@lucern/contracts 0.1.0 → 0.1.2-alpha.1

package/dist/auth-session.contract.js

@@ -1,50 +1,48 @@
-/**
- * Session + Delegation Contract
- *
- * Canonical session lifecycle vocabulary shared by platform gateway auth,
- * hosted MCP auth, Master Control persistence, and SDK session tokens.
- */
-export const SESSION_AUTH_MODES = [
-    "interactive_user",
-    "service_principal",
-    "tenant_api_key",
-    "session_token",
+// src/auth.contract.ts
+var SESSION_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
 ];
-export const SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
-export const SESSION_LIFECYCLE_STATUSES = [
-    "active",
-    "expired",
-    "revoked",
+var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_LIFECYCLE_STATUSES = [
+  "active",
+  "expired",
+  "revoked"
 ];
-export function inferSessionPrincipalType(principalId) {
-    if (principalId.startsWith("user:")) {
-        return "human";
-    }
-    if (principalId.startsWith("agent:")) {
-        return "agent";
-    }
-    return "service";
+function inferSessionPrincipalType(principalId) {
+  if (principalId.startsWith("user:")) {
+    return "human";
+  }
+  if (principalId.startsWith("agent:")) {
+    return "agent";
+  }
+  return "service";
 }
-export function normalizeDelegationChain(args) {
-    if (args.delegationChain && args.delegationChain.length > 0) {
-        return [...args.delegationChain];
+function normalizeDelegationChain(args) {
+  if (args.delegationChain && args.delegationChain.length > 0) {
+    return [...args.delegationChain];
+  }
+  if (!args.delegatedBy) {
+    return;
+  }
+  return [
+    {
+      principalId: args.delegatedBy,
+      principalType: args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),
+      delegatedAt: args.delegatedAt,
+      reason: args.reason
     }
-    if (!args.delegatedBy) {
-        return;
-    }
-    return [
-        {
-            principalId: args.delegatedBy,
-            principalType: args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),
-            delegatedAt: args.delegatedAt,
-            reason: args.reason,
-        },
-    ];
+  ];
 }
-export function lastDelegator(delegationChain) {
-    if (!delegationChain || delegationChain.length === 0) {
-        return;
-    }
-    return delegationChain[delegationChain.length - 1]?.principalId;
+function lastDelegator(delegationChain) {
+  if (!delegationChain || delegationChain.length === 0) {
+    return;
+  }
+  return delegationChain[delegationChain.length - 1]?.principalId;
 }
+
+export { SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain };
+//# sourceMappingURL=auth-session.contract.js.map
 //# sourceMappingURL=auth-session.contract.js.map

package/dist/auth-session.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session.contract.js","sourceRoot":"","sources":["../src/auth-session.contract.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,eAAe;CACP,CAAC;AAGX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAG9E,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ;IACR,SAAS;IACT,SAAS;CACD,CAAC;AA2CX,MAAM,UAAU,yBAAyB,CACvC,WAAmB;IAEnB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAMxC;IACC,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,OAAO;QACL;YACE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EACX,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC;YACrE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,eAAiD;IAEjD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,OAAO,eAAe,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC;AAClE,CAAC"}
+{"version":3,"sources":["../src/auth.contract.ts"],"names":[],"mappings":";AAgBO,IAAM,kBAAA,GAAqB;AAAA,EAChC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AAGO,IAAM,uBAAA,GAA0B,CAAC,OAAA,EAAS,SAAA,EAAW,OAAO;AAG5D,IAAM,0BAAA,GAA6B;AAAA,EACxC,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AA2CO,SAAS,0BACd,WAAA,EACsB;AACtB,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,EAAG;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,QAAQ,CAAA,EAAG;AACpC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA;AACT;AAEO,SAAS,yBAAyB,IAAA,EAMF;AACrC,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC3D,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,eAAe,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,IAAA;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAA,EACE,IAAA,CAAK,eAAA,IAAmB,yBAAA,CAA0B,KAAK,WAAW,CAAA;AAAA,MACpE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,QAAQ,IAAA,CAAK;AAAA;AACf,GACF;AACF;AAEO,SAAS,cACd,eAAA,EACoB;AACpB,EAAA,IAAI,CAAC,eAAA,IAAmB,eAAA,CAAgB,MAAA,KAAW,CAAA,EAAG;AACpD,IAAA;AAAA,EACF;AACA,EAAA,OAAO,eAAA,CAAgB,eAAA,CAAgB,MAAA,GAAS,CAAC,CAAA,EAAG,WAAA;AACtD","file":"auth-session.contract.js","sourcesContent":["/**\n * @lucern/contracts — auth (canonical support contract)\n *\n * Consolidated flat support surface for Lucern authentication:\n *   - Session primitives (auth modes, principal types, lifecycle)\n *   - AuthContext shape + McpTransportKind + LucernSdkClient alias\n *\n * Consolidated from src/auth-session.contract.ts and src/auth-context.contract.ts\n * in EK-16 T1 PR 3a. Compat shims remain at both old paths until Lucern 1.0.0 (D12).\n */\n\n// =============================================================================\n// SESSION PRIMITIVES\n// (Formerly src/auth-session.contract.ts)\n// =============================================================================\n\nexport const SESSION_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const;\nexport type SessionAuthMode = (typeof SESSION_AUTH_MODES)[number];\n\nexport const SESSION_PRINCIPAL_TYPES = [\"human\", \"service\", \"agent\"] as const;\nexport type SessionPrincipalType = (typeof SESSION_PRINCIPAL_TYPES)[number];\n\nexport const SESSION_LIFECYCLE_STATUSES = [\n  \"active\",\n  \"expired\",\n  \"revoked\",\n] as const;\nexport type SessionLifecycleStatus =\n  (typeof SESSION_LIFECYCLE_STATUSES)[number];\n\nexport type SessionDelegationHop = {\n  principalId: string;\n  principalType: SessionPrincipalType;\n  authMode?: SessionAuthMode;\n  sessionId?: string;\n  delegatedAt?: number;\n  reason?: string;\n};\n\nexport type SessionAuditOutcome =\n  | \"accepted\"\n  | \"rejected\"\n  | \"revoked\"\n  | \"expired\";\n\nexport type SessionAuditEnvelope = {\n  sessionId: string;\n  authMode: SessionAuthMode;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  tenantId: string;\n  workspaceId?: string;\n  apiKeyId?: string;\n  scopes: readonly string[];\n  roles?: readonly string[];\n  delegationChain?: readonly SessionDelegationHop[];\n  sourceSessionId?: string;\n  expiresAt?: number;\n  request?: {\n    endpoint?: string;\n    method?: string;\n    correlationId?: string;\n  };\n  result?: {\n    outcome: SessionAuditOutcome;\n    reason?: string;\n  };\n};\n\nexport function inferSessionPrincipalType(\n  principalId: string\n): SessionPrincipalType {\n  if (principalId.startsWith(\"user:\")) {\n    return \"human\";\n  }\n  if (principalId.startsWith(\"agent:\")) {\n    return \"agent\";\n  }\n  return \"service\";\n}\n\nexport function normalizeDelegationChain(args: {\n  delegationChain?: readonly SessionDelegationHop[];\n  delegatedBy?: string;\n  delegatedByType?: SessionPrincipalType;\n  delegatedAt?: number;\n  reason?: string;\n}): SessionDelegationHop[] | undefined {\n  if (args.delegationChain && args.delegationChain.length > 0) {\n    return [...args.delegationChain];\n  }\n  if (!args.delegatedBy) {\n    return;\n  }\n  return [\n    {\n      principalId: args.delegatedBy,\n      principalType:\n        args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),\n      delegatedAt: args.delegatedAt,\n      reason: args.reason,\n    },\n  ];\n}\n\nexport function lastDelegator(\n  delegationChain?: readonly SessionDelegationHop[]\n): string | undefined {\n  if (!delegationChain || delegationChain.length === 0) {\n    return;\n  }\n  return delegationChain[delegationChain.length - 1]?.principalId;\n}\n\n// =============================================================================\n// AUTH CONTEXT\n// (Formerly src/auth-context.contract.ts)\n// =============================================================================\n\nimport type { ConvexAdminClient } from \"./convex-admin.contract\";\n\nexport type McpTransportKind = \"stdio\" | \"hosted\";\n\nexport type LucernSdkClient = unknown;\n\n/**\n * Session authentication context — injected by withAuth() middleware.\n *\n * Built from TenantConfig at dispatch time. Agent sessions get\n * AGENT_IDENTITY + \"agent:internal\" role + unrestricted access.\n * User sessions get Clerk userId + resolved role + tool ACLs.\n */\nexport type AuthContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string; // AGENT_IDENTITY for agents, Clerk userId for users\n  tenantId: string;\n  role: string; // \"agent:internal\" | \"platform_admin\" | \"tenant_admin\" | \"editor\" | \"viewer\" | ...\n  allowedTopics: string[] | null; // null = unrestricted (agents, admins). Block 11D populates this.\n  // Layer 2a: Group-pack binding — resolved at boot from MC resolveUserPackAccess\n  groupIds: string[]; // Groups this user belongs to (empty for agents)\n  permittedPackKeys: string[]; // Packs accessible via group assignments (empty = no pack filtering)\n  sessionId: string; // S2-13K: MCP process session UUID for audit attribution\n  principalId?: string;\n  principalType?: SessionPrincipalType;\n  workspaceId?: string;\n  scopes?: string[];\n  authMode?: SessionAuthMode;\n  roles?: string[];\n  transportKind?: McpTransportKind;\n  lucernClient?: LucernSdkClient;\n  convex?: ConvexAdminClient;\n  setDefaultScopeContext?: (scopeId: string) => Promise<unknown>;\n  matchesWorkspaceReasoningScope?: (\n    node: unknown,\n    scope: unknown\n  ) => boolean;\n};\n"]}

package/dist/auth.contract.d.ts

@@ -0,0 +1,92 @@
+import { ConvexAdminClient } from './convex-admin.contract.js';
+
+/**
+ * @lucern/contracts — auth (canonical support contract)
+ *
+ * Consolidated flat support surface for Lucern authentication:
+ *   - Session primitives (auth modes, principal types, lifecycle)
+ *   - AuthContext shape + McpTransportKind + LucernSdkClient alias
+ *
+ * Consolidated from src/auth-session.contract.ts and src/auth-context.contract.ts
+ * in EK-16 T1 PR 3a. Compat shims remain at both old paths until Lucern 1.0.0 (D12).
+ */
+declare const SESSION_AUTH_MODES: readonly ["interactive_user", "service_principal", "tenant_api_key", "session_token"];
+type SessionAuthMode = (typeof SESSION_AUTH_MODES)[number];
+declare const SESSION_PRINCIPAL_TYPES: readonly ["human", "service", "agent"];
+type SessionPrincipalType = (typeof SESSION_PRINCIPAL_TYPES)[number];
+declare const SESSION_LIFECYCLE_STATUSES: readonly ["active", "expired", "revoked"];
+type SessionLifecycleStatus = (typeof SESSION_LIFECYCLE_STATUSES)[number];
+type SessionDelegationHop = {
+    principalId: string;
+    principalType: SessionPrincipalType;
+    authMode?: SessionAuthMode;
+    sessionId?: string;
+    delegatedAt?: number;
+    reason?: string;
+};
+type SessionAuditOutcome = "accepted" | "rejected" | "revoked" | "expired";
+type SessionAuditEnvelope = {
+    sessionId: string;
+    authMode: SessionAuthMode;
+    principalId: string;
+    principalType: SessionPrincipalType;
+    tenantId: string;
+    workspaceId?: string;
+    apiKeyId?: string;
+    scopes: readonly string[];
+    roles?: readonly string[];
+    delegationChain?: readonly SessionDelegationHop[];
+    sourceSessionId?: string;
+    expiresAt?: number;
+    request?: {
+        endpoint?: string;
+        method?: string;
+        correlationId?: string;
+    };
+    result?: {
+        outcome: SessionAuditOutcome;
+        reason?: string;
+    };
+};
+declare function inferSessionPrincipalType(principalId: string): SessionPrincipalType;
+declare function normalizeDelegationChain(args: {
+    delegationChain?: readonly SessionDelegationHop[];
+    delegatedBy?: string;
+    delegatedByType?: SessionPrincipalType;
+    delegatedAt?: number;
+    reason?: string;
+}): SessionDelegationHop[] | undefined;
+declare function lastDelegator(delegationChain?: readonly SessionDelegationHop[]): string | undefined;
+
+type McpTransportKind = "stdio" | "hosted";
+type LucernSdkClient = unknown;
+/**
+ * Session authentication context — injected by withAuth() middleware.
+ *
+ * Built from TenantConfig at dispatch time. Agent sessions get
+ * AGENT_IDENTITY + "agent:internal" role + unrestricted access.
+ * User sessions get Clerk userId + resolved role + tool ACLs.
+ */
+type AuthContext = {
+    sessionType: "agent" | "user";
+    userId: string;
+    tenantId: string;
+    role: string;
+    allowedTopics: string[] | null;
+    groupIds: string[];
+    permittedPackKeys: string[];
+    sessionId: string;
+    principalId?: string;
+    principalType?: SessionPrincipalType;
+    workspaceId?: string;
+    scopes?: string[];
+    authMode?: SessionAuthMode;
+    roles?: string[];
+    transportKind?: McpTransportKind;
+    lucernClient?: LucernSdkClient;
+    convex?: ConvexAdminClient;
+    setDefaultScopeContext?: (scopeId: string) => Promise<unknown>;
+    matchesWorkspaceReasoningScope?: (node: unknown, scope: unknown) => boolean;
+};
+
+export { type AuthContext, type LucernSdkClient, type McpTransportKind, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, type SessionAuditEnvelope, type SessionAuditOutcome, type SessionAuthMode, type SessionDelegationHop, type SessionLifecycleStatus, type SessionPrincipalType, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain };

package/dist/auth.contract.js

@@ -0,0 +1,48 @@
+// src/auth.contract.ts
+var SESSION_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
+];
+var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_LIFECYCLE_STATUSES = [
+  "active",
+  "expired",
+  "revoked"
+];
+function inferSessionPrincipalType(principalId) {
+  if (principalId.startsWith("user:")) {
+    return "human";
+  }
+  if (principalId.startsWith("agent:")) {
+    return "agent";
+  }
+  return "service";
+}
+function normalizeDelegationChain(args) {
+  if (args.delegationChain && args.delegationChain.length > 0) {
+    return [...args.delegationChain];
+  }
+  if (!args.delegatedBy) {
+    return;
+  }
+  return [
+    {
+      principalId: args.delegatedBy,
+      principalType: args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),
+      delegatedAt: args.delegatedAt,
+      reason: args.reason
+    }
+  ];
+}
+function lastDelegator(delegationChain) {
+  if (!delegationChain || delegationChain.length === 0) {
+    return;
+  }
+  return delegationChain[delegationChain.length - 1]?.principalId;
+}
+
+export { SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain };
+//# sourceMappingURL=auth.contract.js.map
+//# sourceMappingURL=auth.contract.js.map

package/dist/auth.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.contract.ts"],"names":[],"mappings":";AAgBO,IAAM,kBAAA,GAAqB;AAAA,EAChC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AAGO,IAAM,uBAAA,GAA0B,CAAC,OAAA,EAAS,SAAA,EAAW,OAAO;AAG5D,IAAM,0BAAA,GAA6B;AAAA,EACxC,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AA2CO,SAAS,0BACd,WAAA,EACsB;AACtB,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,EAAG;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,QAAQ,CAAA,EAAG;AACpC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA;AACT;AAEO,SAAS,yBAAyB,IAAA,EAMF;AACrC,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC3D,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,eAAe,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,IAAA;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAA,EACE,IAAA,CAAK,eAAA,IAAmB,yBAAA,CAA0B,KAAK,WAAW,CAAA;AAAA,MACpE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,QAAQ,IAAA,CAAK;AAAA;AACf,GACF;AACF;AAEO,SAAS,cACd,eAAA,EACoB;AACpB,EAAA,IAAI,CAAC,eAAA,IAAmB,eAAA,CAAgB,MAAA,KAAW,CAAA,EAAG;AACpD,IAAA;AAAA,EACF;AACA,EAAA,OAAO,eAAA,CAAgB,eAAA,CAAgB,MAAA,GAAS,CAAC,CAAA,EAAG,WAAA;AACtD","file":"auth.contract.js","sourcesContent":["/**\n * @lucern/contracts — auth (canonical support contract)\n *\n * Consolidated flat support surface for Lucern authentication:\n *   - Session primitives (auth modes, principal types, lifecycle)\n *   - AuthContext shape + McpTransportKind + LucernSdkClient alias\n *\n * Consolidated from src/auth-session.contract.ts and src/auth-context.contract.ts\n * in EK-16 T1 PR 3a. Compat shims remain at both old paths until Lucern 1.0.0 (D12).\n */\n\n// =============================================================================\n// SESSION PRIMITIVES\n// (Formerly src/auth-session.contract.ts)\n// =============================================================================\n\nexport const SESSION_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const;\nexport type SessionAuthMode = (typeof SESSION_AUTH_MODES)[number];\n\nexport const SESSION_PRINCIPAL_TYPES = [\"human\", \"service\", \"agent\"] as const;\nexport type SessionPrincipalType = (typeof SESSION_PRINCIPAL_TYPES)[number];\n\nexport const SESSION_LIFECYCLE_STATUSES = [\n  \"active\",\n  \"expired\",\n  \"revoked\",\n] as const;\nexport type SessionLifecycleStatus =\n  (typeof SESSION_LIFECYCLE_STATUSES)[number];\n\nexport type SessionDelegationHop = {\n  principalId: string;\n  principalType: SessionPrincipalType;\n  authMode?: SessionAuthMode;\n  sessionId?: string;\n  delegatedAt?: number;\n  reason?: string;\n};\n\nexport type SessionAuditOutcome =\n  | \"accepted\"\n  | \"rejected\"\n  | \"revoked\"\n  | \"expired\";\n\nexport type SessionAuditEnvelope = {\n  sessionId: string;\n  authMode: SessionAuthMode;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  tenantId: string;\n  workspaceId?: string;\n  apiKeyId?: string;\n  scopes: readonly string[];\n  roles?: readonly string[];\n  delegationChain?: readonly SessionDelegationHop[];\n  sourceSessionId?: string;\n  expiresAt?: number;\n  request?: {\n    endpoint?: string;\n    method?: string;\n    correlationId?: string;\n  };\n  result?: {\n    outcome: SessionAuditOutcome;\n    reason?: string;\n  };\n};\n\nexport function inferSessionPrincipalType(\n  principalId: string\n): SessionPrincipalType {\n  if (principalId.startsWith(\"user:\")) {\n    return \"human\";\n  }\n  if (principalId.startsWith(\"agent:\")) {\n    return \"agent\";\n  }\n  return \"service\";\n}\n\nexport function normalizeDelegationChain(args: {\n  delegationChain?: readonly SessionDelegationHop[];\n  delegatedBy?: string;\n  delegatedByType?: SessionPrincipalType;\n  delegatedAt?: number;\n  reason?: string;\n}): SessionDelegationHop[] | undefined {\n  if (args.delegationChain && args.delegationChain.length > 0) {\n    return [...args.delegationChain];\n  }\n  if (!args.delegatedBy) {\n    return;\n  }\n  return [\n    {\n      principalId: args.delegatedBy,\n      principalType:\n        args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),\n      delegatedAt: args.delegatedAt,\n      reason: args.reason,\n    },\n  ];\n}\n\nexport function lastDelegator(\n  delegationChain?: readonly SessionDelegationHop[]\n): string | undefined {\n  if (!delegationChain || delegationChain.length === 0) {\n    return;\n  }\n  return delegationChain[delegationChain.length - 1]?.principalId;\n}\n\n// =============================================================================\n// AUTH CONTEXT\n// (Formerly src/auth-context.contract.ts)\n// =============================================================================\n\nimport type { ConvexAdminClient } from \"./convex-admin.contract\";\n\nexport type McpTransportKind = \"stdio\" | \"hosted\";\n\nexport type LucernSdkClient = unknown;\n\n/**\n * Session authentication context — injected by withAuth() middleware.\n *\n * Built from TenantConfig at dispatch time. Agent sessions get\n * AGENT_IDENTITY + \"agent:internal\" role + unrestricted access.\n * User sessions get Clerk userId + resolved role + tool ACLs.\n */\nexport type AuthContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string; // AGENT_IDENTITY for agents, Clerk userId for users\n  tenantId: string;\n  role: string; // \"agent:internal\" | \"platform_admin\" | \"tenant_admin\" | \"editor\" | \"viewer\" | ...\n  allowedTopics: string[] | null; // null = unrestricted (agents, admins). Block 11D populates this.\n  // Layer 2a: Group-pack binding — resolved at boot from MC resolveUserPackAccess\n  groupIds: string[]; // Groups this user belongs to (empty for agents)\n  permittedPackKeys: string[]; // Packs accessible via group assignments (empty = no pack filtering)\n  sessionId: string; // S2-13K: MCP process session UUID for audit attribution\n  principalId?: string;\n  principalType?: SessionPrincipalType;\n  workspaceId?: string;\n  scopes?: string[];\n  authMode?: SessionAuthMode;\n  roles?: string[];\n  transportKind?: McpTransportKind;\n  lucernClient?: LucernSdkClient;\n  convex?: ConvexAdminClient;\n  setDefaultScopeContext?: (scopeId: string) => Promise<unknown>;\n  matchesWorkspaceReasoningScope?: (\n    node: unknown,\n    scope: unknown\n  ) => boolean;\n};\n"]}

package/dist/beliefs/v1.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/beliefs/v1.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=v1.js.map
+//# sourceMappingURL=v1.js.map

package/dist/beliefs/v1.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"v1.js"}

package/dist/context-pack.contract.d.ts

@@ -14,7 +14,7 @@
  *   - Changing the version string is BREAKING (consumers check it)
  */
 /** Canonical version string. Consumers MUST check this field for compatibility. */
-export declare const CONTEXT_PACK_SCHEMA_VERSION: "1.0.0";
+declare const CONTEXT_PACK_SCHEMA_VERSION: "1.0.0";
 /**
  * Available ranking profiles for context-pack assembly.
  *
@@ -22,9 +22,9 @@ export declare const CONTEXT_PACK_SCHEMA_VERSION: "1.0.0";
  * - `weighted_v1`: Multi-signal scoring combining query relevance, recency, confidence,
  *    belief type, priority, and severity with section-specific weight vectors.
  */
-export type ContextRankingProfile = "baseline_v1" | "weighted_v1";
-export declare const CONTEXT_RANKING_PROFILES: readonly ContextRankingProfile[];
-export declare const DEFAULT_RANKING_PROFILE: ContextRankingProfile;
+type ContextRankingProfile = "baseline_v1" | "weighted_v1";
+declare const CONTEXT_RANKING_PROFILES: readonly ContextRankingProfile[];
+declare const DEFAULT_RANKING_PROFILE: ContextRankingProfile;
 /**
  * Context compilation mode.
  *
@@ -32,14 +32,14 @@ export declare const DEFAULT_RANKING_PROFILE: ContextRankingProfile;
  * - `delta`: Diff-aware — adds failure context, verification obligations,
  *    and worktree ledger analysis to the standard context pack.
  */
-export type ContextCompilationMode = "standard" | "delta";
-export declare const DEFAULT_COMPILATION_MODE: ContextCompilationMode;
+type ContextCompilationMode = "standard" | "delta";
+declare const DEFAULT_COMPILATION_MODE: ContextCompilationMode;
 /**
  * The five canonical sections of a context pack.
  * Order matters: invariants are injected first, contradictions last.
  */
-export type ContextPackSectionKey = "invariants" | "activeBeliefs" | "openQuestions" | "recentEvidence" | "contradictions";
-export declare const CONTEXT_PACK_SECTION_KEYS: readonly ContextPackSectionKey[];
+type ContextPackSectionKey = "invariants" | "activeBeliefs" | "openQuestions" | "recentEvidence" | "contradictions";
+declare const CONTEXT_PACK_SECTION_KEYS: readonly ContextPackSectionKey[];
 /**
  * Token budget allocation ratios per section.
  * These sum to 1.0 and determine how the total tokenBudget is divided.
@@ -51,19 +51,19 @@ export declare const CONTEXT_PACK_SECTION_KEYS: readonly ContextPackSectionKey[]
  * - recentEvidence (0.17): Implementation context for grounding
  * - contradictions (0.08): Tension signals, smallest section
  */
-export declare const SECTION_BUDGET_RATIOS: Readonly<Record<ContextPackSectionKey, number>>;
+declare const SECTION_BUDGET_RATIOS: Readonly<Record<ContextPackSectionKey, number>>;
 /** Minimum allowed token budget. Below this, context packs lose utility. */
-export declare const MIN_TOKEN_BUDGET = 400;
+declare const MIN_TOKEN_BUDGET = 400;
 /** Maximum allowed token budget. Above this, context packs bloat prompts. */
-export declare const MAX_TOKEN_BUDGET = 8000;
+declare const MAX_TOKEN_BUDGET = 8000;
 /** Default token budget when caller does not specify. */
-export declare const DEFAULT_TOKEN_BUDGET = 1800;
+declare const DEFAULT_TOKEN_BUDGET = 1800;
 /** Default max items per section. */
-export declare const DEFAULT_SECTION_LIMIT = 8;
+declare const DEFAULT_SECTION_LIMIT = 8;
 /** Hard ceiling on items per section. */
-export declare const MAX_SECTION_LIMIT = 25;
+declare const MAX_SECTION_LIMIT = 25;
 /** Minimum contradiction section budget floor (tokens). */
-export declare const MIN_CONTRADICTION_BUDGET = 40;
+declare const MIN_CONTRADICTION_BUDGET = 40;
 /**
  * Weight vectors for the weighted_v1 ranking profile.
  * Each section has a different signal mix:
@@ -75,7 +75,7 @@ export declare const MIN_CONTRADICTION_BUDGET = 40;
  * - priority: Question priority (critical > high > medium > low)
  * - severity: Contradiction severity (critical > high > medium > low)
  */
-export type RankingWeightVector = {
+type RankingWeightVector = {
     query: number;
     recency: number;
     confidence?: number;
@@ -83,35 +83,35 @@ export type RankingWeightVector = {
     priority?: number;
     severity?: number;
 };
-export declare const RANKING_WEIGHTS: Readonly<Record<ContextPackSectionKey, RankingWeightVector>>;
+declare const RANKING_WEIGHTS: Readonly<Record<ContextPackSectionKey, RankingWeightVector>>;
 /** Recency decay half-life in days. After 30 days, recency score = 0.5. */
-export declare const RECENCY_HALF_LIFE_DAYS = 30;
+declare const RECENCY_HALF_LIFE_DAYS = 30;
 /**
  * Ranking weight vector for the relatedEntities section.
  * Entities are ranked by query relevance and connectivity (bridge edge count).
  * Separate from RANKING_WEIGHTS because entities are not part of the
  * token-budgeted injection plan.
  */
-export declare const ENTITY_RANKING_WEIGHTS: {
+declare const ENTITY_RANKING_WEIGHTS: {
     readonly query: 0.4;
     readonly connectivity: 0.6;
 };
 /** Default max entities to include in the context pack. */
-export declare const DEFAULT_ENTITY_LIMIT = 10;
+declare const DEFAULT_ENTITY_LIMIT = 10;
 /** Hard ceiling on entities per context pack. */
-export declare const MAX_ENTITY_LIMIT = 50;
+declare const MAX_ENTITY_LIMIT = 50;
 /**
  * Bonus multiplier for belief types in ranking.
  * Invariants get 1.0, unknown types get 0.4.
  */
-export declare const BELIEF_TYPE_BONUS: Readonly<Record<string, number>>;
-export declare const DEFAULT_BELIEF_TYPE_BONUS = 0.4;
-export declare const PRIORITY_SCORES: Readonly<Record<string, number>>;
-export declare const DEFAULT_PRIORITY_SCORE = 0.5;
-export declare const SEVERITY_SCORES: Readonly<Record<string, number>>;
-export declare const DEFAULT_SEVERITY_SCORE = 0.5;
+declare const BELIEF_TYPE_BONUS: Readonly<Record<string, number>>;
+declare const DEFAULT_BELIEF_TYPE_BONUS = 0.4;
+declare const PRIORITY_SCORES: Readonly<Record<string, number>>;
+declare const DEFAULT_PRIORITY_SCORE = 0.5;
+declare const SEVERITY_SCORES: Readonly<Record<string, number>>;
+declare const DEFAULT_SEVERITY_SCORE = 0.5;
 /** A ranked belief in the invariants or activeBeliefs section. */
-export type ContextPackBelief = {
+type ContextPackBelief = {
     nodeId: string;
     canonicalText: string;
     confidence: number | null;
@@ -124,7 +124,7 @@ export type ContextPackBelief = {
     justification?: string;
 };
 /** A ranked question in the openQuestions section. */
-export type ContextPackQuestion = {
+type ContextPackQuestion = {
     questionId: string;
     text: string;
     status: string;
@@ -135,7 +135,7 @@ export type ContextPackQuestion = {
     justification?: string;
 };
 /** A ranked evidence item in the recentEvidence section. */
-export type ContextPackEvidence = {
+type ContextPackEvidence = {
     nodeId: string;
     canonicalText: string;
     sourceUrl: string | null;
@@ -146,7 +146,7 @@ export type ContextPackEvidence = {
     justification?: string;
 };
 /** A ranked contradiction in the contradictions section. */
-export type ContextPackContradiction = {
+type ContextPackContradiction = {
     contradictionId: string;
     severity: string;
     status: string;
@@ -161,7 +161,7 @@ export type ContextPackContradiction = {
  * to beliefs via bridge edges. They provide the "reality anchor" that makes
  * the reasoning graph domain-aware.
  */
-export type ContextPackEntity = {
+type ContextPackEntity = {
     /** Convex document ID of the entity node. */
     nodeId: string;
     /** Entity type (e.g., "company", "person", "function"). */
@@ -181,7 +181,7 @@ export type ContextPackEntity = {
  * A lattice seed entry representing a belief that was auto-generated
  * to cover an ontology entity type within a topic scope.
  */
-export type BeliefLatticeSeed = {
+type BeliefLatticeSeed = {
     /** The belief node ID that was created or already existed. */
     beliefNodeId: string;
     /** The entity type this seed belief covers. */
@@ -192,7 +192,7 @@ export type BeliefLatticeSeed = {
     canonicalText: string;
 };
 /** Counts and scoped health signals for the context pack. */
-export type ContextPackSummary = {
+type ContextPackSummary = {
     totalBeliefs: number;
     invariants: number;
     openQuestions: number;
@@ -205,7 +205,7 @@ export type ContextPackSummary = {
     query: string | null;
 };
 /** A failed approach surfaced from the failure log for anti-repetition. */
-export type ContextPackFailure = {
+type ContextPackFailure = {
     /** Lucern attempt/evidence node ID. */
     attemptId: string;
     /** What was tried. */
@@ -218,14 +218,14 @@ export type ContextPackFailure = {
     score: number;
 };
 /** Failure context section appended to context packs in delta mode. */
-export type ContextPackFailureContext = {
+type ContextPackFailureContext = {
     /** Ranked failed approaches relevant to the current query. */
     failures: ContextPackFailure[];
     /** IDs of items suppressed from other sections due to anti-repetition. */
     suppressedIds: string[];
 };
 /** A verification obligation surfaced by delta compilation. */
-export type VerificationObligation = {
+type VerificationObligation = {
     /** What must be verified. */
     description: string;
     /** Source of the obligation (e.g., "belief:xyz confidence drop"). */
@@ -234,7 +234,7 @@ export type VerificationObligation = {
     severity: "critical" | "high" | "medium" | "low";
 };
 /** Delta report appended to context packs when mode = "delta". */
-export type ContextPackDeltaReport = {
+type ContextPackDeltaReport = {
     /** Items that changed since the reference point (new, updated, removed). */
     changedItems: Array<{
         id: string;
@@ -251,14 +251,14 @@ export type ContextPackDeltaReport = {
  * Per-section weight overrides that domain packs can apply.
  * Overrides merge with RANKING_WEIGHTS — only specified fields replace defaults.
  */
-export type PackWeightOverride = {
+type PackWeightOverride = {
     /** Which section to override weights for. */
     section: ContextPackSectionKey;
     /** Partial weight vector — only specified fields replace defaults. */
     weights: Partial<RankingWeightVector>;
 };
 /** Token-budgeted section selections for prompt injection. */
-export type ContextPackInjectionPolicy = {
+type ContextPackInjectionPolicy = {
     /** Total token budget for the entire context pack. */
     tokenBudget: number;
     /** Estimated tokens consumed across all sections. */
@@ -278,7 +278,7 @@ export type ContextPackInjectionPolicy = {
     }>;
 };
 /** Telemetry for context pack assembly. */
-export type ContextPackDiagnostics = {
+type ContextPackDiagnostics = {
     /** Total candidates scored across all sections. */
     itemsScored: number;
     /** Ratio of estimatedTokens / tokenBudget. Range [0, 1+]. */
@@ -290,7 +290,7 @@ export type ContextPackDiagnostics = {
  * This preserves the existing external shape while the canonical compiler
  * contract evolves in parallel as ContextPackV1.
  */
-export type PublicContextBelief = {
+type PublicContextBelief = {
     beliefId: string;
     text: string;
     confidence: number | null;
@@ -300,7 +300,7 @@ export type PublicContextBelief = {
     score: number;
     justification?: string;
 };
-export type PublicContextQuestion = {
+type PublicContextQuestion = {
     questionId: string;
     text: string;
     status: string;
@@ -309,7 +309,7 @@ export type PublicContextQuestion = {
     score: number;
     justification?: string;
 };
-export type PublicContextEvidence = {
+type PublicContextEvidence = {
     evidenceId: string;
     text: string;
     sourceUrl?: string | null;
@@ -318,7 +318,7 @@ export type PublicContextEvidence = {
     score: number;
     justification?: string;
 };
-export type PublicContextContradiction = {
+type PublicContextContradiction = {
     contradictionId: string;
     severity: string;
     status: string;
@@ -326,7 +326,7 @@ export type PublicContextContradiction = {
     score: number;
     justification?: string;
 };
-export type PublicContextEntity = {
+type PublicContextEntity = {
     entityId: string;
     entityType: string;
     title: string;
@@ -336,7 +336,7 @@ export type PublicContextEntity = {
     score: number;
     metadata?: Record<string, unknown>;
 };
-export type PublicContextInjectionPolicy = {
+type PublicContextInjectionPolicy = {
     tokenBudget: number;
     estimatedTokens: number;
     sectionBudgets: Record<string, number>;
@@ -349,7 +349,7 @@ export type PublicContextInjectionPolicy = {
         score: number;
     }>;
 };
-export type PublicCompiledContext = {
+type PublicCompiledContext = {
     schemaVersion: string;
     topicId: string;
     topicName: string;
@@ -400,7 +400,7 @@ export type PublicCompiledContext = {
  * in the output. Adding optional fields is non-breaking; removing or
  * changing types is breaking (requires version bump).
  */
-export type ContextPackV1 = {
+type ContextPackV1 = {
     /** Schema version for compatibility checking. */
     schemaVersion: typeof CONTEXT_PACK_SCHEMA_VERSION;
     /** Deprecated compatibility alias for the requested scope ID. */
@@ -452,7 +452,7 @@ export type ContextPackV1 = {
  * The canonical input schema for `compile_context`.
  * `topicId` is canonical. `projectId` remains an optional compatibility alias.
  */
-export type ContextPackRequestV1 = {
+type ContextPackRequestV1 = {
     /** Topic scope ID (required). */
     topicId: string;
     /** Deprecated compatibility alias for older callers. */
@@ -484,12 +484,13 @@ export type ContextPackRequestV1 = {
  * Question statuses that are considered "resolved" (not open).
  * Used to filter which questions appear in the openQuestions section.
  */
-export declare const RESOLVED_QUESTION_STATUSES: readonly string[];
+declare const RESOLVED_QUESTION_STATUSES: readonly string[];
 /**
  * Tokens-per-word multiplier for rough token estimation.
  * Conservative estimate: ~1.35 tokens per whitespace-delimited word.
  */
-export declare const TOKENS_PER_WORD = 1.35;
+declare const TOKENS_PER_WORD = 1.35;
 /** Minimum token estimate for any non-empty string. */
-export declare const MIN_TOKEN_ESTIMATE = 8;
-//# sourceMappingURL=context-pack.contract.d.ts.map
+declare const MIN_TOKEN_ESTIMATE = 8;
+
+export { BELIEF_TYPE_BONUS, type BeliefLatticeSeed, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, type ContextCompilationMode, type ContextPackBelief, type ContextPackContradiction, type ContextPackDeltaReport, type ContextPackDiagnostics, type ContextPackEntity, type ContextPackEvidence, type ContextPackFailure, type ContextPackFailureContext, type ContextPackInjectionPolicy, type ContextPackQuestion, type ContextPackRequestV1, type ContextPackSectionKey, type ContextPackSummary, type ContextPackV1, type ContextRankingProfile, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TOKEN_BUDGET, ENTITY_RANKING_WEIGHTS, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, PRIORITY_SCORES, type PackWeightOverride, type PublicCompiledContext, type PublicContextBelief, type PublicContextContradiction, type PublicContextEntity, type PublicContextEvidence, type PublicContextInjectionPolicy, type PublicContextQuestion, RANKING_WEIGHTS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, type RankingWeightVector, SECTION_BUDGET_RATIOS, SEVERITY_SCORES, TOKENS_PER_WORD, type VerificationObligation };