@treeseed/sdk 0.12.62 → 0.13.0-rc.1

package/LICENSE

@@ -0,0 +1,13 @@
+Copyright 2026 Fractal Synapse Labs LCA PBC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -19,6 +19,8 @@ The SDK is the shared platform substrate used by:
 
 The SDK is not a UI package, admin portal, backend server, CLI parser, capacity-provider runtime, AgentKernel runtime, or ecommerce implementation. See the root [Package Ownership](../../docs/package-ownership.md) guide for the full system map.
 
+The `@treeseed/sdk/account-contracts` export is the canonical portable contract for auth availability, credential/provider results, account identity and sessions, notification capabilities/preferences, and private personal themes. `@treeseed/sdk/platform/plugin` owns the `TreeseedRouteCapability` registry vocabulary consumed by package route registries and generated UI inventories. These contracts contain no UI or backend implementation.
+
 ## Which Surface Should I Use?
 
 Treeseed exposes three public SDK surfaces, but they are not peers:
@@ -297,7 +299,7 @@ await treeDx.metrics();
 Mocked end-to-end TreeDX contract tests prove the SDK can drive the TreeDX repository loop without an agent-side clone when `contentPathMap` is supplied:
 
 ```bash
-npx vitest run --config ./vitest.config.ts test/utils/treedx-e2e-contract.test.ts
+npx vitest run --config ./vitest.config.ts tests/contract/treedx/treedx-e2e-contract.test.ts
 ```
 
 The optional live contract command reports `not configured` and exits
@@ -381,7 +383,7 @@ const scoped = sdk.scopeForAgent({
 The package also exports:
 
 - workflow helpers such as `TreeseedWorkflowSdk`
-- remote and queue clients such as `RemoteTreeseedClient`, `CloudflareQueuePullClient`, and `CloudflareQueuePushClient`
+- remote clients such as `RemoteTreeseedClient`
 - model registry, field, and filter utilities
 - plugin/runtime types and helpers
 

package/dist/accounts/account-contracts.d.ts

@@ -0,0 +1,170 @@
+export type AuthAvailabilityStatus = 'empty' | 'invalid' | 'reserved' | 'taken' | 'available' | 'throttled' | 'error';
+export interface AuthAvailabilityResult {
+    value: string;
+    available: boolean;
+    status: AuthAvailabilityStatus;
+    message: string;
+    retryAfterSeconds?: number;
+}
+export type AuthProviderId = 'github' | 'google' | 'microsoft' | 'apple';
+export interface AuthProviderCapability {
+    id: AuthProviderId;
+    label: string;
+}
+export interface WebAuthenticationResult {
+    accessToken: string;
+    refreshToken?: string | null;
+    tokenType: 'Bearer';
+    expiresAt: string;
+    expiresInSeconds: number;
+    principal: ApiPrincipal;
+}
+export interface CredentialRegistrationRequest {
+    firstName: string;
+    lastName: string;
+    username: string;
+    email: string;
+    password: string;
+    returnTo?: string;
+    inviteToken?: string;
+}
+export interface CredentialRegistrationResult extends Partial<WebAuthenticationResult> {
+    confirmationRequired?: boolean;
+    confirmationToken?: string;
+}
+export interface UsernameClaimResult extends WebAuthenticationResult {
+    username: string;
+}
+export type ReauthenticationAction = 'password_change' | 'account_delete';
+export interface ReauthenticationGrant {
+    grantId: string;
+    action: ReauthenticationAction;
+    expiresInSeconds: number;
+}
+export interface AccountMutationResult {
+    changed?: boolean;
+    deleted?: boolean;
+    id?: string;
+    status?: 'updated' | 'revoked' | 'already-revoked' | 'not-found';
+}
+export interface AccountEmailAddress {
+    id: string;
+    email: string;
+    status: 'pending' | 'verified';
+    isPrimary: boolean;
+    verificationRequestedAt?: string | null;
+    verifiedAt?: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface AccountEmailMutationResult {
+    emailAddress: AccountEmailAddress;
+    verificationSent?: boolean;
+    confirmationToken?: string;
+}
+export interface AccountIdentity {
+    id: string;
+    username: string;
+    displayName: string;
+    firstName?: string | null;
+    lastName?: string | null;
+    image?: string | null;
+    headline?: string | null;
+    profileSummary?: string | null;
+    location?: string | null;
+    website?: string | null;
+    expertise?: string[];
+    hasCredential: boolean;
+    emails: AccountEmailAddress[];
+    providers: Array<{
+        id: string;
+        provider: string;
+        email?: string | null;
+        linkedAt: string;
+        canUnlink: boolean;
+    }>;
+}
+export interface AccountPreferences {
+    timeZone: string;
+    realTimeUpdates: boolean;
+    realTimePollingIntervalSeconds: 2 | 5 | 15 | 30;
+}
+export type AccountPreferencesUpdate = Partial<AccountPreferences>;
+export interface AccountWebSession {
+    id: string;
+    provider: string;
+    expiresAt: string;
+    revokedAt?: string | null;
+    authenticatedAt: string;
+    lastSeenAt?: string | null;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    current: boolean;
+}
+export interface AccountDeletionBlocker {
+    code: 'platform_admin' | 'team_owner';
+    message: string;
+    teamId?: string;
+    teamSlug?: string;
+    teamName?: string;
+}
+export declare const NOTIFICATION_EMAIL_CADENCES: readonly ["immediate", "daily", "weekly"];
+export type NotificationEmailCadence = typeof NOTIFICATION_EMAIL_CADENCES[number];
+export interface NotificationContentCapability {
+    id: string;
+    label: string;
+    description: string;
+    eventTypes: string[];
+}
+export declare const NOTIFICATION_CONTENT_CAPABILITIES: readonly NotificationContentCapability[];
+export interface NotificationProjectOverride {
+    projectId: string;
+    contentTypes: string[];
+}
+export interface NotificationProject {
+    id: string;
+    slug: string;
+    name?: string | null;
+}
+export interface NotificationPreferences {
+    emailCadence: NotificationEmailCadence;
+    globalContentTypes: string[];
+    projectOverrides: NotificationProjectOverride[];
+}
+export interface AccountNotification {
+    id: string;
+    eventType: string;
+    contentType: string;
+    projectId: string;
+    title: string;
+    summary?: string | null;
+    targetUrl: string;
+    createdAt: string;
+    readAt?: string | null;
+}
+export interface PersonalThemePaletteMode {
+    canvas: string;
+    surface: string;
+    text: string;
+    accent: string;
+}
+export interface PersonalThemePalette {
+    light: PersonalThemePaletteMode;
+    dark: PersonalThemePaletteMode;
+}
+export interface PersonalThemeDraft {
+    name: string;
+    baseScheme: string;
+    palette: PersonalThemePalette;
+}
+export interface PersonalTheme extends PersonalThemeDraft {
+    id: string;
+    schemeId: string;
+    compilerVersion: number;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const PERSONAL_THEME_COMPILER_VERSION = 1;
+export declare function normalizeNotificationPreferences(input: Partial<NotificationPreferences> | null | undefined): NotificationPreferences;
+export declare function isValidPersonalThemeDraft(input: unknown): input is PersonalThemeDraft;
+import type { ApiPrincipal } from '../api/types.js';

package/dist/accounts/account-contracts.js

@@ -0,0 +1,33 @@
+const NOTIFICATION_EMAIL_CADENCES = ["immediate", "daily", "weekly"];
+const NOTIFICATION_CONTENT_CAPABILITIES = [
+  { id: "objectives", label: "Objectives", description: "Strategic objectives and changes to their status.", eventTypes: ["content.objective.published"] },
+  { id: "questions", label: "Questions", description: "New research questions and published answers.", eventTypes: ["content.question.published"] },
+  { id: "notes", label: "Notes", description: "Linked observations, feedback, and implementation notes.", eventTypes: ["content.note.published"] },
+  { id: "proposals", label: "Proposals", description: "New proposals and material proposal updates.", eventTypes: ["content.proposal.published"] },
+  { id: "decisions", label: "Decisions", description: "Accepted, rejected, deferred, or superseded decisions.", eventTypes: ["content.decision.published"] },
+  { id: "agents", label: "Agents", description: "Project agent definition changes.", eventTypes: ["content.agent.published"] }
+];
+const PERSONAL_THEME_COMPILER_VERSION = 1;
+function normalizeNotificationPreferences(input) {
+  const allowed = new Set(NOTIFICATION_CONTENT_CAPABILITIES.map((entry) => entry.id));
+  const cadence = NOTIFICATION_EMAIL_CADENCES.includes(input?.emailCadence) ? input?.emailCadence : "daily";
+  const normalizeTypes = (values) => Array.isArray(values) ? [...new Set(values.filter((value) => typeof value === "string" && allowed.has(value)))].sort() : [];
+  return {
+    emailCadence: cadence,
+    globalContentTypes: normalizeTypes(input?.globalContentTypes),
+    projectOverrides: Array.isArray(input?.projectOverrides) ? input.projectOverrides.filter((entry) => Boolean(entry && typeof entry.projectId === "string" && entry.projectId.trim())).map((entry) => ({ projectId: entry.projectId.trim(), contentTypes: normalizeTypes(entry.contentTypes) })).sort((left, right) => left.projectId.localeCompare(right.projectId)) : []
+  };
+}
+function isValidPersonalThemeDraft(input) {
+  if (!input || typeof input !== "object") return false;
+  const draft = input;
+  const color = (value) => typeof value === "string" && /^#[0-9a-f]{6}$/iu.test(value);
+  return typeof draft.name === "string" && draft.name.trim().length >= 2 && draft.name.trim().length <= 60 && typeof draft.baseScheme === "string" && Boolean(draft.baseScheme.trim()) && Boolean(draft.palette?.light && draft.palette?.dark) && ["canvas", "surface", "text", "accent"].every((key) => color(draft.palette.light[key]) && color(draft.palette.dark[key]));
+}
+export {
+  NOTIFICATION_CONTENT_CAPABILITIES,
+  NOTIFICATION_EMAIL_CADENCES,
+  PERSONAL_THEME_COMPILER_VERSION,
+  isValidPersonalThemeDraft,
+  normalizeNotificationPreferences
+};

package/dist/agent-capacity/allocation.d.ts

@@ -0,0 +1,186 @@
+export type CapacityAllocationSetStatus = 'draft' | 'validated' | 'active' | 'superseded' | 'archived';
+export type CapacityAllocationScope = 'project' | 'agent-class' | 'mode';
+export type CapacityAllocationOverflow = 'deny' | 'approval-required' | 'borrow';
+export type CapacityGrantStatus = 'planned' | 'active' | 'paused' | 'revoked' | 'expired';
+export interface CapacityAllocationSlicePolicy {
+    targetPercent: number;
+    minPercent: number;
+    maxPercent: number;
+    hardCapPercent: number;
+}
+export interface CapacityAllocationSlice {
+    id: string;
+    scope: CapacityAllocationScope;
+    targetId: string;
+    parentSliceId?: string | null;
+    policy: CapacityAllocationSlicePolicy;
+    metadata?: Record<string, unknown>;
+}
+export interface CapacityReservePolicy {
+    percent: number;
+    overflow: CapacityAllocationOverflow;
+}
+export interface CapacityBorrowingRule {
+    id: string;
+    fromSliceId: string;
+    toSliceId: string;
+    maxPercent: number;
+    requiresApproval: boolean;
+    allocationPriorityBand: 'minimum' | 'target' | 'normal' | 'overflow';
+    allocationPriorityScore: number;
+}
+export interface CapacityAllocationSetV2 {
+    schemaVersion: 2;
+    id: string;
+    teamId: string;
+    version: number;
+    status: CapacityAllocationSetStatus;
+    effectiveFrom: string;
+    effectiveUntil?: string | null;
+    reservePolicy: CapacityReservePolicy;
+    slices: CapacityAllocationSlice[];
+    borrowingRules: CapacityBorrowingRule[];
+    createdById?: string | null;
+    activatedAt?: string | null;
+    supersededById?: string | null;
+    metadata?: Record<string, unknown>;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface CapacityGrantV2 {
+    schemaVersion: 2;
+    id: string;
+    membershipId: string;
+    teamId: string;
+    providerId: string;
+    projectId: string;
+    environment: string;
+    status: CapacityGrantStatus;
+    executionProviderIds: string[];
+    laneIds: string[];
+    capabilities: string[];
+    allowedModes: Array<'planning' | 'acting'>;
+    dailyAgentSecondsLimit?: number | null;
+    monthlyAgentSecondsLimit?: number | null;
+    maxConcurrentAssignments?: number | null;
+    budgetLimits?: {
+        tokens?: number | null;
+        cost?: {
+            amount: number;
+            currency: string;
+        } | null;
+        native?: Array<{
+            unit: string;
+            amount: number;
+        }>;
+    } | null;
+    unmetered?: boolean;
+    expiresAt?: string | null;
+    metadata?: Record<string, unknown>;
+}
+export type CapacityAdmissionReasonCode = 'allowed' | 'membership_not_approved' | 'membership_id_mismatch' | 'membership_suspended' | 'membership_revoked' | 'membership_team_mismatch' | 'membership_provider_mismatch' | 'availability_session_not_open' | 'outside_availability_window' | 'missing_active_grant' | 'grant_membership_mismatch' | 'grant_team_mismatch' | 'grant_provider_mismatch' | 'grant_expired' | 'grant_project_mismatch' | 'grant_environment_mismatch' | 'grant_mode_denied' | 'grant_capability_missing' | 'grant_execution_provider_denied' | 'grant_lane_denied' | 'grant_time_exhausted' | 'grant_concurrency_exhausted' | 'workday_not_active' | 'workday_budget_exhausted' | 'allocation_set_not_active' | 'allocation_set_not_effective' | 'allocation_team_mismatch' | 'allocation_slice_missing' | 'allocation_hard_cap_exhausted' | 'allocation_borrowing_approval_required' | 'allocation_borrowing_denied' | 'provider_capacity_exhausted' | 'provider_capability_missing' | 'provider_local_limit_exhausted' | 'acting_decision_not_approved' | 'acting_readiness_not_ready' | 'acting_capacity_plan_not_accepted' | 'requested_seconds_invalid' | 'requested_budget_invalid' | 'grant_token_exhausted' | 'grant_cost_exhausted' | 'grant_native_exhausted' | 'provider_budget_exhausted';
+export interface CapacityAdmissionInput {
+    now: string;
+    request: {
+        teamId: string;
+        providerId: string;
+        membershipId: string;
+        projectId: string;
+        environment: string;
+        agentClassId: string;
+        mode: 'planning' | 'acting';
+        executionProviderId?: string | null;
+        laneId?: string | null;
+        requiredCapabilities: string[];
+        requestedSeconds: number;
+        budget?: import('./contracts/support/time-capacity.js').CapacityBudgetV2 | null;
+    };
+    membership: {
+        id: string;
+        teamId: string;
+        providerId: string;
+        status: 'approved' | 'suspended' | 'revoked';
+    };
+    availability: {
+        status: 'open' | 'draining' | 'closed' | 'expired';
+        availableFrom: string;
+        availableUntil?: string | null;
+    };
+    grant?: CapacityGrantV2 | null;
+    workday: {
+        id: string;
+        status: 'draft' | 'active' | 'paused' | 'completed' | 'cancelled';
+        totalSeconds: number;
+        committedSeconds: number;
+    };
+    allocationSet?: CapacityAllocationSetV2 | null;
+    allocationSliceIds: string[];
+    committedSecondsBySlice: Record<string, number>;
+    committedBorrowedSecondsByRule?: Record<string, number>;
+    reserveCommittedSeconds?: number;
+    approvedBorrowingRuleIds?: string[];
+    providerCapacity: {
+        availableAgentSeconds: number;
+        availableConcurrentAssignments: number;
+        capabilities?: string[];
+        availableTokens?: number | null;
+        availableCost?: number | null;
+        availableNative?: Record<string, number>;
+    };
+    providerLocalLimits: {
+        availableAgentSeconds: number;
+        availableConcurrentAssignments: number;
+        availableTokens?: number | null;
+        availableCost?: number | null;
+        availableNative?: Record<string, number>;
+    };
+    grantCommitted: {
+        dailyAgentSeconds: number;
+        monthlyAgentSeconds: number;
+        activeAssignments: number;
+        tokens?: number;
+        cost?: number;
+        native?: Record<string, number>;
+    };
+    acting?: {
+        decisionApproved: boolean;
+        readinessReady: boolean;
+        capacityPlanAccepted: boolean;
+    };
+}
+export interface CapacityAdmissionDecision {
+    allowed: boolean;
+    reasonCode: CapacityAdmissionReasonCode;
+    reasonCodes: CapacityAdmissionReasonCode[];
+    maxReservableSeconds: number;
+    requiresApproval: boolean;
+    allocationPriorityBand: 'minimum' | 'target' | 'normal' | 'overflow';
+    allocationPriorityScore: number;
+    grantId?: string | null;
+    allocationSetId?: string | null;
+    allocationVersion?: number | null;
+    counterClaims: CapacityAdmissionCounterClaim[];
+    policySnapshot: Record<string, unknown>;
+    explanation: Array<{
+        gate: string;
+        allowed: boolean;
+        remaining?: number;
+        detail?: string;
+    }>;
+}
+export interface CapacityAdmissionCounterClaim {
+    id: string;
+    scope: 'grant-daily' | 'grant-monthly' | 'grant-concurrency' | 'grant-token' | 'grant-cost' | 'grant-native' | 'provider-time' | 'provider-concurrency' | 'provider-token' | 'provider-cost' | 'provider-native' | 'provider-local-time' | 'provider-local-concurrency' | 'provider-local-token' | 'provider-local-cost' | 'provider-local-native' | 'workday' | 'allocation-slice' | 'allocation-overflow' | 'allocation-reserve' | 'allocation-borrow';
+    scopeId: string;
+    periodKey: string;
+    hardLimit: number;
+    amount: number;
+    release: 'settlement-difference' | 'assignment-terminal';
+    dimension?: 'time' | 'concurrency' | 'tokens' | 'cost' | 'native';
+    unit?: string | null;
+}
+export { validateCapacityAllocationSetV2, validateCapacityGrantV2 } from './validation/allocation.js';
+export type { CapacityAllocationDiagnostic, CapacityAllocationValidation } from './validation/allocation.js';
+export declare function timestamp(value: string | null | undefined): number | null;
+export declare function firstReason(reasons: CapacityAdmissionReasonCode[]): CapacityAdmissionReasonCode;
+export declare function evaluateCapacityAdmission(input: CapacityAdmissionInput): CapacityAdmissionDecision;

package/dist/agent-capacity/allocation.js

@@ -0,0 +1,226 @@
+import { validateCapacityAllocationSetV2, validateCapacityGrantV2 } from "./validation/allocation.js";
+function timestamp(value) {
+  const parsed = value ? Date.parse(value) : Number.NaN;
+  return Number.isFinite(parsed) ? parsed : null;
+}
+function firstReason(reasons) {
+  return reasons[0] ?? "allowed";
+}
+function evaluateCapacityAdmission(input) {
+  const reasons = [];
+  const explanation = [];
+  let remaining = Number.POSITIVE_INFINITY;
+  let requiresApproval = false;
+  let allocationCalculations = {};
+  let allocationPriorityBand = "overflow";
+  let allocationPriorityScore = 0;
+  const counterClaims = [];
+  const deny = (gate, code, detail) => {
+    reasons.push(code);
+    explanation.push({ gate, allowed: false, detail });
+  };
+  const allow = (gate, gateRemaining, detail) => {
+    if (gateRemaining !== void 0) remaining = Math.min(remaining, Math.max(0, gateRemaining));
+    explanation.push({ gate, allowed: true, remaining: gateRemaining, detail });
+  };
+  const now = timestamp(input.now) ?? Date.now();
+  const request = input.request;
+  const requestedTokens = Number(request.budget?.tokens.hardLimitTokens ?? 0);
+  const requestedCost = Number(request.budget?.cost?.hardLimitAmount ?? 0);
+  const requestedNative = (request.budget?.native ?? []).filter((entry) => entry.cap != null).map((entry) => ({ unit: entry.unit, amount: Number(entry.cap) }));
+  if (!Number.isFinite(request.requestedSeconds) || request.requestedSeconds <= 0) deny("request", "requested_seconds_invalid");
+  if (requestedTokens < 0 || requestedCost < 0 || requestedNative.some((entry) => !entry.unit || !Number.isFinite(entry.amount) || entry.amount < 0)) deny("request-budget", "requested_budget_invalid");
+  if (input.membership.status !== "approved") deny("membership", input.membership.status === "suspended" ? "membership_suspended" : input.membership.status === "revoked" ? "membership_revoked" : "membership_not_approved");
+  else allow("membership");
+  if (input.membership.id !== request.membershipId) deny("membership-id", "membership_id_mismatch");
+  else allow("membership-id");
+  if (input.membership.teamId !== request.teamId) deny("membership-team", "membership_team_mismatch");
+  else allow("membership-team");
+  if (input.membership.providerId !== request.providerId) deny("membership-provider", "membership_provider_mismatch");
+  else allow("membership-provider");
+  if (input.availability.status !== "open") deny("availability", "availability_session_not_open");
+  else if ((timestamp(input.availability.availableFrom) ?? Number.POSITIVE_INFINITY) > now || input.availability.availableUntil && (timestamp(input.availability.availableUntil) ?? 0) <= now) deny("availability", "outside_availability_window");
+  else allow("availability");
+  const grant = input.grant;
+  if (!grant || grant.status !== "active") deny("grant", "missing_active_grant");
+  else {
+    if (grant.membershipId !== request.membershipId) deny("grant-membership", "grant_membership_mismatch");
+    else allow("grant-membership");
+    if (grant.teamId !== request.teamId) deny("grant-team", "grant_team_mismatch");
+    else allow("grant-team");
+    if (grant.providerId !== request.providerId) deny("grant-provider", "grant_provider_mismatch");
+    else allow("grant-provider");
+    if (grant.expiresAt && (timestamp(grant.expiresAt) ?? 0) <= now) deny("grant-expiry", "grant_expired");
+    else allow("grant-expiry");
+    if (grant.projectId !== request.projectId) deny("grant-project", "grant_project_mismatch");
+    else allow("grant-project");
+    if (grant.environment !== request.environment) deny("grant-environment", "grant_environment_mismatch");
+    else allow("grant-environment");
+    if (!grant.allowedModes.includes(request.mode)) deny("grant-mode", "grant_mode_denied");
+    else allow("grant-mode");
+    const missing = request.requiredCapabilities.filter((capability) => !grant.capabilities.includes(capability));
+    if (missing.length) deny("grant-capabilities", "grant_capability_missing", missing.join(", "));
+    else allow("grant-capabilities");
+    if (request.executionProviderId && grant.executionProviderIds.length && !grant.executionProviderIds.includes(request.executionProviderId)) deny("grant-execution-provider", "grant_execution_provider_denied");
+    else allow("grant-execution-provider");
+    if (request.laneId && grant.laneIds.length && !grant.laneIds.includes(request.laneId)) deny("grant-lane", "grant_lane_denied");
+    else allow("grant-lane");
+    if (!grant.unmetered && grant.dailyAgentSecondsLimit == null && grant.monthlyAgentSecondsLimit == null) deny("grant-time", "grant_time_exhausted", "Grant must declare agent-time limits or explicit unmetered capacity.");
+    if (grant.dailyAgentSecondsLimit != null) {
+      const available = grant.dailyAgentSecondsLimit - input.grantCommitted.dailyAgentSeconds;
+      if (available <= 0) deny("grant-daily", "grant_time_exhausted");
+      else allow("grant-daily", available);
+      counterClaims.push({ id: `grant-daily:${grant.id}:${input.now.slice(0, 10)}`, scope: "grant-daily", scopeId: grant.id, periodKey: input.now.slice(0, 10), hardLimit: grant.dailyAgentSecondsLimit, amount: request.requestedSeconds, release: "settlement-difference" });
+    }
+    if (grant.monthlyAgentSecondsLimit != null) {
+      const available = grant.monthlyAgentSecondsLimit - input.grantCommitted.monthlyAgentSeconds;
+      if (available <= 0) deny("grant-monthly", "grant_time_exhausted");
+      else allow("grant-monthly", available);
+      counterClaims.push({ id: `grant-monthly:${grant.id}:${input.now.slice(0, 7)}`, scope: "grant-monthly", scopeId: grant.id, periodKey: input.now.slice(0, 7), hardLimit: grant.monthlyAgentSecondsLimit, amount: request.requestedSeconds, release: "settlement-difference" });
+    }
+    if (grant.maxConcurrentAssignments != null) {
+      const available = grant.maxConcurrentAssignments - input.grantCommitted.activeAssignments;
+      if (available < 1) deny("grant-concurrency", "grant_concurrency_exhausted");
+      else allow("grant-concurrency");
+      counterClaims.push({ id: `grant-concurrency:${grant.id}:active`, scope: "grant-concurrency", scopeId: grant.id, periodKey: "active", hardLimit: grant.maxConcurrentAssignments, amount: 1, release: "assignment-terminal", dimension: "concurrency" });
+    }
+    const tokenLimit = Number(grant.budgetLimits?.tokens ?? Number.NaN);
+    if (requestedTokens > 0 && Number.isFinite(tokenLimit)) {
+      const available = tokenLimit - Number(input.grantCommitted.tokens ?? 0);
+      if (available < requestedTokens) deny("grant-token", "grant_token_exhausted");
+      else allow("grant-token", available);
+      counterClaims.push({ id: `grant-token:${grant.id}:lifetime`, scope: "grant-token", scopeId: grant.id, periodKey: "lifetime", hardLimit: tokenLimit, amount: requestedTokens, release: "settlement-difference", dimension: "tokens" });
+    }
+    const costLimit = Number(grant.budgetLimits?.cost?.amount ?? Number.NaN);
+    if (requestedCost > 0 && Number.isFinite(costLimit)) {
+      const available = costLimit - Number(input.grantCommitted.cost ?? 0);
+      if (available < requestedCost) deny("grant-cost", "grant_cost_exhausted");
+      else allow("grant-cost", available);
+      counterClaims.push({ id: `grant-cost:${grant.id}:${grant.budgetLimits?.cost?.currency ?? "USD"}`, scope: "grant-cost", scopeId: grant.id, periodKey: grant.budgetLimits?.cost?.currency ?? "USD", hardLimit: costLimit, amount: requestedCost, release: "settlement-difference", dimension: "cost", unit: grant.budgetLimits?.cost?.currency ?? "USD" });
+    }
+    for (const native of requestedNative) {
+      const limit = grant.budgetLimits?.native?.find((entry) => entry.unit === native.unit)?.amount;
+      if (limit == null) continue;
+      const available = limit - Number(input.grantCommitted.native?.[native.unit] ?? 0);
+      if (available < native.amount) deny(`grant-native:${native.unit}`, "grant_native_exhausted");
+      else allow(`grant-native:${native.unit}`, available);
+      counterClaims.push({ id: `grant-native:${grant.id}:${native.unit}`, scope: "grant-native", scopeId: grant.id, periodKey: native.unit, hardLimit: limit, amount: native.amount, release: "settlement-difference", dimension: "native", unit: native.unit });
+    }
+  }
+  if (input.workday.status !== "active") deny("workday", "workday_not_active");
+  else {
+    const available = input.workday.totalSeconds - input.workday.committedSeconds;
+    if (available <= 0) deny("workday-budget", "workday_budget_exhausted");
+    else allow("workday-budget", available);
+    counterClaims.push({ id: `workday:${input.workday.id}:lifetime`, scope: "workday", scopeId: input.workday.id, periodKey: "lifetime", hardLimit: input.workday.totalSeconds, amount: request.requestedSeconds, release: "settlement-difference" });
+  }
+  const allocation = input.allocationSet;
+  if (!allocation || allocation.status !== "active") deny("allocation", "allocation_set_not_active");
+  else if (allocation.teamId !== request.teamId) deny("allocation", "allocation_team_mismatch");
+  else if ((timestamp(allocation.effectiveFrom) ?? Number.POSITIVE_INFINITY) > now || allocation.effectiveUntil && (timestamp(allocation.effectiveUntil) ?? 0) <= now) deny("allocation", "allocation_set_not_effective");
+  else {
+    allow("allocation");
+    const hierarchy = evaluateAllocationHierarchy({
+      allocation,
+      workdayId: input.workday.id,
+      totalSeconds: input.workday.totalSeconds,
+      requestedSeconds: request.requestedSeconds,
+      selectedSliceIds: input.allocationSliceIds,
+      committedBySlice: input.committedSecondsBySlice,
+      committedBorrowedByRule: input.committedBorrowedSecondsByRule,
+      reserveCommittedSeconds: input.reserveCommittedSeconds,
+      approvedBorrowingRuleIds: input.approvedBorrowingRuleIds
+    });
+    reasons.push(...hierarchy.reasons);
+    explanation.push(...hierarchy.explanation);
+    counterClaims.push(...hierarchy.counterClaims);
+    remaining = Math.min(remaining, hierarchy.maxReservableSeconds);
+    requiresApproval ||= hierarchy.requiresApproval;
+    allocationCalculations = hierarchy.calculations;
+    allocationPriorityBand = hierarchy.priorityBand;
+    allocationPriorityScore = hierarchy.priorityScore;
+  }
+  if (input.providerCapacity.availableConcurrentAssignments < 1 || input.providerCapacity.availableAgentSeconds <= 0) deny("provider-capacity", "provider_capacity_exhausted");
+  else {
+    allow("provider-capacity", input.providerCapacity.availableAgentSeconds);
+    const period = input.availability.availableFrom;
+    counterClaims.push(
+      { id: `provider-time:${request.providerId}:${period}`, scope: "provider-time", scopeId: request.providerId, periodKey: period, hardLimit: input.providerCapacity.availableAgentSeconds, amount: request.requestedSeconds, release: "settlement-difference", dimension: "time" },
+      { id: `provider-concurrency:${request.providerId}:${period}`, scope: "provider-concurrency", scopeId: request.providerId, periodKey: period, hardLimit: input.providerCapacity.availableConcurrentAssignments, amount: 1, release: "assignment-terminal", dimension: "concurrency" }
+    );
+  }
+  const advertisedCapabilities = input.providerCapacity.capabilities;
+  if (advertisedCapabilities) {
+    const missing = request.requiredCapabilities.filter((capability) => !advertisedCapabilities.includes(capability));
+    if (missing.length) deny("provider-capabilities", "provider_capability_missing", missing.join(", "));
+    else allow("provider-capabilities");
+  }
+  if (input.providerLocalLimits.availableConcurrentAssignments < 1 || input.providerLocalLimits.availableAgentSeconds <= 0) deny("provider-local", "provider_local_limit_exhausted");
+  else {
+    allow("provider-local", input.providerLocalLimits.availableAgentSeconds);
+    const period = input.availability.availableFrom;
+    counterClaims.push(
+      { id: `provider-local-time:${request.providerId}:${period}`, scope: "provider-local-time", scopeId: request.providerId, periodKey: period, hardLimit: input.providerLocalLimits.availableAgentSeconds, amount: request.requestedSeconds, release: "settlement-difference", dimension: "time" },
+      { id: `provider-local-concurrency:${request.providerId}:${period}`, scope: "provider-local-concurrency", scopeId: request.providerId, periodKey: period, hardLimit: input.providerLocalLimits.availableConcurrentAssignments, amount: 1, release: "assignment-terminal", dimension: "concurrency" }
+    );
+  }
+  for (const [scope, available] of [["provider-token", input.providerCapacity.availableTokens], ["provider-local-token", input.providerLocalLimits.availableTokens]]) if (requestedTokens > 0 && available != null) {
+    if (available < requestedTokens) deny(scope, "provider_budget_exhausted");
+    counterClaims.push({ id: `${scope}:${request.providerId}:${input.availability.availableFrom}`, scope, scopeId: request.providerId, periodKey: input.availability.availableFrom, hardLimit: available, amount: requestedTokens, release: "settlement-difference", dimension: "tokens" });
+  }
+  for (const [scope, available] of [["provider-cost", input.providerCapacity.availableCost], ["provider-local-cost", input.providerLocalLimits.availableCost]]) if (requestedCost > 0 && available != null) {
+    if (available < requestedCost) deny(scope, "provider_budget_exhausted");
+    counterClaims.push({ id: `${scope}:${request.providerId}:${input.availability.availableFrom}`, scope, scopeId: request.providerId, periodKey: input.availability.availableFrom, hardLimit: available, amount: requestedCost, release: "settlement-difference", dimension: "cost", unit: request.budget?.cost?.currency ?? "USD" });
+  }
+  for (const native of requestedNative) for (const [scope, available] of [["provider-native", input.providerCapacity.availableNative?.[native.unit]], ["provider-local-native", input.providerLocalLimits.availableNative?.[native.unit]]]) if (available != null) {
+    if (available < native.amount) deny(`${scope}:${native.unit}`, "provider_budget_exhausted");
+    counterClaims.push({ id: `${scope}:${request.providerId}:${input.availability.availableFrom}:${native.unit}`, scope, scopeId: request.providerId, periodKey: native.unit, hardLimit: available, amount: native.amount, release: "settlement-difference", dimension: "native", unit: native.unit });
+  }
+  if (request.mode === "acting") {
+    if (!input.acting?.decisionApproved) deny("acting-decision", "acting_decision_not_approved");
+    else allow("acting-decision");
+    if (!input.acting?.readinessReady) deny("acting-readiness", "acting_readiness_not_ready");
+    else allow("acting-readiness");
+    if (!input.acting?.capacityPlanAccepted) deny("acting-capacity-plan", "acting_capacity_plan_not_accepted");
+    else allow("acting-capacity-plan");
+  }
+  if (remaining <= 0 && !reasons.includes("grant_time_exhausted") && !reasons.includes("workday_budget_exhausted") && !reasons.includes("allocation_hard_cap_exhausted")) reasons.push("allocation_hard_cap_exhausted");
+  const maxReservableSeconds = Number.isFinite(remaining) ? Math.max(0, remaining) : 0;
+  const allowed = reasons.length === 0 && maxReservableSeconds >= request.requestedSeconds;
+  if (!allowed && reasons.length === 0) reasons.push("allocation_hard_cap_exhausted");
+  return {
+    allowed,
+    reasonCode: firstReason(reasons),
+    reasonCodes: reasons,
+    maxReservableSeconds,
+    requiresApproval,
+    allocationPriorityBand,
+    allocationPriorityScore,
+    grantId: grant?.id ?? null,
+    allocationSetId: allocation?.id ?? null,
+    allocationVersion: allocation?.version ?? null,
+    counterClaims,
+    policySnapshot: {
+      allocationSetId: allocation?.id ?? null,
+      allocationVersion: allocation?.version ?? null,
+      grantId: grant?.id ?? null,
+      allocationSliceIds: [...input.allocationSliceIds],
+      requestedSeconds: request.requestedSeconds,
+      budget: request.budget ?? null,
+      laneId: request.laneId ?? null,
+      counterClaims,
+      calculations: allocationCalculations,
+      allocationPriorityBand,
+      allocationPriorityScore
+    },
+    explanation
+  };
+}
+import { evaluateAllocationHierarchy } from "./policy/capacity/allocations/allocation-hierarchy.js";
+export {
+  evaluateCapacityAdmission,
+  firstReason,
+  timestamp,
+  validateCapacityAllocationSetV2,
+  validateCapacityGrantV2
+};