@hasna/capacity 0.1.0

package/dist/domain/authority-evidence.d.ts

@@ -0,0 +1,198 @@
+import { type KeyObject } from "node:crypto";
+import { type Counter } from "./counter";
+export declare const AUTHORITY_EVIDENCE_SCHEMA_VERSION: "accounts.authority-evidence.v1";
+export declare const AUTHORITY_EVIDENCE_TYPES: readonly ["provider_ownership", "provider_capacity", "entitlement_execution_policy", "entitlement_terms", "entitlement_data_policy", "lane_isolation_policy", "lane_execution_policy", "lane_health"];
+export type AuthorityEvidenceType = (typeof AUTHORITY_EVIDENCE_TYPES)[number];
+export declare const AUTHORITY_ISSUER_CLASSES: readonly ["provider_ownership_verifier", "provider_capacity_verifier", "execution_policy_authority", "terms_authority", "adapter_health_reporter"];
+export type AuthorityIssuerClass = (typeof AUTHORITY_ISSUER_CLASSES)[number];
+export type AuthorityAggregateKind = "provider_account" | "capacity_pool" | "entitlement" | "account_lane";
+export interface ProviderOwnershipPayload {
+    readonly provider_key: string;
+    readonly provider_subject_ref: string;
+    readonly owner_ref: string;
+    readonly identity_realm: string;
+    readonly ownership_generation: Counter;
+}
+export interface ProviderCapacityPayload {
+    readonly provider_account_id: string;
+    readonly provider_key: string;
+    readonly owner_ref: string;
+    readonly capacity_domain_ref: string;
+    readonly serialization_key: string;
+    readonly max_concurrency: Counter;
+    readonly decision: "allowed" | "denied";
+    readonly policy_version: string;
+}
+export interface EntitlementExecutionPolicyPayload {
+    readonly provider_account_id: string;
+    readonly owner_ref: string;
+    readonly provider_key: string;
+    readonly use_case: string;
+    readonly adapter_version: string;
+    readonly decision: "allowed" | "denied";
+    readonly capability_set: {
+        readonly operations: readonly string[];
+        readonly models: readonly string[];
+    };
+    readonly policy_version: string;
+}
+export interface EntitlementTermsPayload {
+    readonly provider_account_id: string;
+    readonly owner_ref: string;
+    readonly provider_key: string;
+    readonly use_case: string;
+    readonly decision: "allowed" | "denied";
+    readonly terms_version: string;
+    readonly terms_digest: string;
+}
+export interface EntitlementDataPolicyPayload {
+    readonly provider_account_id: string;
+    readonly owner_ref: string;
+    readonly provider_key: string;
+    readonly use_case: string;
+    readonly decision: "allowed" | "denied";
+    readonly allowed_classifications: readonly string[];
+    readonly retention_class: "none" | "transient" | "bounded";
+    readonly max_retention_days?: Counter;
+    readonly policy_version: string;
+}
+export interface LaneIsolationPolicyPayload {
+    readonly provider_account_id: string;
+    readonly entitlement_id: string;
+    readonly capacity_pool_id: string;
+    readonly owner_ref: string;
+    readonly adapter_key: string;
+    readonly adapter_version: string;
+    readonly access_transport: "native_session" | "api_key" | "workload_identity";
+    readonly decision: "allowed" | "denied";
+    readonly required_isolation_policy_ref?: string;
+    readonly required_isolation_policy_digest?: string;
+    readonly policy_version: string;
+}
+export interface LaneExecutionPolicyPayload {
+    readonly provider_account_id: string;
+    readonly entitlement_id: string;
+    readonly capacity_pool_id: string;
+    readonly owner_ref: string;
+    readonly adapter_key: string;
+    readonly adapter_version: string;
+    readonly access_transport: "native_session" | "api_key" | "workload_identity";
+    readonly decision: "allowed" | "denied";
+    readonly allowed_operations: readonly string[];
+    readonly allowed_models: readonly string[];
+    readonly allowed_destination_policy_classes: readonly string[];
+    readonly policy_version: string;
+}
+export interface LaneHealthPayload {
+    readonly provider_account_id: string;
+    readonly entitlement_id: string;
+    readonly capacity_pool_id: string;
+    readonly owner_ref: string;
+    readonly adapter_key: string;
+    readonly adapter_version: string;
+    readonly state: "healthy" | "degraded" | "unavailable" | "unknown";
+    readonly observed_at: string;
+}
+export type AuthorityEvidencePayload<Type extends AuthorityEvidenceType = AuthorityEvidenceType> = Type extends "provider_ownership" ? ProviderOwnershipPayload : Type extends "provider_capacity" ? ProviderCapacityPayload : Type extends "entitlement_execution_policy" ? EntitlementExecutionPolicyPayload : Type extends "entitlement_terms" ? EntitlementTermsPayload : Type extends "entitlement_data_policy" ? EntitlementDataPolicyPayload : Type extends "lane_isolation_policy" ? LaneIsolationPolicyPayload : Type extends "lane_execution_policy" ? LaneExecutionPolicyPayload : Type extends "lane_health" ? LaneHealthPayload : never;
+type IssuerClassFor<Type extends AuthorityEvidenceType> = Type extends "provider_ownership" ? "provider_ownership_verifier" : Type extends "provider_capacity" ? "provider_capacity_verifier" : Type extends "entitlement_terms" ? "terms_authority" : Type extends "lane_health" ? "adapter_health_reporter" : "execution_policy_authority";
+type AggregateKindFor<Type extends AuthorityEvidenceType> = Type extends "provider_ownership" ? "provider_account" : Type extends "provider_capacity" ? "capacity_pool" : Type extends `entitlement_${string}` ? "entitlement" : "account_lane";
+export interface AuthorityEvidenceDraft<Type extends AuthorityEvidenceType = AuthorityEvidenceType> {
+    readonly schema_version: typeof AUTHORITY_EVIDENCE_SCHEMA_VERSION;
+    readonly evidence_type: Type;
+    readonly evidence_ref: string;
+    readonly subject_ref: string;
+    readonly aggregate_kind: AggregateKindFor<Type>;
+    readonly aggregate_id: string;
+    readonly aggregate_revision: Counter;
+    readonly identity_realm: string;
+    readonly issuer_ref: string;
+    readonly issuer_class: IssuerClassFor<Type>;
+    readonly issuer_incarnation: string;
+    readonly audience: string;
+    readonly key_id: string;
+    readonly issued_at: string;
+    readonly expires_at: string;
+    readonly nonce: string;
+    readonly evidence_generation: Counter;
+    readonly payload: AuthorityEvidencePayload<Type>;
+}
+export interface AuthorityEvidenceEnvelope<Type extends AuthorityEvidenceType = AuthorityEvidenceType> extends AuthorityEvidenceDraft<Type> {
+    readonly payload_digest: string;
+    readonly signature: string;
+}
+export interface AuthorityEvidenceTrustRoot {
+    readonly issuerRef: string;
+    readonly issuerClass: AuthorityIssuerClass;
+    readonly issuerIncarnation: string;
+    readonly audience: string;
+    readonly identityRealm: string;
+    readonly keyId: string;
+    readonly publicKey: KeyObject;
+    readonly revoked: boolean;
+}
+export interface ProviderOwnershipBinding {
+    readonly providerKey: string;
+    readonly providerSubjectRef: string;
+    readonly ownerRef: string;
+}
+export interface ProviderCapacityBinding {
+    readonly providerAccountId: string;
+    readonly providerKey: string;
+    readonly ownerRef: string;
+    readonly capacityDomainRef: string;
+    readonly serializationKey: string;
+    readonly maxConcurrency: Counter;
+}
+export interface EntitlementPolicyBinding {
+    readonly providerAccountId: string;
+    readonly ownerRef: string;
+    readonly providerKey: string;
+    readonly useCase: string;
+}
+export interface EntitlementExecutionPolicyBinding extends EntitlementPolicyBinding {
+    readonly adapterVersion: string;
+}
+export interface LanePolicyBinding {
+    readonly providerAccountId: string;
+    readonly entitlementId: string;
+    readonly capacityPoolId: string;
+    readonly ownerRef: string;
+    readonly adapterKey: string;
+    readonly adapterVersion: string;
+    readonly accessTransport: "native_session" | "api_key" | "workload_identity";
+}
+export interface LaneHealthBinding {
+    readonly providerAccountId: string;
+    readonly entitlementId: string;
+    readonly capacityPoolId: string;
+    readonly ownerRef: string;
+    readonly adapterKey: string;
+    readonly adapterVersion: string;
+}
+export type AuthorityEvidenceBinding<Type extends AuthorityEvidenceType = AuthorityEvidenceType> = Type extends "provider_ownership" ? ProviderOwnershipBinding : Type extends "provider_capacity" ? ProviderCapacityBinding : Type extends "entitlement_execution_policy" ? EntitlementExecutionPolicyBinding : Type extends "entitlement_terms" | "entitlement_data_policy" ? EntitlementPolicyBinding : Type extends "lane_isolation_policy" | "lane_execution_policy" ? LanePolicyBinding : Type extends "lane_health" ? LaneHealthBinding : never;
+export interface AuthorityEvidenceExpectation<Type extends AuthorityEvidenceType = AuthorityEvidenceType> {
+    readonly evidenceType: Type;
+    readonly subjectRef: string;
+    readonly aggregateKind: AggregateKindFor<Type>;
+    readonly aggregateId: string;
+    readonly aggregateRevision: Counter;
+    readonly identityRealm: string;
+    readonly evidenceGeneration: Counter;
+    readonly nonce: string;
+    readonly now: Date;
+    readonly maximumAgeMs: number;
+    readonly maximumLifetimeMs: number;
+    readonly allowedClockSkewMs?: number;
+    readonly binding: AuthorityEvidenceBinding<Type>;
+}
+/**
+ * Verifies an immutable, canonical signed authority envelope against a trust root
+ * selected by deployment configuration and the exact aggregate being promoted.
+ */
+export declare function verifyAuthorityEvidence<Type extends AuthorityEvidenceType>(source: Uint8Array, trust: AuthorityEvidenceTrustRoot, expectation: AuthorityEvidenceExpectation<Type>): AuthorityEvidenceEnvelope<Type>;
+/**
+ * Test-fixture helper only. Keep this internal module out of the package export map.
+ * Production signers must live behind their separately authorized issuer service.
+ */
+export declare function signAuthorityEvidenceForTest<Type extends AuthorityEvidenceType>(input: AuthorityEvidenceDraft<Type>, privateKey: KeyObject): Uint8Array;
+export {};

package/dist/domain/catalog.d.ts

@@ -0,0 +1,65 @@
+import type { AccountsRepository, CredentialHandleEnvelope, CredentialResolutionGrant, CredentialResolutionTransport, MutationContext, MutationResult, NativeRevocationRequest, OutboxAcknowledgeRequest, OutboxClaimRequest } from "../storage/repository";
+import { type Counter } from "./counter";
+import type { EntityKind, EntityMap } from "./models";
+import type { EligibilityRequest, SlotEligibilityMetadata } from "./models";
+import { type AuthorityEvidenceTrustRoot, type AuthorityEvidenceType } from "./authority-evidence";
+export interface AuthorityEvidencePolicy {
+    readonly trustRoots: ReadonlyMap<AuthorityEvidenceType, AuthorityEvidenceTrustRoot>;
+    readonly identityRealm: string;
+    readonly maximumAgeMs: number;
+    readonly maximumLifetimeMs: number;
+    readonly allowedClockSkewMs?: number;
+}
+export interface EvidenceFence {
+    readonly nonce: string;
+    readonly evidenceGeneration: Counter;
+}
+export interface EntitlementEvidenceBundle {
+    readonly executionPolicy: Uint8Array;
+    readonly executionPolicyFence: EvidenceFence;
+    readonly terms: Uint8Array;
+    readonly termsFence: EvidenceFence;
+    readonly dataPolicy: Uint8Array;
+    readonly dataPolicyFence: EvidenceFence;
+    readonly useCase: string;
+    readonly adapterVersion: string;
+}
+export interface LaneEvidenceBundle {
+    readonly isolationPolicy: Uint8Array;
+    readonly isolationPolicyFence: EvidenceFence;
+    readonly executionPolicy: Uint8Array;
+    readonly executionPolicyFence: EvidenceFence;
+    readonly health: Uint8Array;
+    readonly healthFence: EvidenceFence;
+}
+export declare class AccountsCatalog {
+    private readonly repository;
+    private readonly now;
+    private readonly authorityPolicy?;
+    private mutationTail;
+    constructor(repository: AccountsRepository, now?: () => Date, authorityPolicy?: AuthorityEvidencePolicy | undefined);
+    get<K extends EntityKind>(kind: K, id: EntityMap[K]["id"]): Promise<EntityMap[K]>;
+    list<K extends EntityKind>(kind: K): Promise<readonly EntityMap[K][]>;
+    add<K extends EntityKind>(kind: K, record: EntityMap[K], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    addCapacityPoolFromEvidence(record: EntityMap["capacity_pool"], evidence: Uint8Array, fence: EvidenceFence, context: MutationContext): Promise<MutationResult<EntityMap["capacity_pool"]>>;
+    addCredentialBinding(record: EntityMap["credential_binding"], handle: CredentialHandleEnvelope, context: MutationContext): Promise<MutationResult<EntityMap["credential_binding"]>>;
+    activateProviderAccount(candidate: EntityMap["account"], evidence: Uint8Array, fence: EvidenceFence, expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap["account"]>>;
+    activateEntitlement(candidate: EntityMap["entitlement"], bundle: EntitlementEvidenceBundle, expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap["entitlement"]>>;
+    activateAccessMethod(candidate: EntityMap["access_method"], bundle: LaneEvidenceBundle, expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap["access_method"]>>;
+    resolveCredentialHandle(bindingId: EntityMap["credential_binding"]["id"], grant: CredentialResolutionGrant, transport: CredentialResolutionTransport): Promise<import("../storage/repository").ResolvedCredentialHandle>;
+    revokeNativeGeneration(request: NativeRevocationRequest): Promise<import("../storage/repository").NativeRevocationResult>;
+    credentialOperations(): Promise<readonly import("./models").CredentialOperation[]>;
+    outbox(): Promise<readonly import("../storage/repository").OutboxRecord[]>;
+    claimOutbox(request: OutboxClaimRequest): Promise<readonly import("../storage/repository").OutboxRecord[]>;
+    acknowledgeOutbox(request: OutboxAcknowledgeRequest): Promise<import("../storage/repository").OutboxRecord>;
+    transition<K extends EntityKind>(kind: K, id: EntityMap[K]["id"], to: EntityMap[K]["status"], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    eligibility(request: EligibilityRequest): Promise<SlotEligibilityMetadata>;
+    checkCurrent(evidence: SlotEligibilityMetadata, request: EligibilityRequest): Promise<SlotEligibilityMetadata>;
+    doctor(): Promise<import("../storage/repository").RepositoryDoctor>;
+    close(): Promise<void>;
+    private assertTransitionPreconditions;
+    private nextTimestamp;
+    private verifyEvidence;
+    private evidenceRecord;
+    private runMutation;
+}

package/dist/domain/counter.d.ts

@@ -0,0 +1,7 @@
+import type { Brand } from "./ids";
+export type Counter = Brand<string, "Counter">;
+export declare const MAX_COUNTER = 9223372036854775807n;
+export declare function parseCounter(value: unknown, field?: string): Counter;
+export declare function counter(value: bigint): Counter;
+export declare function incrementCounter(value: Counter): Counter;
+export declare function compareCounters(left: Counter, right: Counter): -1 | 0 | 1;

package/dist/domain/eligibility.d.ts

@@ -0,0 +1,4 @@
+import type { AccountsRepository } from "../storage/repository";
+import type { EligibilityRequest, SlotEligibilityMetadata } from "./models";
+export declare function evaluateSlotEligibility(repository: AccountsRepository, request: EligibilityRequest, clock?: () => Date): Promise<SlotEligibilityMetadata>;
+export declare function checkCurrentEligibility(repository: AccountsRepository, previous: SlotEligibilityMetadata, request: EligibilityRequest, clock?: () => Date): Promise<SlotEligibilityMetadata>;

package/dist/domain/ids.d.ts

@@ -0,0 +1,47 @@
+declare const brand: unique symbol;
+export type Brand<T, Name extends string> = T & {
+    readonly [brand]: Name;
+};
+export type AccountId = Brand<string, "AccountId">;
+export type ProviderAccountId = AccountId;
+export type EntitlementId = Brand<string, "EntitlementId">;
+export type CapacityPoolId = Brand<string, "CapacityPoolId">;
+export type AccessMethodId = Brand<string, "AccessMethodId">;
+export type AccountLaneId = AccessMethodId;
+export type AuthCapsuleId = Brand<string, "AuthCapsuleId">;
+export type CanonicalNodeId = Brand<string, "CanonicalNodeId">;
+export type CredentialBindingId = Brand<string, "CredentialBindingId">;
+export type CredentialOperationId = Brand<string, "CredentialOperationId">;
+export type EligibilityEvidenceId = Brand<string, "EligibilityEvidenceId">;
+export type AccountEventId = Brand<string, "AccountEventId">;
+export type OutboxId = Brand<string, "OutboxId">;
+export type EntityId = AccountId | EntitlementId | CapacityPoolId | AccessMethodId | AuthCapsuleId | CredentialBindingId;
+export type IdKind = "account" | "entitlement" | "capacity_pool" | "access_method" | "auth_capsule" | "canonical_node" | "credential_binding" | "credential_operation" | "eligibility_evidence" | "account_event" | "outbox";
+export declare function isUuidV7(value: string): boolean;
+export declare function generateUuidV7(nowMs?: number): string;
+export declare const parseAccountId: (value: unknown) => AccountId;
+export declare const parseProviderAccountId: (value: unknown) => AccountId;
+export declare const parseEntitlementId: (value: unknown) => EntitlementId;
+export declare const parseCapacityPoolId: (value: unknown) => CapacityPoolId;
+export declare const parseAccessMethodId: (value: unknown) => AccessMethodId;
+export declare const parseAccountLaneId: (value: unknown) => AccessMethodId;
+export declare const parseAuthCapsuleId: (value: unknown) => AuthCapsuleId;
+export declare const parseCanonicalNodeId: (value: unknown) => CanonicalNodeId;
+export declare const parseCredentialBindingId: (value: unknown) => CredentialBindingId;
+export declare const parseCredentialOperationId: (value: unknown) => CredentialOperationId;
+export declare const parseEligibilityEvidenceId: (value: unknown) => EligibilityEvidenceId;
+export declare const parseAccountEventId: (value: unknown) => AccountEventId;
+export declare const parseOutboxId: (value: unknown) => OutboxId;
+export declare const newAccountId: (nowMs?: number) => AccountId;
+export declare const newProviderAccountId: (nowMs?: number) => AccountId;
+export declare const newEntitlementId: (nowMs?: number) => EntitlementId;
+export declare const newCapacityPoolId: (nowMs?: number) => CapacityPoolId;
+export declare const newAccessMethodId: (nowMs?: number) => AccessMethodId;
+export declare const newAccountLaneId: (nowMs?: number) => AccessMethodId;
+export declare const newAuthCapsuleId: (nowMs?: number) => AuthCapsuleId;
+export declare const newCredentialBindingId: (nowMs?: number) => CredentialBindingId;
+export declare const newCredentialOperationId: (nowMs?: number) => CredentialOperationId;
+export declare const newEligibilityEvidenceId: (nowMs?: number) => EligibilityEvidenceId;
+export declare const newAccountEventId: (nowMs?: number) => AccountEventId;
+export declare const newOutboxId: (nowMs?: number) => OutboxId;
+export {};

package/dist/domain/invariants.d.ts

@@ -0,0 +1,4 @@
+import type { AccountsRepository } from "../storage/repository";
+import type { EntityKind, EntityMap } from "./models";
+export declare function assertInitialRecord<K extends EntityKind>(kind: K, record: EntityMap[K]): void;
+export declare function assertInsertInvariants<K extends EntityKind>(repository: AccountsRepository, kind: K, record: EntityMap[K]): Promise<void>;

package/dist/domain/models.d.ts

@@ -0,0 +1,300 @@
+import type { Counter } from "./counter";
+import type { AccessMethodId, AccountId, AuthCapsuleId, CanonicalNodeId, CapacityPoolId, CredentialBindingId, CredentialOperationId, EligibilityEvidenceId, EntitlementId } from "./ids";
+export declare const ACCOUNTS_CAPACITY_SCHEMA_VERSION: "accounts.capacity.v1";
+export interface RecordBase<Id extends string> {
+    readonly id: Id;
+    readonly revision: Counter;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export type AccountStatus = "pending" | "active" | "suspended" | "revoked";
+export interface Account extends RecordBase<AccountId> {
+    readonly providerKey: string;
+    readonly ownerRef: string;
+    readonly displayLabel: string;
+    readonly providerSubjectRef?: string;
+    readonly providerSubjectCandidateRef?: string;
+    readonly ownershipEvidenceRef?: string;
+    readonly ownershipEvidenceIssuerRef?: string;
+    readonly ownershipEvidenceVersion?: string;
+    readonly ownershipEvidenceDigest?: string;
+    readonly ownershipEvidenceIssuedAt?: string;
+    readonly ownershipEvidenceExpiresAt?: string;
+    readonly ownershipGeneration?: Counter;
+    readonly providerDisplayHint?: string;
+    readonly status: AccountStatus;
+}
+export type ProviderAccount = Account;
+export type FundingKind = "subscription" | "metered" | "credit" | "contract" | "externally_managed";
+export type EntitlementStatus = "pending" | "active" | "paused" | "expired" | "revoked";
+export interface TermsDecision {
+    readonly decision: "allowed" | "denied";
+    readonly useCase: string;
+    readonly evidenceRef: string;
+    readonly verifiedBy: string;
+    readonly verifiedAt: string;
+    readonly expiresAt: string;
+    readonly termsVersion: string;
+    readonly termsDigest: string;
+}
+export interface UnknownTermsDecision {
+    readonly decision: "unknown";
+    readonly useCase: string;
+    readonly reasonCode: string;
+}
+export interface DataPolicy {
+    readonly allowedClassifications: readonly string[];
+    readonly retentionClass: "none" | "transient" | "bounded";
+    readonly maxRetentionDays?: Counter;
+}
+export interface CapabilitySet {
+    readonly operations: readonly string[];
+    readonly models: readonly string[];
+}
+export interface Entitlement extends RecordBase<EntitlementId> {
+    readonly accountId: AccountId;
+    readonly fundingKind: FundingKind;
+    readonly status: EntitlementStatus;
+    readonly capabilitySet?: CapabilitySet;
+    readonly capabilityEvidenceRef?: string;
+    readonly capabilityDigest?: string;
+    readonly capabilityExpiresAt?: string;
+    readonly executionPolicyDecisionRef?: string;
+    readonly executionPolicyDecisionDigest?: string;
+    readonly executionPolicyDecisionExpiresAt?: string;
+    readonly termsDecision?: TermsDecision | UnknownTermsDecision;
+    readonly dataPolicy?: DataPolicy;
+    readonly dataPolicyEvidenceRef?: string;
+    readonly dataPolicyDigest?: string;
+    readonly dataPolicyExpiresAt?: string;
+    readonly lastVerifiedAt?: string;
+}
+export type CapacityPoolStatus = "pending" | "active" | "draining" | "denied" | "retired";
+export type DenyState = "allowed" | "denied";
+export interface CapacityPool extends RecordBase<CapacityPoolId> {
+    readonly accountId: AccountId;
+    readonly capacityDomainRef: string;
+    readonly capacityEvidenceRef: string;
+    readonly capacityEvidenceIssuerRef: string;
+    readonly capacityEvidenceVersion: string;
+    readonly capacityEvidenceDigest: string;
+    readonly capacityEvidenceIssuedAt: string;
+    readonly capacityEvidenceExpiresAt: string;
+    readonly capacityEvidenceGeneration: Counter;
+    readonly capacityPolicyVersion: string;
+    readonly serializationKey: string;
+    readonly maxConcurrency: Counter;
+    readonly status: CapacityPoolStatus;
+    readonly capacityGeneration: Counter;
+    readonly denyGeneration: Counter;
+    readonly denyState: DenyState;
+}
+export type AccessTransport = "native_session" | "api_key" | "workload_identity";
+export type AccessMethodStatus = "draft" | "ready" | "draining" | "disabled" | "retired";
+export type HealthState = "healthy" | "degraded" | "unavailable" | "unknown";
+export interface HealthObservation {
+    readonly state: HealthState;
+    readonly evidenceRef: string;
+    readonly observedAt: string;
+    readonly expiresAt: string;
+}
+export interface AccessMethod extends RecordBase<AccessMethodId> {
+    readonly entitlementId: EntitlementId;
+    readonly capacityPoolId: CapacityPoolId;
+    readonly adapterKey: string;
+    readonly adapterVersion: string;
+    readonly accessTransport: AccessTransport;
+    readonly status: AccessMethodStatus;
+    readonly requiredIsolationPolicyRef?: string;
+    readonly requiredIsolationPolicyDigest?: string;
+    readonly isolationEvidenceExpiresAt?: string;
+    readonly allowedDestinationPolicyClasses?: readonly string[];
+    readonly parentPolicyDecisionRef?: string;
+    readonly parentPolicyDecisionDigest?: string;
+    readonly executionPolicyEvidenceRef?: string;
+    readonly executionPolicyDigest?: string;
+    readonly executionPolicyExpiresAt?: string;
+    readonly health?: HealthObservation;
+}
+export type AccountLane = AccessMethod;
+export type AuthCapsuleStatus = "unprovisioned" | "bootstrapping" | "ready" | "degraded" | "revoked";
+export interface CapsuleAttestation {
+    readonly evidenceRef: string;
+    readonly issuerRef: string;
+    readonly measurementDigest: string;
+    readonly attestedAt: string;
+    readonly expiresAt: string;
+}
+export interface AuthCapsule extends RecordBase<AuthCapsuleId> {
+    readonly accessMethodId: AccessMethodId;
+    readonly capacityPoolId: CapacityPoolId;
+    readonly kind: "native_session";
+    readonly ownerRef: string;
+    readonly placementKind: "enrolled_node";
+    readonly placementRef: CanonicalNodeId;
+    readonly hardwareKeyThumbprint: string;
+    readonly nodeGeneration: Counter;
+    readonly placementGeneration: Counter;
+    readonly status: AuthCapsuleStatus;
+    readonly refreshOwnerRef: string;
+    readonly refreshMode: "provider_native" | "interactive_owner";
+    readonly authGeneration: Counter;
+    readonly authStateRevision: Counter;
+    readonly isolationPolicyRef: string;
+    readonly isolationPolicyDigest: string;
+    readonly attestation?: CapsuleAttestation;
+    readonly lastHealthAt?: string;
+}
+export type CredentialBindingStatus = "pending" | "active" | "retiring" | "revoked";
+export type CredentialResolver = "brokered_secret" | "workload_identity" | "capsule_local_native";
+export type CredentialPurpose = "provider_session" | "api_key" | "workload_identity";
+export interface CredentialBindingBase extends RecordBase<CredentialBindingId> {
+    readonly accessMethodId: AccessMethodId;
+    readonly capacityPoolId: CapacityPoolId;
+    readonly authCapsuleId?: AuthCapsuleId;
+    readonly credentialFamilyId: string;
+    readonly purpose: CredentialPurpose;
+    readonly resolver: CredentialResolver;
+    readonly credentialGeneration: Counter;
+    readonly authStateRevision?: Counter;
+    readonly refreshMode?: "broker_serialized";
+    readonly policyDigest: string;
+    readonly rotatedAt?: string;
+}
+export interface CredentialBindingEvidence {
+    readonly bindingEvidenceRef: string;
+    readonly bindingEvidenceIssuerRef: string;
+    readonly bindingEvidenceDigest: string;
+    readonly bindingEvidenceExpiresAt: string;
+    readonly expiresAt?: string;
+}
+export interface NonterminalCredentialBinding extends CredentialBindingBase, CredentialBindingEvidence {
+    readonly status: "pending" | "active" | "retiring";
+}
+export interface RetiredHandleCredentialBinding extends CredentialBindingBase, CredentialBindingEvidence {
+    readonly status: "revoked";
+    readonly terminalKind: "retired_handle_generation";
+    readonly credentialHandleAuditDigest: string;
+    readonly revocationBarrierReceiptDigest: string;
+    readonly revokedAt: string;
+}
+export interface RevocationBarrierCredentialBinding extends CredentialBindingBase {
+    readonly status: "revoked";
+    readonly terminalKind: "revocation_barrier";
+    readonly lastUsableCredentialGeneration: Counter;
+    readonly revocationBarrierReceiptDigest: string;
+    readonly revokedAt: string;
+}
+export type CredentialBinding = NonterminalCredentialBinding | RetiredHandleCredentialBinding | RevocationBarrierCredentialBinding;
+export type CredentialBindingMetadata = CredentialBinding;
+export type CredentialOperationKind = "refresh" | "reauthentication" | "rotation" | "revocation";
+export type CredentialOperationState = "requested" | "quiescing" | "applying" | "verifying" | "completed" | "failed_before_dispatch" | "failed" | "quarantined";
+export interface CredentialOperation extends RecordBase<CredentialOperationId> {
+    readonly kind: CredentialOperationKind;
+    readonly sourceBindingId?: CredentialBindingId;
+    readonly targetBindingId?: CredentialBindingId;
+    readonly credentialFamilyId: string;
+    readonly capacityPoolId: CapacityPoolId;
+    readonly serializationKey: string;
+    readonly expectedSourceGeneration: Counter;
+    readonly expectedAuthStateRevision?: Counter;
+    readonly proposedTargetGeneration: Counter;
+    readonly proposedAuthStateRevision?: Counter;
+    readonly state: CredentialOperationState;
+    readonly idempotencyRequestHash: string;
+    readonly barrierReceiptDigest?: string;
+    readonly completionReceiptDigest?: string;
+}
+export type EntityKind = "account" | "entitlement" | "capacity_pool" | "access_method" | "auth_capsule" | "credential_binding";
+export interface EntityMap {
+    readonly account: Account;
+    readonly entitlement: Entitlement;
+    readonly capacity_pool: CapacityPool;
+    readonly access_method: AccessMethod;
+    readonly auth_capsule: AuthCapsule;
+    readonly credential_binding: CredentialBinding;
+}
+export type AnyEntity = EntityMap[EntityKind];
+export declare const ELIGIBILITY_REASON_CODES: readonly ["CURRENT_DENY", "ACCOUNT_NOT_ACTIVE", "ENTITLEMENT_NOT_ACTIVE", "TERMS_NOT_ALLOWED", "TERMS_STALE", "OPERATION_NOT_ALLOWED", "MODEL_NOT_ALLOWED", "DATA_CLASSIFICATION_NOT_ALLOWED", "DESTINATION_POLICY_NOT_ALLOWED", "CAPACITY_POOL_NOT_ACTIVE", "CAPACITY_EVIDENCE_STALE", "ACCESS_METHOD_NOT_READY", "HEALTH_NOT_HEALTHY", "HEALTH_STALE", "POLICY_EVIDENCE_STALE", "POLICY_DIGEST_MISMATCH", "CAPSULE_REQUIRED", "CAPSULE_NOT_READY", "CAPSULE_OWNER_MISMATCH", "CAPSULE_PLACEMENT_INVALID", "ATTESTATION_STALE", "CREDENTIAL_BINDING_REQUIRED", "CREDENTIAL_BINDING_NOT_ACTIVE", "CREDENTIAL_BINDING_RETIRING", "CREDENTIAL_BINDING_EXPIRED", "INVALID_ACCESS_TARGET", "GENERATION_MISMATCH", "DEPENDENCY_UNAVAILABLE", "RECOVERY_HOLD"];
+export type EligibilityReasonCode = (typeof ELIGIBILITY_REASON_CODES)[number];
+export interface EligibilityRequest {
+    readonly accessMethodId: AccessMethodId;
+    readonly operation: string;
+    readonly model: string;
+    readonly dataClassification: string;
+    readonly destinationPolicyClass: string;
+}
+export type EligibilityAccessTarget = {
+    readonly kind: "native";
+    readonly authCapsuleId: AuthCapsuleId;
+    readonly canonicalNodeId: string;
+    readonly nodeKeyThumbprint: string;
+    readonly nodeGeneration: Counter;
+    readonly placementGeneration: Counter;
+    readonly authGeneration: Counter;
+    readonly authStateRevision: Counter;
+} | {
+    readonly kind: "brokered";
+    readonly credentialBindingId: CredentialBindingId;
+    readonly resolver: "brokered_secret" | "workload_identity";
+} | {
+    readonly kind: "unresolved";
+};
+interface SlotEligibilityBase {
+    readonly schemaVersion: "accounts.slot-eligibility.v1";
+    readonly evidenceId: EligibilityEvidenceId;
+    readonly evidenceClass: "local_diagnostic";
+    readonly authority: "none";
+    readonly reservation: "none";
+    readonly accessMethodId: AccessMethodId;
+    readonly accessTarget: EligibilityAccessTarget;
+    readonly eligibilityRequestDigest: string;
+    readonly catalogIncarnation?: string;
+    readonly recoveryFrontierSequence?: Counter;
+    readonly recoveryFrontierHash?: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+export interface EligibleSlotEligibility extends SlotEligibilityBase {
+    readonly eligible: true;
+    readonly reasonCodes: readonly [];
+    readonly accountId: AccountId;
+    readonly entitlementId: EntitlementId;
+    readonly capacityPoolId: CapacityPoolId;
+    readonly ownerRef: string;
+    readonly accessTransport: AccessTransport;
+    readonly accessTarget: Exclude<EligibilityAccessTarget, {
+        readonly kind: "unresolved";
+    }>;
+    readonly serializationKey: string;
+    readonly maxConcurrency: Counter;
+    readonly capacityGeneration: Counter;
+    readonly denyGeneration: Counter;
+    readonly denyState: "allowed";
+    readonly credentialFamilyId: string;
+    readonly credentialGeneration: Counter;
+    readonly catalogIncarnation: string;
+    readonly recoveryFrontierSequence: Counter;
+    readonly recoveryFrontierHash: string;
+    readonly recordRevisionSet: Readonly<Record<Exclude<EntityKind, "auth_capsule">, Counter> & Partial<Record<"auth_capsule", Counter>>>;
+}
+export interface IneligibleSlotEligibility extends SlotEligibilityBase {
+    readonly eligible: false;
+    readonly reasonCodes: readonly EligibilityReasonCode[];
+    readonly accountId?: AccountId;
+    readonly entitlementId?: EntitlementId;
+    readonly capacityPoolId?: CapacityPoolId;
+    readonly ownerRef?: string;
+    readonly accessTransport?: AccessTransport;
+    readonly serializationKey?: string;
+    readonly maxConcurrency?: Counter;
+    readonly capacityGeneration?: Counter;
+    readonly denyGeneration?: Counter;
+    readonly denyState?: DenyState;
+    readonly credentialFamilyId?: string;
+    readonly credentialGeneration?: Counter;
+    readonly recordRevisionSet: Readonly<Partial<Record<EntityKind, Counter>>>;
+}
+export type SlotEligibilityMetadata = EligibleSlotEligibility | IneligibleSlotEligibility;
+export type SlotEligibility = SlotEligibilityMetadata;
+export {};