why

type Address struct {
	RunID string
	Step  int
}

type Aliases map[string]string

type Attenuation string

type Credential struct {
	Issuer   string   `json:"issuer"`
	Kind     string   `json:"kind"`
	ID       string   `json:"id"`
	Exp      int64    `json:"exp"`
	JKT      string   `json:"jkt"`
	AuthTime int64    `json:"auth_time"`
	AMR      []string `json:"amr"`
}

type Grant struct {
	Type       string      `json:"type"`
	Actions    []string    `json:"actions"`
	Locations  []string    `json:"locations"`
	Datatypes  []string    `json:"datatypes"`
	Identifier string      `json:"identifier"`
	Privileges []Privilege `json:"privileges"`
	// Intent is a named behalf extension on the RFC 9396 object: the
	// human's words for what was delegated ("resolve ticket 4417").
	Intent string `json:"intent"`
	// Tools is the AAT draft's own profile of RFC 9396 (§3.3): a map of tool
	// name to argument constraint set, carried on an entry whose Type is
	// AATGrantType. It is held as raw bytes rather than a decoded map so that
	// a malformed `tools` member cannot abort the projection of the fields
	// beside it — the draft's shape is read, and validated, in aat_i4.go.
	Tools json.RawMessage `json:"tools"`
	Raw   json.RawMessage `json:"-"`
}

type Hop struct {
	Depth        int
	MaxDepth     int
	ParHash      string
	JKT          string // RFC 7638 thumbprint of the hop's cnf.jwk (Q16)
	JTI          string
	Exp          int64
	Grants       []Grant
	Credential   Credential
	RootBinding  *RootBinding
	Verification Verification
	Carriage     string
	// StoredFlag is the attenuation_flag as captured (schema §7); Computed
	// and ComputedReason are this read's comparison against the parent hop
	// and are never written back (Q11).
	StoredFlag     string
	Computed       Attenuation
	ComputedReason string
}

type I4Violation struct {
	Tool        string
	Argument    string
	ParentType  string
	DerivedType string
	Detail      string
}

type Limit struct {
	Amount   string `json:"amount"`
	Currency string `json:"currency"`
}

type Options struct {
	Color   bool
	Aliases Aliases
}

type Privilege struct {
	Operation string `json:"operation"`
	Limit     *Limit `json:"limit"`
}

type Result struct {
	Address  Address
	LogIndex uint64
	LeafHash string
	// Payload is the exact stored payload span — the signed bytes,
	// untouched (the span rule).
	Payload []byte

	ReceiptID  string
	Kind       string
	CapturedAt string
	Operation  string
	Target     string
	Outcome    string
	// Amount is the operation's amount as captured when the surface reported
	// a decimal, and the read-time rendering of `amount_cents` when it
	// reported minor units (see amountOf). It is what the scope check
	// compares.
	Amount   string
	Currency string
	ActorJKT string

	// StoredAttribution is the receipt-level rollup as captured (§8).
	StoredAttribution string
	AttributionClass  string

	Chain  []Hop
	Excess *ScopeExcess
	// VerifiedHops of TotalHops is the "chain intact for N of M hops" line.
	VerifiedHops int
	TotalHops    int
}

type RootBinding struct {
	Nonce      string `json:"nonce"`
	DeviceJKT  string `json:"device_jkt"`
	IDTokenRef string `json:"id_token_ref"`
}

type RunRow struct {
	RunID   string
	Started string // the first captured_at in the run, verbatim
	// Status is the run's outcome: `ok` unless some receipt records a
	// failed operation. Two successful runs both reading `ok` is the
	// point of the listing, not a gap in it — an error tracker shows
	// nothing here, and the divergence that matters is only visible to
	// `behalf diff`.
	//
	// Run *completeness* (Q82) is deliberately not this column: it is
	// marked by a session-end receipt, the frozen kind enum has no such
	// kind yet, so on v1 data every run would read `open` forever. That
	// belongs in the listing once the kind exists, not before.
	Status string
	// Actions counts the action-family receipts — the denominator of the
	// attribution metric (Q86).
	Actions int64
	// Actor names the human at the root of the delegation chain — who the
	// run was carried out on behalf of, which is the question the product
	// exists to answer. It is a display label off the local alias map
	// (Q16): asserted, never evidence.
	Actor string
	// Attribution is the run's weakest attribution, rendered from the
	// stored per-hop verification states (Q12, Q86).
	Attribution string
}

type ScopeExcess struct {
	Operation         string
	Limit             string // the tightest delegated ceiling, verbatim
	Currency          string
	Amount            string // what the operation actually did, verbatim
	ComparatorVersion string
}

type Verification struct {
	Status      string `json:"status"`
	Method      string `json:"method"`
	EvidenceRef string `json:"evidence_ref"`
}