@lucern/contracts 0.1.1-alpha.1 → 0.1.2-alpha.1

package/CHANGELOG.md

@@ -0,0 +1,3 @@
+# Changelog
+
+All notable changes to `@lucern/contracts` are tracked in this repository.

package/README.md

@@ -0,0 +1,3 @@
+# @lucern/contracts
+
+Machine-readable Lucern contracts for the public SDK, gateway, and MCP surfaces.

package/dist/agents/v1.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/agents/v1.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=v1.js.map
+//# sourceMappingURL=v1.js.map

package/dist/agents/v1.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"v1.js"}

package/dist/api-enums.contract.d.ts

@@ -0,0 +1,60 @@
+/**
+ * API Enum Contract Definitions
+ *
+ * Canonical enum values for all API-facing enumerations.
+ * These are co-equal with MCP contracts as external contracts.
+ * SDK types are DERIVED from these — not independently authored.
+ *
+ * CONTRACT SURFACE: Adding a new enum value is additive (non-breaking).
+ * Removing or renaming an existing value is a BREAKING CHANGE.
+ */
+/** Fork reasons — why a scored belief was branched */
+declare const FORK_REASONS: readonly ["refinement", "contradiction_response", "scope_change", "confidence_collapse", "manual"];
+type ForkReason = (typeof FORK_REASONS)[number];
+/** Confidence modulation triggers — what caused a confidence change */
+declare const CONFIDENCE_TRIGGERS: readonly ["evidence_added", "contradiction_detected", "merge_outcome", "manual", "decay"];
+type ConfidenceTrigger = (typeof CONFIDENCE_TRIGGERS)[number];
+/** Belief status — lifecycle state */
+declare const BELIEF_STATUSES: readonly ["unscored", "scored", "archived"];
+type BeliefStatus = (typeof BELIEF_STATUSES)[number];
+/** Reasoning methods — how an edge relationship was determined */
+declare const REASONING_METHODS: readonly ["deductive", "inductive", "abductive", "analogical", "empirical"];
+type ReasoningMethod = (typeof REASONING_METHODS)[number];
+/** Defeat types (Pollock taxonomy) — how a contradiction operates */
+declare const DEFEAT_TYPES: readonly ["rebuts", "undercuts", "undermines"];
+type DefeatType = (typeof DEFEAT_TYPES)[number];
+/** Contradiction severity levels */
+declare const CONTRADICTION_SEVERITIES: readonly ["low", "medium", "high", "critical"];
+type ContradictionSeverity = (typeof CONTRADICTION_SEVERITIES)[number];
+/** Contradiction resolution status */
+declare const CONTRADICTION_STATUSES: readonly ["unresolved", "resolved", "accepted"];
+type ContradictionStatus = (typeof CONTRADICTION_STATUSES)[number];
+/** Merge outcome types — how a worktree merge resolved */
+declare const MERGE_OUTCOMES: readonly ["validated", "invalidated", "forked", "inconclusive"];
+type MergeOutcome = (typeof MERGE_OUTCOMES)[number];
+/** Worktree phases — investigation lifecycle within a checked-out worktree */
+declare const WORKTREE_PHASES: readonly ["hypothesis", "investigation", "evaluation", "resolution"];
+type WorktreePhase = (typeof WORKTREE_PHASES)[number];
+/** Branch status — thematic branch lifecycle */
+declare const BRANCH_STATUSES: readonly ["dormant", "active", "archived"];
+type BranchStatus = (typeof BRANCH_STATUSES)[number];
+/** Pull request status — review lifecycle before merge */
+declare const PULL_REQUEST_STATUSES: readonly ["pending_review", "changes_requested", "approved", "blocked"];
+type PullRequestStatus = (typeof PULL_REQUEST_STATUSES)[number];
+/** Epistemic layers — the hierarchy of knowledge */
+declare const EPISTEMIC_LAYERS: readonly ["L1", "L2", "L3", "L4"];
+type EpistemicLayer = (typeof EPISTEMIC_LAYERS)[number];
+/**
+ * Judgment type — classification of the determination.
+ *
+ * Phase 1: These are new enum values for the Judgment (L4) vocabulary.
+ * The existing code uses "Decision" — these are the forward-looking terms
+ * that will eventually replace the Decision vocabulary (Phase 2-3).
+ */
+declare const JUDGMENT_TYPES: readonly ["investment_thesis", "thesis_maturity", "contradiction_ruling", "scope_determination", "confidence_ruling"];
+type JudgmentType = (typeof JUDGMENT_TYPES)[number];
+/** Core edge types used in the Integration Surfaces */
+declare const INTEGRATION_EDGE_TYPES: readonly ["informs", "grounds", "answers", "contradicts", "supports", "depends_on", "derived_from", "contains", "supersedes", "tests"];
+type IntegrationEdgeType = (typeof INTEGRATION_EDGE_TYPES)[number];
+
+export { BELIEF_STATUSES, BRANCH_STATUSES, type BeliefStatus, type BranchStatus, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, type ConfidenceTrigger, type ContradictionSeverity, type ContradictionStatus, DEFEAT_TYPES, type DefeatType, EPISTEMIC_LAYERS, type EpistemicLayer, FORK_REASONS, type ForkReason, INTEGRATION_EDGE_TYPES, type IntegrationEdgeType, JUDGMENT_TYPES, type JudgmentType, MERGE_OUTCOMES, type MergeOutcome, PULL_REQUEST_STATUSES, type PullRequestStatus, REASONING_METHODS, type ReasoningMethod, WORKTREE_PHASES, type WorktreePhase };

package/dist/api-enums.contract.js

@@ -0,0 +1,160 @@
+// src/api-enums.contract.ts
+var FORK_REASONS = [
+  "refinement",
+  // Belief text evolved based on new understanding
+  "contradiction_response",
+  // Created in response to a detected contradiction
+  "scope_change",
+  // Belief scope narrowed or broadened
+  "confidence_collapse",
+  // Confidence dropped below viability threshold
+  "manual"
+  // User-initiated fork without specific trigger
+];
+var CONFIDENCE_TRIGGERS = [
+  "evidence_added",
+  // New evidence bore on the belief
+  "contradiction_detected",
+  // A contradiction was flagged involving this belief
+  "merge_outcome",
+  // Merge scoring determined this confidence
+  "manual",
+  // User manually adjusted confidence
+  "decay"
+  // Time-based confidence erosion
+];
+var BELIEF_STATUSES = [
+  "unscored",
+  // Draft — editable in worktree (on feature branch, pre-merge)
+  "scored",
+  // Merged — formulation frozen (merged to main)
+  "archived"
+  // Soft-deleted — preserved in history (git rm)
+];
+var REASONING_METHODS = [
+  "deductive",
+  // Logically entailed
+  "inductive",
+  // Generalized from instances
+  "abductive",
+  // Best explanation inference
+  "analogical",
+  // Reasoning by analogy
+  "empirical"
+  // Direct observation/measurement
+];
+var DEFEAT_TYPES = [
+  "rebuts",
+  // Direct contradiction — reasons for the negation
+  "undercuts",
+  // Breaks the inference link between evidence and belief
+  "undermines"
+  // Attacks a premise the belief depends on
+];
+var CONTRADICTION_SEVERITIES = [
+  "low",
+  // Minor tension, may not require action
+  "medium",
+  // Moderate conflict, should be investigated
+  "high",
+  // Significant contradiction, likely needs resolution
+  "critical"
+  // Blocks progress — must be addressed before judgment
+];
+var CONTRADICTION_STATUSES = [
+  "unresolved",
+  // Open conflict — may persist indefinitely
+  "resolved",
+  // Conflict addressed (one belief forked, archived, or confidence adjusted)
+  "accepted"
+  // Explicitly accepted as irreconcilable — both beliefs maintained
+];
+var MERGE_OUTCOMES = [
+  "validated",
+  // Beliefs confirmed — clean merge to main
+  "invalidated",
+  // Defeat recorded — confidence collapsed (merge with revert)
+  "forked",
+  // Beliefs split into competing versions (fork from merge point)
+  "inconclusive"
+  // Insufficient evidence — stashed (git stash)
+];
+var WORKTREE_PHASES = [
+  "hypothesis",
+  // Form testable claims (write the code — commits)
+  "investigation",
+  // Collect evidence (run the tests — more commits)
+  "evaluation",
+  // Update credences (review the results — amend as needed)
+  "resolution"
+  // Determine outcome (merge to main, fork, or stash)
+];
+var BRANCH_STATUSES = [
+  "dormant",
+  // Branch exists but no active worktree (no one investigating)
+  "active",
+  // At least one worktree is investigating this branch
+  "archived"
+  // Branch retired — no longer a relevant thematic container
+];
+var PULL_REQUEST_STATUSES = [
+  "pending_review",
+  // PR opened — awaiting reviewer feedback
+  "changes_requested",
+  // Reviewer requests changes before merge
+  "approved",
+  // Approved — ready to merge
+  "blocked"
+  // Blocked — cannot merge until contradiction is resolved
+];
+var EPISTEMIC_LAYERS = [
+  "L1",
+  // Source — the given (vendored deps)
+  "L2",
+  // Evidence — the interpreted (test suite)
+  "L3",
+  // Belief — the structural (source files)
+  "L4"
+  // Judgment — the committed (release tags)
+];
+var JUDGMENT_TYPES = [
+  "investment_thesis",
+  // Judgment on an investment opportunity
+  "thesis_maturity",
+  // Judgment that a thesis is ready for IC presentation
+  "contradiction_ruling",
+  // Judgment on how to handle an irreconcilable contradiction
+  "scope_determination",
+  // Judgment that defines or redefines investigation scope
+  "confidence_ruling"
+  // Judgment that overrides automated confidence for policy reasons
+];
+var INTEGRATION_EDGE_TYPES = [
+  // Support relations
+  "informs",
+  // Evidence bears on a belief (weight = direction/strength)
+  "grounds",
+  // Source provides raw basis for evidence
+  "answers",
+  // Evidence or belief resolves a question
+  // Defeat relations (Pollock) — weight carries direction
+  "contradicts",
+  // Rebuts — direct contradiction
+  "supports",
+  // Weight carries valence (negative = weakens/undercuts)
+  // Structural relations
+  "depends_on",
+  // Belief B requires Belief A
+  "derived_from",
+  // Provenance lineage
+  "contains",
+  // Hierarchical containment
+  "supersedes",
+  // New version replaces old (lineage)
+  "tests"
+  // Question tests a belief
+];
+
+export { BELIEF_STATUSES, BRANCH_STATUSES, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, DEFEAT_TYPES, EPISTEMIC_LAYERS, FORK_REASONS, INTEGRATION_EDGE_TYPES, JUDGMENT_TYPES, MERGE_OUTCOMES, PULL_REQUEST_STATUSES, REASONING_METHODS, WORKTREE_PHASES };
+//# sourceMappingURL=api-enums.contract.js.map
+//# sourceMappingURL=api-enums.contract.js.map

package/dist/api-enums.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api-enums.contract.ts"],"names":[],"mappings":";AAgBO,IAAM,YAAA,GAAe;AAAA,EAC1B,YAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,cAAA;AAAA;AAAA,EACA,qBAAA;AAAA;AAAA,EACA;AAAA;AACF;AAIO,IAAM,mBAAA,GAAsB;AAAA,EACjC,gBAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,eAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF;AAIO,IAAM,eAAA,GAAkB;AAAA,EAC7B,UAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF;AAQO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,WAAA;AAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA,YAAA;AAAA;AAAA,EACA;AAAA;AACF;AAIO,IAAM,YAAA,GAAe;AAAA,EAC1B,QAAA;AAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA;AAAA;AACF;AAIO,IAAM,wBAAA,GAA2B;AAAA,EACtC,KAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA;AAAA;AACF;AAIO,IAAM,sBAAA,GAAyB;AAAA,EACpC,YAAA;AAAA;AAAA,EACA,UAAA;AAAA;AAAA,EACA;AAAA;AACF;AAQO,IAAM,cAAA,GAAiB;AAAA,EAC5B,WAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF;AAIO,IAAM,eAAA,GAAkB;AAAA,EAC7B,YAAA;AAAA;AAAA,EACA,eAAA;AAAA;AAAA,EACA,YAAA;AAAA;AAAA,EACA;AAAA;AACF;AAQO,IAAM,eAAA,GAAkB;AAAA,EAC7B,SAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF;AAQO,IAAM,qBAAA,GAAwB;AAAA,EACnC,gBAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,UAAA;AAAA;AAAA,EACA;AAAA;AACF;AAQO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,IAAA;AAAA;AAAA,EACA,IAAA;AAAA;AAAA,EACA,IAAA;AAAA;AAAA,EACA;AAAA;AACF;AAcO,IAAM,cAAA,GAAiB;AAAA,EAC5B,mBAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,qBAAA;AAAA;AAAA,EACA;AAAA;AACF;AAQO,IAAM,sBAAA,GAAyB;AAAA;AAAA,EAEpC,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA;AAAA,EAEA,aAAA;AAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EACA,cAAA;AAAA;AAAA,EACA,UAAA;AAAA;AAAA,EACA,YAAA;AAAA;AAAA,EACA;AAAA;AACF","file":"api-enums.contract.js","sourcesContent":["/**\n * API Enum Contract Definitions\n *\n * Canonical enum values for all API-facing enumerations.\n * These are co-equal with MCP contracts as external contracts.\n * SDK types are DERIVED from these — not independently authored.\n *\n * CONTRACT SURFACE: Adding a new enum value is additive (non-breaking).\n * Removing or renaming an existing value is a BREAKING CHANGE.\n */\n\n// =============================================================================\n// BELIEF ENUMS\n// =============================================================================\n\n/** Fork reasons — why a scored belief was branched */\nexport const FORK_REASONS = [\n  \"refinement\", // Belief text evolved based on new understanding\n  \"contradiction_response\", // Created in response to a detected contradiction\n  \"scope_change\", // Belief scope narrowed or broadened\n  \"confidence_collapse\", // Confidence dropped below viability threshold\n  \"manual\", // User-initiated fork without specific trigger\n] as const;\nexport type ForkReason = (typeof FORK_REASONS)[number];\n\n/** Confidence modulation triggers — what caused a confidence change */\nexport const CONFIDENCE_TRIGGERS = [\n  \"evidence_added\", // New evidence bore on the belief\n  \"contradiction_detected\", // A contradiction was flagged involving this belief\n  \"merge_outcome\", // Merge scoring determined this confidence\n  \"manual\", // User manually adjusted confidence\n  \"decay\", // Time-based confidence erosion\n] as const;\nexport type ConfidenceTrigger = (typeof CONFIDENCE_TRIGGERS)[number];\n\n/** Belief status — lifecycle state */\nexport const BELIEF_STATUSES = [\n  \"unscored\", // Draft — editable in worktree (on feature branch, pre-merge)\n  \"scored\", // Merged — formulation frozen (merged to main)\n  \"archived\", // Soft-deleted — preserved in history (git rm)\n] as const;\nexport type BeliefStatus = (typeof BELIEF_STATUSES)[number];\n\n// =============================================================================\n// EDGE ENUMS\n// =============================================================================\n\n/** Reasoning methods — how an edge relationship was determined */\nexport const REASONING_METHODS = [\n  \"deductive\", // Logically entailed\n  \"inductive\", // Generalized from instances\n  \"abductive\", // Best explanation inference\n  \"analogical\", // Reasoning by analogy\n  \"empirical\", // Direct observation/measurement\n] as const;\nexport type ReasoningMethod = (typeof REASONING_METHODS)[number];\n\n/** Defeat types (Pollock taxonomy) — how a contradiction operates */\nexport const DEFEAT_TYPES = [\n  \"rebuts\", // Direct contradiction — reasons for the negation\n  \"undercuts\", // Breaks the inference link between evidence and belief\n  \"undermines\", // Attacks a premise the belief depends on\n] as const;\nexport type DefeatType = (typeof DEFEAT_TYPES)[number];\n\n/** Contradiction severity levels */\nexport const CONTRADICTION_SEVERITIES = [\n  \"low\", // Minor tension, may not require action\n  \"medium\", // Moderate conflict, should be investigated\n  \"high\", // Significant contradiction, likely needs resolution\n  \"critical\", // Blocks progress — must be addressed before judgment\n] as const;\nexport type ContradictionSeverity = (typeof CONTRADICTION_SEVERITIES)[number];\n\n/** Contradiction resolution status */\nexport const CONTRADICTION_STATUSES = [\n  \"unresolved\", // Open conflict — may persist indefinitely\n  \"resolved\", // Conflict addressed (one belief forked, archived, or confidence adjusted)\n  \"accepted\", // Explicitly accepted as irreconcilable — both beliefs maintained\n] as const;\nexport type ContradictionStatus = (typeof CONTRADICTION_STATUSES)[number];\n\n// =============================================================================\n// WORKTREE ENUMS (git worktree lifecycle)\n// =============================================================================\n\n/** Merge outcome types — how a worktree merge resolved */\nexport const MERGE_OUTCOMES = [\n  \"validated\", // Beliefs confirmed — clean merge to main\n  \"invalidated\", // Defeat recorded — confidence collapsed (merge with revert)\n  \"forked\", // Beliefs split into competing versions (fork from merge point)\n  \"inconclusive\", // Insufficient evidence — stashed (git stash)\n] as const;\nexport type MergeOutcome = (typeof MERGE_OUTCOMES)[number];\n\n/** Worktree phases — investigation lifecycle within a checked-out worktree */\nexport const WORKTREE_PHASES = [\n  \"hypothesis\", // Form testable claims (write the code — commits)\n  \"investigation\", // Collect evidence (run the tests — more commits)\n  \"evaluation\", // Update credences (review the results — amend as needed)\n  \"resolution\", // Determine outcome (merge to main, fork, or stash)\n] as const;\nexport type WorktreePhase = (typeof WORKTREE_PHASES)[number];\n\n// =============================================================================\n// BRANCH ENUMS (git branch lifecycle)\n// =============================================================================\n\n/** Branch status — thematic branch lifecycle */\nexport const BRANCH_STATUSES = [\n  \"dormant\", // Branch exists but no active worktree (no one investigating)\n  \"active\", // At least one worktree is investigating this branch\n  \"archived\", // Branch retired — no longer a relevant thematic container\n] as const;\nexport type BranchStatus = (typeof BRANCH_STATUSES)[number];\n\n// =============================================================================\n// PULL REQUEST ENUMS (git pull request lifecycle)\n// =============================================================================\n\n/** Pull request status — review lifecycle before merge */\nexport const PULL_REQUEST_STATUSES = [\n  \"pending_review\", // PR opened — awaiting reviewer feedback\n  \"changes_requested\", // Reviewer requests changes before merge\n  \"approved\", // Approved — ready to merge\n  \"blocked\", // Blocked — cannot merge until contradiction is resolved\n] as const;\nexport type PullRequestStatus = (typeof PULL_REQUEST_STATUSES)[number];\n\n// =============================================================================\n// LAYER ENUMS\n// =============================================================================\n\n/** Epistemic layers — the hierarchy of knowledge */\nexport const EPISTEMIC_LAYERS = [\n  \"L1\", // Source — the given (vendored deps)\n  \"L2\", // Evidence — the interpreted (test suite)\n  \"L3\", // Belief — the structural (source files)\n  \"L4\", // Judgment — the committed (release tags)\n] as const;\nexport type EpistemicLayer = (typeof EPISTEMIC_LAYERS)[number];\n\n// =============================================================================\n// JUDGMENT ENUMS (Phase 1: new vocabulary)\n// =============================================================================\n\n/**\n * Judgment type — classification of the determination.\n *\n * Phase 1: These are new enum values for the Judgment (L4) vocabulary.\n * The existing code uses \"Decision\" — these are the forward-looking terms\n * that will eventually replace the Decision vocabulary (Phase 2-3).\n */\nexport const JUDGMENT_TYPES = [\n  \"investment_thesis\", // Judgment on an investment opportunity\n  \"thesis_maturity\", // Judgment that a thesis is ready for IC presentation\n  \"contradiction_ruling\", // Judgment on how to handle an irreconcilable contradiction\n  \"scope_determination\", // Judgment that defines or redefines investigation scope\n  \"confidence_ruling\", // Judgment that overrides automated confidence for policy reasons\n] as const;\nexport type JudgmentType = (typeof JUDGMENT_TYPES)[number];\n\n// =============================================================================\n// SUPPORT RELATION ENUMS\n// =============================================================================\n\n/** Core edge types used in the Integration Surfaces */\nexport const INTEGRATION_EDGE_TYPES = [\n  // Support relations\n  \"informs\", // Evidence bears on a belief (weight = direction/strength)\n  \"grounds\", // Source provides raw basis for evidence\n  \"answers\", // Evidence or belief resolves a question\n  // Defeat relations (Pollock) — weight carries direction\n  \"contradicts\", // Rebuts — direct contradiction\n  \"supports\", // Weight carries valence (negative = weakens/undercuts)\n  // Structural relations\n  \"depends_on\", // Belief B requires Belief A\n  \"derived_from\", // Provenance lineage\n  \"contains\", // Hierarchical containment\n  \"supersedes\", // New version replaces old (lineage)\n  \"tests\", // Question tests a belief\n] as const;\nexport type IntegrationEdgeType = (typeof INTEGRATION_EDGE_TYPES)[number];\n"]}

package/dist/auth-context.contract.d.ts

@@ -0,0 +1,2 @@
+export { AuthContext, LucernSdkClient, McpTransportKind, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SessionAuditEnvelope, SessionAuditOutcome, SessionAuthMode, SessionDelegationHop, SessionLifecycleStatus, SessionPrincipalType, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain } from './auth.contract.js';
+import './convex-admin.contract.js';

package/dist/auth-context.contract.js

@@ -0,0 +1,48 @@
+// src/auth.contract.ts
+var SESSION_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
+];
+var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_LIFECYCLE_STATUSES = [
+  "active",
+  "expired",
+  "revoked"
+];
+function inferSessionPrincipalType(principalId) {
+  if (principalId.startsWith("user:")) {
+    return "human";
+  }
+  if (principalId.startsWith("agent:")) {
+    return "agent";
+  }
+  return "service";
+}
+function normalizeDelegationChain(args) {
+  if (args.delegationChain && args.delegationChain.length > 0) {
+    return [...args.delegationChain];
+  }
+  if (!args.delegatedBy) {
+    return;
+  }
+  return [
+    {
+      principalId: args.delegatedBy,
+      principalType: args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),
+      delegatedAt: args.delegatedAt,
+      reason: args.reason
+    }
+  ];
+}
+function lastDelegator(delegationChain) {
+  if (!delegationChain || delegationChain.length === 0) {
+    return;
+  }
+  return delegationChain[delegationChain.length - 1]?.principalId;
+}
+
+export { SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain };
+//# sourceMappingURL=auth-context.contract.js.map
+//# sourceMappingURL=auth-context.contract.js.map

package/dist/auth-context.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.contract.ts"],"names":[],"mappings":";AAgBO,IAAM,kBAAA,GAAqB;AAAA,EAChC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AAGO,IAAM,uBAAA,GAA0B,CAAC,OAAA,EAAS,SAAA,EAAW,OAAO;AAG5D,IAAM,0BAAA,GAA6B;AAAA,EACxC,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AA2CO,SAAS,0BACd,WAAA,EACsB;AACtB,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,EAAG;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,QAAQ,CAAA,EAAG;AACpC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA;AACT;AAEO,SAAS,yBAAyB,IAAA,EAMF;AACrC,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC3D,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,eAAe,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,IAAA;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAA,EACE,IAAA,CAAK,eAAA,IAAmB,yBAAA,CAA0B,KAAK,WAAW,CAAA;AAAA,MACpE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,QAAQ,IAAA,CAAK;AAAA;AACf,GACF;AACF;AAEO,SAAS,cACd,eAAA,EACoB;AACpB,EAAA,IAAI,CAAC,eAAA,IAAmB,eAAA,CAAgB,MAAA,KAAW,CAAA,EAAG;AACpD,IAAA;AAAA,EACF;AACA,EAAA,OAAO,eAAA,CAAgB,eAAA,CAAgB,MAAA,GAAS,CAAC,CAAA,EAAG,WAAA;AACtD","file":"auth-context.contract.js","sourcesContent":["/**\n * @lucern/contracts — auth (canonical support contract)\n *\n * Consolidated flat support surface for Lucern authentication:\n *   - Session primitives (auth modes, principal types, lifecycle)\n *   - AuthContext shape + McpTransportKind + LucernSdkClient alias\n *\n * Consolidated from src/auth-session.contract.ts and src/auth-context.contract.ts\n * in EK-16 T1 PR 3a. Compat shims remain at both old paths until Lucern 1.0.0 (D12).\n */\n\n// =============================================================================\n// SESSION PRIMITIVES\n// (Formerly src/auth-session.contract.ts)\n// =============================================================================\n\nexport const SESSION_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const;\nexport type SessionAuthMode = (typeof SESSION_AUTH_MODES)[number];\n\nexport const SESSION_PRINCIPAL_TYPES = [\"human\", \"service\", \"agent\"] as const;\nexport type SessionPrincipalType = (typeof SESSION_PRINCIPAL_TYPES)[number];\n\nexport const SESSION_LIFECYCLE_STATUSES = [\n  \"active\",\n  \"expired\",\n  \"revoked\",\n] as const;\nexport type SessionLifecycleStatus =\n  (typeof SESSION_LIFECYCLE_STATUSES)[number];\n\nexport type SessionDelegationHop = {\n  principalId: string;\n  principalType: SessionPrincipalType;\n  authMode?: SessionAuthMode;\n  sessionId?: string;\n  delegatedAt?: number;\n  reason?: string;\n};\n\nexport type SessionAuditOutcome =\n  | \"accepted\"\n  | \"rejected\"\n  | \"revoked\"\n  | \"expired\";\n\nexport type SessionAuditEnvelope = {\n  sessionId: string;\n  authMode: SessionAuthMode;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  tenantId: string;\n  workspaceId?: string;\n  apiKeyId?: string;\n  scopes: readonly string[];\n  roles?: readonly string[];\n  delegationChain?: readonly SessionDelegationHop[];\n  sourceSessionId?: string;\n  expiresAt?: number;\n  request?: {\n    endpoint?: string;\n    method?: string;\n    correlationId?: string;\n  };\n  result?: {\n    outcome: SessionAuditOutcome;\n    reason?: string;\n  };\n};\n\nexport function inferSessionPrincipalType(\n  principalId: string\n): SessionPrincipalType {\n  if (principalId.startsWith(\"user:\")) {\n    return \"human\";\n  }\n  if (principalId.startsWith(\"agent:\")) {\n    return \"agent\";\n  }\n  return \"service\";\n}\n\nexport function normalizeDelegationChain(args: {\n  delegationChain?: readonly SessionDelegationHop[];\n  delegatedBy?: string;\n  delegatedByType?: SessionPrincipalType;\n  delegatedAt?: number;\n  reason?: string;\n}): SessionDelegationHop[] | undefined {\n  if (args.delegationChain && args.delegationChain.length > 0) {\n    return [...args.delegationChain];\n  }\n  if (!args.delegatedBy) {\n    return;\n  }\n  return [\n    {\n      principalId: args.delegatedBy,\n      principalType:\n        args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),\n      delegatedAt: args.delegatedAt,\n      reason: args.reason,\n    },\n  ];\n}\n\nexport function lastDelegator(\n  delegationChain?: readonly SessionDelegationHop[]\n): string | undefined {\n  if (!delegationChain || delegationChain.length === 0) {\n    return;\n  }\n  return delegationChain[delegationChain.length - 1]?.principalId;\n}\n\n// =============================================================================\n// AUTH CONTEXT\n// (Formerly src/auth-context.contract.ts)\n// =============================================================================\n\nimport type { ConvexAdminClient } from \"./convex-admin.contract\";\n\nexport type McpTransportKind = \"stdio\" | \"hosted\";\n\nexport type LucernSdkClient = unknown;\n\n/**\n * Session authentication context — injected by withAuth() middleware.\n *\n * Built from TenantConfig at dispatch time. Agent sessions get\n * AGENT_IDENTITY + \"agent:internal\" role + unrestricted access.\n * User sessions get Clerk userId + resolved role + tool ACLs.\n */\nexport type AuthContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string; // AGENT_IDENTITY for agents, Clerk userId for users\n  tenantId: string;\n  role: string; // \"agent:internal\" | \"platform_admin\" | \"tenant_admin\" | \"editor\" | \"viewer\" | ...\n  allowedTopics: string[] | null; // null = unrestricted (agents, admins). Block 11D populates this.\n  // Layer 2a: Group-pack binding — resolved at boot from MC resolveUserPackAccess\n  groupIds: string[]; // Groups this user belongs to (empty for agents)\n  permittedPackKeys: string[]; // Packs accessible via group assignments (empty = no pack filtering)\n  sessionId: string; // S2-13K: MCP process session UUID for audit attribution\n  principalId?: string;\n  principalType?: SessionPrincipalType;\n  workspaceId?: string;\n  scopes?: string[];\n  authMode?: SessionAuthMode;\n  roles?: string[];\n  transportKind?: McpTransportKind;\n  lucernClient?: LucernSdkClient;\n  convex?: ConvexAdminClient;\n  setDefaultScopeContext?: (scopeId: string) => Promise<unknown>;\n  matchesWorkspaceReasoningScope?: (\n    node: unknown,\n    scope: unknown\n  ) => boolean;\n};\n"]}

package/dist/auth-session.contract.d.ts

@@ -0,0 +1,2 @@
+export { AuthContext, LucernSdkClient, McpTransportKind, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SessionAuditEnvelope, SessionAuditOutcome, SessionAuthMode, SessionDelegationHop, SessionLifecycleStatus, SessionPrincipalType, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain } from './auth.contract.js';
+import './convex-admin.contract.js';

package/dist/auth-session.contract.js

@@ -0,0 +1,48 @@
+// src/auth.contract.ts
+var SESSION_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
+];
+var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_LIFECYCLE_STATUSES = [
+  "active",
+  "expired",
+  "revoked"
+];
+function inferSessionPrincipalType(principalId) {
+  if (principalId.startsWith("user:")) {
+    return "human";
+  }
+  if (principalId.startsWith("agent:")) {
+    return "agent";
+  }
+  return "service";
+}
+function normalizeDelegationChain(args) {
+  if (args.delegationChain && args.delegationChain.length > 0) {
+    return [...args.delegationChain];
+  }
+  if (!args.delegatedBy) {
+    return;
+  }
+  return [
+    {
+      principalId: args.delegatedBy,
+      principalType: args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),
+      delegatedAt: args.delegatedAt,
+      reason: args.reason
+    }
+  ];
+}
+function lastDelegator(delegationChain) {
+  if (!delegationChain || delegationChain.length === 0) {
+    return;
+  }
+  return delegationChain[delegationChain.length - 1]?.principalId;
+}
+
+export { SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain };
+//# sourceMappingURL=auth-session.contract.js.map
+//# sourceMappingURL=auth-session.contract.js.map

package/dist/auth-session.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.contract.ts"],"names":[],"mappings":";AAgBO,IAAM,kBAAA,GAAqB;AAAA,EAChC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AAGO,IAAM,uBAAA,GAA0B,CAAC,OAAA,EAAS,SAAA,EAAW,OAAO;AAG5D,IAAM,0BAAA,GAA6B;AAAA,EACxC,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AA2CO,SAAS,0BACd,WAAA,EACsB;AACtB,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,EAAG;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,QAAQ,CAAA,EAAG;AACpC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA;AACT;AAEO,SAAS,yBAAyB,IAAA,EAMF;AACrC,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC3D,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,eAAe,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,IAAA;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAA,EACE,IAAA,CAAK,eAAA,IAAmB,yBAAA,CAA0B,KAAK,WAAW,CAAA;AAAA,MACpE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,QAAQ,IAAA,CAAK;AAAA;AACf,GACF;AACF;AAEO,SAAS,cACd,eAAA,EACoB;AACpB,EAAA,IAAI,CAAC,eAAA,IAAmB,eAAA,CAAgB,MAAA,KAAW,CAAA,EAAG;AACpD,IAAA;AAAA,EACF;AACA,EAAA,OAAO,eAAA,CAAgB,eAAA,CAAgB,MAAA,GAAS,CAAC,CAAA,EAAG,WAAA;AACtD","file":"auth-session.contract.js","sourcesContent":["/**\n * @lucern/contracts — auth (canonical support contract)\n *\n * Consolidated flat support surface for Lucern authentication:\n *   - Session primitives (auth modes, principal types, lifecycle)\n *   - AuthContext shape + McpTransportKind + LucernSdkClient alias\n *\n * Consolidated from src/auth-session.contract.ts and src/auth-context.contract.ts\n * in EK-16 T1 PR 3a. Compat shims remain at both old paths until Lucern 1.0.0 (D12).\n */\n\n// =============================================================================\n// SESSION PRIMITIVES\n// (Formerly src/auth-session.contract.ts)\n// =============================================================================\n\nexport const SESSION_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const;\nexport type SessionAuthMode = (typeof SESSION_AUTH_MODES)[number];\n\nexport const SESSION_PRINCIPAL_TYPES = [\"human\", \"service\", \"agent\"] as const;\nexport type SessionPrincipalType = (typeof SESSION_PRINCIPAL_TYPES)[number];\n\nexport const SESSION_LIFECYCLE_STATUSES = [\n  \"active\",\n  \"expired\",\n  \"revoked\",\n] as const;\nexport type SessionLifecycleStatus =\n  (typeof SESSION_LIFECYCLE_STATUSES)[number];\n\nexport type SessionDelegationHop = {\n  principalId: string;\n  principalType: SessionPrincipalType;\n  authMode?: SessionAuthMode;\n  sessionId?: string;\n  delegatedAt?: number;\n  reason?: string;\n};\n\nexport type SessionAuditOutcome =\n  | \"accepted\"\n  | \"rejected\"\n  | \"revoked\"\n  | \"expired\";\n\nexport type SessionAuditEnvelope = {\n  sessionId: string;\n  authMode: SessionAuthMode;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  tenantId: string;\n  workspaceId?: string;\n  apiKeyId?: string;\n  scopes: readonly string[];\n  roles?: readonly string[];\n  delegationChain?: readonly SessionDelegationHop[];\n  sourceSessionId?: string;\n  expiresAt?: number;\n  request?: {\n    endpoint?: string;\n    method?: string;\n    correlationId?: string;\n  };\n  result?: {\n    outcome: SessionAuditOutcome;\n    reason?: string;\n  };\n};\n\nexport function inferSessionPrincipalType(\n  principalId: string\n): SessionPrincipalType {\n  if (principalId.startsWith(\"user:\")) {\n    return \"human\";\n  }\n  if (principalId.startsWith(\"agent:\")) {\n    return \"agent\";\n  }\n  return \"service\";\n}\n\nexport function normalizeDelegationChain(args: {\n  delegationChain?: readonly SessionDelegationHop[];\n  delegatedBy?: string;\n  delegatedByType?: SessionPrincipalType;\n  delegatedAt?: number;\n  reason?: string;\n}): SessionDelegationHop[] | undefined {\n  if (args.delegationChain && args.delegationChain.length > 0) {\n    return [...args.delegationChain];\n  }\n  if (!args.delegatedBy) {\n    return;\n  }\n  return [\n    {\n      principalId: args.delegatedBy,\n      principalType:\n        args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),\n      delegatedAt: args.delegatedAt,\n      reason: args.reason,\n    },\n  ];\n}\n\nexport function lastDelegator(\n  delegationChain?: readonly SessionDelegationHop[]\n): string | undefined {\n  if (!delegationChain || delegationChain.length === 0) {\n    return;\n  }\n  return delegationChain[delegationChain.length - 1]?.principalId;\n}\n\n// =============================================================================\n// AUTH CONTEXT\n// (Formerly src/auth-context.contract.ts)\n// =============================================================================\n\nimport type { ConvexAdminClient } from \"./convex-admin.contract\";\n\nexport type McpTransportKind = \"stdio\" | \"hosted\";\n\nexport type LucernSdkClient = unknown;\n\n/**\n * Session authentication context — injected by withAuth() middleware.\n *\n * Built from TenantConfig at dispatch time. Agent sessions get\n * AGENT_IDENTITY + \"agent:internal\" role + unrestricted access.\n * User sessions get Clerk userId + resolved role + tool ACLs.\n */\nexport type AuthContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string; // AGENT_IDENTITY for agents, Clerk userId for users\n  tenantId: string;\n  role: string; // \"agent:internal\" | \"platform_admin\" | \"tenant_admin\" | \"editor\" | \"viewer\" | ...\n  allowedTopics: string[] | null; // null = unrestricted (agents, admins). Block 11D populates this.\n  // Layer 2a: Group-pack binding — resolved at boot from MC resolveUserPackAccess\n  groupIds: string[]; // Groups this user belongs to (empty for agents)\n  permittedPackKeys: string[]; // Packs accessible via group assignments (empty = no pack filtering)\n  sessionId: string; // S2-13K: MCP process session UUID for audit attribution\n  principalId?: string;\n  principalType?: SessionPrincipalType;\n  workspaceId?: string;\n  scopes?: string[];\n  authMode?: SessionAuthMode;\n  roles?: string[];\n  transportKind?: McpTransportKind;\n  lucernClient?: LucernSdkClient;\n  convex?: ConvexAdminClient;\n  setDefaultScopeContext?: (scopeId: string) => Promise<unknown>;\n  matchesWorkspaceReasoningScope?: (\n    node: unknown,\n    scope: unknown\n  ) => boolean;\n};\n"]}

package/dist/auth.contract.d.ts

@@ -0,0 +1,92 @@
+import { ConvexAdminClient } from './convex-admin.contract.js';
+
+/**
+ * @lucern/contracts — auth (canonical support contract)
+ *
+ * Consolidated flat support surface for Lucern authentication:
+ *   - Session primitives (auth modes, principal types, lifecycle)
+ *   - AuthContext shape + McpTransportKind + LucernSdkClient alias
+ *
+ * Consolidated from src/auth-session.contract.ts and src/auth-context.contract.ts
+ * in EK-16 T1 PR 3a. Compat shims remain at both old paths until Lucern 1.0.0 (D12).
+ */
+declare const SESSION_AUTH_MODES: readonly ["interactive_user", "service_principal", "tenant_api_key", "session_token"];
+type SessionAuthMode = (typeof SESSION_AUTH_MODES)[number];
+declare const SESSION_PRINCIPAL_TYPES: readonly ["human", "service", "agent"];
+type SessionPrincipalType = (typeof SESSION_PRINCIPAL_TYPES)[number];
+declare const SESSION_LIFECYCLE_STATUSES: readonly ["active", "expired", "revoked"];
+type SessionLifecycleStatus = (typeof SESSION_LIFECYCLE_STATUSES)[number];
+type SessionDelegationHop = {
+    principalId: string;
+    principalType: SessionPrincipalType;
+    authMode?: SessionAuthMode;
+    sessionId?: string;
+    delegatedAt?: number;
+    reason?: string;
+};
+type SessionAuditOutcome = "accepted" | "rejected" | "revoked" | "expired";
+type SessionAuditEnvelope = {
+    sessionId: string;
+    authMode: SessionAuthMode;
+    principalId: string;
+    principalType: SessionPrincipalType;
+    tenantId: string;
+    workspaceId?: string;
+    apiKeyId?: string;
+    scopes: readonly string[];
+    roles?: readonly string[];
+    delegationChain?: readonly SessionDelegationHop[];
+    sourceSessionId?: string;
+    expiresAt?: number;
+    request?: {
+        endpoint?: string;
+        method?: string;
+        correlationId?: string;
+    };
+    result?: {
+        outcome: SessionAuditOutcome;
+        reason?: string;
+    };
+};
+declare function inferSessionPrincipalType(principalId: string): SessionPrincipalType;
+declare function normalizeDelegationChain(args: {
+    delegationChain?: readonly SessionDelegationHop[];
+    delegatedBy?: string;
+    delegatedByType?: SessionPrincipalType;
+    delegatedAt?: number;
+    reason?: string;
+}): SessionDelegationHop[] | undefined;
+declare function lastDelegator(delegationChain?: readonly SessionDelegationHop[]): string | undefined;
+
+type McpTransportKind = "stdio" | "hosted";
+type LucernSdkClient = unknown;
+/**
+ * Session authentication context — injected by withAuth() middleware.
+ *
+ * Built from TenantConfig at dispatch time. Agent sessions get
+ * AGENT_IDENTITY + "agent:internal" role + unrestricted access.
+ * User sessions get Clerk userId + resolved role + tool ACLs.
+ */
+type AuthContext = {
+    sessionType: "agent" | "user";
+    userId: string;
+    tenantId: string;
+    role: string;
+    allowedTopics: string[] | null;
+    groupIds: string[];
+    permittedPackKeys: string[];
+    sessionId: string;
+    principalId?: string;
+    principalType?: SessionPrincipalType;
+    workspaceId?: string;
+    scopes?: string[];
+    authMode?: SessionAuthMode;
+    roles?: string[];
+    transportKind?: McpTransportKind;
+    lucernClient?: LucernSdkClient;
+    convex?: ConvexAdminClient;
+    setDefaultScopeContext?: (scopeId: string) => Promise<unknown>;
+    matchesWorkspaceReasoningScope?: (node: unknown, scope: unknown) => boolean;
+};
+
+export { type AuthContext, type LucernSdkClient, type McpTransportKind, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, type SessionAuditEnvelope, type SessionAuditOutcome, type SessionAuthMode, type SessionDelegationHop, type SessionLifecycleStatus, type SessionPrincipalType, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain };

package/dist/auth.contract.js

@@ -0,0 +1,48 @@
+// src/auth.contract.ts
+var SESSION_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
+];
+var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_LIFECYCLE_STATUSES = [
+  "active",
+  "expired",
+  "revoked"
+];
+function inferSessionPrincipalType(principalId) {
+  if (principalId.startsWith("user:")) {
+    return "human";
+  }
+  if (principalId.startsWith("agent:")) {
+    return "agent";
+  }
+  return "service";
+}
+function normalizeDelegationChain(args) {
+  if (args.delegationChain && args.delegationChain.length > 0) {
+    return [...args.delegationChain];
+  }
+  if (!args.delegatedBy) {
+    return;
+  }
+  return [
+    {
+      principalId: args.delegatedBy,
+      principalType: args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),
+      delegatedAt: args.delegatedAt,
+      reason: args.reason
+    }
+  ];
+}
+function lastDelegator(delegationChain) {
+  if (!delegationChain || delegationChain.length === 0) {
+    return;
+  }
+  return delegationChain[delegationChain.length - 1]?.principalId;
+}
+
+export { SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain };
+//# sourceMappingURL=auth.contract.js.map
+//# sourceMappingURL=auth.contract.js.map

package/dist/auth.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.contract.ts"],"names":[],"mappings":";AAgBO,IAAM,kBAAA,GAAqB;AAAA,EAChC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AAGO,IAAM,uBAAA,GAA0B,CAAC,OAAA,EAAS,SAAA,EAAW,OAAO;AAG5D,IAAM,0BAAA,GAA6B;AAAA,EACxC,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AA2CO,SAAS,0BACd,WAAA,EACsB;AACtB,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,EAAG;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,QAAQ,CAAA,EAAG;AACpC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA;AACT;AAEO,SAAS,yBAAyB,IAAA,EAMF;AACrC,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC3D,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,eAAe,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,IAAA;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAA,EACE,IAAA,CAAK,eAAA,IAAmB,yBAAA,CAA0B,KAAK,WAAW,CAAA;AAAA,MACpE,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,QAAQ,IAAA,CAAK;AAAA;AACf,GACF;AACF;AAEO,SAAS,cACd,eAAA,EACoB;AACpB,EAAA,IAAI,CAAC,eAAA,IAAmB,eAAA,CAAgB,MAAA,KAAW,CAAA,EAAG;AACpD,IAAA;AAAA,EACF;AACA,EAAA,OAAO,eAAA,CAAgB,eAAA,CAAgB,MAAA,GAAS,CAAC,CAAA,EAAG,WAAA;AACtD","file":"auth.contract.js","sourcesContent":["/**\n * @lucern/contracts — auth (canonical support contract)\n *\n * Consolidated flat support surface for Lucern authentication:\n *   - Session primitives (auth modes, principal types, lifecycle)\n *   - AuthContext shape + McpTransportKind + LucernSdkClient alias\n *\n * Consolidated from src/auth-session.contract.ts and src/auth-context.contract.ts\n * in EK-16 T1 PR 3a. Compat shims remain at both old paths until Lucern 1.0.0 (D12).\n */\n\n// =============================================================================\n// SESSION PRIMITIVES\n// (Formerly src/auth-session.contract.ts)\n// =============================================================================\n\nexport const SESSION_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const;\nexport type SessionAuthMode = (typeof SESSION_AUTH_MODES)[number];\n\nexport const SESSION_PRINCIPAL_TYPES = [\"human\", \"service\", \"agent\"] as const;\nexport type SessionPrincipalType = (typeof SESSION_PRINCIPAL_TYPES)[number];\n\nexport const SESSION_LIFECYCLE_STATUSES = [\n  \"active\",\n  \"expired\",\n  \"revoked\",\n] as const;\nexport type SessionLifecycleStatus =\n  (typeof SESSION_LIFECYCLE_STATUSES)[number];\n\nexport type SessionDelegationHop = {\n  principalId: string;\n  principalType: SessionPrincipalType;\n  authMode?: SessionAuthMode;\n  sessionId?: string;\n  delegatedAt?: number;\n  reason?: string;\n};\n\nexport type SessionAuditOutcome =\n  | \"accepted\"\n  | \"rejected\"\n  | \"revoked\"\n  | \"expired\";\n\nexport type SessionAuditEnvelope = {\n  sessionId: string;\n  authMode: SessionAuthMode;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  tenantId: string;\n  workspaceId?: string;\n  apiKeyId?: string;\n  scopes: readonly string[];\n  roles?: readonly string[];\n  delegationChain?: readonly SessionDelegationHop[];\n  sourceSessionId?: string;\n  expiresAt?: number;\n  request?: {\n    endpoint?: string;\n    method?: string;\n    correlationId?: string;\n  };\n  result?: {\n    outcome: SessionAuditOutcome;\n    reason?: string;\n  };\n};\n\nexport function inferSessionPrincipalType(\n  principalId: string\n): SessionPrincipalType {\n  if (principalId.startsWith(\"user:\")) {\n    return \"human\";\n  }\n  if (principalId.startsWith(\"agent:\")) {\n    return \"agent\";\n  }\n  return \"service\";\n}\n\nexport function normalizeDelegationChain(args: {\n  delegationChain?: readonly SessionDelegationHop[];\n  delegatedBy?: string;\n  delegatedByType?: SessionPrincipalType;\n  delegatedAt?: number;\n  reason?: string;\n}): SessionDelegationHop[] | undefined {\n  if (args.delegationChain && args.delegationChain.length > 0) {\n    return [...args.delegationChain];\n  }\n  if (!args.delegatedBy) {\n    return;\n  }\n  return [\n    {\n      principalId: args.delegatedBy,\n      principalType:\n        args.delegatedByType ?? inferSessionPrincipalType(args.delegatedBy),\n      delegatedAt: args.delegatedAt,\n      reason: args.reason,\n    },\n  ];\n}\n\nexport function lastDelegator(\n  delegationChain?: readonly SessionDelegationHop[]\n): string | undefined {\n  if (!delegationChain || delegationChain.length === 0) {\n    return;\n  }\n  return delegationChain[delegationChain.length - 1]?.principalId;\n}\n\n// =============================================================================\n// AUTH CONTEXT\n// (Formerly src/auth-context.contract.ts)\n// =============================================================================\n\nimport type { ConvexAdminClient } from \"./convex-admin.contract\";\n\nexport type McpTransportKind = \"stdio\" | \"hosted\";\n\nexport type LucernSdkClient = unknown;\n\n/**\n * Session authentication context — injected by withAuth() middleware.\n *\n * Built from TenantConfig at dispatch time. Agent sessions get\n * AGENT_IDENTITY + \"agent:internal\" role + unrestricted access.\n * User sessions get Clerk userId + resolved role + tool ACLs.\n */\nexport type AuthContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string; // AGENT_IDENTITY for agents, Clerk userId for users\n  tenantId: string;\n  role: string; // \"agent:internal\" | \"platform_admin\" | \"tenant_admin\" | \"editor\" | \"viewer\" | ...\n  allowedTopics: string[] | null; // null = unrestricted (agents, admins). Block 11D populates this.\n  // Layer 2a: Group-pack binding — resolved at boot from MC resolveUserPackAccess\n  groupIds: string[]; // Groups this user belongs to (empty for agents)\n  permittedPackKeys: string[]; // Packs accessible via group assignments (empty = no pack filtering)\n  sessionId: string; // S2-13K: MCP process session UUID for audit attribution\n  principalId?: string;\n  principalType?: SessionPrincipalType;\n  workspaceId?: string;\n  scopes?: string[];\n  authMode?: SessionAuthMode;\n  roles?: string[];\n  transportKind?: McpTransportKind;\n  lucernClient?: LucernSdkClient;\n  convex?: ConvexAdminClient;\n  setDefaultScopeContext?: (scopeId: string) => Promise<unknown>;\n  matchesWorkspaceReasoningScope?: (\n    node: unknown,\n    scope: unknown\n  ) => boolean;\n};\n"]}

package/dist/beliefs/v1.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/beliefs/v1.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=v1.js.map
+//# sourceMappingURL=v1.js.map

package/dist/beliefs/v1.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"v1.js"}