⚡ Bolt: [O(N^2) complexity checking dependency elevation capabilities]

tools/package-manager/Cargo.toml

@@ -10,3 +10,10 @@ serde_json = { workspace = true }
 toml = "1.1"
 anyhow = { workspace = true }
 ureq = { version = "2.9" }
+
+[[bench]]
+name = "capability_validation_bench"
+harness = false
+
+[dev-dependencies]
+criterion = "0.8.2"

tools/package-manager/benches/capability_validation_bench.rs

@@ -0,0 +1,29 @@
+use criterion::{criterion_group, criterion_main, Criterion};
+use std::hint::black_box;
+use techscript_package_manager::CapabilityValidator;
+
+fn benchmark_validate_elevation(c: &mut Criterion) {
+    let mut group = c.benchmark_group("capability_validation");
+
+    let root_caps: Vec<String> = (0..100).map(|i| format!("cap_{}", i)).collect();
+    let dep_caps: Vec<String> = (50..150).map(|i| format!("cap_{}", i)).collect();
+    let allowed_elevations: Vec<String> = (0..100).map(|i| format!("dep_{}", i)).collect();
+
+    let dep_name = "dep_50"; // Will be found in allowed_elevations
+
+    group.bench_function("validate_elevation", |b| {
+        b.iter(|| {
+            let _ = CapabilityValidator::validate_elevation(
+                black_box(&root_caps),
+                black_box(&dep_caps),
+                black_box(&allowed_elevations),
+                black_box(dep_name),
+            );
+        });
+    });
+
+    group.finish();
+}
+
+criterion_group!(benches, benchmark_validate_elevation);
+criterion_main!(benches);

tools/package-manager/src/lib.rs

@@ -340,8 +340,10 @@ impl CapabilityValidator {
         dep_name: &str,
     ) -> Result<()> {
         let root_set: HashSet<&String> = root_caps.iter().collect();
+        let allowed_elevations_set: HashSet<&str> =
+            allowed_elevations.iter().map(|s| s.as_str()).collect();
         for cap in dependency_caps {
-            if !root_set.contains(cap) && !allowed_elevations.contains(&dep_name.to_string()) {
+            if !root_set.contains(cap) && !allowed_elevations_set.contains(dep_name) {
                 return Err(anyhow!(
                     "Security validation failed: Dependency '{}' requests capability '{}' which is not granted to the parent package.",
                     dep_name,