent

Defined in: packages/core/src/audit.ts:14

Properties

Property	Modifier	Type	Defined in
<a id="property-action"></a> action?	readonly	string	packages/core/src/audit.ts:26
<a id="property-actor"></a> actor	readonly	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	packages/core/src/audit.ts:21
<a id="property-at"></a> at	readonly	string	packages/core/src/audit.ts:18
<a id="property-authority"></a> authority	readonly	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	packages/core/src/audit.ts:22
<a id="property-grantid"></a> grantId?	readonly	string	packages/core/src/audit.ts:27
<a id="property-messageid"></a> messageId?	readonly	string	packages/core/src/audit.ts:30
<a id="property-metadata"></a> metadata?	readonly	JsonObject	packages/core/src/audit.ts:33
<a id="property-namespaceid"></a> namespaceId	readonly	string	packages/core/src/audit.ts:20
<a id="property-operationid"></a> operationId?	readonly	string	packages/core/src/audit.ts:28
<a id="property-outcome"></a> outcome	readonly	AuditOutcome	packages/core/src/audit.ts:17
<a id="property-owner"></a> owner	readonly	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	packages/core/src/audit.ts:23
<a id="property-purpose"></a> purpose	readonly	string	packages/core/src/audit.ts:24
<a id="property-reason"></a> reason?	readonly	string	packages/core/src/audit.ts:32
<a id="property-receiver"></a> receiver?	readonly	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	packages/core/src/audit.ts:31
<a id="property-resource"></a> resource?	readonly	object	packages/core/src/audit.ts:25
resource.namespace	public	string	packages/contracts/dist/capability.d.ts:54
resource.owner?	public	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	packages/contracts/dist/capability.d.ts:55
resource.path	public	string[]	packages/contracts/dist/capability.d.ts:53
<a id="property-tool"></a> tool?	readonly	string	packages/core/src/audit.ts:29
<a id="property-traceid"></a> traceId	readonly	string	packages/core/src/audit.ts:19
<a id="property-type"></a> type	readonly	AuditEventType	packages/core/src/audit.ts:16
<a id="property-version"></a> version	readonly	"1"	packages/core/src/audit.ts:15

---

AuditSink

Defined in: packages/core/src/audit.ts:36

Methods

record()

record(event): Promise<void>>

Defined in: packages/core/src/audit.ts:37

Parameters

Parameter	Type
event	AuditEvent

Returns

Promise<void>

---

AuthorizationRequest

Defined in: packages/core/src/authorization.ts:10

Properties

Property	Modifier	Type	Defined in
<a id="property-action-1"></a> action	readonly	string	packages/core/src/authorization.ts:12
<a id="property-resource-1"></a> resource	readonly	object	packages/core/src/authorization.ts:11
resource.namespace	public	string	packages/contracts/dist/capability.d.ts:54
resource.owner?	public	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	packages/contracts/dist/capability.d.ts:55
resource.path	public	string[]	packages/contracts/dist/capability.d.ts:53

---

AuthorizeOptions

Defined in: packages/core/src/authorization.ts:32

Properties

Property	Modifier	Type	Description	Defined in
<a id="property-consume"></a> consume?	readonly	boolean	Consumption is reserved for execution. Discovery calls must leave this false so merely viewing a catalog cannot spend a bounded grant.	packages/core/src/authorization.ts:37

---

CapabilityAuthorizerOptions

Defined in: packages/core/src/authorization.ts:40

Properties

Property	Modifier	Type	Defined in
<a id="property-grantverifier"></a> grantVerifier?	readonly	CapabilityGrantVerifier	packages/core/src/authorization.ts:42
<a id="property-usagestore"></a> usageStore?	readonly	GrantUsageStore	packages/core/src/authorization.ts:41

---

CapabilityGrantVerifier

Defined in: packages/core/src/authorization.ts:28

Methods

verify()

verify(grant, context): Promise<boolean>>

Defined in: packages/core/src/authorization.ts:29

Parameters

Parameter	Type
grant	{ capabilities: object[]; constraints: { delegationDepth?: number; expiresAt?: string; maxUses?: number; notBefore?: string; purposes?: string[]; }; id: string; issuedAt: string; issuer: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; metadata?: JsonObject; namespaceId: string; revokedAt?: string; subject: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; }
grant.capabilities	object[]
grant.constraints	{ delegationDepth?: number; expiresAt?: string; maxUses?: number; notBefore?: string; purposes?: string[]; }
grant.constraints.delegationDepth?	number
grant.constraints.expiresAt?	string
grant.constraints.maxUses?	number
grant.constraints.notBefore?	string
grant.constraints.purposes?	string[]
grant.id	string
grant.issuedAt	string
grant.issuer	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
grant.metadata?	JsonObject
grant.namespaceId	string
grant.revokedAt?	string
grant.subject	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string

Returns

Promise<boolean>

---

ContextToolProvider

Defined in: packages/core/src/tool-registry.ts:29

Supplies tools for exactly one trusted access context.

Hosts use this port for user-specific MCP servers and other dynamic catalogs instead of mutating one global registry shared by concurrent users.

Properties

Property	Modifier	Type	Defined in
<a id="property-id"></a> id	readonly	string	packages/core/src/tool-registry.ts:30

Methods

listTools()

listTools(context, signal): Promise<readonly ToolHandler[]>

Defined in: packages/core/src/tool-registry.ts:31

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
signal	AbortSignal

Returns

Promise<readonly ToolHandler[]>

---

GrantUsageStore

Defined in: packages/core/src/authorization.ts:23

Methods

getUsage()

getUsage(namespaceId, grantId): Promise<number>>

Defined in: packages/core/src/authorization.ts:24

Parameters

Parameter	Type
namespaceId	string
grantId	string

Returns

Promise<number>

tryConsume()

tryConsume(namespaceId, grantId, maximumUses): Promise<boolean>>

Defined in: packages/core/src/authorization.ts:25

Parameters

Parameter	Type
namespaceId	string
grantId	string
maximumUses	number

Returns

Promise<boolean>

---

KernelOperationOptions

Defined in: packages/core/src/kernel.ts:60

Properties

Property	Modifier	Type	Defined in
<a id="property-signal"></a> signal?	readonly	AbortSignal	packages/core/src/kernel.ts:61

---

MessageCapabilityResolver

Defined in: packages/core/src/message-service.ts:35

Methods

resolve()

resolve(context, envelope): AuthorizationRequest

Defined in: packages/core/src/message-service.ts:36

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
envelope	{ createdAt: string; id: string; intent: string; payload: JsonValue; provenance?: { metadata?: JsonObject; parentIds: string[]; source: string; }; purpose: string; receiver: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; replyTo?: string; sender: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; traceId: string; version: "1"; }
envelope.createdAt	string
envelope.id	string
envelope.intent	string
envelope.payload	JsonValue
envelope.provenance?	{ metadata?: JsonObject; parentIds: string[]; source: string; }
envelope.provenance.metadata?	JsonObject
envelope.provenance.parentIds	string[]
envelope.provenance.source	string
envelope.purpose	string
envelope.receiver	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.replyTo?	string
envelope.sender	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.traceId	string
envelope.version	"1"

Returns

AuthorizationRequest

---

MessageTransport

Defined in: packages/core/src/message-service.ts:27

Methods

deliver()

deliver(context, envelope, signal): Promise<{ messageId: string; metadata?: JsonObject; status: "accepted"; timestamp: string; } | { messageId: string; metadata?: JsonObject; status: "delivered"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "denied"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "failed"; timestamp: string; }>

Defined in: packages/core/src/message-service.ts:28

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
envelope	{ createdAt: string; id: string; intent: string; payload: JsonValue; provenance?: { metadata?: JsonObject; parentIds: string[]; source: string; }; purpose: string; receiver: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; replyTo?: string; sender: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; traceId: string; version: "1"; }
envelope.createdAt	string
envelope.id	string
envelope.intent	string
envelope.payload	JsonValue
envelope.provenance?	{ metadata?: JsonObject; parentIds: string[]; source: string; }
envelope.provenance.metadata?	JsonObject
envelope.provenance.parentIds	string[]
envelope.provenance.source	string
envelope.purpose	string
envelope.receiver	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.replyTo?	string
envelope.sender	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
envelope.traceId	string
envelope.version	"1"
signal	AbortSignal

Returns

Promise<{ messageId: string; metadata?: JsonObject; status: "accepted"; timestamp: string; } | { messageId: string; metadata?: JsonObject; status: "delivered"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "denied"; timestamp: string; } | { error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; messageId: string; metadata?: JsonObject; status: "failed"; timestamp: string; }>

---

ResourceInvocationRequest

Defined in: packages/core/src/resource-registry.ts:10

Properties

Property	Modifier	Type	Defined in
<a id="property-action-2"></a> action	readonly	string	packages/core/src/resource-registry.ts:13
<a id="property-input"></a> input?	readonly	JsonValue	packages/core/src/resource-registry.ts:14
<a id="property-metadata-1"></a> metadata?	readonly	JsonObject	packages/core/src/resource-registry.ts:15
<a id="property-operationid-1"></a> operationId	readonly	string	packages/core/src/resource-registry.ts:11
<a id="property-resource-2"></a> resource	readonly	object	packages/core/src/resource-registry.ts:12
resource.namespace	public	string	packages/contracts/dist/capability.d.ts:54
resource.owner?	public	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	packages/contracts/dist/capability.d.ts:55
resource.path	public	string[]	packages/contracts/dist/capability.d.ts:53

---

ResourceProvider

Defined in: packages/core/src/resource-registry.ts:18

Properties

Property	Modifier	Type	Defined in
<a id="property-namespace"></a> namespace	readonly	string	packages/core/src/resource-registry.ts:19

Methods

invoke()

invoke(operation, signal): Promise<{ completedAt: string; metadata?: JsonObject; operationId: string; output: JsonValue; status: "succeeded"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "denied"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "failed"; }>

Defined in: packages/core/src/resource-registry.ts:20

Parameters

Parameter	Type
operation	{ action: string; context: { actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }; input?: JsonValue; metadata?: JsonObject; operationId: string; resource: { namespace: string; owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; path: string[]; }; }
operation.action	string
operation.context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
operation.context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
operation.context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
operation.context.enabledToolNamespaces	string[]
operation.context.grants	object[]
operation.context.namespaceId	string
operation.context.now	string
operation.context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
operation.context.purpose	string
operation.context.traceId	string
operation.input?	JsonValue
operation.metadata?	JsonObject
operation.operationId	string
operation.resource	{ namespace: string; owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; path: string[]; }
operation.resource.namespace	string
operation.resource.owner?	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
operation.resource.path	string[]
signal	AbortSignal

Returns

Promise<{ completedAt: string; metadata?: JsonObject; operationId: string; output: JsonValue; status: "succeeded"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "denied"; } | { completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; operationId: string; status: "failed"; }>

---

SharedOSKernelOptions

Defined in: packages/core/src/kernel.ts:47

Properties

Property	Modifier	Type	Description	Defined in
<a id="property-audit"></a> audit?	readonly	AuditSink	-	packages/core/src/kernel.ts:55
<a id="property-authorizer"></a> authorizer?	readonly	CapabilityAuthorizer	-	packages/core/src/kernel.ts:48
<a id="property-messagecapabilityresolver"></a> messageCapabilityResolver?	readonly	MessageCapabilityResolver	-	packages/core/src/kernel.ts:54
<a id="property-messagetransport"></a> messageTransport?	readonly	MessageTransport	-	packages/core/src/kernel.ts:53
<a id="property-onauditerror"></a> onAuditError?	readonly	(error, event) => void | Promise<void>	Notification for audit failures that occur after a side effect.	packages/core/src/kernel.ts:57
<a id="property-resources"></a> resources?	readonly	ResourceProviderRegistry	-	packages/core/src/kernel.ts:49
<a id="property-toolnamespacesettings"></a> toolNamespaceSettings?	readonly	ToolNamespaceSettingsStore	-	packages/core/src/kernel.ts:52
<a id="property-toolproviders"></a> toolProviders?	readonly	readonly ContextToolProvider[]	-	packages/core/src/kernel.ts:51
<a id="property-tools"></a> tools?	readonly	ToolRegistry	-	packages/core/src/kernel.ts:50

---

ToolHandler

Defined in: packages/core/src/tool-registry.ts:14

Properties

Property	Modifier	Type	Description	Defined in
<a id="property-definition"></a> definition	readonly	object	-	packages/core/src/tool-registry.ts:15
definition.annotations?	public	object	-	packages/contracts/dist/tool.d.ts:287
definition.annotations.destructive?	public	boolean	-	packages/contracts/dist/tool.d.ts:289
definition.annotations.idempotent?	public	boolean	-	packages/contracts/dist/tool.d.ts:290
definition.annotations.readOnly?	public	boolean	-	packages/contracts/dist/tool.d.ts:288
definition.description	public	string	-	packages/contracts/dist/tool.d.ts:261
definition.inputSchema	public	JsonObject	-	packages/contracts/dist/tool.d.ts:264
definition.metadata?	public	JsonObject	-	packages/contracts/dist/tool.d.ts:285
definition.name	public	string	-	packages/contracts/dist/tool.d.ts:260
definition.namespace	public	string	-	packages/contracts/dist/tool.d.ts:259
definition.outputSchema?	public	JsonObject	-	packages/contracts/dist/tool.d.ts:286
definition.readWrite	public	"read" | "write"	-	packages/contracts/dist/tool.d.ts:263
definition.requiredCapability	public	object	-	packages/contracts/dist/tool.d.ts:265
definition.requiredCapability.action	public	string	-	packages/contracts/dist/tool.d.ts:283
definition.requiredCapability.resource	public	object	-	packages/contracts/dist/tool.d.ts:266
definition.requiredCapability.resource.namespace	public	string	-	packages/contracts/dist/tool.d.ts:268
definition.requiredCapability.resource.owner?	public	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }	-	packages/contracts/dist/tool.d.ts:269
definition.requiredCapability.resource.path	public	string[]	-	packages/contracts/dist/tool.d.ts:267
definition.source	public	string	-	packages/contracts/dist/tool.d.ts:262
<a id="property-parsearguments"></a> parseArguments	readonly	(arguments_) => unknown	Parse and normalize untrusted arguments before authorization or execution.	packages/core/src/tool-registry.ts:17
<a id="property-resolverequirement"></a> resolveRequirement?	readonly	(context, call) => AuthorizationRequest	Resolve argument-selected resources immediately before execution.	packages/core/src/tool-registry.ts:19

Methods

invoke()

invoke(context, call, signal): Promise<{ callId: string; completedAt: string; metadata?: JsonObject; output: JsonValue; status: "succeeded"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "denied"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "failed"; tool: string; }>

Defined in: packages/core/src/tool-registry.ts:20

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
call	{ arguments: JsonObject; id: string; requestedAt: string; tool: string; traceId: string; }
call.arguments	JsonObject
call.id	string
call.requestedAt	string
call.tool	string
call.traceId	string
signal	AbortSignal

Returns

Promise<{ callId: string; completedAt: string; metadata?: JsonObject; output: JsonValue; status: "succeeded"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "denied"; tool: string; } | { callId: string; completedAt: string; error: { code: string; details?: JsonObject; message: string; retryable?: boolean; }; metadata?: JsonObject; status: "failed"; tool: string; }>

---

ToolNamespaceSettingsStore

Defined in: packages/core/src/tool-namespace-control.ts:11

Host-owned persistence and product-policy boundary for namespace settings.

Implementations must apply a patch atomically against fresh state and return the authoritative effective selection. They may narrow the result according to organization policy, but must never widen it beyond trusted host policy.

Methods

applyUpdate()

applyUpdate(context, update, signal): Promise<readonly string[]>

Defined in: packages/core/src/tool-namespace-control.ts:12

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
update	{ disable?: string[]; enable?: string[]; }
update.disable?	string[]
update.enable?	string[]
signal	AbortSignal

Returns

Promise<readonly string[]>

Type Aliases

AuditEventType

AuditEventType = "authorization.checked" | "resource.invoked" | "tool.catalog.listed" | "tool.namespace.catalog.listed" | "tool.namespace.selection.updated" | "tool.invoked" | "message.sent"

Defined in: packages/core/src/audit.ts:3

---

AuditOutcome

AuditOutcome = "allowed" | "denied" | "succeeded" | "failed"

Defined in: packages/core/src/audit.ts:12

---

AuthorizationReasonCode

AuthorizationReasonCode = "allowed" | "invalid_context" | "invalid_request" | "no_matching_grant" | "grant_exhausted" | "usage_store_unavailable"

Defined in: packages/core/src/authorization.ts:15

Variables

AGENT_INVOKE_ACTION

const AGENT_INVOKE_ACTION: "invoke" = "invoke"

Defined in: packages/core/src/kernel.ts:65

---

EXECUTION_NAMESPACE

const EXECUTION_NAMESPACE: "sharedos.execution" = "sharedos.execution"

Defined in: packages/core/src/kernel.ts:64

---

MESSAGE_SEND_ACTION

const MESSAGE_SEND_ACTION: "send" = "send"

Defined in: packages/core/src/message-service.ts:13

---

MESSAGING_NAMESPACE

const MESSAGING_NAMESPACE: "sharedos.messaging" = "sharedos.messaging"

Defined in: packages/core/src/message-service.ts:12

Functions

addressesEqual()

addressesEqual(left, right): boolean

Defined in: packages/core/src/authorization.ts:204

Parameters

Parameter	Type
left	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
right	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

Returns

boolean

---

addressPath()

addressPath(address): ["human" | "agent" | "group" | "service", string]

Defined in: packages/core/src/message-service.ts:58

Stable, segment-safe grant path for recipient-scoped messaging.

Parameters

Parameter	Type
address	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

Returns

["human" | "agent" | "group" | "service", string]

---

agentExecutionCapability()

agentExecutionCapability(agent, owner): object

Defined in: packages/core/src/kernel.ts:67

Parameters

Parameter	Type
agent	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

Returns

object

actions

actions: string[]

resource

resource: object

resource.namespace

namespace: string

resource.owner?

optional owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

resource.path

path: string[]

scope

scope: "exact" | "descendants"

---

applyToolNamespaceUpdate()

applyToolNamespaceUpdate(current, update): string[]

Defined in: packages/core/src/tool-namespace-control.ts:20

Apply the standard idempotent patch semantics used by host stores.

Parameters

Parameter	Type
current	readonly string[]
update	{ disable?: string[]; enable?: string[]; }
update.disable?	string[]
update.enable?	string[]

Returns

string[]

---

auditEvent()

auditEvent(context, event): AuditEvent

Defined in: packages/core/src/audit.ts:60

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
event	Omit<AuditEvent, "version" | "at" | "traceId" | "namespaceId" | "actor" | "authority" | "owner" | "purpose">

Returns

AuditEvent

---

capabilityIntersectsCeiling()

capabilityIntersectsCeiling(capability, ceiling, context): boolean

Defined in: packages/core/src/authorization.ts:236

Parameters

Parameter	Type
capability	{ actions: string[]; resource: { namespace: string; owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; path: string[]; }; scope: "exact" | "descendants"; }
capability.actions	string[]
capability.resource	{ namespace: string; owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; path: string[]; }
capability.resource.namespace	string
capability.resource.owner?	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
capability.resource.path	string[]
capability.scope	"exact" | "descendants"
ceiling	AuthorizationRequest
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string

Returns

boolean

---

capabilityMatches()

capabilityMatches(capability, request, context): boolean

Defined in: packages/core/src/authorization.ts:208

Parameters

Parameter	Type
capability	{ actions: string[]; resource: { namespace: string; owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; path: string[]; }; scope: "exact" | "descendants"; }
capability.actions	string[]
capability.resource	{ namespace: string; owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; path: string[]; }
capability.resource.namespace	string
capability.resource.owner?	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
capability.resource.path	string[]
capability.scope	"exact" | "descendants"
request	AuthorizationRequest
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string

Returns

boolean

---

messageSendCapability()

messageSendCapability(receiver, owner): object

Defined in: packages/core/src/message-service.ts:15

Parameters

Parameter	Type
receiver	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

Returns

object

actions

actions: string[]

resource

resource: object

resource.namespace

namespace: string

resource.owner?

optional owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

resource.path

path: string[]

scope

scope: "exact" | "descendants"

---

toResourceOperation()

toResourceOperation(context, request): object

Defined in: packages/core/src/resource-registry.ts:50

Parameters

Parameter	Type
context	{ actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; enabledToolNamespaces: string[]; grants: object[]; namespaceId: string; now: string; owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }; purpose: string; traceId: string; }
context.actor	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.authority	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.enabledToolNamespaces	string[]
context.grants	object[]
context.namespaceId	string
context.now	string
context.owner	{ kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }
context.purpose	string
context.traceId	string
request	ResourceInvocationRequest

Returns

object

action

action: string

context

context: object

context.actor

actor: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

context.authority

authority: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

context.enabledToolNamespaces

enabledToolNamespaces: string[]

context.grants

grants: object[]

context.namespaceId

namespaceId: string

context.now

now: string

context.owner

owner: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

context.purpose

purpose: string

context.traceId

traceId: string

input?

optional input?: JsonValue

metadata?

optional metadata?: JsonObject

operationId

operationId: string

resource

resource: object

resource.namespace

namespace: string

resource.owner?

optional owner?: { kind: "human"; userId: string; } | { agentId: string; kind: "agent"; } | { conversationId: string; kind: "group"; } | { kind: "service"; serviceId: string; }

resource.path

path: string[]