ci: pin Swatinem/rust-cache to v2.9.1 for release workflow compliance

.github/workflows/ci.yml

@@ -78,7 +78,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Rust cache
-        uses: Swatinem/rust-cache@v2.7.3
+        uses: Swatinem/rust-cache@v2.9.1
 
       - name: Binary cache
         uses: actions/cache@v5

policies/dotnet/Devolutions.Now.Policy.Api/Enums.cs

@@ -21,6 +21,20 @@ public enum ManagerName
     Winget,
     PowerShell,
     PowerShell7,
+    Apt,
+    Bun,
+    Cargo,
+    Chocolatey,
+    Dnf,
+    Dotnet,
+    Flatpak,
+    Homebrew,
+    Npm,
+    Pacman,
+    Pip,
+    Scoop,
+    Snap,
+    Vcpkg,
 }
 
 /// <summary>Installation scope.</summary>

policies/dotnet/Devolutions.Now.Policy.Api/MetaModels.cs

@@ -58,6 +58,13 @@ public string ResponseKind
 
     [JsonPropertyName("MaxRequestBodyBytes")]
     public long MaxRequestBodyBytes { get; set; }
+
+    /// <summary>Capability entry advertised for <paramref name="manager"/>, if any.</summary>
+    public ManagerCapability? GetManagerCapability(ManagerName manager)
+        => Managers.FirstOrDefault(capability => capability.Manager == manager);
+
+    /// <summary>Whether the broker advertises support for <paramref name="manager"/>.</summary>
+    public bool SupportsManager(ManagerName manager) => GetManagerCapability(manager) is not null;
 }
 
 public sealed class ManagerCapability

policies/dotnet/Devolutions.Now.Policy.Api/PolicyCompatibility.cs

@@ -31,6 +31,20 @@ public static class PolicyCompatibility
         ManagerName.Winget => PolicyManagerName.Winget,
         ManagerName.PowerShell => PolicyManagerName.PowerShell,
         ManagerName.PowerShell7 => PolicyManagerName.PowerShell7,
+        ManagerName.Apt => PolicyManagerName.Apt,
+        ManagerName.Bun => PolicyManagerName.Bun,
+        ManagerName.Cargo => PolicyManagerName.Cargo,
+        ManagerName.Chocolatey => PolicyManagerName.Chocolatey,
+        ManagerName.Dnf => PolicyManagerName.Dnf,
+        ManagerName.Dotnet => PolicyManagerName.Dotnet,
+        ManagerName.Flatpak => PolicyManagerName.Flatpak,
+        ManagerName.Homebrew => PolicyManagerName.Homebrew,
+        ManagerName.Npm => PolicyManagerName.Npm,
+        ManagerName.Pacman => PolicyManagerName.Pacman,
+        ManagerName.Pip => PolicyManagerName.Pip,
+        ManagerName.Scoop => PolicyManagerName.Scoop,
+        ManagerName.Snap => PolicyManagerName.Snap,
+        ManagerName.Vcpkg => PolicyManagerName.Vcpkg,
         _ => throw new ArgumentOutOfRangeException(nameof(value), value, null),
     };
 
@@ -39,6 +53,20 @@ public static class PolicyCompatibility
         PolicyManagerName.Winget => ManagerName.Winget,
         PolicyManagerName.PowerShell => ManagerName.PowerShell,
         PolicyManagerName.PowerShell7 => ManagerName.PowerShell7,
+        PolicyManagerName.Apt => ManagerName.Apt,
+        PolicyManagerName.Bun => ManagerName.Bun,
+        PolicyManagerName.Cargo => ManagerName.Cargo,
+        PolicyManagerName.Chocolatey => ManagerName.Chocolatey,
+        PolicyManagerName.Dnf => ManagerName.Dnf,
+        PolicyManagerName.Dotnet => ManagerName.Dotnet,
+        PolicyManagerName.Flatpak => ManagerName.Flatpak,
+        PolicyManagerName.Homebrew => ManagerName.Homebrew,
+        PolicyManagerName.Npm => ManagerName.Npm,
+        PolicyManagerName.Pacman => ManagerName.Pacman,
+        PolicyManagerName.Pip => ManagerName.Pip,
+        PolicyManagerName.Scoop => ManagerName.Scoop,
+        PolicyManagerName.Snap => ManagerName.Snap,
+        PolicyManagerName.Vcpkg => ManagerName.Vcpkg,
         _ => throw new ArgumentOutOfRangeException(nameof(value), value, null),
     };
 

policies/dotnet/Devolutions.Now.Policy.Client.Tests/BrokerClientTests.cs

@@ -170,6 +170,27 @@ public async Task Evaluate_rejects_unsupported_capability_before_operation_reque
         Assert.Equal("/v1/capabilities", transport.Requests[0].Path);
     }
 
+    [Fact]
+    public async Task Evaluate_rejects_manager_not_advertised_by_broker_before_sending()
+    {
+        // The broker does not advertise Chocolatey in its capabilities.
+        var transport = new FakeBrokerTransport(CapabilitiesResponse);
+        var client = CreateClient(transport);
+
+        var exception = await Assert.ThrowsAsync<BrokerClientException>(() => client.Evaluate(new PackageOperationRequest
+        {
+            Operation = Operation.Install,
+            Manager = ManagerName.Chocolatey,
+            Source = new RequestSource { Name = "chocolatey" },
+            Package = new RequestPackage { Id = "git" },
+        }));
+
+        Assert.Equal(BrokerClientErrorKind.UnsupportedCapability, exception.Kind);
+        Assert.Contains("does not advertise support", exception.Message);
+        Assert.Single(transport.Requests);
+        Assert.Equal("/v1/capabilities", transport.Requests[0].Path);
+    }
+
     [Fact]
     public async Task GetHealth_throws_typed_error_for_broker_error_response()
     {

policies/dotnet/Devolutions.Now.Policy.Client/README.md

@@ -62,7 +62,7 @@ discriminators automatically while the client fills `RequestVersion` at the top
 and `ResponseVersion`; this is required for further protocol evolution and allows the client to
 switch transport from HTTP to other mechanisms without changing the wire schema.
 
-Before sending package operation and status requests, the client implicitly queries `GetCapabilities` once and caches the result. The cached capabilities are used as a local preflight gate: unsupported transports, package managers, operations, scopes, architectures, request body sizes, custom parameters, custom install locations, or captured output requests fail before the client sends the operation/status request.
+Before sending package operation and status requests, the client implicitly queries `GetCapabilities` once and caches the result. The cached capabilities are used as a local preflight gate: unsupported transports, package managers, operations, scopes, architectures, request body sizes, custom parameters, custom install locations, or captured output requests fail before the client sends the operation/status request. Use `CapabilitiesResponse.SupportsManager(ManagerName)` or `GetManagerCapability(ManagerName)` to check package manager support ahead of time.
 
 Before sending package operation requests, the client fills missing request metadata:
 

policies/dotnet/Devolutions.Now.Policy.Model/Enums.cs

@@ -18,6 +18,20 @@ public enum ManagerName
     Winget,
     PowerShell,
     PowerShell7,
+    Apt,
+    Bun,
+    Cargo,
+    Chocolatey,
+    Dnf,
+    Dotnet,
+    Flatpak,
+    Homebrew,
+    Npm,
+    Pacman,
+    Pip,
+    Scoop,
+    Snap,
+    Vcpkg,
 }
 
 /// <summary>Installation scope.</summary>

policies/rust/now-policy-api/openapi/now-policy-api.yaml

@@ -543,6 +543,20 @@ components:
       - Winget
       - PowerShell
       - PowerShell7
+      - Apt
+      - Bun
+      - Cargo
+      - Chocolatey
+      - Dnf
+      - Dotnet
+      - Flatpak
+      - Homebrew
+      - Npm
+      - Pacman
+      - Pip
+      - Scoop
+      - Snap
+      - Vcpkg
     Operation:
       description: Package operation type.
       type: string

policies/rust/now-policy-api/src/capabilities.rs

@@ -31,6 +31,18 @@ pub struct CapabilitiesResponse {
     pub max_request_body_bytes: u64,
 }
 
+impl CapabilitiesResponse {
+    /// Capability entry advertised for `manager`, if any.
+    pub fn manager_capability(&self, manager: ManagerName) -> Option<&ManagerCapability> {
+        self.managers.iter().find(|capability| capability.manager == manager)
+    }
+
+    /// Whether the broker advertises support for `manager`.
+    pub fn supports_manager(&self, manager: ManagerName) -> bool {
+        self.manager_capability(manager).is_some()
+    }
+}
+
 /// Package-manager-specific capability declaration.
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 #[schemars(rename = "ManagerCapability")]
@@ -64,3 +76,59 @@ pub struct ManagerCapability {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_operation_timeout_seconds: Option<u64>,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{API_VERSION_STR, ServerContext, Transport};
+
+    fn capabilities(response_version: &str, managers: Vec<ManagerCapability>) -> CapabilitiesResponse {
+        CapabilitiesResponse {
+            response_kind: CapabilitiesResponseKind,
+            response_version: response_version.into(),
+            server: ServerContext {
+                server_version: "0.1.0".to_owned(),
+                transport: Transport::HttpNamedPipe,
+            },
+            transports: vec![Transport::HttpNamedPipe],
+            managers,
+            max_request_body_bytes: 262144,
+        }
+    }
+
+    fn manager_capability(manager: ManagerName) -> ManagerCapability {
+        ManagerCapability {
+            manager,
+            operations: vec![Operation::Install],
+            scopes: vec![Scope::Machine],
+            architectures: vec![Architecture::Neutral],
+            supports_custom_parameters: false,
+            supports_custom_install_location: false,
+            supports_capture_output: false,
+            supports_details: false,
+            max_operation_timeout_seconds: None,
+        }
+    }
+
+    #[test]
+    fn supports_manager_reflects_advertised_capabilities() {
+        let broker = capabilities(
+            API_VERSION_STR,
+            vec![
+                manager_capability(ManagerName::Winget),
+                manager_capability(ManagerName::Chocolatey),
+            ],
+        );
+
+        assert!(broker.supports_manager(ManagerName::Winget));
+        assert!(broker.supports_manager(ManagerName::Chocolatey));
+        assert!(!broker.supports_manager(ManagerName::Scoop));
+        assert!(broker.manager_capability(ManagerName::Scoop).is_none());
+        assert_eq!(
+            broker
+                .manager_capability(ManagerName::Chocolatey)
+                .map(|capability| capability.manager),
+            Some(ManagerName::Chocolatey)
+        );
+    }
+}

policies/rust/now-policy-api/src/enums.rs

@@ -37,6 +37,20 @@ pub enum ManagerName {
     Winget,
     PowerShell,
     PowerShell7,
+    Apt,
+    Bun,
+    Cargo,
+    Chocolatey,
+    Dnf,
+    Dotnet,
+    Flatpak,
+    Homebrew,
+    Npm,
+    Pacman,
+    Pip,
+    Scoop,
+    Snap,
+    Vcpkg,
 }
 
 /// Policy decision.

policies/rust/now-policy-api/src/policy_compat.rs

@@ -44,7 +44,29 @@ macro_rules! bidirectional_newtype_conversion {
 bidirectional_enum_conversion!(Operation, now_policy::Operation, [Install, Update, Uninstall]);
 bidirectional_enum_conversion!(Scope, now_policy::Scope, [User, Machine]);
 bidirectional_enum_conversion!(Architecture, now_policy::Architecture, [X86, X64, Arm64, Neutral]);
-bidirectional_enum_conversion!(ManagerName, now_policy::ManagerName, [Winget, PowerShell, PowerShell7]);
+bidirectional_enum_conversion!(
+    ManagerName,
+    now_policy::ManagerName,
+    [
+        Winget,
+        PowerShell,
+        PowerShell7,
+        Apt,
+        Bun,
+        Cargo,
+        Chocolatey,
+        Dnf,
+        Dotnet,
+        Flatpak,
+        Homebrew,
+        Npm,
+        Pacman,
+        Pip,
+        Scoop,
+        Snap,
+        Vcpkg,
+    ]
+);
 bidirectional_enum_conversion!(Decision, now_policy::Decision, [Allow, Deny]);
 bidirectional_enum_conversion!(Elevation, now_policy::Elevation, [Standard, Elevated]);
 

policies/rust/now-policy-server-template/assets/samples/requests/chocolatey-git-install.request.json

@@ -0,0 +1,32 @@
+{
+  "RequestKind": "PackageRequest",
+  "RequestVersion": "1.0",
+  "RequestId": "req-chocolatey-git-install",
+  "CreatedAt": "2026-05-05T12:00:00Z",
+  "Operation": "Install",
+  "Manager": "Chocolatey",
+  "Source": {
+    "Name": "chocolatey",
+    "Url": "https://community.chocolatey.org/api/v2/"
+  },
+  "Package": {
+    "Id": "git",
+    "Architecture": "X64"
+  },
+  "Options": {
+    "Scope": "Machine",
+    "Interactive": false,
+    "SkipHashCheck": false,
+    "PreRelease": false,
+    "CustomParameters": [],
+    "KillBeforeOperation": []
+  },
+  "Client": {
+    "RequestedElevation": "Elevated",
+    "EffectiveUser": "CONTOSO\\alice",
+    "ClientVersion": "3.2.0",
+    "Transport": "HttpNamedPipe",
+    "ClientExecutablePath": "C:\\Program Files\\Devolutions\\NOW\\now-client.exe"
+  },
+  "IncludeCommandPreview": true
+}