$scopes Token scopes: action categories or * ability patterns. Empty = unrestricted * (PRD STORY-9.1, MCP02). * @param string|null $app_password_uuid Application password bound to this * agent, so a client that can only send * Basic auth still arrives with an agent * identity. Null = no binding (AF-13.2). * @param int|null $admin_confirmed_by The administrator who confirmed * that this agent runs as an * administrator (AF-25.15). * @param DateTimeImmutable|null $admin_confirmed_at When (UTC). Null for * every other agent. */ public function __construct( public readonly int $id, public readonly string $agent_key, public readonly string $name, public readonly int $wp_user_id, public readonly ?string $token_hash, public readonly string $status, public readonly DateTimeImmutable $created_at, public readonly array $scopes = array(), public readonly ?string $app_password_uuid = null, public readonly ?int $admin_confirmed_by = null, public readonly ?DateTimeImmutable $admin_confirmed_at = null ) { } /** * Whether an administrator confirmed this agent runs as an administrator * (AF-25.15, ADR-18 §9). Such an agent is bound only by an extension: * never by a bearer token or an application password. */ public function runs_as_admin(): bool { return null !== $this->admin_confirmed_at; } }