@cofy-x/axern-sdk 0.5.1 → 0.7.0

package/dist/network-policy.js

@@ -0,0 +1,132 @@
+/**
+ * @license
+ * Copyright 2026 cofy-x
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { isIP } from "node:net";
+import { domainToASCII } from "node:url";
+const maxRules = 256;
+export class NetworkPolicy {
+    wire;
+    constructor(wire) {
+        this.wire = wire;
+    }
+    static strict(options = {}) {
+        const domains = normalizeDomains(options.domains ?? []);
+        const cidrRules = normalizeCIDRRules(options.cidrRules ?? []);
+        if (domains.length + cidrRules.length > maxRules) {
+            throw new RangeError(`network policy may contain at most ${maxRules} rules`);
+        }
+        return new NetworkPolicy({
+            strict: {
+                allowed_domains: domains,
+                allowed_cidrs: cidrRules.map((rule) => ({
+                    cidr: rule.cidr,
+                    protocol: rule.protocol === "tcp" ? 1 : 2,
+                    ports: rule.ports.map((port) => ({ start: port.start, end: port.end })),
+                })),
+            },
+        });
+    }
+    static allowDomains(...domains) {
+        return NetworkPolicy.strict({ domains });
+    }
+    static denyDns(...domains) {
+        const normalized = normalizeDomains(domains);
+        if (normalized.length === 0)
+            throw new RangeError("denyDns requires at least one domain");
+        return new NetworkPolicy({ dns_deny: { denied_domains: normalized } });
+    }
+    static denyAll() {
+        return NetworkPolicy.strict();
+    }
+    /** @internal */
+    toWire() {
+        return structuredClone(this.wire);
+    }
+}
+export function portRange(start, end = start) {
+    if (!Number.isInteger(start) || !Number.isInteger(end) || start < 1 || end < start || end > 65535) {
+        throw new RangeError("ports must be an inclusive range within 1..65535");
+    }
+    return Object.freeze({ start, end });
+}
+export function cidrRule(cidr, protocol, ...ports) {
+    return normalizeCIDRRule({ cidr, protocol, ports });
+}
+function normalizeDomains(values) {
+    const result = [];
+    const seen = new Set();
+    for (const value of values) {
+        let raw = value.trim().toLowerCase();
+        const wildcard = raw.startsWith("*.");
+        if (wildcard)
+            raw = raw.slice(2);
+        raw = raw.replace(/\.+$/, "");
+        if (raw === "" || /[/:@?#*]/u.test(raw) || isIP(raw) !== 0) {
+            throw new TypeError(`invalid domain rule ${JSON.stringify(value)}`);
+        }
+        const ascii = domainToASCII(raw).toLowerCase();
+        const labels = ascii.split(".");
+        if (ascii === "" || Buffer.byteLength(ascii, "ascii") > 253 || labels.some((label) => label === "" || label.length > 63)) {
+            throw new TypeError(`invalid domain rule ${JSON.stringify(value)}`);
+        }
+        const normalized = wildcard ? `*.${ascii}` : ascii;
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            result.push(normalized);
+        }
+    }
+    return result;
+}
+function normalizeCIDRRules(values) {
+    const result = [];
+    const seen = new Set();
+    for (const value of values) {
+        const rule = normalizeCIDRRule(value);
+        const key = JSON.stringify(rule);
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(rule);
+        }
+    }
+    return result;
+}
+function normalizeCIDRRule(value) {
+    const cidr = value.cidr.trim();
+    const separator = cidr.lastIndexOf("/");
+    const address = separator < 0 ? "" : cidr.slice(0, separator);
+    const prefix = separator < 0 ? -1 : Number(cidr.slice(separator + 1));
+    const family = isIP(address);
+    if ((family !== 4 && family !== 6) || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+        throw new TypeError(`invalid CIDR ${JSON.stringify(value.cidr)}`);
+    }
+    if (isProtectedCIDR(address, prefix, family)) {
+        throw new TypeError(`CIDR ${JSON.stringify(value.cidr)} targets a protected address range`);
+    }
+    if (value.protocol !== "tcp" && value.protocol !== "udp")
+        throw new TypeError("CIDR protocol must be tcp or udp");
+    if (value.ports.length === 0)
+        throw new RangeError("CIDR rule requires at least one port range");
+    const ports = value.ports.map((port) => portRange(port.start, port.end));
+    return Object.freeze({ cidr, protocol: value.protocol, ports: Object.freeze(ports) });
+}
+function isProtectedCIDR(address, prefix, family) {
+    if (family === 4) {
+        const value = address.split(".").reduce((result, octet) => (result << 8n) | BigInt(octet), 0n);
+        const protectedRanges = [
+            [0n, 32],
+            [1684301000n, 32], // 100.100.100.200
+            [2130706432n, 8], // 127.0.0.0
+            [2851995648n, 16], // 169.254.0.0
+            [3221225664n, 32], // 192.0.0.192
+            [3758096384n, 4], // 224.0.0.0
+        ];
+        return protectedRanges.some(([base, bits]) => prefix >= bits && (value >> BigInt(32 - bits)) === (base >> BigInt(32 - bits)));
+    }
+    const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1).toLowerCase();
+    if (prefix >= 128 && (canonical === "::" || canonical === "::1"))
+        return true;
+    const first = Number.parseInt(canonical.split(":", 1)[0] || "0", 16);
+    return (prefix >= 10 && first >= 0xfe80 && first <= 0xfebf) || (prefix >= 8 && first >= 0xff00 && first <= 0xffff);
+}

package/dist/node/attached_process.d.ts

@@ -3,8 +3,7 @@
  * Copyright 2026 cofy-x
  * SPDX-License-Identifier: Apache-2.0
  */
-import type { Command, ImageProcessOptions, ProcessOptions } from "../types.js";
+import type { Command, ProcessOptions } from "../types.js";
 import { NodeClientContext } from "./context.js";
 import { SandboxProcess } from "./process.js";
 export declare function process(ctx: NodeClientContext, command: Command, options?: ProcessOptions): Promise<SandboxProcess>;
-export declare function processImage(ctx: NodeClientContext, image: string, command: Command, options?: ImageProcessOptions): Promise<SandboxProcess>;

package/dist/node/attached_process.js

@@ -3,12 +3,13 @@
  * Copyright 2026 cofy-x
  * SPDX-License-Identifier: Apache-2.0
  */
-import { mapRpcError } from "../errors/index.js";
+import { mapRpcError, SandboxValidationError } from "../errors/index.js";
 import { normalizeCommand } from "../validation.js";
-import { execSpec, imageProcessSpec } from "./exec.js";
+import { execSpec } from "./exec.js";
 import { SandboxProcess } from "./process.js";
 export async function process(ctx, command, options = {}) {
     const argv = normalizeCommand(command);
+    const initialSize = processInitialSize(options);
     const client = ctx.rpcClient();
     const call = client
         .Process();
@@ -20,6 +21,7 @@ export async function process(ctx, command, options = {}) {
     call.write({
         open: ctx.authRequest({
             spec: execSpec(argv, options),
+            ...(initialSize === undefined ? {} : { initial_size: initialSize }),
         }),
     });
     try {
@@ -31,30 +33,14 @@ export async function process(ctx, command, options = {}) {
         throw mapRpcError(error, "sandbox process", ctx.allocationId);
     }
 }
-export async function processImage(ctx, image, command, options = {}) {
-    if (image.trim() === "") {
-        throw new Error("image is required");
+function processInitialSize(options) {
+    const cols = options.initialCols ?? 0;
+    const rows = options.initialRows ?? 0;
+    if ((cols === 0) !== (rows === 0)) {
+        throw new SandboxValidationError("initialCols and initialRows must both be zero or both be positive");
     }
-    const argv = normalizeCommand(command);
-    const client = ctx.rpcClient();
-    const call = client
-        .ProcessImage();
-    const sandboxProcess = new SandboxProcess({
-        allocationId: ctx.allocationId,
-        call,
-        closeClient: () => client.close(),
-    });
-    call.write({
-        open: ctx.authRequest({
-            spec: imageProcessSpec(image, argv, options),
-        }),
-    });
-    try {
-        await sandboxProcess.waitReady();
-        return sandboxProcess;
-    }
-    catch (error) {
-        await sandboxProcess.close();
-        throw mapRpcError(error, "sandbox image process", ctx.allocationId);
+    if (cols < 0 || rows < 0 || !Number.isInteger(cols) || !Number.isInteger(rows)) {
+        throw new SandboxValidationError("initialCols and initialRows must be non-negative integers");
     }
+    return cols === 0 ? undefined : { cols, rows };
 }

package/dist/node/client.d.ts

@@ -4,22 +4,20 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import type * as grpc from "@grpc/grpc-js";
-import type { ChmodOptions, CapabilityStatus, Command, ComputerUseDisplay, ComputerUseKeyboardOptions, ComputerUseMouseOptions, ComputerUseScreenshot, ComputerUseScreenshotOptions, ComputerUseStatus, CopyOptions, DownloadArchiveOptions, ExecOptions, ExecResult, ImageExecOptions, ImageProcessOptions, MkdirOptions, MoveOptions, NodeCallOptions, ProcessOptions, RemoveOptions, SandboxFileInfo, TouchOptions, UploadArchiveOptions, WriteFileOptions } from "../types.js";
+import type { ChmodOptions, CapabilityStatus, Command, ComputerUseDisplay, ComputerUseKeyboardOptions, ComputerUseMouseOptions, ComputerUseScreenshot, ComputerUseScreenshotOptions, ComputerUseStatus, CopyOptions, DownloadArchiveOptions, ExecOptions, ExecResult, MkdirOptions, MoveOptions, NodeCallOptions, ProcessOptions, RemoveOptions, SandboxFileInfo, TouchOptions, UploadArchiveOptions, WriteFileOptions } from "../types.js";
 import type { SandboxProcess } from "./process.js";
-export interface NodeSandboxClientOptions {
+export interface AllocationClientOptions {
     allocationId: string;
     target: string;
     credentials: grpc.ChannelCredentials;
     channelOptions?: grpc.ChannelOptions;
 }
-export declare class NodeSandboxClient {
+export declare class AllocationClient {
     readonly allocationId: string;
     private readonly ctx;
-    constructor(options: NodeSandboxClientOptions);
+    constructor(options: AllocationClientOptions);
     exec(command: Command, options?: ExecOptions): Promise<ExecResult>;
     process(command: Command, options?: ProcessOptions): Promise<SandboxProcess>;
-    execImage(image: string, command: Command, options?: ImageExecOptions): Promise<ExecResult>;
-    processImage(image: string, command: Command, options?: ImageProcessOptions): Promise<SandboxProcess>;
     capabilityStatus(options?: NodeCallOptions): Promise<CapabilityStatus>;
     computerUseStatus(options?: NodeCallOptions): Promise<ComputerUseStatus>;
     computerUseScreenshot(options?: ComputerUseScreenshotOptions): Promise<ComputerUseScreenshot>;

package/dist/node/client.js

@@ -7,11 +7,10 @@ import { uploadArchive, downloadArchive } from "./archive.js";
 import { capabilityStatus } from "./capabilities.js";
 import * as computerUse from "./computer_use.js";
 import { process as startProcess } from "./attached_process.js";
-import { processImage as startImageProcess } from "./attached_process.js";
 import { NodeClientContext } from "./context.js";
-import { exec, execImage } from "./exec.js";
+import { exec } from "./exec.js";
 import * as files from "./files.js";
-export class NodeSandboxClient {
+export class AllocationClient {
     allocationId;
     ctx;
     constructor(options) {
@@ -24,12 +23,6 @@ export class NodeSandboxClient {
     async process(command, options = {}) {
         return startProcess(this.ctx, command, options);
     }
-    async execImage(image, command, options = {}) {
-        return execImage(this.ctx, image, command, options);
-    }
-    async processImage(image, command, options = {}) {
-        return startImageProcess(this.ctx, image, command, options);
-    }
     async capabilityStatus(options = {}) {
         return capabilityStatus(this.ctx, options);
     }

package/dist/node/exec.d.ts

@@ -3,10 +3,8 @@
  * Copyright 2026 cofy-x
  * SPDX-License-Identifier: Apache-2.0
  */
-import type { Command, ExecOptions, ExecResult, ImageExecOptions, ImageProcessOptions, ProcessOptions } from "../types.js";
+import type { Command, ExecOptions, ExecResult, ProcessOptions } from "../types.js";
 import type { NodeClientContext } from "./context.js";
 export declare function exec(ctx: NodeClientContext, command: Command, options?: ExecOptions): Promise<ExecResult>;
-export declare function execImage(ctx: NodeClientContext, image: string, command: Command, options?: ImageExecOptions): Promise<ExecResult>;
 export declare function execSpec(argv: string[], options: ExecOptions | ProcessOptions): Record<string, unknown>;
-export declare function imageProcessSpec(image: string, argv: string[], options: ImageExecOptions | ImageProcessOptions): Record<string, unknown>;
 export declare function execResult(response: Record<string, unknown>): ExecResult;

package/dist/node/exec.js

@@ -25,28 +25,6 @@ export async function exec(ctx, command, options = {}) {
         throw mapRpcError(error, "sandbox exec", ctx.allocationId);
     }
 }
-export async function execImage(ctx, image, command, options = {}) {
-    if (image.trim() === "") {
-        throw new Error("image is required");
-    }
-    const argv = normalizeCommand(command);
-    try {
-        const response = await ctx.withAuthRetry(options.leaseTtlSeconds ?? 300, async (client) => unary(client, "ExecImage", ctx.authRequest({
-            spec: imageProcessSpec(image, argv, options),
-        }), options.rpcTimeoutMs));
-        const result = execResult(response);
-        if (options.check === true && result.exitCode !== 0) {
-            throw new SandboxExecError(argv, result);
-        }
-        return result;
-    }
-    catch (error) {
-        if (error instanceof SandboxExecError) {
-            throw error;
-        }
-        throw mapRpcError(error, "sandbox exec image", ctx.allocationId);
-    }
-}
 export function execSpec(argv, options) {
     return {
         argv,
@@ -57,27 +35,6 @@ export function execSpec(argv, options) {
         user: options.user ?? "",
     };
 }
-export function imageProcessSpec(image, argv, options) {
-    return {
-        image,
-        argv,
-        env: options.env ?? {},
-        cwd: options.cwd ?? "",
-        timeout_seconds: options.timeoutSeconds ?? 0,
-        tty: options.tty ?? false,
-        user: options.user ?? "",
-        mounts: imageProcessMounts(options.mounts),
-    };
-}
-function imageProcessMounts(mounts) {
-    const effective = mounts ?? [{ sandboxPath: "/workspace", targetPath: "/workspace" }];
-    return effective.map((mount) => ({
-        sandbox_path: mount.sandboxPath,
-        target_path: mount.targetPath,
-        readonly: mount.readonly ?? false,
-        options: [...(mount.options ?? [])],
-    }));
-}
 export function execResult(response) {
     const stdout = Buffer.from(response.stdout ?? []);
     const stderr = Buffer.from(response.stderr ?? []);

package/dist/proto/axern/control/admin/v1/access.proto

@@ -30,7 +30,12 @@ enum AccessRole {
   ACCESS_ROLE_NAMESPACE_ADMIN = 2;
   ACCESS_ROLE_NAMESPACE_EDITOR = 3;
   ACCESS_ROLE_NAMESPACE_VIEWER = 4;
-  ACCESS_ROLE_ROLLOUT_EXECUTOR = 5;
+}
+
+enum CredentialKind {
+  CREDENTIAL_KIND_UNSPECIFIED = 0;
+  CREDENTIAL_KIND_X509 = 1;
+  CREDENTIAL_KIND_SSH = 2;
 }
 
 message Principal {
@@ -39,19 +44,19 @@ message Principal {
   string display_name = 3;
   PrincipalKind kind = 4;
   PrincipalStatus status = 5;
-  int64 version = 6;
-  google.protobuf.Timestamp created_at = 7;
-  google.protobuf.Timestamp updated_at = 8;
+  google.protobuf.Timestamp created_at = 6;
+  google.protobuf.Timestamp updated_at = 7;
 }
 
 message PrincipalCredential {
   string credential_id = 1;
   string principal_id = 2;
   string fingerprint = 3;
-  google.protobuf.Timestamp certificate_not_after = 4;
+  google.protobuf.Timestamp expires_at = 4;
   string label = 5;
   google.protobuf.Timestamp created_at = 6;
   google.protobuf.Timestamp revoked_at = 7;
+  CredentialKind kind = 8;
 }
 
 message RoleBinding {
@@ -83,6 +88,8 @@ message AddPrincipalCredentialRequest {
   string principal_id = 1;
   bytes certificate_der = 2;
   string label = 3;
+  string ssh_public_key = 4;
+  google.protobuf.Timestamp expires_at = 5;
 }
 message AddPrincipalCredentialResponse { PrincipalCredential credential = 1; }
 

package/dist/proto/axern/control/admin/v1/audit.proto

@@ -11,27 +11,25 @@ enum AdminAuditOperation {
   ADMIN_AUDIT_OPERATION_FORCE_ALLOCATION_LIFECYCLE_RETRY = 1;
   ADMIN_AUDIT_OPERATION_FAIL_ALLOCATION_LIFECYCLE_RETRY = 2;
   ADMIN_AUDIT_OPERATION_CLEAR_ALLOCATION_LIFECYCLE_RETRY = 3;
-  ADMIN_AUDIT_OPERATION_RETRY_STORAGE_BINDING = 4;
-  ADMIN_AUDIT_OPERATION_PURGE_SERVICE = 5;
-  ADMIN_AUDIT_OPERATION_RETIRE_NODE = 6;
-  ADMIN_AUDIT_OPERATION_CREATE_PRINCIPAL = 7;
-  ADMIN_AUDIT_OPERATION_DISABLE_PRINCIPAL = 8;
-  ADMIN_AUDIT_OPERATION_ADD_CREDENTIAL = 9;
-  ADMIN_AUDIT_OPERATION_REVOKE_CREDENTIAL = 10;
-  ADMIN_AUDIT_OPERATION_GRANT_ROLE_BINDING = 11;
-  ADMIN_AUDIT_OPERATION_REVOKE_ROLE_BINDING = 12;
-  ADMIN_AUDIT_OPERATION_BOOTSTRAP_ACCESS = 13;
+  ADMIN_AUDIT_OPERATION_RETIRE_NODE = 4;
+  ADMIN_AUDIT_OPERATION_CREATE_PRINCIPAL = 5;
+  ADMIN_AUDIT_OPERATION_DISABLE_PRINCIPAL = 6;
+  ADMIN_AUDIT_OPERATION_ADD_CREDENTIAL = 7;
+  ADMIN_AUDIT_OPERATION_REVOKE_CREDENTIAL = 8;
+  ADMIN_AUDIT_OPERATION_GRANT_ROLE_BINDING = 9;
+  ADMIN_AUDIT_OPERATION_REVOKE_ROLE_BINDING = 10;
+  ADMIN_AUDIT_OPERATION_BOOTSTRAP_ACCESS = 11;
+  ADMIN_AUDIT_OPERATION_ADMIT_NODE = 12;
+  ADMIN_AUDIT_OPERATION_REVOKE_NODE = 13;
 }
 
 enum AdminAuditTargetType {
   ADMIN_AUDIT_TARGET_TYPE_UNSPECIFIED = 0;
   ADMIN_AUDIT_TARGET_TYPE_ALLOCATION = 1;
-  ADMIN_AUDIT_TARGET_TYPE_STORAGE_BINDING = 2;
-  ADMIN_AUDIT_TARGET_TYPE_SERVICE = 3;
-  ADMIN_AUDIT_TARGET_TYPE_NODE = 4;
-  ADMIN_AUDIT_TARGET_TYPE_PRINCIPAL = 5;
-  ADMIN_AUDIT_TARGET_TYPE_CREDENTIAL = 6;
-  ADMIN_AUDIT_TARGET_TYPE_ROLE_BINDING = 7;
+  ADMIN_AUDIT_TARGET_TYPE_NODE = 2;
+  ADMIN_AUDIT_TARGET_TYPE_PRINCIPAL = 3;
+  ADMIN_AUDIT_TARGET_TYPE_CREDENTIAL = 4;
+  ADMIN_AUDIT_TARGET_TYPE_ROLE_BINDING = 5;
 }
 
 message AdminAuditEvent {

package/dist/proto/axern/control/admin/v1/node.proto

@@ -6,12 +6,12 @@ option go_package = "github.com/cofy-x/axern/sdk/go/gen/axern/control/admin/v1;a
 
 import "google/protobuf/timestamp.proto";
 import "axern/control/capability/v1/capability.proto";
-import "axern/control/node/v1/node_control.proto";
 
 enum AdminNodeLifecycleStatus {
   ADMIN_NODE_LIFECYCLE_STATUS_UNSPECIFIED = 0;
   ADMIN_NODE_LIFECYCLE_STATUS_ACTIVE = 1;
-  ADMIN_NODE_LIFECYCLE_STATUS_RETIRED = 2;
+  ADMIN_NODE_LIFECYCLE_STATUS_REVOKED = 2;
+  ADMIN_NODE_LIFECYCLE_STATUS_RETIRED = 3;
 }
 
 message AdminNode {
@@ -22,8 +22,8 @@ message AdminNode {
   bool axnoded_ready = 5;
   int64 heartbeat_age_seconds = 6;
   int64 summary_age_seconds = 7;
-  google.protobuf.Timestamp registered_at = 8;
-  google.protobuf.Timestamp updated_at = 9;
+  google.protobuf.Timestamp admitted_at = 8;
+  google.protobuf.Timestamp last_heartbeat_at = 9;
   google.protobuf.Timestamp retired_at = 10;
   string retired_reason = 11;
 }
@@ -36,67 +36,40 @@ message ListAdminNodesResponse {
   repeated AdminNode nodes = 1;
 }
 
-message RetireAdminNodeRequest {
+message AdmitAdminNodeRequest {
   string node_id = 1;
-  string operator_reason = 2;
+  string enrollment_token = 2;
+  string operator_reason = 3;
 }
 
-message RetireAdminNodeResponse {
+message AdmitAdminNodeResponse {
   AdminNode node = 1;
 }
 
-message GetNodeCapabilitySnapshotRequest {
+message RevokeAdminNodeRequest {
   string node_id = 1;
+  string operator_reason = 2;
 }
 
-message GetNodeCapabilitySnapshotResponse {
-  axern.control.capability.v1.CapabilitySnapshot snapshot = 1;
-}
-
-message AdminCapabilityTransition {
-  string transition_id = 1;
-  string node_id = 2;
-  string snapshot_id = 3;
-  int64 snapshot_sequence = 4;
-  axern.control.capability.v1.CapabilityKey key = 5;
-  axern.control.capability.v1.CapabilityState old_state = 6;
-  axern.control.capability.v1.CapabilityState new_state = 7;
-  axern.control.capability.v1.CapabilityEvidence old_evidence = 8;
-  axern.control.capability.v1.CapabilityEvidence new_evidence = 9;
-  axern.control.capability.v1.CapabilityReasonCode old_reason_code = 10;
-  axern.control.capability.v1.CapabilityReasonCode new_reason_code = 11;
-  string reason = 12;
-  google.protobuf.Timestamp observed_at = 13;
-  google.protobuf.Timestamp reported_at = 14;
+message RevokeAdminNodeResponse {
+  AdminNode node = 1;
 }
 
-message ListNodeCapabilityTransitionsRequest {
+message RetireAdminNodeRequest {
   string node_id = 1;
-  int32 limit = 2;
-}
-
-message ListNodeCapabilityTransitionsResponse {
-  repeated AdminCapabilityTransition transitions = 1;
+  string operator_reason = 2;
 }
 
-message AdminCapabilityReconcileItem {
-  string allocation_id = 1;
-  string node_id = 2;
-  repeated axern.control.capability.v1.CapabilityDependency pending_dependencies = 3;
-  int32 attempts = 4;
-  google.protobuf.Timestamp next_run_at = 5;
-  google.protobuf.Timestamp lease_expires_at = 6;
-  string last_error = 7;
-  google.protobuf.Timestamp updated_at = 8;
+message RetireAdminNodeResponse {
+  AdminNode node = 1;
 }
 
-message ListCapabilityReconcileQueueRequest {
+message GetNodeCapabilitySnapshotRequest {
   string node_id = 1;
-  int32 limit = 2;
 }
 
-message ListCapabilityReconcileQueueResponse {
-  repeated AdminCapabilityReconcileItem items = 1;
+message GetNodeCapabilitySnapshotResponse {
+  axern.control.capability.v1.CapabilitySnapshot snapshot = 1;
 }
 
 message GetAllocationCapabilityDiagnosticsRequest {
@@ -106,32 +79,15 @@ message GetAllocationCapabilityDiagnosticsRequest {
 message GetAllocationCapabilityDiagnosticsResponse {
   string allocation_id = 1;
   string node_id = 2;
-  repeated axern.control.capability.v1.CapabilityDependency required_dependencies = 3;
-  repeated axern.control.capability.v1.CapabilityDependency admitted_dependencies = 4;
-  axern.control.capability.v1.CapabilityConditionSet condition_set = 5;
-  AdminCapabilityReconcileItem reconcile = 6;
-  int64 allocation_attempt = 7;
-  bool create_admission_recorded = 8;
-  string create_dependency_set_digest = 9;
-  google.protobuf.Timestamp create_admitted_at = 10;
-  AllocationMemoryAdmissionEvidence memory_admission = 11;
-  axern.control.node.v1.AllocationMemoryObservation latest_memory_observation = 12;
-}
-
-message AllocationMemoryAdmissionEvidence {
-  int64 sandbox_memory_request_bytes = 1;
-  int64 sandbox_memory_limit_bytes = 2;
-  axern.control.node.v1.NodeMemoryBudget node_memory_budget = 3;
-  google.protobuf.Timestamp summary_collected_at = 4;
-  int64 node_local_commitment_bytes = 5;
-  google.protobuf.Timestamp admitted_at = 6;
+  repeated axern.control.capability.v1.CapabilityRequirement requirements = 3;
+  axern.control.capability.v1.CapabilityConditionSet condition_set = 4;
 }
 
 service NodeAdmin {
+  rpc AdmitAdminNode(AdmitAdminNodeRequest) returns (AdmitAdminNodeResponse) {}
   rpc ListAdminNodes(ListAdminNodesRequest) returns (ListAdminNodesResponse) {}
+  rpc RevokeAdminNode(RevokeAdminNodeRequest) returns (RevokeAdminNodeResponse) {}
   rpc RetireAdminNode(RetireAdminNodeRequest) returns (RetireAdminNodeResponse) {}
   rpc GetNodeCapabilitySnapshot(GetNodeCapabilitySnapshotRequest) returns (GetNodeCapabilitySnapshotResponse) {}
-  rpc ListNodeCapabilityTransitions(ListNodeCapabilityTransitionsRequest) returns (ListNodeCapabilityTransitionsResponse) {}
-  rpc ListCapabilityReconcileQueue(ListCapabilityReconcileQueueRequest) returns (ListCapabilityReconcileQueueResponse) {}
   rpc GetAllocationCapabilityDiagnostics(GetAllocationCapabilityDiagnosticsRequest) returns (GetAllocationCapabilityDiagnosticsResponse) {}
 }