workspace

type EnvironmentScope struct {
	EnvironmentID    string
	KeyID            string
	CredentialDigest []byte
}

type Scope struct {
	ID string
	// Session is non-nil only for a per-Work Session credential. Environment
	// is non-nil only for a supervisor key. Workspace keys leave both nil.
	Session     *SessionScope
	Environment *EnvironmentScope
}

type SessionScope struct {
	// ResultOnly is the brief terminal healthcheck replay grant. It never
	// authorizes lease renewal or Session execution.
	ResultOnly    bool
	EnvironmentID string
	WorkID        string
	SessionID     string
	// CredentialDigest is the server-side SHA-256 identity of the bearer.
	// Repositories use it to fence mutations in the same transaction as the
	// protected write, closing the middleware-to-database reclaim race.
	CredentialDigest []byte
	Skills           map[SkillVersion]struct{}
	// Memories records the access snapshotted on each Memory Store attached to
	// the Session. The per-Work credential may read only these stores and may
	// mutate a store only when its value is "read_write".
	Memories map[string]string
}

type SkillVersion struct {
	ID      string
	Version string
}