refactor(capabilities/pdp): add pdp capabilities

.gitignore

@@ -0,0 +1 @@
+.idea

capabilities/access/gen/main.go

@@ -30,6 +30,7 @@ func main() {
 		access.ClaimOK{},
 		access.ConfirmArguments{},
 		access.DelegateArguments{},
+		access.GrantArguments{},
 	}
 	const (
 		cborFile = "../cbor_gen.go"

capabilities/access/grant.go

@@ -0,0 +1,35 @@
+//go:build !codegen
+
+package access
+
+import (
+	"github.com/fil-forge/libforge/capabilities"
+	"github.com/fil-forge/ucantone/errors"
+)
+
+const GrantCommand = "/access/grant"
+
+// GrantOK mirrors ClaimOK / ConfirmOK: a successful grant resolves into a
+// bundle of delegation CIDs. The actual delegation envelopes ride in the
+// receipt response container as metadata.
+type GrantOK = ClaimOK
+
+// Grant can be invoked by an agent to request that a set of capabilities be
+// granted directly. Unlike Request -> Confirm, Grant is one-shot: the
+// executor decides immediately whether to issue the delegation.
+var Grant = capabilities.MustNew[*GrantArguments](GrantCommand)
+
+const (
+	UnknownAbilityErrorName    = "UnknownAbility"
+	MissingCapabilityErrorName = "MissingCapability"
+	UnknownCauseErrorName      = "UnknownCause"
+	MissingCauseErrorName      = "MissingCause"
+	InvalidCauseErrorName      = "InvalidCause"
+	UnauthorizedCauseErrorName = "UnauthorizedCause"
+)
+
+var (
+	ErrMissingCapability = errors.New(MissingCapabilityErrorName, "grant requires one or more capabilities")
+	ErrMissingCause      = errors.New(MissingCauseErrorName, "grant requires a supporting contextual invocation")
+	ErrUnknownCause      = errors.New(UnknownCauseErrorName, "unknown cause invocation")
+)