@lucern/contracts 0.3.0-alpha.1 → 0.3.0-alpha.10

package/dist/tenant-client.contract.js

@@ -0,0 +1,488 @@
+// src/tenant-client.contract.ts
+var TENANT_CLIENT_CONTRACT_VERSION = "2026-04-27";
+var TENANT_CLIENT_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
+];
+var TENANT_CLIENT_PRINCIPAL_TYPES = [
+  "human",
+  "service",
+  "agent"
+];
+var TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "authMode",
+  "scopes"
+];
+var TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [
+  "principalType",
+  "roles",
+  "sessionId",
+  "delegationChain"
+];
+var TENANT_CLIENT_INSTALL_TOKEN_ENV = "INSTALL_LUCERN_NPM";
+var TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH = "tenants/shared";
+var TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [
+  "/platform/publish"
+];
+var TENANT_CLIENT_FORBIDDEN_SECRET_ENV = ["NPM_TOKEN"];
+var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
+  {
+    packageName: "@lucern/access-control",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/agent",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/auth",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/cli",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/client-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/confidence",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/config",
+    role: "configuration",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/contracts",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/control-plane",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/developer-kit",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    role: "host_addon_runtime",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/identity",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+var TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES = TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
+  (entry) => entry.packageName
+);
+var TENANT_CLIENT_INSTALL_PROFILES = [
+  {
+    id: "core_app_runtime",
+    description: "Smallest tenant app/runtime install for typed Lucern API calls plus tool-access policy helpers.",
+    packageNames: ["@lucern/sdk", "@lucern/access-control"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "react_app_runtime",
+    description: "React tenant app install for hooks, provider, curated graph components, and direct SDK calls.",
+    packageNames: ["@lucern/react", "@lucern/sdk", "@lucern/access-control"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "convex_components",
+    description: "Tenant Convex host install for binding the Lucern identity and reasoning-kernel components.",
+    packageNames: ["@lucern/identity", "@lucern/reasoning-kernel"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "graph_mirroring_addon",
+    description: "Optional tenant Convex host install for Neo4j graph projection, edge topology writes, backfill, health checks, and query proxy helpers.",
+    packageNames: ["@lucern/graph-sync"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "operator_cli",
+    description: "Developer/operator install for the `lucern` binary, including tenant bootstrap seed commands.",
+    packageNames: ["@lucern/cli"],
+    dependencyField: "devDependencies"
+  },
+  {
+    id: "mcp_runtime",
+    description: "Agent runtime install for the standalone Lucern MCP server and hosted route helpers.",
+    packageNames: ["@lucern/mcp"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "contracts_and_types",
+    description: "Compile-time contract/type install for codegen, audits, and tenant integration validation.",
+    packageNames: ["@lucern/contracts", "@lucern/types"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "full_suite",
+    description: "Full coherent Lucern package suite for design-partner repos that want every published runtime, tool, component, test, and config package pinned together.",
+    packageNames: TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES,
+    dependencyField: "mixed"
+  }
+];
+var TENANT_CLIENT_PUBLIC_IMPORTS = [
+  {
+    packageName: "@lucern/sdk",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "TypeScript SDK runtime and generated operation namespaces."
+  },
+  {
+    packageName: "@lucern/react",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "React bindings for tenant-owned UI applications."
+  },
+  {
+    packageName: "@lucern/mcp",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "MCP client/server entry points and hosted route helpers."
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "Optional Neo4j graph mirroring host actions, edge API, query proxy, backfill, and health helpers."
+  },
+  {
+    packageName: "@lucern/contracts",
+    surface: "contract",
+    subpaths: "published_exports",
+    description: "Published type and manifest contracts."
+  },
+  {
+    packageName: "@lucern/access-control",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "Tenant runtime access-control helpers, including effective tool access."
+  },
+  {
+    packageName: "@lucern/types",
+    surface: "contract",
+    subpaths: "published_exports",
+    description: "Published type-only helpers for tenant integration code."
+  }
+];
+var TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [
+  {
+    packageName: "@lucern/identity",
+    importPath: "@lucern/identity/convex.config",
+    surface: "component_config",
+    description: "Convex component binding config for tenant deployments that install Lucern identity."
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    importPath: "@lucern/reasoning-kernel/convex.config",
+    surface: "component_config",
+    description: "Convex component binding config for tenant deployments that install the Lucern reasoning kernel."
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    importPath: "@lucern/reasoning-kernel/runtime.config",
+    surface: "component_config",
+    description: "Runtime config alias for tenant deployments that install the Lucern reasoning kernel."
+  }
+];
+function findTenantClientInstallablePackage(packageName) {
+  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(
+    (entry) => entry.packageName === packageName
+  );
+}
+function isTenantClientInstallablePackage(packageName) {
+  return Boolean(findTenantClientInstallablePackage(packageName));
+}
+var TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [
+  "bootstrap",
+  "context",
+  "beliefs",
+  "evidence",
+  "questions",
+  "graph",
+  "worktrees",
+  "topics",
+  "edges",
+  "contradictions",
+  "contracts",
+  "graphIntel",
+  "graphIntelligence",
+  "graphAnalysis",
+  "graphRecommendations",
+  "orgGraphSearch",
+  "embeddings",
+  "ontologyLinks",
+  "graphStateClassifier",
+  "tools",
+  "identity",
+  "modelRuntime",
+  "events",
+  "jobs",
+  "telemetry"
+];
+var TENANT_CLIENT_CAPABILITIES = [
+  {
+    id: "identity.bootstrap_session",
+    description: "Start a scoped Lucern session for a tenant principal.",
+    surfaces: ["@lucern/sdk", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.context.compile",
+    description: "Compile tenant and workspace scoped reasoning context.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph.read",
+    description: "Read beliefs, evidence, questions, topics, graph edges, and lineage.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph.write",
+    description: "Create and update graph objects through authorized APIs.",
+    surfaces: ["@lucern/sdk", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph_intelligence.run",
+    description: "Discover and run Graph Intelligence query recipes for structural graph analysis.",
+    surfaces: ["@lucern/sdk", "@lucern/cli", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph_mirroring.install",
+    description: "Install and run the optional Neo4j graph mirror for paid or enterprise tenant deployments.",
+    surfaces: ["@lucern/graph-sync", "@lucern/cli"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "workflow.worktree_lifecycle",
+    description: "Create, review, merge, and close scoped worktrees.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  }
+];
+var TENANT_CLIENT_ISOLATION_RULES = [
+  {
+    id: "tenant_workspace_scope_required",
+    description: "Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state."
+  },
+  {
+    id: "principal_audit_required",
+    description: "Runtime operations must carry principalId, authMode, and scopes for audit attribution."
+  },
+  {
+    id: "no_private_lucern_imports",
+    description: "Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals."
+  }
+];
+var TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [
+  {
+    id: "deep_src_import",
+    pattern: "^@lucern/[^/]+/src(?:/|$)",
+    description: "Published packages must not be bypassed through src paths."
+  },
+  {
+    id: "deep_dist_import",
+    pattern: "^@lucern/[^/]+/dist(?:/|$)",
+    description: "Published package exports must be used instead of dist file paths."
+  },
+  {
+    id: "generated_adapter_import",
+    pattern: "^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)",
+    description: "Generated Lucern adapters are internal deployment artifacts."
+  },
+  {
+    id: "private_runtime_import",
+    pattern: "^@lucern/[^/]+/(?:internal|private)(?:/|$)",
+    description: "Internal and private package subpaths are not public SDK API."
+  },
+  {
+    id: "workspace_source_import",
+    pattern: "^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)",
+    description: "Tenant clients must not import source files from the Lucern monorepo."
+  },
+  {
+    id: "root_alias_lucern_import",
+    pattern: "^@/(?:lucern|packages|modules|services|apps)(?:/|$)",
+    description: "Tenant clients must not depend on Lucern repo-local path aliases."
+  },
+  {
+    id: "relative_lucern_source_import",
+    pattern: "^\\.\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)",
+    description: "Tenant clients must not reach back into Lucern source through relative paths."
+  },
+  {
+    id: "monorepo_path_import",
+    pattern: "lucern-repo",
+    description: "Absolute imports that name the Lucern repository are not portable tenant code."
+  }
+];
+function matchesPublicImport(importPath) {
+  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(
+    (entry) => importPath === entry.importPath
+  );
+  if (componentConfig) {
+    return componentConfig;
+  }
+  return TENANT_CLIENT_PUBLIC_IMPORTS.find(
+    (entry) => importPath === entry.packageName || importPath.startsWith(`${entry.packageName}/`)
+  );
+}
+function matchesForbiddenPattern(importPath) {
+  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find(
+    (entry) => new RegExp(entry.pattern, "u").test(importPath)
+  );
+}
+function classifyTenantClientImport(importPath) {
+  const normalizedImportPath = importPath.trim();
+  const pattern = matchesForbiddenPattern(normalizedImportPath);
+  if (pattern) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "forbidden",
+      pattern,
+      reason: pattern.description
+    };
+  }
+  const publicImport = matchesPublicImport(normalizedImportPath);
+  if (publicImport) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "public",
+      publicImport,
+      reason: publicImport.description
+    };
+  }
+  if (normalizedImportPath.startsWith("@lucern/")) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "forbidden",
+      reason: "This @lucern package is not part of the tenant client public surface."
+    };
+  }
+  if (normalizedImportPath.startsWith("./") || normalizedImportPath.startsWith("../")) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "local",
+      reason: "Local tenant-owned import."
+    };
+  }
+  return {
+    importPath: normalizedImportPath,
+    decision: "external",
+    reason: "External dependency outside the Lucern package namespace."
+  };
+}
+function isTenantClientPublicImport(importPath) {
+  return classifyTenantClientImport(importPath).decision === "public";
+}
+function isTenantClientComponentConfigImport(importPath) {
+  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(
+    (entry) => importPath === entry.importPath
+  );
+}
+function isTenantClientAllowedImport(importPath) {
+  return classifyTenantClientImport(importPath).decision === "public";
+}
+function assertTenantClientImportAllowed(importPath) {
+  const classification = classifyTenantClientImport(importPath);
+  if (classification.decision !== "forbidden") {
+    return;
+  }
+  throw new Error(formatTenantClientImportViolation(classification));
+}
+function formatTenantClientImportViolation(classification) {
+  const patternId = classification.pattern ? ` [${classification.pattern.id}]` : "";
+  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;
+}
+
+export { TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_PROFILES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, assertTenantClientImportAllowed, classifyTenantClientImport, findTenantClientInstallablePackage, formatTenantClientImportViolation, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport };
+//# sourceMappingURL=tenant-client.contract.js.map
+//# sourceMappingURL=tenant-client.contract.js.map

package/dist/tenant-client.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tenant-client.contract.ts"],"names":[],"mappings":";AAcO,IAAM,8BAAA,GAAiC;AAEvC,IAAM,wBAAA,GAA2B;AAAA,EACtC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF;AAGO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,OAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,UAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,eAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF;AAIO,IAAM,+BAAA,GAAkC;AACxC,IAAM,0CAAA,GACX;AACK,IAAM,qDAAA,GAAwD;AAAA,EACnE;AACF;AACO,IAAM,kCAAA,GAAqC,CAAC,WAAW;AAMvD,IAAM,kCAAA,GAAqC;AAAA,EAChD;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,cAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,eAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,kBAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,iBAAA;AAAA,IACb,IAAA,EAAM,cAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA;AAExB;AAwBO,IAAM,yCACX,kCAAA,CAAmC,GAAA;AAAA,EACjC,CAAC,UAAU,KAAA,CAAM;AACnB;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,WAAA,EACE,iGAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAA,EAAe,wBAAwB,CAAA;AAAA,IACtD,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,WAAA,EACE,+FAAA;AAAA,IACF,YAAA,EAAc,CAAC,eAAA,EAAiB,aAAA,EAAe,wBAAwB,CAAA;AAAA,IACvE,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,WAAA,EACE,6FAAA;AAAA,IACF,YAAA,EAAc,CAAC,kBAAA,EAAoB,0BAA0B,CAAA;AAAA,IAC7D,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,WAAA,EACE,yIAAA;AAAA,IACF,YAAA,EAAc,CAAC,oBAAoB,CAAA;AAAA,IACnC,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,cAAA;AAAA,IACJ,WAAA,EACE,+FAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAa,CAAA;AAAA,IAC5B,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,aAAA;AAAA,IACJ,WAAA,EACE,sFAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAa,CAAA;AAAA,IAC5B,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,qBAAA;AAAA,IACJ,WAAA,EACE,4FAAA;AAAA,IACF,YAAA,EAAc,CAAC,mBAAA,EAAqB,eAAe,CAAA;AAAA,IACnD,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EACE,2JAAA;AAAA,IACF,YAAA,EAAc,sCAAA;AAAA,IACd,eAAA,EAAiB;AAAA;AAErB;AAUO,IAAM,4BAAA,GAA+B;AAAA,EAC1C;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA;AAEjB;AAOO,IAAM,sCAAA,GAAyC;AAAA,EACpD;AAAA,IACE,WAAA,EAAa,kBAAA;AAAA,IACb,UAAA,EAAY,gCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,UAAA,EAAY,wCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,UAAA,EAAY,yCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA;AAEN;AAOO,SAAS,mCACd,WAAA,EAC4C;AAC5C,EAAA,OAAO,kCAAA,CAAmC,IAAA;AAAA,IACxC,CAAC,KAAA,KAAU,KAAA,CAAM,WAAA,KAAgB;AAAA,GACnC;AACF;AAEO,SAAS,iCAAiC,WAAA,EAA8B;AAC7E,EAAA,OAAO,OAAA,CAAQ,kCAAA,CAAmC,WAAW,CAAC,CAAA;AAChE;AAEO,IAAM,qCAAA,GAAwC;AAAA,EACnD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,gBAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF;AAIO,IAAM,0BAAA,GAA6B;AAAA,EACxC;AAAA,IACE,EAAA,EAAI,4BAAA;AAAA,IACJ,WAAA,EAAa,uDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,aAAa,CAAA;AAAA,IACvC,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,2BAAA;AAAA,IACJ,WAAA,EAAa,wDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,WAAA,EAAa,sEAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,WAAA,EAAa,0DAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,aAAa,CAAA;AAAA,IACvC,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kCAAA;AAAA,IACJ,WAAA,EACE,kFAAA;AAAA,IACF,QAAA,EAAU,CAAC,aAAA,EAAe,aAAA,EAAe,aAAa,CAAA;AAAA,IACtD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mCAAA;AAAA,IACJ,WAAA,EACE,4FAAA;AAAA,IACF,QAAA,EAAU,CAAC,oBAAA,EAAsB,aAAa,CAAA;AAAA,IAC9C,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,6BAAA;AAAA,IACJ,WAAA,EAAa,oDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA;AAE3B;AAKO,IAAM,6BAAA,GAAgC;AAAA,EAC3C;AAAA,IACE,EAAA,EAAI,iCAAA;AAAA,IACJ,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,2BAAA;AAAA,IACJ,WAAA,EACE;AAAA;AAEN;AAIO,IAAM,uCAAA,GAA0C;AAAA,EACrD;AAAA,IACE,EAAA,EAAI,iBAAA;AAAA,IACJ,OAAA,EAAS,2BAAA;AAAA,IACT,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,4BAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,OAAA,EAAS,gDAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,wBAAA;AAAA,IACJ,OAAA,EAAS,4CAAA;AAAA,IACT,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,EAAA,EAAI,yBAAA;AAAA,IACJ,OAAA,EAAS,+DAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,OAAA,EAAS,qDAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,+BAAA;AAAA,IACJ,OAAA,EAAS,mEAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,aAAA;AAAA,IACT,WAAA,EACE;AAAA;AAEN;AAoBA,SAAS,oBACP,UAAA,EACuC;AACvC,EAAA,MAAM,kBAAkB,sCAAA,CAAuC,IAAA;AAAA,IAC7D,CAAC,KAAA,KAAU,UAAA,KAAe,KAAA,CAAM;AAAA,GAClC;AACA,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,eAAA;AAAA,EACT;AAEA,EAAA,OAAO,4BAAA,CAA6B,IAAA;AAAA,IAClC,CAAC,KAAA,KACC,UAAA,KAAe,KAAA,CAAM,WAAA,IACrB,WAAW,UAAA,CAAW,CAAA,EAAG,KAAA,CAAM,WAAW,CAAA,CAAA,CAAG;AAAA,GACjD;AACF;AAEA,SAAS,wBACP,UAAA,EACgD;AAChD,EAAA,OAAO,uCAAA,CAAwC,IAAA;AAAA,IAAK,CAAC,UACnD,IAAI,MAAA,CAAO,MAAM,OAAA,EAAS,GAAG,CAAA,CAAE,IAAA,CAAK,UAAU;AAAA,GAChD;AACF;AAEO,SAAS,2BACd,UAAA,EACkC;AAClC,EAAA,MAAM,oBAAA,GAAuB,WAAW,IAAA,EAAK;AAC7C,EAAA,MAAM,OAAA,GAAU,wBAAwB,oBAAoB,CAAA;AAE5D,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,oBAAA;AAAA,MACZ,QAAA,EAAU,WAAA;AAAA,MACV,OAAA;AAAA,MACA,QAAQ,OAAA,CAAQ;AAAA,KAClB;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,oBAAoB,oBAAoB,CAAA;AAC7D,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,oBAAA;AAAA,MACZ,QAAA,EAAU,QAAA;AAAA,MACV,YAAA;AAAA,MACA,QAAQ,YAAA,CAAa;AAAA,KACvB;AAAA,EACF;AAEA,EAAA,IAAI,oBAAA,CAAqB,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/C,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,oBAAA;AAAA,MACZ,QAAA,EAAU,WAAA;AAAA,MACV,MAAA,EACE;AAAA,KACJ;AAAA,EACF;AAEA,EAAA,IACE,qBAAqB,UAAA,CAAW,IAAI,KACpC,oBAAA,CAAqB,UAAA,CAAW,KAAK,CAAA,EACrC;AACA,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,oBAAA;AAAA,MACZ,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,oBAAA;AAAA,IACZ,QAAA,EAAU,UAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AACF;AAEO,SAAS,2BAA2B,UAAA,EAA6B;AACtE,EAAA,OAAO,0BAAA,CAA2B,UAAU,CAAA,CAAE,QAAA,KAAa,QAAA;AAC7D;AAEO,SAAS,oCACd,UAAA,EACS;AACT,EAAA,OAAO,sCAAA,CAAuC,IAAA;AAAA,IAC5C,CAAC,KAAA,KAAU,UAAA,KAAe,KAAA,CAAM;AAAA,GAClC;AACF;AAEO,SAAS,4BAA4B,UAAA,EAA6B;AACvE,EAAA,OAAO,0BAAA,CAA2B,UAAU,CAAA,CAAE,QAAA,KAAa,QAAA;AAC7D;AAEO,SAAS,gCAAgC,UAAA,EAA0B;AACxE,EAAA,MAAM,cAAA,GAAiB,2BAA2B,UAAU,CAAA;AAC5D,EAAA,IAAI,cAAA,CAAe,aAAa,WAAA,EAAa;AAC3C,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,KAAA,CAAM,iCAAA,CAAkC,cAAc,CAAC,CAAA;AACnE;AAEO,SAAS,kCACd,cAAA,EACQ;AACR,EAAA,MAAM,YAAY,cAAA,CAAe,OAAA,GAC7B,KAAK,cAAA,CAAe,OAAA,CAAQ,EAAE,CAAA,CAAA,CAAA,GAC9B,EAAA;AACJ,EAAA,OAAO,sCAAsC,SAAS,CAAA,EAAA,EAAK,eAAe,UAAU,CAAA,EAAA,EAAK,eAAe,MAAM,CAAA,CAAA;AAChH","file":"tenant-client.contract.js","sourcesContent":["/**\n * Tenant client contract\n *\n * Defines the generic boundary for any customer-owned product that consumes\n * Lucern through the SDK, hosted API, or MCP server. Tenant clients may run\n * their own UI, auth provider, deployment, and data plane, but reasoning\n * operations must enter through the published packages below.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const TENANT_CLIENT_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const TENANT_CLIENT_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const satisfies readonly SessionAuthMode[];\nexport type TenantClientAuthMode = (typeof TENANT_CLIENT_AUTH_MODES)[number];\n\nexport const TENANT_CLIENT_PRINCIPAL_TYPES = [\n  \"human\",\n  \"service\",\n  \"agent\",\n] as const satisfies readonly SessionPrincipalType[];\nexport type TenantClientPrincipalType =\n  (typeof TENANT_CLIENT_PRINCIPAL_TYPES)[number];\n\nexport const TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [\n  \"tenantId\",\n  \"workspaceId\",\n  \"principalId\",\n  \"authMode\",\n  \"scopes\",\n] as const;\nexport type TenantClientRequiredContextField =\n  (typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [\n  \"principalType\",\n  \"roles\",\n  \"sessionId\",\n  \"delegationChain\",\n] as const;\nexport type TenantClientOptionalContextField =\n  (typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_INSTALL_TOKEN_ENV = \"INSTALL_LUCERN_NPM\" as const;\nexport const TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH =\n  \"tenants/shared\" as const;\nexport const TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [\n  \"/platform/publish\",\n] as const;\nexport const TENANT_CLIENT_FORBIDDEN_SECRET_ENV = [\"NPM_TOKEN\"] as const;\nexport type TenantClientForbiddenInstallTokenInfisicalPath =\n  (typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS)[number];\nexport type TenantClientForbiddenSecretEnv =\n  (typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV)[number];\n\nexport const TENANT_CLIENT_INSTALLABLE_PACKAGES = [\n  {\n    packageName: \"@lucern/access-control\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/agent\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/auth\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/cli\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/client-core\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/confidence\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/config\",\n    role: \"configuration\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/control-plane\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/developer-kit\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/events\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-primitives\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-sync\",\n    role: \"host_addon_runtime\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/identity\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/pack-host\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/pack-installer\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/proof-compiler\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/react\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/sdk\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/server-core\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/testing\",\n    role: \"test_support\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/types\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n] as const;\nexport type TenantClientInstallablePackage =\n  (typeof TENANT_CLIENT_INSTALLABLE_PACKAGES)[number];\nexport type TenantClientPackageRole = TenantClientInstallablePackage[\"role\"];\nexport type TenantClientInstallablePackageName =\n  TenantClientInstallablePackage[\"packageName\"];\n\n/**\n * Direct package installs are package.json entries owned by the tenant repo.\n * Direct imports are source-code imports that tenant application code may use.\n *\n * These concepts intentionally differ: `@lucern/cli` is a direct install when a\n * tenant repo needs the `lucern` binary, but it is not a direct application\n * import. `@lucern/reasoning-kernel` and `@lucern/identity` are direct installs\n * for Convex component binding, while tenant app code should only import their\n * explicit component config subpaths.\n */\nexport type TenantClientInstallProfile = {\n  id: string;\n  description: string;\n  packageNames: readonly TenantClientInstallablePackageName[];\n  dependencyField: \"dependencies\" | \"devDependencies\" | \"mixed\";\n};\n\nexport const TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES =\n  TENANT_CLIENT_INSTALLABLE_PACKAGES.map(\n    (entry) => entry.packageName\n  ) as readonly TenantClientInstallablePackageName[];\n\nexport const TENANT_CLIENT_INSTALL_PROFILES = [\n  {\n    id: \"core_app_runtime\",\n    description:\n      \"Smallest tenant app/runtime install for typed Lucern API calls plus tool-access policy helpers.\",\n    packageNames: [\"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"react_app_runtime\",\n    description:\n      \"React tenant app install for hooks, provider, curated graph components, and direct SDK calls.\",\n    packageNames: [\"@lucern/react\", \"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"convex_components\",\n    description:\n      \"Tenant Convex host install for binding the Lucern identity and reasoning-kernel components.\",\n    packageNames: [\"@lucern/identity\", \"@lucern/reasoning-kernel\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"graph_mirroring_addon\",\n    description:\n      \"Optional tenant Convex host install for Neo4j graph projection, edge topology writes, backfill, health checks, and query proxy helpers.\",\n    packageNames: [\"@lucern/graph-sync\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"operator_cli\",\n    description:\n      \"Developer/operator install for the `lucern` binary, including tenant bootstrap seed commands.\",\n    packageNames: [\"@lucern/cli\"],\n    dependencyField: \"devDependencies\",\n  },\n  {\n    id: \"mcp_runtime\",\n    description:\n      \"Agent runtime install for the standalone Lucern MCP server and hosted route helpers.\",\n    packageNames: [\"@lucern/mcp\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"contracts_and_types\",\n    description:\n      \"Compile-time contract/type install for codegen, audits, and tenant integration validation.\",\n    packageNames: [\"@lucern/contracts\", \"@lucern/types\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"full_suite\",\n    description:\n      \"Full coherent Lucern package suite for design-partner repos that want every published runtime, tool, component, test, and config package pinned together.\",\n    packageNames: TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES,\n    dependencyField: \"mixed\",\n  },\n] as const satisfies readonly TenantClientInstallProfile[];\nexport type TenantClientInstallProfileId =\n  (typeof TENANT_CLIENT_INSTALL_PROFILES)[number][\"id\"];\n\n/**\n * Direct imports tenant-owned product code may use. This is intentionally\n * smaller than TENANT_CLIENT_INSTALLABLE_PACKAGES: several publishable packages\n * are installed as SDK dependencies, tooling, or platform runtimes but should\n * not become the application integration surface.\n */\nexport const TENANT_CLIENT_PUBLIC_IMPORTS = [\n  {\n    packageName: \"@lucern/sdk\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"TypeScript SDK runtime and generated operation namespaces.\",\n  },\n  {\n    packageName: \"@lucern/react\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"React bindings for tenant-owned UI applications.\",\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"MCP client/server entry points and hosted route helpers.\",\n  },\n  {\n    packageName: \"@lucern/graph-sync\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description:\n      \"Optional Neo4j graph mirroring host actions, edge API, query proxy, backfill, and health helpers.\",\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type and manifest contracts.\",\n  },\n  {\n    packageName: \"@lucern/access-control\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description:\n      \"Tenant runtime access-control helpers, including effective tool access.\",\n  },\n  {\n    packageName: \"@lucern/types\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type-only helpers for tenant integration code.\",\n  },\n] as const;\nexport type TenantClientPublicImport =\n  (typeof TENANT_CLIENT_PUBLIC_IMPORTS)[number];\nexport type TenantClientPublicPackage =\n  TenantClientPublicImport[\"packageName\"];\nexport type TenantClientPublicSurface = TenantClientPublicImport[\"surface\"];\n\nexport const TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [\n  {\n    packageName: \"@lucern/identity\",\n    importPath: \"@lucern/identity/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install Lucern identity.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/runtime.config\",\n    surface: \"component_config\",\n    description:\n      \"Runtime config alias for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n] as const;\nexport type TenantClientComponentConfigImport =\n  (typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS)[number];\nexport type TenantClientAllowedImport =\n  | TenantClientPublicImport\n  | TenantClientComponentConfigImport;\n\nexport function findTenantClientInstallablePackage(\n  packageName: string\n): TenantClientInstallablePackage | undefined {\n  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(\n    (entry) => entry.packageName === packageName\n  );\n}\n\nexport function isTenantClientInstallablePackage(packageName: string): boolean {\n  return Boolean(findTenantClientInstallablePackage(packageName));\n}\n\nexport const TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [\n  \"bootstrap\",\n  \"context\",\n  \"beliefs\",\n  \"evidence\",\n  \"questions\",\n  \"graph\",\n  \"worktrees\",\n  \"topics\",\n  \"edges\",\n  \"contradictions\",\n  \"contracts\",\n  \"graphIntel\",\n  \"graphIntelligence\",\n  \"graphAnalysis\",\n  \"graphRecommendations\",\n  \"orgGraphSearch\",\n  \"embeddings\",\n  \"ontologyLinks\",\n  \"graphStateClassifier\",\n  \"tools\",\n  \"identity\",\n  \"modelRuntime\",\n  \"events\",\n  \"jobs\",\n  \"telemetry\",\n] as const;\nexport type TenantClientRequiredSdkNamespace =\n  (typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES)[number];\n\nexport const TENANT_CLIENT_CAPABILITIES = [\n  {\n    id: \"identity.bootstrap_session\",\n    description: \"Start a scoped Lucern session for a tenant principal.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.context.compile\",\n    description: \"Compile tenant and workspace scoped reasoning context.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.read\",\n    description: \"Read beliefs, evidence, questions, topics, graph edges, and lineage.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.write\",\n    description: \"Create and update graph objects through authorized APIs.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph_intelligence.run\",\n    description:\n      \"Discover and run Graph Intelligence query recipes for structural graph analysis.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/cli\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph_mirroring.install\",\n    description:\n      \"Install and run the optional Neo4j graph mirror for paid or enterprise tenant deployments.\",\n    surfaces: [\"@lucern/graph-sync\", \"@lucern/cli\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"workflow.worktree_lifecycle\",\n    description: \"Create, review, merge, and close scoped worktrees.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n] as const;\nexport type TenantClientCapability =\n  (typeof TENANT_CLIENT_CAPABILITIES)[number];\nexport type TenantClientCapabilityId = TenantClientCapability[\"id\"];\n\nexport const TENANT_CLIENT_ISOLATION_RULES = [\n  {\n    id: \"tenant_workspace_scope_required\",\n    description:\n      \"Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state.\",\n  },\n  {\n    id: \"principal_audit_required\",\n    description:\n      \"Runtime operations must carry principalId, authMode, and scopes for audit attribution.\",\n  },\n  {\n    id: \"no_private_lucern_imports\",\n    description:\n      \"Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals.\",\n  },\n] as const;\nexport type TenantClientIsolationRule =\n  (typeof TENANT_CLIENT_ISOLATION_RULES)[number];\n\nexport const TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [\n  {\n    id: \"deep_src_import\",\n    pattern: \"^@lucern/[^/]+/src(?:/|$)\",\n    description: \"Published packages must not be bypassed through src paths.\",\n  },\n  {\n    id: \"deep_dist_import\",\n    pattern: \"^@lucern/[^/]+/dist(?:/|$)\",\n    description:\n      \"Published package exports must be used instead of dist file paths.\",\n  },\n  {\n    id: \"generated_adapter_import\",\n    pattern: \"^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)\",\n    description:\n      \"Generated Lucern adapters are internal deployment artifacts.\",\n  },\n  {\n    id: \"private_runtime_import\",\n    pattern: \"^@lucern/[^/]+/(?:internal|private)(?:/|$)\",\n    description: \"Internal and private package subpaths are not public SDK API.\",\n  },\n  {\n    id: \"workspace_source_import\",\n    pattern: \"^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)\",\n    description:\n      \"Tenant clients must not import source files from the Lucern monorepo.\",\n  },\n  {\n    id: \"root_alias_lucern_import\",\n    pattern: \"^@/(?:lucern|packages|modules|services|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not depend on Lucern repo-local path aliases.\",\n  },\n  {\n    id: \"relative_lucern_source_import\",\n    pattern: \"^\\\\.\\\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not reach back into Lucern source through relative paths.\",\n  },\n  {\n    id: \"monorepo_path_import\",\n    pattern: \"lucern-repo\",\n    description:\n      \"Absolute imports that name the Lucern repository are not portable tenant code.\",\n  },\n] as const;\nexport type TenantClientForbiddenImportPattern =\n  (typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS)[number];\nexport type TenantClientForbiddenImportPatternId =\n  TenantClientForbiddenImportPattern[\"id\"];\n\nexport type TenantClientImportDecision =\n  | \"public\"\n  | \"forbidden\"\n  | \"local\"\n  | \"external\";\n\nexport type TenantClientImportClassification = {\n  importPath: string;\n  decision: TenantClientImportDecision;\n  publicImport?: TenantClientAllowedImport;\n  pattern?: TenantClientForbiddenImportPattern;\n  reason: string;\n};\n\nfunction matchesPublicImport(\n  importPath: string\n): TenantClientAllowedImport | undefined {\n  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(\n    (entry) => importPath === entry.importPath\n  );\n  if (componentConfig) {\n    return componentConfig;\n  }\n\n  return TENANT_CLIENT_PUBLIC_IMPORTS.find(\n    (entry) =>\n      importPath === entry.packageName ||\n      importPath.startsWith(`${entry.packageName}/`)\n  );\n}\n\nfunction matchesForbiddenPattern(\n  importPath: string\n): TenantClientForbiddenImportPattern | undefined {\n  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find((entry) =>\n    new RegExp(entry.pattern, \"u\").test(importPath)\n  );\n}\n\nexport function classifyTenantClientImport(\n  importPath: string\n): TenantClientImportClassification {\n  const normalizedImportPath = importPath.trim();\n  const pattern = matchesForbiddenPattern(normalizedImportPath);\n\n  if (pattern) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      pattern,\n      reason: pattern.description,\n    };\n  }\n\n  const publicImport = matchesPublicImport(normalizedImportPath);\n  if (publicImport) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"public\",\n      publicImport,\n      reason: publicImport.description,\n    };\n  }\n\n  if (normalizedImportPath.startsWith(\"@lucern/\")) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      reason:\n        \"This @lucern package is not part of the tenant client public surface.\",\n    };\n  }\n\n  if (\n    normalizedImportPath.startsWith(\"./\") ||\n    normalizedImportPath.startsWith(\"../\")\n  ) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"local\",\n      reason: \"Local tenant-owned import.\",\n    };\n  }\n\n  return {\n    importPath: normalizedImportPath,\n    decision: \"external\",\n    reason: \"External dependency outside the Lucern package namespace.\",\n  };\n}\n\nexport function isTenantClientPublicImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function isTenantClientComponentConfigImport(\n  importPath: string\n): boolean {\n  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(\n    (entry) => importPath === entry.importPath\n  );\n}\n\nexport function isTenantClientAllowedImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function assertTenantClientImportAllowed(importPath: string): void {\n  const classification = classifyTenantClientImport(importPath);\n  if (classification.decision !== \"forbidden\") {\n    return;\n  }\n\n  throw new Error(formatTenantClientImportViolation(classification));\n}\n\nexport function formatTenantClientImportViolation(\n  classification: TenantClientImportClassification\n): string {\n  const patternId = classification.pattern\n    ? ` [${classification.pattern.id}]`\n    : \"\";\n  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;\n}\n"]}