billing-internal

Service mode only. Pushes of the billing service (not routed publicly).

📄️The complete entitlement of a workspace (billing contract `product-entitlements`), stored when its version is newer. Only `status: active` makes the tenant writable; `limits.agents` becomes the tenant's agent limit.

The complete entitlement of a workspace (billing contract `product-entitlements`), stored when its version is newer. Only `status: active` makes the tenant writable; `limits.agents` becomes the tenant's agent limit.

📄️The desired state of one membership (billing contract `product-provisioning`): creates the tenant of an unknown workspace, the user of an unknown identity (never by email; `external_user_id` moves a known user to a new identity) and maps the role: admin → admin binding, member → viewer binding, on the whole tenant. Older versions change nothing. `revoked` removes the membership, its bindings, tokens and team memberships, and ends the user's sessions in this tenant.

The desired state of one membership (billing contract `product-provisioning`): creates the tenant of an unknown workspace, the user of an unknown identity (never by email; `external_user_id` moves a known user to a new identity) and maps the role: admin → admin binding, member → viewer binding, on the whole tenant. Older versions change nothing. `revoked` removes the membership, its bindings, tokens and team memberships, and ends the user's sessions in this tenant.