# @forgegraph/capability-manifest

> Pinned adapter capability manifests and their validator.

Latest version **0.4.0** (published 2026-09-24) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @forgegraph/capability-manifest
pnpm add @forgegraph/capability-manifest
yarn add @forgegraph/capability-manifest
bun add @forgegraph/capability-manifest
```

## Health

**Score 65/100 (B)** — status: active.

Positive: esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; no types; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.4.0 |
| Published | 2026-09-24 |
| First published | 2026-09-21 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | none |
| Module format | ESM |
| Node | >=24 |
| Dependencies | 0 |
| Unpacked size | 59.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 0 |
| Author | ForgeGraph contributors |
| Maintainers | gmackie |

## Links

- npm: https://www.npmjs.com/package/@forgegraph/capability-manifest
- Repository: https://github.com/gmackie/forgec
- Homepage: https://github.com/gmackie/forgec#readme
- Issues: https://github.com/gmackie/forgec/issues
- npm.io page: https://npm.io/package/@forgegraph/capability-manifest

## Recent versions

- 0.4.0 (latest) — 2026-09-24
- 0.3.0 — 2026-09-21

## README

# @forgegraph/capability-manifest

Pinned adapter capability manifests and their validator. A manifest states what a storage or object
adapter actually guarantees (atomic batch shape, ordering, conditional writes, limits); the compiler
validates it by digest and shape and **never executes it**.

**Stability: stable-candidate.**

```bash
npm install @forgegraph/capability-manifest
```

```ts
import { loadManifest, validateManifest } from "@forgegraph/capability-manifest";

const manifest = loadManifest("d1");          // bundled: memory, d1, dynamodb
validateManifest(manifest);                    // throws on an unknown or malformed capability
```

Pin a manifest from a package with `[extensions.<target>] manifest = "..."` and `sha256 = "..."` in
`forge.toml`; a digest mismatch fails the build (E-EXT-001/002).

Apache-2.0

Execution manifests (`execution-manifest/1`) describe simple runner atoms such as
`tool.forgec`, `browser.playwright` and `os.linux`. They are separate from adapter
support/evidence claims: matching an atom grants no data or operation authority.

`pinExecutionManifest` validates and hashes a manifest. `deriveExecutionRequirements`
walks a function's transitive `uses`, selected content-pinned implementation/provider
bindings, and profile providers. Missing bindings or pins fail closed. Function,
resource, and workflow identities must be unique across the supplied artifact;
ambiguous identities are rejected before dependency traversal. Profile bindings
use only own properties, never inherited JavaScript properties. Results carry
sorted atoms, atom-to-source explanations, artifact/profile digests and a provenance
digest. The artifact digest is `executionDigest` over the exact supplied compiled IR;
it is an integrity check, not a trust signature. Requirements describe selected
bindings, not a proof that arbitrary handwritten code has no undeclared dependencies.

Explicit extra atoms require a reason. `runnerEligibility` uses all-of matching only.
`executionCompatibility` reports changed requirements and provenance; callers must
persist the returned snapshot with a task and never re-derive already queued work.

`deriveWorkflowStepRequirements` selects a named function call or mapped call in a
compiled workflow, including calls nested in choice/parallel branches. It derives
only that activity's transitive requirements and binds the workflow ID, step ID,
version and graph hash into the snapshot and explanations. Duplicate step IDs,
unknown steps, non-activity steps and artifact/pin tampering fail closed.

The caller selects the activity being dispatched; this helper does not execute
branch predicates or schedule work. `WorkQueue.enqueueWorkflowStep` materializes
and persists that snapshot, verifies the target against the queue's execution
function and keeps existing tasks unchanged across workflow revisions. Mapped
items receive separate caller-supplied task identities and share the pinned
activity contract.

Automatic workflow-to-runner dispatch, input-dependent manifest requirements and
compiler/CLI integration remain outstanding. Tests cover Bob-style agent work,
Forge verification work, compiled map enqueue, restart, capability matching,
ordering, tampering, missing pins and binding changes.

---
_Source: https://npm.io/package/@forgegraph/capability-manifest · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._