Returns readonly (
| "relay:read"
| "relay:write"
| "cache:read"
| "cache:write"
| "hotkey:forward"
| "state:read"
| "state:write"
| "identity:read"
| "keys:bind"
| "keys:forward"
| "media:control"
| "notify:send"
| "notify:channel"
| "theme:read"
| "config:read"
| "resource:fetch"
| "cvm:call"
| "outbox:read"
| "outbox:write"
| "upload:write"
| "intent:read"
| "intent:write"
| "dm:read"
| "dm:write"
| "fs:read"
| "fs:write"
| "llm:generate"
)[]
The capabilities, possibly empty.
Capabilities a domain needs. Unknown domains need none, which keeps the grants layer honest about domains kehto adds later: they are advertised only when the environment resolver allows them.