@lucern/contracts 0.3.0-alpha.10 → 0.3.0-alpha.12

package/dist/manifests/tenant-client-manifest.d.ts

@@ -78,7 +78,7 @@ declare const TENANT_CLIENT_MANIFEST: {
             readonly directTenantImport: true;
         }, {
             readonly packageName: "@lucern/control-plane";
-            readonly role: "platform_runtime";
+            readonly role: "component_runtime";
             readonly directTenantImport: false;
         }, {
             readonly packageName: "@lucern/developer-kit";
@@ -96,10 +96,6 @@ declare const TENANT_CLIENT_MANIFEST: {
             readonly packageName: "@lucern/graph-sync";
             readonly role: "host_addon_runtime";
             readonly directTenantImport: true;
-        }, {
-            readonly packageName: "@lucern/identity";
-            readonly role: "component_runtime";
-            readonly directTenantImport: false;
         }, {
             readonly packageName: "@lucern/mcp";
             readonly role: "runtime_entrypoint";
@@ -128,6 +124,10 @@ declare const TENANT_CLIENT_MANIFEST: {
             readonly packageName: "@lucern/sdk";
             readonly role: "runtime_entrypoint";
             readonly directTenantImport: true;
+        }, {
+            readonly packageName: "@lucern/secrets";
+            readonly role: "sdk_dependency";
+            readonly directTenantImport: false;
         }, {
             readonly packageName: "@lucern/server-core";
             readonly role: "platform_runtime";
@@ -153,8 +153,8 @@ declare const TENANT_CLIENT_MANIFEST: {
             readonly dependencyField: "dependencies";
         }, {
             readonly id: "convex_components";
-            readonly description: "Tenant Convex host install for binding the Lucern identity and reasoning-kernel components.";
-            readonly packageNames: readonly ["@lucern/identity", "@lucern/reasoning-kernel"];
+            readonly description: "Tenant Convex host install for binding the Lucern control-plane and reasoning-kernel components.";
+            readonly packageNames: readonly ["@lucern/control-plane", "@lucern/reasoning-kernel"];
             readonly dependencyField: "dependencies";
         }, {
             readonly id: "graph_mirroring_addon";
@@ -179,7 +179,7 @@ declare const TENANT_CLIENT_MANIFEST: {
         }, {
             readonly id: "full_suite";
             readonly description: "Full coherent Lucern package suite for design-partner repos that want every published runtime, tool, component, test, and config package pinned together.";
-            readonly packageNames: readonly ("@lucern/access-control" | "@lucern/agent" | "@lucern/auth" | "@lucern/cli" | "@lucern/client-core" | "@lucern/confidence" | "@lucern/config" | "@lucern/contracts" | "@lucern/control-plane" | "@lucern/developer-kit" | "@lucern/events" | "@lucern/graph-primitives" | "@lucern/graph-sync" | "@lucern/identity" | "@lucern/mcp" | "@lucern/pack-host" | "@lucern/pack-installer" | "@lucern/proof-compiler" | "@lucern/react" | "@lucern/reasoning-kernel" | "@lucern/sdk" | "@lucern/server-core" | "@lucern/testing" | "@lucern/types")[];
+            readonly packageNames: readonly ("@lucern/access-control" | "@lucern/agent" | "@lucern/auth" | "@lucern/cli" | "@lucern/client-core" | "@lucern/confidence" | "@lucern/config" | "@lucern/contracts" | "@lucern/control-plane" | "@lucern/developer-kit" | "@lucern/events" | "@lucern/graph-primitives" | "@lucern/graph-sync" | "@lucern/mcp" | "@lucern/pack-host" | "@lucern/pack-installer" | "@lucern/proof-compiler" | "@lucern/react" | "@lucern/reasoning-kernel" | "@lucern/sdk" | "@lucern/secrets" | "@lucern/server-core" | "@lucern/testing" | "@lucern/types")[];
             readonly dependencyField: "mixed";
         }];
         readonly directImports: readonly [{
@@ -219,10 +219,10 @@ declare const TENANT_CLIENT_MANIFEST: {
             readonly description: "Published type-only helpers for tenant integration code.";
         }];
         readonly componentConfigImports: readonly [{
-            readonly packageName: "@lucern/identity";
-            readonly importPath: "@lucern/identity/convex.config";
+            readonly packageName: "@lucern/control-plane";
+            readonly importPath: "@lucern/control-plane/convex.config";
             readonly surface: "component_config";
-            readonly description: "Convex component binding config for tenant deployments that install Lucern identity.";
+            readonly description: "Convex component binding config for tenant deployments that install the Lucern control plane.";
         }, {
             readonly packageName: "@lucern/reasoning-kernel";
             readonly importPath: "@lucern/reasoning-kernel/convex.config";

package/dist/manifests/tenant-client-manifest.js

@@ -73,7 +73,7 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
   },
   {
     packageName: "@lucern/control-plane",
-    role: "platform_runtime",
+    role: "component_runtime",
     directTenantImport: false
   },
   {
@@ -96,11 +96,6 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
     role: "host_addon_runtime",
     directTenantImport: true
   },
-  {
-    packageName: "@lucern/identity",
-    role: "component_runtime",
-    directTenantImport: false
-  },
   {
     packageName: "@lucern/mcp",
     role: "runtime_entrypoint",
@@ -136,6 +131,11 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
     role: "runtime_entrypoint",
     directTenantImport: true
   },
+  {
+    packageName: "@lucern/secrets",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
   {
     packageName: "@lucern/server-core",
     role: "platform_runtime",
@@ -170,8 +170,8 @@ var TENANT_CLIENT_INSTALL_PROFILES = [
   },
   {
     id: "convex_components",
-    description: "Tenant Convex host install for binding the Lucern identity and reasoning-kernel components.",
-    packageNames: ["@lucern/identity", "@lucern/reasoning-kernel"],
+    description: "Tenant Convex host install for binding the Lucern control-plane and reasoning-kernel components.",
+    packageNames: ["@lucern/control-plane", "@lucern/reasoning-kernel"],
     dependencyField: "dependencies"
   },
   {
@@ -251,10 +251,10 @@ var TENANT_CLIENT_PUBLIC_IMPORTS = [
 ];
 var TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [
   {
-    packageName: "@lucern/identity",
-    importPath: "@lucern/identity/convex.config",
+    packageName: "@lucern/control-plane",
+    importPath: "@lucern/control-plane/convex.config",
     surface: "component_config",
-    description: "Convex component binding config for tenant deployments that install Lucern identity."
+    description: "Convex component binding config for tenant deployments that install the Lucern control plane."
   },
   {
     packageName: "@lucern/reasoning-kernel",

package/dist/manifests/tenant-client-manifest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tenant-client.contract.ts","../../src/manifests/tenant-client-manifest.ts"],"names":[],"mappings":";AAcO,IAAM,8BAAA,GAAiC,YAAA;AAEvC,IAAM,wBAAA,GAA2B;AAAA,EACtC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAGO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,OAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,UAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,eAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,+BAAA,GAAkC,oBAAA;AACxC,IAAM,0CAAA,GACX,gBAAA;AACK,IAAM,qDAAA,GAAwD;AAAA,EACnE;AACF,CAAA;AACO,IAAM,kCAAA,GAAqC,CAAC,WAAW,CAAA;AAMvD,IAAM,kCAAA,GAAqC;AAAA,EAChD;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,cAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,eAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,kBAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,iBAAA;AAAA,IACb,IAAA,EAAM,cAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA;AAExB,CAAA;AAwBO,IAAM,yCACX,kCAAA,CAAmC,GAAA;AAAA,EACjC,CAAC,UAAU,KAAA,CAAM;AACnB,CAAA;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,WAAA,EACE,iGAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAA,EAAe,wBAAwB,CAAA;AAAA,IACtD,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,WAAA,EACE,+FAAA;AAAA,IACF,YAAA,EAAc,CAAC,eAAA,EAAiB,aAAA,EAAe,wBAAwB,CAAA;AAAA,IACvE,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,WAAA,EACE,6FAAA;AAAA,IACF,YAAA,EAAc,CAAC,kBAAA,EAAoB,0BAA0B,CAAA;AAAA,IAC7D,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,WAAA,EACE,yIAAA;AAAA,IACF,YAAA,EAAc,CAAC,oBAAoB,CAAA;AAAA,IACnC,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,cAAA;AAAA,IACJ,WAAA,EACE,+FAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAa,CAAA;AAAA,IAC5B,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,aAAA;AAAA,IACJ,WAAA,EACE,sFAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAa,CAAA;AAAA,IAC5B,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,qBAAA;AAAA,IACJ,WAAA,EACE,4FAAA;AAAA,IACF,YAAA,EAAc,CAAC,mBAAA,EAAqB,eAAe,CAAA;AAAA,IACnD,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EACE,2JAAA;AAAA,IACF,YAAA,EAAc,sCAAA;AAAA,IACd,eAAA,EAAiB;AAAA;AAErB,CAAA;AAUO,IAAM,4BAAA,GAA+B;AAAA,EAC1C;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA;AAEjB,CAAA;AAOO,IAAM,sCAAA,GAAyC;AAAA,EACpD;AAAA,IACE,WAAA,EAAa,kBAAA;AAAA,IACb,UAAA,EAAY,gCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,UAAA,EAAY,wCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,UAAA,EAAY,yCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA;AAEN,CAAA;AAmBO,IAAM,qCAAA,GAAwC;AAAA,EACnD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,gBAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,0BAAA,GAA6B;AAAA,EACxC;AAAA,IACE,EAAA,EAAI,4BAAA;AAAA,IACJ,WAAA,EAAa,uDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,aAAa,CAAA;AAAA,IACvC,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,2BAAA;AAAA,IACJ,WAAA,EAAa,wDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,WAAA,EAAa,sEAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,WAAA,EAAa,0DAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,aAAa,CAAA;AAAA,IACvC,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kCAAA;AAAA,IACJ,WAAA,EACE,kFAAA;AAAA,IACF,QAAA,EAAU,CAAC,aAAA,EAAe,aAAA,EAAe,aAAa,CAAA;AAAA,IACtD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mCAAA;AAAA,IACJ,WAAA,EACE,4FAAA;AAAA,IACF,QAAA,EAAU,CAAC,oBAAA,EAAsB,aAAa,CAAA;AAAA,IAC9C,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,6BAAA;AAAA,IACJ,WAAA,EAAa,oDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA;AAE3B,CAAA;AAKO,IAAM,6BAAA,GAAgC;AAAA,EAC3C;AAAA,IACE,EAAA,EAAI,iCAAA;AAAA,IACJ,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,2BAAA;AAAA,IACJ,WAAA,EACE;AAAA;AAEN,CAAA;AAIO,IAAM,uCAAA,GAA0C;AAAA,EACrD;AAAA,IACE,EAAA,EAAI,iBAAA;AAAA,IACJ,OAAA,EAAS,2BAAA;AAAA,IACT,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,4BAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,OAAA,EAAS,gDAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,wBAAA;AAAA,IACJ,OAAA,EAAS,4CAAA;AAAA,IACT,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,EAAA,EAAI,yBAAA;AAAA,IACJ,OAAA,EAAS,+DAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,OAAA,EAAS,qDAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,+BAAA;AAAA,IACJ,OAAA,EAAS,mEAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,aAAA;AAAA,IACT,WAAA,EACE;AAAA;AAEN,CAAA;;;ACvdO,IAAM,sBAAA,GAAyB;AAAA,EACpC,eAAA,EAAiB,OAAA;AAAA,EACjB,eAAA,EAAiB,8BAAA;AAAA,EACjB,IAAA,EAAM;AAAA,IACJ,KAAA,EAAO,wBAAA;AAAA,IACP,cAAA,EAAgB,6BAAA;AAAA,IAChB,qBAAA,EAAuB,qCAAA;AAAA,IACvB,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA,YAAA,EAAc;AAAA,IACZ,GAAA,EAAK,+BAAA;AAAA,IACL,aAAA,EAAe,0CAAA;AAAA,IACf,uBAAA,EAAyB,qDAAA;AAAA,IACzB,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA,QAAA,EAAU;AAAA,IACR,WAAA,EAAa,kCAAA;AAAA,IACb,eAAA,EAAiB,8BAAA;AAAA,IACjB,aAAA,EAAe,4BAAA;AAAA,IACf,sBAAA,EAAwB;AAAA,GAC1B;AAAA,EACA,GAAA,EAAK;AAAA,IACH,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA,YAAA,EAAc,0BAAA;AAAA,EACd,cAAA,EAAgB,6BAAA;AAAA,EAChB,uBAAA,EAAyB;AAC3B","file":"tenant-client-manifest.js","sourcesContent":["/**\n * Tenant client contract\n *\n * Defines the generic boundary for any customer-owned product that consumes\n * Lucern through the SDK, hosted API, or MCP server. Tenant clients may run\n * their own UI, auth provider, deployment, and data plane, but reasoning\n * operations must enter through the published packages below.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const TENANT_CLIENT_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const TENANT_CLIENT_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const satisfies readonly SessionAuthMode[];\nexport type TenantClientAuthMode = (typeof TENANT_CLIENT_AUTH_MODES)[number];\n\nexport const TENANT_CLIENT_PRINCIPAL_TYPES = [\n  \"human\",\n  \"service\",\n  \"agent\",\n] as const satisfies readonly SessionPrincipalType[];\nexport type TenantClientPrincipalType =\n  (typeof TENANT_CLIENT_PRINCIPAL_TYPES)[number];\n\nexport const TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [\n  \"tenantId\",\n  \"workspaceId\",\n  \"principalId\",\n  \"authMode\",\n  \"scopes\",\n] as const;\nexport type TenantClientRequiredContextField =\n  (typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [\n  \"principalType\",\n  \"roles\",\n  \"sessionId\",\n  \"delegationChain\",\n] as const;\nexport type TenantClientOptionalContextField =\n  (typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_INSTALL_TOKEN_ENV = \"INSTALL_LUCERN_NPM\" as const;\nexport const TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH =\n  \"tenants/shared\" as const;\nexport const TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [\n  \"/platform/publish\",\n] as const;\nexport const TENANT_CLIENT_FORBIDDEN_SECRET_ENV = [\"NPM_TOKEN\"] as const;\nexport type TenantClientForbiddenInstallTokenInfisicalPath =\n  (typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS)[number];\nexport type TenantClientForbiddenSecretEnv =\n  (typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV)[number];\n\nexport const TENANT_CLIENT_INSTALLABLE_PACKAGES = [\n  {\n    packageName: \"@lucern/access-control\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/agent\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/auth\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/cli\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/client-core\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/confidence\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/config\",\n    role: \"configuration\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/control-plane\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/developer-kit\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/events\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-primitives\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-sync\",\n    role: \"host_addon_runtime\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/identity\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/pack-host\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/pack-installer\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/proof-compiler\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/react\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/sdk\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/server-core\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/testing\",\n    role: \"test_support\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/types\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n] as const;\nexport type TenantClientInstallablePackage =\n  (typeof TENANT_CLIENT_INSTALLABLE_PACKAGES)[number];\nexport type TenantClientPackageRole = TenantClientInstallablePackage[\"role\"];\nexport type TenantClientInstallablePackageName =\n  TenantClientInstallablePackage[\"packageName\"];\n\n/**\n * Direct package installs are package.json entries owned by the tenant repo.\n * Direct imports are source-code imports that tenant application code may use.\n *\n * These concepts intentionally differ: `@lucern/cli` is a direct install when a\n * tenant repo needs the `lucern` binary, but it is not a direct application\n * import. `@lucern/reasoning-kernel` and `@lucern/identity` are direct installs\n * for Convex component binding, while tenant app code should only import their\n * explicit component config subpaths.\n */\nexport type TenantClientInstallProfile = {\n  id: string;\n  description: string;\n  packageNames: readonly TenantClientInstallablePackageName[];\n  dependencyField: \"dependencies\" | \"devDependencies\" | \"mixed\";\n};\n\nexport const TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES =\n  TENANT_CLIENT_INSTALLABLE_PACKAGES.map(\n    (entry) => entry.packageName\n  ) as readonly TenantClientInstallablePackageName[];\n\nexport const TENANT_CLIENT_INSTALL_PROFILES = [\n  {\n    id: \"core_app_runtime\",\n    description:\n      \"Smallest tenant app/runtime install for typed Lucern API calls plus tool-access policy helpers.\",\n    packageNames: [\"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"react_app_runtime\",\n    description:\n      \"React tenant app install for hooks, provider, curated graph components, and direct SDK calls.\",\n    packageNames: [\"@lucern/react\", \"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"convex_components\",\n    description:\n      \"Tenant Convex host install for binding the Lucern identity and reasoning-kernel components.\",\n    packageNames: [\"@lucern/identity\", \"@lucern/reasoning-kernel\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"graph_mirroring_addon\",\n    description:\n      \"Optional tenant Convex host install for Neo4j graph projection, edge topology writes, backfill, health checks, and query proxy helpers.\",\n    packageNames: [\"@lucern/graph-sync\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"operator_cli\",\n    description:\n      \"Developer/operator install for the `lucern` binary, including tenant bootstrap seed commands.\",\n    packageNames: [\"@lucern/cli\"],\n    dependencyField: \"devDependencies\",\n  },\n  {\n    id: \"mcp_runtime\",\n    description:\n      \"Agent runtime install for the standalone Lucern MCP server and hosted route helpers.\",\n    packageNames: [\"@lucern/mcp\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"contracts_and_types\",\n    description:\n      \"Compile-time contract/type install for codegen, audits, and tenant integration validation.\",\n    packageNames: [\"@lucern/contracts\", \"@lucern/types\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"full_suite\",\n    description:\n      \"Full coherent Lucern package suite for design-partner repos that want every published runtime, tool, component, test, and config package pinned together.\",\n    packageNames: TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES,\n    dependencyField: \"mixed\",\n  },\n] as const satisfies readonly TenantClientInstallProfile[];\nexport type TenantClientInstallProfileId =\n  (typeof TENANT_CLIENT_INSTALL_PROFILES)[number][\"id\"];\n\n/**\n * Direct imports tenant-owned product code may use. This is intentionally\n * smaller than TENANT_CLIENT_INSTALLABLE_PACKAGES: several publishable packages\n * are installed as SDK dependencies, tooling, or platform runtimes but should\n * not become the application integration surface.\n */\nexport const TENANT_CLIENT_PUBLIC_IMPORTS = [\n  {\n    packageName: \"@lucern/sdk\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"TypeScript SDK runtime and generated operation namespaces.\",\n  },\n  {\n    packageName: \"@lucern/react\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"React bindings for tenant-owned UI applications.\",\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"MCP client/server entry points and hosted route helpers.\",\n  },\n  {\n    packageName: \"@lucern/graph-sync\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description:\n      \"Optional Neo4j graph mirroring host actions, edge API, query proxy, backfill, and health helpers.\",\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type and manifest contracts.\",\n  },\n  {\n    packageName: \"@lucern/access-control\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description:\n      \"Tenant runtime access-control helpers, including effective tool access.\",\n  },\n  {\n    packageName: \"@lucern/types\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type-only helpers for tenant integration code.\",\n  },\n] as const;\nexport type TenantClientPublicImport =\n  (typeof TENANT_CLIENT_PUBLIC_IMPORTS)[number];\nexport type TenantClientPublicPackage =\n  TenantClientPublicImport[\"packageName\"];\nexport type TenantClientPublicSurface = TenantClientPublicImport[\"surface\"];\n\nexport const TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [\n  {\n    packageName: \"@lucern/identity\",\n    importPath: \"@lucern/identity/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install Lucern identity.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/runtime.config\",\n    surface: \"component_config\",\n    description:\n      \"Runtime config alias for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n] as const;\nexport type TenantClientComponentConfigImport =\n  (typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS)[number];\nexport type TenantClientAllowedImport =\n  | TenantClientPublicImport\n  | TenantClientComponentConfigImport;\n\nexport function findTenantClientInstallablePackage(\n  packageName: string\n): TenantClientInstallablePackage | undefined {\n  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(\n    (entry) => entry.packageName === packageName\n  );\n}\n\nexport function isTenantClientInstallablePackage(packageName: string): boolean {\n  return Boolean(findTenantClientInstallablePackage(packageName));\n}\n\nexport const TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [\n  \"bootstrap\",\n  \"context\",\n  \"beliefs\",\n  \"evidence\",\n  \"questions\",\n  \"graph\",\n  \"worktrees\",\n  \"topics\",\n  \"edges\",\n  \"contradictions\",\n  \"contracts\",\n  \"graphIntel\",\n  \"graphIntelligence\",\n  \"graphAnalysis\",\n  \"graphRecommendations\",\n  \"orgGraphSearch\",\n  \"embeddings\",\n  \"ontologyLinks\",\n  \"graphStateClassifier\",\n  \"tools\",\n  \"identity\",\n  \"modelRuntime\",\n  \"events\",\n  \"jobs\",\n  \"telemetry\",\n] as const;\nexport type TenantClientRequiredSdkNamespace =\n  (typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES)[number];\n\nexport const TENANT_CLIENT_CAPABILITIES = [\n  {\n    id: \"identity.bootstrap_session\",\n    description: \"Start a scoped Lucern session for a tenant principal.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.context.compile\",\n    description: \"Compile tenant and workspace scoped reasoning context.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.read\",\n    description: \"Read beliefs, evidence, questions, topics, graph edges, and lineage.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.write\",\n    description: \"Create and update graph objects through authorized APIs.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph_intelligence.run\",\n    description:\n      \"Discover and run Graph Intelligence query recipes for structural graph analysis.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/cli\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph_mirroring.install\",\n    description:\n      \"Install and run the optional Neo4j graph mirror for paid or enterprise tenant deployments.\",\n    surfaces: [\"@lucern/graph-sync\", \"@lucern/cli\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"workflow.worktree_lifecycle\",\n    description: \"Create, review, merge, and close scoped worktrees.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n] as const;\nexport type TenantClientCapability =\n  (typeof TENANT_CLIENT_CAPABILITIES)[number];\nexport type TenantClientCapabilityId = TenantClientCapability[\"id\"];\n\nexport const TENANT_CLIENT_ISOLATION_RULES = [\n  {\n    id: \"tenant_workspace_scope_required\",\n    description:\n      \"Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state.\",\n  },\n  {\n    id: \"principal_audit_required\",\n    description:\n      \"Runtime operations must carry principalId, authMode, and scopes for audit attribution.\",\n  },\n  {\n    id: \"no_private_lucern_imports\",\n    description:\n      \"Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals.\",\n  },\n] as const;\nexport type TenantClientIsolationRule =\n  (typeof TENANT_CLIENT_ISOLATION_RULES)[number];\n\nexport const TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [\n  {\n    id: \"deep_src_import\",\n    pattern: \"^@lucern/[^/]+/src(?:/|$)\",\n    description: \"Published packages must not be bypassed through src paths.\",\n  },\n  {\n    id: \"deep_dist_import\",\n    pattern: \"^@lucern/[^/]+/dist(?:/|$)\",\n    description:\n      \"Published package exports must be used instead of dist file paths.\",\n  },\n  {\n    id: \"generated_adapter_import\",\n    pattern: \"^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)\",\n    description:\n      \"Generated Lucern adapters are internal deployment artifacts.\",\n  },\n  {\n    id: \"private_runtime_import\",\n    pattern: \"^@lucern/[^/]+/(?:internal|private)(?:/|$)\",\n    description: \"Internal and private package subpaths are not public SDK API.\",\n  },\n  {\n    id: \"workspace_source_import\",\n    pattern: \"^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)\",\n    description:\n      \"Tenant clients must not import source files from the Lucern monorepo.\",\n  },\n  {\n    id: \"root_alias_lucern_import\",\n    pattern: \"^@/(?:lucern|packages|modules|services|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not depend on Lucern repo-local path aliases.\",\n  },\n  {\n    id: \"relative_lucern_source_import\",\n    pattern: \"^\\\\.\\\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not reach back into Lucern source through relative paths.\",\n  },\n  {\n    id: \"monorepo_path_import\",\n    pattern: \"lucern-repo\",\n    description:\n      \"Absolute imports that name the Lucern repository are not portable tenant code.\",\n  },\n] as const;\nexport type TenantClientForbiddenImportPattern =\n  (typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS)[number];\nexport type TenantClientForbiddenImportPatternId =\n  TenantClientForbiddenImportPattern[\"id\"];\n\nexport type TenantClientImportDecision =\n  | \"public\"\n  | \"forbidden\"\n  | \"local\"\n  | \"external\";\n\nexport type TenantClientImportClassification = {\n  importPath: string;\n  decision: TenantClientImportDecision;\n  publicImport?: TenantClientAllowedImport;\n  pattern?: TenantClientForbiddenImportPattern;\n  reason: string;\n};\n\nfunction matchesPublicImport(\n  importPath: string\n): TenantClientAllowedImport | undefined {\n  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(\n    (entry) => importPath === entry.importPath\n  );\n  if (componentConfig) {\n    return componentConfig;\n  }\n\n  return TENANT_CLIENT_PUBLIC_IMPORTS.find(\n    (entry) =>\n      importPath === entry.packageName ||\n      importPath.startsWith(`${entry.packageName}/`)\n  );\n}\n\nfunction matchesForbiddenPattern(\n  importPath: string\n): TenantClientForbiddenImportPattern | undefined {\n  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find((entry) =>\n    new RegExp(entry.pattern, \"u\").test(importPath)\n  );\n}\n\nexport function classifyTenantClientImport(\n  importPath: string\n): TenantClientImportClassification {\n  const normalizedImportPath = importPath.trim();\n  const pattern = matchesForbiddenPattern(normalizedImportPath);\n\n  if (pattern) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      pattern,\n      reason: pattern.description,\n    };\n  }\n\n  const publicImport = matchesPublicImport(normalizedImportPath);\n  if (publicImport) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"public\",\n      publicImport,\n      reason: publicImport.description,\n    };\n  }\n\n  if (normalizedImportPath.startsWith(\"@lucern/\")) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      reason:\n        \"This @lucern package is not part of the tenant client public surface.\",\n    };\n  }\n\n  if (\n    normalizedImportPath.startsWith(\"./\") ||\n    normalizedImportPath.startsWith(\"../\")\n  ) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"local\",\n      reason: \"Local tenant-owned import.\",\n    };\n  }\n\n  return {\n    importPath: normalizedImportPath,\n    decision: \"external\",\n    reason: \"External dependency outside the Lucern package namespace.\",\n  };\n}\n\nexport function isTenantClientPublicImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function isTenantClientComponentConfigImport(\n  importPath: string\n): boolean {\n  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(\n    (entry) => importPath === entry.importPath\n  );\n}\n\nexport function isTenantClientAllowedImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function assertTenantClientImportAllowed(importPath: string): void {\n  const classification = classifyTenantClientImport(importPath);\n  if (classification.decision !== \"forbidden\") {\n    return;\n  }\n\n  throw new Error(formatTenantClientImportViolation(classification));\n}\n\nexport function formatTenantClientImportViolation(\n  classification: TenantClientImportClassification\n): string {\n  const patternId = classification.pattern\n    ? ` [${classification.pattern.id}]`\n    : \"\";\n  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;\n}\n","import {\n  TENANT_CLIENT_AUTH_MODES,\n  TENANT_CLIENT_CAPABILITIES,\n  TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS,\n  TENANT_CLIENT_CONTRACT_VERSION,\n  TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS,\n  TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS,\n  TENANT_CLIENT_FORBIDDEN_SECRET_ENV,\n  TENANT_CLIENT_INSTALLABLE_PACKAGES,\n  TENANT_CLIENT_INSTALL_PROFILES,\n  TENANT_CLIENT_INSTALL_TOKEN_ENV,\n  TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,\n  TENANT_CLIENT_ISOLATION_RULES,\n  TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS,\n  TENANT_CLIENT_PRINCIPAL_TYPES,\n  TENANT_CLIENT_PUBLIC_IMPORTS,\n  TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  TENANT_CLIENT_REQUIRED_SDK_NAMESPACES,\n} from \"../tenant-client.contract\";\n\nexport type TenantClientManifest = {\n  readonly manifestVersion: \"1.0.0\";\n  readonly contractVersion: typeof TENANT_CLIENT_CONTRACT_VERSION;\n  readonly auth: {\n    readonly modes: typeof TENANT_CLIENT_AUTH_MODES;\n    readonly principalTypes: typeof TENANT_CLIENT_PRINCIPAL_TYPES;\n    readonly requiredContextFields: typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS;\n    readonly optionalContextFields: typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS;\n  };\n  readonly installToken: {\n    readonly env: typeof TENANT_CLIENT_INSTALL_TOKEN_ENV;\n    readonly infisicalPath: typeof TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH;\n    readonly forbiddenInfisicalPaths: typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS;\n    readonly forbiddenSecretEnv: typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV;\n  };\n  readonly packages: {\n    readonly installable: typeof TENANT_CLIENT_INSTALLABLE_PACKAGES;\n    readonly installProfiles: typeof TENANT_CLIENT_INSTALL_PROFILES;\n    readonly directImports: typeof TENANT_CLIENT_PUBLIC_IMPORTS;\n    readonly componentConfigImports: typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS;\n  };\n  readonly sdk: {\n    readonly requiredNamespaces: typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES;\n  };\n  readonly capabilities: typeof TENANT_CLIENT_CAPABILITIES;\n  readonly isolationRules: typeof TENANT_CLIENT_ISOLATION_RULES;\n  readonly forbiddenImportPatterns: typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS;\n};\n\nexport const TENANT_CLIENT_MANIFEST = {\n  manifestVersion: \"1.0.0\",\n  contractVersion: TENANT_CLIENT_CONTRACT_VERSION,\n  auth: {\n    modes: TENANT_CLIENT_AUTH_MODES,\n    principalTypes: TENANT_CLIENT_PRINCIPAL_TYPES,\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n    optionalContextFields: TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS,\n  },\n  installToken: {\n    env: TENANT_CLIENT_INSTALL_TOKEN_ENV,\n    infisicalPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,\n    forbiddenInfisicalPaths: TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS,\n    forbiddenSecretEnv: TENANT_CLIENT_FORBIDDEN_SECRET_ENV,\n  },\n  packages: {\n    installable: TENANT_CLIENT_INSTALLABLE_PACKAGES,\n    installProfiles: TENANT_CLIENT_INSTALL_PROFILES,\n    directImports: TENANT_CLIENT_PUBLIC_IMPORTS,\n    componentConfigImports: TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS,\n  },\n  sdk: {\n    requiredNamespaces: TENANT_CLIENT_REQUIRED_SDK_NAMESPACES,\n  },\n  capabilities: TENANT_CLIENT_CAPABILITIES,\n  isolationRules: TENANT_CLIENT_ISOLATION_RULES,\n  forbiddenImportPatterns: TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS,\n} as const satisfies TenantClientManifest;\n"]}
+{"version":3,"sources":["../../src/tenant-client.contract.ts","../../src/manifests/tenant-client-manifest.ts"],"names":[],"mappings":";AAcO,IAAM,8BAAA,GAAiC,YAAA;AAEvC,IAAM,wBAAA,GAA2B;AAAA,EACtC,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAGO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,OAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,UAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,eAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,+BAAA,GAAkC,oBAAA;AACxC,IAAM,0CAAA,GACX,gBAAA;AACK,IAAM,qDAAA,GAAwD;AAAA,EACnE;AACF,CAAA;AACO,IAAM,kCAAA,GAAqC,CAAC,WAAW,CAAA;AAMvD,IAAM,kCAAA,GAAqC;AAAA,EAChD;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,cAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,eAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,iBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,iBAAA;AAAA,IACb,IAAA,EAAM,cAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA;AAExB,CAAA;AAwBO,IAAM,yCACX,kCAAA,CAAmC,GAAA;AAAA,EACjC,CAAC,UAAU,KAAA,CAAM;AACnB,CAAA;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,WAAA,EACE,iGAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAA,EAAe,wBAAwB,CAAA;AAAA,IACtD,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,WAAA,EACE,+FAAA;AAAA,IACF,YAAA,EAAc,CAAC,eAAA,EAAiB,aAAA,EAAe,wBAAwB,CAAA;AAAA,IACvE,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,WAAA,EACE,kGAAA;AAAA,IACF,YAAA,EAAc,CAAC,uBAAA,EAAyB,0BAA0B,CAAA;AAAA,IAClE,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,WAAA,EACE,yIAAA;AAAA,IACF,YAAA,EAAc,CAAC,oBAAoB,CAAA;AAAA,IACnC,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,cAAA;AAAA,IACJ,WAAA,EACE,+FAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAa,CAAA;AAAA,IAC5B,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,aAAA;AAAA,IACJ,WAAA,EACE,sFAAA;AAAA,IACF,YAAA,EAAc,CAAC,aAAa,CAAA;AAAA,IAC5B,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,qBAAA;AAAA,IACJ,WAAA,EACE,4FAAA;AAAA,IACF,YAAA,EAAc,CAAC,mBAAA,EAAqB,eAAe,CAAA;AAAA,IACnD,eAAA,EAAiB;AAAA,GACnB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EACE,2JAAA;AAAA,IACF,YAAA,EAAc,sCAAA;AAAA,IACd,eAAA,EAAiB;AAAA;AAErB,CAAA;AAUO,IAAM,4BAAA,GAA+B;AAAA,EAC1C;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,mBAAA;AAAA,IACV,WAAA,EAAa;AAAA;AAEjB,CAAA;AAOO,IAAM,sCAAA,GAAyC;AAAA,EACpD;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,UAAA,EAAY,qCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,UAAA,EAAY,wCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,UAAA,EAAY,yCAAA;AAAA,IACZ,OAAA,EAAS,kBAAA;AAAA,IACT,WAAA,EACE;AAAA;AAEN,CAAA;AAmBO,IAAM,qCAAA,GAAwC;AAAA,EACnD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,gBAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA;AAIO,IAAM,0BAAA,GAA6B;AAAA,EACxC;AAAA,IACE,EAAA,EAAI,4BAAA;AAAA,IACJ,WAAA,EAAa,uDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,aAAa,CAAA;AAAA,IACvC,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,2BAAA;AAAA,IACJ,WAAA,EAAa,wDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,WAAA,EAAa,sEAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,WAAA,EAAa,0DAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,aAAa,CAAA;AAAA,IACvC,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kCAAA;AAAA,IACJ,WAAA,EACE,kFAAA;AAAA,IACF,QAAA,EAAU,CAAC,aAAA,EAAe,aAAA,EAAe,aAAa,CAAA;AAAA,IACtD,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mCAAA;AAAA,IACJ,WAAA,EACE,4FAAA;AAAA,IACF,QAAA,EAAU,CAAC,oBAAA,EAAsB,aAAa,CAAA;AAAA,IAC9C,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,6BAAA;AAAA,IACJ,WAAA,EAAa,oDAAA;AAAA,IACb,QAAA,EAAU,CAAC,aAAA,EAAe,eAAA,EAAiB,aAAa,CAAA;AAAA,IACxD,qBAAA,EAAuB;AAAA;AAE3B,CAAA;AAKO,IAAM,6BAAA,GAAgC;AAAA,EAC3C;AAAA,IACE,EAAA,EAAI,iCAAA;AAAA,IACJ,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,2BAAA;AAAA,IACJ,WAAA,EACE;AAAA;AAEN,CAAA;AAIO,IAAM,uCAAA,GAA0C;AAAA,EACrD;AAAA,IACE,EAAA,EAAI,iBAAA;AAAA,IACJ,OAAA,EAAS,2BAAA;AAAA,IACT,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,4BAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,OAAA,EAAS,gDAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,wBAAA;AAAA,IACJ,OAAA,EAAS,4CAAA;AAAA,IACT,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,EAAA,EAAI,yBAAA;AAAA,IACJ,OAAA,EAAS,+DAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,OAAA,EAAS,qDAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,+BAAA;AAAA,IACJ,OAAA,EAAS,mEAAA;AAAA,IACT,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,aAAA;AAAA,IACT,WAAA,EACE;AAAA;AAEN,CAAA;;;ACvdO,IAAM,sBAAA,GAAyB;AAAA,EACpC,eAAA,EAAiB,OAAA;AAAA,EACjB,eAAA,EAAiB,8BAAA;AAAA,EACjB,IAAA,EAAM;AAAA,IACJ,KAAA,EAAO,wBAAA;AAAA,IACP,cAAA,EAAgB,6BAAA;AAAA,IAChB,qBAAA,EAAuB,qCAAA;AAAA,IACvB,qBAAA,EAAuB;AAAA,GACzB;AAAA,EACA,YAAA,EAAc;AAAA,IACZ,GAAA,EAAK,+BAAA;AAAA,IACL,aAAA,EAAe,0CAAA;AAAA,IACf,uBAAA,EAAyB,qDAAA;AAAA,IACzB,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA,QAAA,EAAU;AAAA,IACR,WAAA,EAAa,kCAAA;AAAA,IACb,eAAA,EAAiB,8BAAA;AAAA,IACjB,aAAA,EAAe,4BAAA;AAAA,IACf,sBAAA,EAAwB;AAAA,GAC1B;AAAA,EACA,GAAA,EAAK;AAAA,IACH,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA,YAAA,EAAc,0BAAA;AAAA,EACd,cAAA,EAAgB,6BAAA;AAAA,EAChB,uBAAA,EAAyB;AAC3B","file":"tenant-client-manifest.js","sourcesContent":["/**\n * Tenant client contract\n *\n * Defines the generic boundary for any customer-owned product that consumes\n * Lucern through the SDK, hosted API, or MCP server. Tenant clients may run\n * their own UI, auth provider, deployment, and data plane, but reasoning\n * operations must enter through the published packages below.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const TENANT_CLIENT_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const TENANT_CLIENT_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const satisfies readonly SessionAuthMode[];\nexport type TenantClientAuthMode = (typeof TENANT_CLIENT_AUTH_MODES)[number];\n\nexport const TENANT_CLIENT_PRINCIPAL_TYPES = [\n  \"human\",\n  \"service\",\n  \"agent\",\n] as const satisfies readonly SessionPrincipalType[];\nexport type TenantClientPrincipalType =\n  (typeof TENANT_CLIENT_PRINCIPAL_TYPES)[number];\n\nexport const TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [\n  \"tenantId\",\n  \"workspaceId\",\n  \"principalId\",\n  \"authMode\",\n  \"scopes\",\n] as const;\nexport type TenantClientRequiredContextField =\n  (typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [\n  \"principalType\",\n  \"roles\",\n  \"sessionId\",\n  \"delegationChain\",\n] as const;\nexport type TenantClientOptionalContextField =\n  (typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_INSTALL_TOKEN_ENV = \"INSTALL_LUCERN_NPM\" as const;\nexport const TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH =\n  \"tenants/shared\" as const;\nexport const TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [\n  \"/platform/publish\",\n] as const;\nexport const TENANT_CLIENT_FORBIDDEN_SECRET_ENV = [\"NPM_TOKEN\"] as const;\nexport type TenantClientForbiddenInstallTokenInfisicalPath =\n  (typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS)[number];\nexport type TenantClientForbiddenSecretEnv =\n  (typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV)[number];\n\nexport const TENANT_CLIENT_INSTALLABLE_PACKAGES = [\n  {\n    packageName: \"@lucern/access-control\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/agent\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/auth\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/cli\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/client-core\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/confidence\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/config\",\n    role: \"configuration\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/control-plane\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/developer-kit\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/events\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-primitives\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-sync\",\n    role: \"host_addon_runtime\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/pack-host\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/pack-installer\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/proof-compiler\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/react\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/sdk\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/secrets\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/server-core\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/testing\",\n    role: \"test_support\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/types\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n] as const;\nexport type TenantClientInstallablePackage =\n  (typeof TENANT_CLIENT_INSTALLABLE_PACKAGES)[number];\nexport type TenantClientPackageRole = TenantClientInstallablePackage[\"role\"];\nexport type TenantClientInstallablePackageName =\n  TenantClientInstallablePackage[\"packageName\"];\n\n/**\n * Direct package installs are package.json entries owned by the tenant repo.\n * Direct imports are source-code imports that tenant application code may use.\n *\n * These concepts intentionally differ: `@lucern/cli` is a direct install when a\n * tenant repo needs the `lucern` binary, but it is not a direct application\n * import. `@lucern/reasoning-kernel` and `@lucern/control-plane` are direct installs\n * for Convex component binding, while tenant app code should only import their\n * explicit component config subpaths.\n */\nexport type TenantClientInstallProfile = {\n  id: string;\n  description: string;\n  packageNames: readonly TenantClientInstallablePackageName[];\n  dependencyField: \"dependencies\" | \"devDependencies\" | \"mixed\";\n};\n\nexport const TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES =\n  TENANT_CLIENT_INSTALLABLE_PACKAGES.map(\n    (entry) => entry.packageName\n  ) as readonly TenantClientInstallablePackageName[];\n\nexport const TENANT_CLIENT_INSTALL_PROFILES = [\n  {\n    id: \"core_app_runtime\",\n    description:\n      \"Smallest tenant app/runtime install for typed Lucern API calls plus tool-access policy helpers.\",\n    packageNames: [\"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"react_app_runtime\",\n    description:\n      \"React tenant app install for hooks, provider, curated graph components, and direct SDK calls.\",\n    packageNames: [\"@lucern/react\", \"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"convex_components\",\n    description:\n      \"Tenant Convex host install for binding the Lucern control-plane and reasoning-kernel components.\",\n    packageNames: [\"@lucern/control-plane\", \"@lucern/reasoning-kernel\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"graph_mirroring_addon\",\n    description:\n      \"Optional tenant Convex host install for Neo4j graph projection, edge topology writes, backfill, health checks, and query proxy helpers.\",\n    packageNames: [\"@lucern/graph-sync\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"operator_cli\",\n    description:\n      \"Developer/operator install for the `lucern` binary, including tenant bootstrap seed commands.\",\n    packageNames: [\"@lucern/cli\"],\n    dependencyField: \"devDependencies\",\n  },\n  {\n    id: \"mcp_runtime\",\n    description:\n      \"Agent runtime install for the standalone Lucern MCP server and hosted route helpers.\",\n    packageNames: [\"@lucern/mcp\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"contracts_and_types\",\n    description:\n      \"Compile-time contract/type install for codegen, audits, and tenant integration validation.\",\n    packageNames: [\"@lucern/contracts\", \"@lucern/types\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"full_suite\",\n    description:\n      \"Full coherent Lucern package suite for design-partner repos that want every published runtime, tool, component, test, and config package pinned together.\",\n    packageNames: TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES,\n    dependencyField: \"mixed\",\n  },\n] as const satisfies readonly TenantClientInstallProfile[];\nexport type TenantClientInstallProfileId =\n  (typeof TENANT_CLIENT_INSTALL_PROFILES)[number][\"id\"];\n\n/**\n * Direct imports tenant-owned product code may use. This is intentionally\n * smaller than TENANT_CLIENT_INSTALLABLE_PACKAGES: several publishable packages\n * are installed as SDK dependencies, tooling, or platform runtimes but should\n * not become the application integration surface.\n */\nexport const TENANT_CLIENT_PUBLIC_IMPORTS = [\n  {\n    packageName: \"@lucern/sdk\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"TypeScript SDK runtime and generated operation namespaces.\",\n  },\n  {\n    packageName: \"@lucern/react\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"React bindings for tenant-owned UI applications.\",\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"MCP client/server entry points and hosted route helpers.\",\n  },\n  {\n    packageName: \"@lucern/graph-sync\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description:\n      \"Optional Neo4j graph mirroring host actions, edge API, query proxy, backfill, and health helpers.\",\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type and manifest contracts.\",\n  },\n  {\n    packageName: \"@lucern/access-control\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description:\n      \"Tenant runtime access-control helpers, including effective tool access.\",\n  },\n  {\n    packageName: \"@lucern/types\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type-only helpers for tenant integration code.\",\n  },\n] as const;\nexport type TenantClientPublicImport =\n  (typeof TENANT_CLIENT_PUBLIC_IMPORTS)[number];\nexport type TenantClientPublicPackage =\n  TenantClientPublicImport[\"packageName\"];\nexport type TenantClientPublicSurface = TenantClientPublicImport[\"surface\"];\n\nexport const TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [\n  {\n    packageName: \"@lucern/control-plane\",\n    importPath: \"@lucern/control-plane/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install the Lucern control plane.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/runtime.config\",\n    surface: \"component_config\",\n    description:\n      \"Runtime config alias for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n] as const;\nexport type TenantClientComponentConfigImport =\n  (typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS)[number];\nexport type TenantClientAllowedImport =\n  | TenantClientPublicImport\n  | TenantClientComponentConfigImport;\n\nexport function findTenantClientInstallablePackage(\n  packageName: string\n): TenantClientInstallablePackage | undefined {\n  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(\n    (entry) => entry.packageName === packageName\n  );\n}\n\nexport function isTenantClientInstallablePackage(packageName: string): boolean {\n  return Boolean(findTenantClientInstallablePackage(packageName));\n}\n\nexport const TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [\n  \"bootstrap\",\n  \"context\",\n  \"beliefs\",\n  \"evidence\",\n  \"questions\",\n  \"graph\",\n  \"worktrees\",\n  \"topics\",\n  \"edges\",\n  \"contradictions\",\n  \"contracts\",\n  \"graphIntel\",\n  \"graphIntelligence\",\n  \"graphAnalysis\",\n  \"graphRecommendations\",\n  \"orgGraphSearch\",\n  \"embeddings\",\n  \"ontologyLinks\",\n  \"graphStateClassifier\",\n  \"tools\",\n  \"identity\",\n  \"modelRuntime\",\n  \"events\",\n  \"jobs\",\n  \"telemetry\",\n] as const;\nexport type TenantClientRequiredSdkNamespace =\n  (typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES)[number];\n\nexport const TENANT_CLIENT_CAPABILITIES = [\n  {\n    id: \"identity.bootstrap_session\",\n    description: \"Start a scoped Lucern session for a tenant principal.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.context.compile\",\n    description: \"Compile tenant and workspace scoped reasoning context.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.read\",\n    description: \"Read beliefs, evidence, questions, topics, graph edges, and lineage.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.write\",\n    description: \"Create and update graph objects through authorized APIs.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph_intelligence.run\",\n    description:\n      \"Discover and run Graph Intelligence query recipes for structural graph analysis.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/cli\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph_mirroring.install\",\n    description:\n      \"Install and run the optional Neo4j graph mirror for paid or enterprise tenant deployments.\",\n    surfaces: [\"@lucern/graph-sync\", \"@lucern/cli\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"workflow.worktree_lifecycle\",\n    description: \"Create, review, merge, and close scoped worktrees.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n] as const;\nexport type TenantClientCapability =\n  (typeof TENANT_CLIENT_CAPABILITIES)[number];\nexport type TenantClientCapabilityId = TenantClientCapability[\"id\"];\n\nexport const TENANT_CLIENT_ISOLATION_RULES = [\n  {\n    id: \"tenant_workspace_scope_required\",\n    description:\n      \"Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state.\",\n  },\n  {\n    id: \"principal_audit_required\",\n    description:\n      \"Runtime operations must carry principalId, authMode, and scopes for audit attribution.\",\n  },\n  {\n    id: \"no_private_lucern_imports\",\n    description:\n      \"Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals.\",\n  },\n] as const;\nexport type TenantClientIsolationRule =\n  (typeof TENANT_CLIENT_ISOLATION_RULES)[number];\n\nexport const TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [\n  {\n    id: \"deep_src_import\",\n    pattern: \"^@lucern/[^/]+/src(?:/|$)\",\n    description: \"Published packages must not be bypassed through src paths.\",\n  },\n  {\n    id: \"deep_dist_import\",\n    pattern: \"^@lucern/[^/]+/dist(?:/|$)\",\n    description:\n      \"Published package exports must be used instead of dist file paths.\",\n  },\n  {\n    id: \"generated_adapter_import\",\n    pattern: \"^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)\",\n    description:\n      \"Generated Lucern adapters are internal deployment artifacts.\",\n  },\n  {\n    id: \"private_runtime_import\",\n    pattern: \"^@lucern/[^/]+/(?:internal|private)(?:/|$)\",\n    description: \"Internal and private package subpaths are not public SDK API.\",\n  },\n  {\n    id: \"workspace_source_import\",\n    pattern: \"^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)\",\n    description:\n      \"Tenant clients must not import source files from the Lucern monorepo.\",\n  },\n  {\n    id: \"root_alias_lucern_import\",\n    pattern: \"^@/(?:lucern|packages|modules|services|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not depend on Lucern repo-local path aliases.\",\n  },\n  {\n    id: \"relative_lucern_source_import\",\n    pattern: \"^\\\\.\\\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not reach back into Lucern source through relative paths.\",\n  },\n  {\n    id: \"monorepo_path_import\",\n    pattern: \"lucern-repo\",\n    description:\n      \"Absolute imports that name the Lucern repository are not portable tenant code.\",\n  },\n] as const;\nexport type TenantClientForbiddenImportPattern =\n  (typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS)[number];\nexport type TenantClientForbiddenImportPatternId =\n  TenantClientForbiddenImportPattern[\"id\"];\n\nexport type TenantClientImportDecision =\n  | \"public\"\n  | \"forbidden\"\n  | \"local\"\n  | \"external\";\n\nexport type TenantClientImportClassification = {\n  importPath: string;\n  decision: TenantClientImportDecision;\n  publicImport?: TenantClientAllowedImport;\n  pattern?: TenantClientForbiddenImportPattern;\n  reason: string;\n};\n\nfunction matchesPublicImport(\n  importPath: string\n): TenantClientAllowedImport | undefined {\n  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(\n    (entry) => importPath === entry.importPath\n  );\n  if (componentConfig) {\n    return componentConfig;\n  }\n\n  return TENANT_CLIENT_PUBLIC_IMPORTS.find(\n    (entry) =>\n      importPath === entry.packageName ||\n      importPath.startsWith(`${entry.packageName}/`)\n  );\n}\n\nfunction matchesForbiddenPattern(\n  importPath: string\n): TenantClientForbiddenImportPattern | undefined {\n  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find((entry) =>\n    new RegExp(entry.pattern, \"u\").test(importPath)\n  );\n}\n\nexport function classifyTenantClientImport(\n  importPath: string\n): TenantClientImportClassification {\n  const normalizedImportPath = importPath.trim();\n  const pattern = matchesForbiddenPattern(normalizedImportPath);\n\n  if (pattern) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      pattern,\n      reason: pattern.description,\n    };\n  }\n\n  const publicImport = matchesPublicImport(normalizedImportPath);\n  if (publicImport) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"public\",\n      publicImport,\n      reason: publicImport.description,\n    };\n  }\n\n  if (normalizedImportPath.startsWith(\"@lucern/\")) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      reason:\n        \"This @lucern package is not part of the tenant client public surface.\",\n    };\n  }\n\n  if (\n    normalizedImportPath.startsWith(\"./\") ||\n    normalizedImportPath.startsWith(\"../\")\n  ) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"local\",\n      reason: \"Local tenant-owned import.\",\n    };\n  }\n\n  return {\n    importPath: normalizedImportPath,\n    decision: \"external\",\n    reason: \"External dependency outside the Lucern package namespace.\",\n  };\n}\n\nexport function isTenantClientPublicImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function isTenantClientComponentConfigImport(\n  importPath: string\n): boolean {\n  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(\n    (entry) => importPath === entry.importPath\n  );\n}\n\nexport function isTenantClientAllowedImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function assertTenantClientImportAllowed(importPath: string): void {\n  const classification = classifyTenantClientImport(importPath);\n  if (classification.decision !== \"forbidden\") {\n    return;\n  }\n\n  throw new Error(formatTenantClientImportViolation(classification));\n}\n\nexport function formatTenantClientImportViolation(\n  classification: TenantClientImportClassification\n): string {\n  const patternId = classification.pattern\n    ? ` [${classification.pattern.id}]`\n    : \"\";\n  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;\n}\n","import {\n  TENANT_CLIENT_AUTH_MODES,\n  TENANT_CLIENT_CAPABILITIES,\n  TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS,\n  TENANT_CLIENT_CONTRACT_VERSION,\n  TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS,\n  TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS,\n  TENANT_CLIENT_FORBIDDEN_SECRET_ENV,\n  TENANT_CLIENT_INSTALLABLE_PACKAGES,\n  TENANT_CLIENT_INSTALL_PROFILES,\n  TENANT_CLIENT_INSTALL_TOKEN_ENV,\n  TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,\n  TENANT_CLIENT_ISOLATION_RULES,\n  TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS,\n  TENANT_CLIENT_PRINCIPAL_TYPES,\n  TENANT_CLIENT_PUBLIC_IMPORTS,\n  TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  TENANT_CLIENT_REQUIRED_SDK_NAMESPACES,\n} from \"../tenant-client.contract\";\n\nexport type TenantClientManifest = {\n  readonly manifestVersion: \"1.0.0\";\n  readonly contractVersion: typeof TENANT_CLIENT_CONTRACT_VERSION;\n  readonly auth: {\n    readonly modes: typeof TENANT_CLIENT_AUTH_MODES;\n    readonly principalTypes: typeof TENANT_CLIENT_PRINCIPAL_TYPES;\n    readonly requiredContextFields: typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS;\n    readonly optionalContextFields: typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS;\n  };\n  readonly installToken: {\n    readonly env: typeof TENANT_CLIENT_INSTALL_TOKEN_ENV;\n    readonly infisicalPath: typeof TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH;\n    readonly forbiddenInfisicalPaths: typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS;\n    readonly forbiddenSecretEnv: typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV;\n  };\n  readonly packages: {\n    readonly installable: typeof TENANT_CLIENT_INSTALLABLE_PACKAGES;\n    readonly installProfiles: typeof TENANT_CLIENT_INSTALL_PROFILES;\n    readonly directImports: typeof TENANT_CLIENT_PUBLIC_IMPORTS;\n    readonly componentConfigImports: typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS;\n  };\n  readonly sdk: {\n    readonly requiredNamespaces: typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES;\n  };\n  readonly capabilities: typeof TENANT_CLIENT_CAPABILITIES;\n  readonly isolationRules: typeof TENANT_CLIENT_ISOLATION_RULES;\n  readonly forbiddenImportPatterns: typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS;\n};\n\nexport const TENANT_CLIENT_MANIFEST = {\n  manifestVersion: \"1.0.0\",\n  contractVersion: TENANT_CLIENT_CONTRACT_VERSION,\n  auth: {\n    modes: TENANT_CLIENT_AUTH_MODES,\n    principalTypes: TENANT_CLIENT_PRINCIPAL_TYPES,\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n    optionalContextFields: TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS,\n  },\n  installToken: {\n    env: TENANT_CLIENT_INSTALL_TOKEN_ENV,\n    infisicalPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,\n    forbiddenInfisicalPaths: TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS,\n    forbiddenSecretEnv: TENANT_CLIENT_FORBIDDEN_SECRET_ENV,\n  },\n  packages: {\n    installable: TENANT_CLIENT_INSTALLABLE_PACKAGES,\n    installProfiles: TENANT_CLIENT_INSTALL_PROFILES,\n    directImports: TENANT_CLIENT_PUBLIC_IMPORTS,\n    componentConfigImports: TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS,\n  },\n  sdk: {\n    requiredNamespaces: TENANT_CLIENT_REQUIRED_SDK_NAMESPACES,\n  },\n  capabilities: TENANT_CLIENT_CAPABILITIES,\n  isolationRules: TENANT_CLIENT_ISOLATION_RULES,\n  forbiddenImportPatterns: TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS,\n} as const satisfies TenantClientManifest;\n"]}

package/dist/mcp-gateway-boundary.contract.d.ts

@@ -1,4 +1,4 @@
-import { SessionPrincipalType, SessionAuthMode } from './auth.contract.js';
+import { SessionPrincipalType, SessionAuthMode, SessionDelegationHop } from './auth.contract.js';
 import './convex-admin.contract.js';
 
 /**
@@ -18,7 +18,7 @@ declare const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT: "/api/platform
 declare const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT: "/api/platform/v1/mcp/contracts/evaluate-research";
 declare const MCP_GATEWAY_ALLOWED_CLIENT_ENV: readonly ["LUCERN_API_KEY", "LUCERN_API_BASE_URL", "LUCERN_ENVIRONMENT", "LUCERN_USER_TOKEN"];
 type McpGatewayAllowedClientEnv = (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];
-declare const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV: readonly ["MC_CONVEX_URL", "MC_DEPLOY_KEY", "LUCERN_CONVEX_URL", "LUCERN_DEPLOY_KEY", "TENANT_CONVEX_URL", "TENANT_DEPLOY_KEY"];
+declare const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV: readonly ["CONVEX_MC_URL", "CONVEX_MC_DEPLOY_KEY", "MC_CONVEX_URL", "MC_DEPLOY_KEY", "LUCERN_CONVEX_URL", "LUCERN_DEPLOY_KEY", "TENANT_CONVEX_URL", "TENANT_DEPLOY_KEY"];
 type McpGatewayForbiddenClientEnv = (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];
 declare const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS: readonly ["tenant", "session", "permissions"];
 type McpGatewayBootstrapRequiredField = (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];
@@ -42,6 +42,9 @@ type McpGatewaySessionContext = {
     sessionId?: string;
     userEmail?: string;
     expiresAt?: number;
+    delegatedBy?: string;
+    delegationChain?: SessionDelegationHop[];
+    worktreeId?: string;
 };
 type McpGatewayPermissionContext = {
     allowedTools: string[] | null;
@@ -62,6 +65,7 @@ type McpGatewayBootstrapRequest = {
     sessionId?: string;
     agentIdentity?: string;
     workspaceId?: string;
+    worktreeId?: string;
 };
 type McpGatewayWritePolicyCheckRequest = {
     topicId?: string;
@@ -127,6 +131,19 @@ type McpGatewayBuildSessionDecision = {
     question: string;
     decision: string;
 };
+type McpGatewayBuildSessionTask = {
+    taskId: string;
+    title: string;
+    status: "todo" | "in_progress" | "blocked" | "done";
+    priority: "low" | "medium" | "high" | "urgent";
+    description?: string;
+    taskType?: string;
+    linkedBeliefId?: string;
+    linkedQuestionId?: string;
+    linkedWorktreeId?: string;
+    outputSummary?: string;
+    tags?: string[];
+};
 type McpGatewayBuildSessionWorktreeSummary = {
     worktreeId: string;
     title: string;
@@ -151,6 +168,9 @@ type McpGatewayBeginBuildSessionResponse = {
     sessionMode: string;
     targetBeliefIds: string[];
     targetQuestionIds: string[];
+    taskIds: string[];
+    incompleteTaskIds: string[];
+    tasks: McpGatewayBuildSessionTask[];
     topBeliefs: McpGatewayBuildSessionBelief[];
     openQuestions: McpGatewayBuildSessionQuestion[];
     resolvedDecisions: McpGatewayBuildSessionDecision[];
@@ -178,4 +198,4 @@ type McpGatewayOwnedBootstrapOperation = (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPE
 declare const MCP_GATEWAY_CLIENT_ONLY_PACKAGES: readonly ["@lucern/sdk", "@lucern/mcp", "@lucern/contracts"];
 type McpGatewayClientOnlyPackage = (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];
 
-export { MCP_GATEWAY_ALLOWED_CLIENT_ENV, MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS, MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION, MCP_GATEWAY_CLIENT_ONLY_PACKAGES, MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT, MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT, MCP_GATEWAY_FORBIDDEN_CLIENT_ENV, MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS, MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT, type McpGatewayAllowedClientEnv, type McpGatewayBeginBuildSessionRequest, type McpGatewayBeginBuildSessionResponse, type McpGatewayBootstrapRequest, type McpGatewayBootstrapRequiredField, type McpGatewayBootstrapResponse, type McpGatewayBuildSessionBelief, type McpGatewayBuildSessionDecision, type McpGatewayBuildSessionQuestion, type McpGatewayBuildSessionWorktreeSummary, type McpGatewayClientOnlyPackage, type McpGatewayContractEvaluationResponse, type McpGatewayEvaluateEngineeringContractRequest, type McpGatewayEvaluateResearchContractRequest, type McpGatewayForbiddenClientEnv, type McpGatewayJsonArray, type McpGatewayJsonObject, type McpGatewayJsonValue, type McpGatewayOwnedBootstrapOperation, type McpGatewayPermissionContext, type McpGatewaySessionContext, type McpGatewayTenantContext, type McpGatewayWritePolicyCheckRequest, type McpGatewayWritePolicyCheckResponse };
+export { MCP_GATEWAY_ALLOWED_CLIENT_ENV, MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS, MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION, MCP_GATEWAY_CLIENT_ONLY_PACKAGES, MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT, MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT, MCP_GATEWAY_FORBIDDEN_CLIENT_ENV, MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS, MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT, type McpGatewayAllowedClientEnv, type McpGatewayBeginBuildSessionRequest, type McpGatewayBeginBuildSessionResponse, type McpGatewayBootstrapRequest, type McpGatewayBootstrapRequiredField, type McpGatewayBootstrapResponse, type McpGatewayBuildSessionBelief, type McpGatewayBuildSessionDecision, type McpGatewayBuildSessionQuestion, type McpGatewayBuildSessionTask, type McpGatewayBuildSessionWorktreeSummary, type McpGatewayClientOnlyPackage, type McpGatewayContractEvaluationResponse, type McpGatewayEvaluateEngineeringContractRequest, type McpGatewayEvaluateResearchContractRequest, type McpGatewayForbiddenClientEnv, type McpGatewayJsonArray, type McpGatewayJsonObject, type McpGatewayJsonValue, type McpGatewayOwnedBootstrapOperation, type McpGatewayPermissionContext, type McpGatewaySessionContext, type McpGatewayTenantContext, type McpGatewayWritePolicyCheckRequest, type McpGatewayWritePolicyCheckResponse };

package/dist/mcp-gateway-boundary.contract.js

@@ -12,6 +12,8 @@ var MCP_GATEWAY_ALLOWED_CLIENT_ENV = [
   "LUCERN_USER_TOKEN"
 ];
 var MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [
+  "CONVEX_MC_URL",
+  "CONVEX_MC_DEPLOY_KEY",
   "MC_CONVEX_URL",
   "MC_DEPLOY_KEY",
   "LUCERN_CONVEX_URL",

package/dist/mcp-gateway-boundary.contract.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/mcp-gateway-boundary.contract.ts"],"names":[],"mappings":";AAcO,IAAM,qCAAA,GAAwC;AAE9C,IAAM,8BAAA,GACX;AAEK,IAAM,uCAAA,GACX;AAEK,IAAM,wCAAA,GACX;AAEK,IAAM,kDAAA,GACX;AAEK,IAAM,+CAAA,GACX;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C,gBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,eAAA;AAAA,EACA,eAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAoLO,IAAM,sCAAA,GAAyC;AAAA,EACpD,sBAAA;AAAA,EACA,kBAAA;AAAA,EACA,2BAAA;AAAA,EACA,sBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,aAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF","file":"mcp-gateway-boundary.contract.js","sourcesContent":["/**\n * MCP gateway boundary contract\n *\n * Defines the target thin-client boundary for the Lucern MCP server. MCP is a\n * client of the Lucern gateway, not a privileged Convex or Master Control\n * process. The gateway owns tenant resolution, deploy-key access, policy, and\n * session persistence.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const MCP_GATEWAY_BOOTSTRAP_ENDPOINT =\n  \"/api/platform/v1/mcp/session\" as const;\n\nexport const MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT =\n  \"/api/platform/v1/mcp/write-policy/check\" as const;\n\nexport const MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT =\n  \"/api/platform/v1/mcp/build-session/begin\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-engineering\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-research\" as const;\n\nexport const MCP_GATEWAY_ALLOWED_CLIENT_ENV = [\n  \"LUCERN_API_KEY\",\n  \"LUCERN_API_BASE_URL\",\n  \"LUCERN_ENVIRONMENT\",\n  \"LUCERN_USER_TOKEN\",\n] as const;\nexport type McpGatewayAllowedClientEnv =\n  (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [\n  \"MC_CONVEX_URL\",\n  \"MC_DEPLOY_KEY\",\n  \"LUCERN_CONVEX_URL\",\n  \"LUCERN_DEPLOY_KEY\",\n  \"TENANT_CONVEX_URL\",\n  \"TENANT_DEPLOY_KEY\",\n] as const;\nexport type McpGatewayForbiddenClientEnv =\n  (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS = [\n  \"tenant\",\n  \"session\",\n  \"permissions\",\n] as const;\nexport type McpGatewayBootstrapRequiredField =\n  (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];\n\nexport type McpGatewayTenantContext = {\n  tenantId: string;\n  slug: string;\n  name: string;\n  tier: string;\n  methodologyPackIds: string[];\n  apiKeyId?: string;\n};\n\nexport type McpGatewaySessionContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  workspaceId?: string;\n  authMode: SessionAuthMode;\n  roles: string[];\n  scopes: string[];\n  sessionId?: string;\n  userEmail?: string;\n  expiresAt?: number;\n};\n\nexport type McpGatewayPermissionContext = {\n  allowedTools: string[] | null;\n  allowedTopics: string[] | null;\n  groupIds: string[];\n  permittedPackKeys: string[];\n  permittedToolNames: string[];\n  permittedTools: Array<{\n    toolName: string;\n    requiredRole?: string;\n    approvalGateId?: string;\n    isCore?: boolean;\n    category?: string;\n  }>;\n};\n\nexport type McpGatewayBootstrapRequest = {\n  transportKind?: \"stdio\" | \"hosted\";\n  sessionId?: string;\n  agentIdentity?: string;\n  workspaceId?: string;\n};\n\nexport type McpGatewayWritePolicyCheckRequest = {\n  topicId?: string;\n  role: string;\n  toolName: string;\n};\n\nexport type McpGatewayBeginBuildSessionRequest = {\n  worktreeId: string;\n  branch?: string;\n  branchBase?: string;\n  prBase?: string;\n  sessionMode?: string;\n  activateIfPlanning?: boolean;\n};\n\nexport type McpGatewayJsonObject = {\n  [key: string]: McpGatewayJsonValue | undefined;\n};\n\nexport type McpGatewayJsonArray = McpGatewayJsonValue[];\n\nexport type McpGatewayJsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | McpGatewayJsonArray\n  | McpGatewayJsonObject;\n\nexport type McpGatewayEvaluateEngineeringContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  testOutput?: McpGatewayJsonValue;\n  tscOutput?: McpGatewayJsonValue;\n  lintOutput?: McpGatewayJsonValue;\n  sentryData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayEvaluateResearchContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  metricData?: McpGatewayJsonValue;\n  referenceCheckData?: McpGatewayJsonValue;\n  marketIndexData?: McpGatewayJsonValue;\n  temporalData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayContractEvaluationResponse = McpGatewayJsonObject;\n\nexport type McpGatewayWritePolicyCheckResponse = {\n  allowed: boolean;\n  permission: string;\n  rationale?: string;\n  maxWritesPerSession?: number;\n  toolCategory?: string | null;\n  policy?: McpGatewayJsonObject | null;\n  explanation?: McpGatewayJsonObject;\n  reason: string;\n};\n\nexport type McpGatewayBootstrapResponse = {\n  tenant: McpGatewayTenantContext;\n  session: McpGatewaySessionContext;\n  permissions: McpGatewayPermissionContext;\n};\n\nexport type McpGatewayBuildSessionBelief = {\n  nodeId: string;\n  text: string;\n  confidence: number | null;\n};\n\nexport type McpGatewayBuildSessionQuestion = {\n  nodeId: string;\n  text: string;\n  priority: string;\n};\n\nexport type McpGatewayBuildSessionDecision = {\n  question: string;\n  decision: string;\n};\n\nexport type McpGatewayBuildSessionWorktreeSummary = {\n  worktreeId: string;\n  title: string;\n  status?: string;\n};\n\nexport type McpGatewayBeginBuildSessionResponse = {\n  topicId: string;\n  topicName: string;\n  worktreeId: string;\n  worktreeName: string;\n  branch: string;\n  branchBase: string;\n  prBase: string;\n  campaign: number | null;\n  lane: string;\n  laneOrderInCampaign: number | null;\n  orderInLane: number | null;\n  gate: string;\n  hypothesis: string;\n  focus: string;\n  status: string;\n  sessionMode: string;\n  targetBeliefIds: string[];\n  targetQuestionIds: string[];\n  topBeliefs: McpGatewayBuildSessionBelief[];\n  openQuestions: McpGatewayBuildSessionQuestion[];\n  resolvedDecisions: McpGatewayBuildSessionDecision[];\n  exitCriteria: string[];\n  requiredDocs: string[];\n  keyFiles: string[];\n  pillarBeliefs: Array<{\n    pillar: string;\n    text: string;\n    nodeId: string;\n  }>;\n  visionDocs: Array<{\n    path: string;\n    description: string;\n  }>;\n  dependencies: McpGatewayBuildSessionWorktreeSummary[];\n  unblocks: Array<{\n    worktreeId: string;\n    title: string;\n  }>;\n  mergeOrderNotes: string;\n};\n\nexport const MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS = [\n  \"validate_mcp_session\",\n  \"record_key_usage\",\n  \"resolve_default_workspace\",\n  \"resolve_user_context\",\n  \"create_user_session\",\n  \"upsert_agent_principal\",\n] as const;\nexport type McpGatewayOwnedBootstrapOperation =\n  (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS)[number];\n\nexport const MCP_GATEWAY_CLIENT_ONLY_PACKAGES = [\n  \"@lucern/sdk\",\n  \"@lucern/mcp\",\n  \"@lucern/contracts\",\n] as const;\nexport type McpGatewayClientOnlyPackage =\n  (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];\n"]}
+{"version":3,"sources":["../src/mcp-gateway-boundary.contract.ts"],"names":[],"mappings":";AAeO,IAAM,qCAAA,GAAwC;AAE9C,IAAM,8BAAA,GACX;AAEK,IAAM,uCAAA,GACX;AAEK,IAAM,wCAAA,GACX;AAEK,IAAM,kDAAA,GACX;AAEK,IAAM,+CAAA,GACX;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C,gBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAyMO,IAAM,sCAAA,GAAyC;AAAA,EACpD,sBAAA;AAAA,EACA,kBAAA;AAAA,EACA,2BAAA;AAAA,EACA,sBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,aAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF","file":"mcp-gateway-boundary.contract.js","sourcesContent":["/**\n * MCP gateway boundary contract\n *\n * Defines the target thin-client boundary for the Lucern MCP server. MCP is a\n * client of the Lucern gateway, not a privileged Convex or Master Control\n * process. The gateway owns tenant resolution, deploy-key access, policy, and\n * session persistence.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionDelegationHop,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const MCP_GATEWAY_BOOTSTRAP_ENDPOINT =\n  \"/api/platform/v1/mcp/session\" as const;\n\nexport const MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT =\n  \"/api/platform/v1/mcp/write-policy/check\" as const;\n\nexport const MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT =\n  \"/api/platform/v1/mcp/build-session/begin\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-engineering\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-research\" as const;\n\nexport const MCP_GATEWAY_ALLOWED_CLIENT_ENV = [\n  \"LUCERN_API_KEY\",\n  \"LUCERN_API_BASE_URL\",\n  \"LUCERN_ENVIRONMENT\",\n  \"LUCERN_USER_TOKEN\",\n] as const;\nexport type McpGatewayAllowedClientEnv =\n  (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [\n  \"CONVEX_MC_URL\",\n  \"CONVEX_MC_DEPLOY_KEY\",\n  \"MC_CONVEX_URL\",\n  \"MC_DEPLOY_KEY\",\n  \"LUCERN_CONVEX_URL\",\n  \"LUCERN_DEPLOY_KEY\",\n  \"TENANT_CONVEX_URL\",\n  \"TENANT_DEPLOY_KEY\",\n] as const;\nexport type McpGatewayForbiddenClientEnv =\n  (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS = [\n  \"tenant\",\n  \"session\",\n  \"permissions\",\n] as const;\nexport type McpGatewayBootstrapRequiredField =\n  (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];\n\nexport type McpGatewayTenantContext = {\n  tenantId: string;\n  slug: string;\n  name: string;\n  tier: string;\n  methodologyPackIds: string[];\n  apiKeyId?: string;\n};\n\nexport type McpGatewaySessionContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  workspaceId?: string;\n  authMode: SessionAuthMode;\n  roles: string[];\n  scopes: string[];\n  sessionId?: string;\n  userEmail?: string;\n  expiresAt?: number;\n  delegatedBy?: string;\n  delegationChain?: SessionDelegationHop[];\n  worktreeId?: string;\n};\n\nexport type McpGatewayPermissionContext = {\n  allowedTools: string[] | null;\n  allowedTopics: string[] | null;\n  groupIds: string[];\n  permittedPackKeys: string[];\n  permittedToolNames: string[];\n  permittedTools: Array<{\n    toolName: string;\n    requiredRole?: string;\n    approvalGateId?: string;\n    isCore?: boolean;\n    category?: string;\n  }>;\n};\n\nexport type McpGatewayBootstrapRequest = {\n  transportKind?: \"stdio\" | \"hosted\";\n  sessionId?: string;\n  agentIdentity?: string;\n  workspaceId?: string;\n  worktreeId?: string;\n};\n\nexport type McpGatewayWritePolicyCheckRequest = {\n  topicId?: string;\n  role: string;\n  toolName: string;\n};\n\nexport type McpGatewayBeginBuildSessionRequest = {\n  worktreeId: string;\n  branch?: string;\n  branchBase?: string;\n  prBase?: string;\n  sessionMode?: string;\n  activateIfPlanning?: boolean;\n};\n\nexport type McpGatewayJsonObject = {\n  [key: string]: McpGatewayJsonValue | undefined;\n};\n\nexport type McpGatewayJsonArray = McpGatewayJsonValue[];\n\nexport type McpGatewayJsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | McpGatewayJsonArray\n  | McpGatewayJsonObject;\n\nexport type McpGatewayEvaluateEngineeringContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  testOutput?: McpGatewayJsonValue;\n  tscOutput?: McpGatewayJsonValue;\n  lintOutput?: McpGatewayJsonValue;\n  sentryData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayEvaluateResearchContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  metricData?: McpGatewayJsonValue;\n  referenceCheckData?: McpGatewayJsonValue;\n  marketIndexData?: McpGatewayJsonValue;\n  temporalData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayContractEvaluationResponse = McpGatewayJsonObject;\n\nexport type McpGatewayWritePolicyCheckResponse = {\n  allowed: boolean;\n  permission: string;\n  rationale?: string;\n  maxWritesPerSession?: number;\n  toolCategory?: string | null;\n  policy?: McpGatewayJsonObject | null;\n  explanation?: McpGatewayJsonObject;\n  reason: string;\n};\n\nexport type McpGatewayBootstrapResponse = {\n  tenant: McpGatewayTenantContext;\n  session: McpGatewaySessionContext;\n  permissions: McpGatewayPermissionContext;\n};\n\nexport type McpGatewayBuildSessionBelief = {\n  nodeId: string;\n  text: string;\n  confidence: number | null;\n};\n\nexport type McpGatewayBuildSessionQuestion = {\n  nodeId: string;\n  text: string;\n  priority: string;\n};\n\nexport type McpGatewayBuildSessionDecision = {\n  question: string;\n  decision: string;\n};\n\nexport type McpGatewayBuildSessionTask = {\n  taskId: string;\n  title: string;\n  status: \"todo\" | \"in_progress\" | \"blocked\" | \"done\";\n  priority: \"low\" | \"medium\" | \"high\" | \"urgent\";\n  description?: string;\n  taskType?: string;\n  linkedBeliefId?: string;\n  linkedQuestionId?: string;\n  linkedWorktreeId?: string;\n  outputSummary?: string;\n  tags?: string[];\n};\n\nexport type McpGatewayBuildSessionWorktreeSummary = {\n  worktreeId: string;\n  title: string;\n  status?: string;\n};\n\nexport type McpGatewayBeginBuildSessionResponse = {\n  topicId: string;\n  topicName: string;\n  worktreeId: string;\n  worktreeName: string;\n  branch: string;\n  branchBase: string;\n  prBase: string;\n  campaign: number | null;\n  lane: string;\n  laneOrderInCampaign: number | null;\n  orderInLane: number | null;\n  gate: string;\n  hypothesis: string;\n  focus: string;\n  status: string;\n  sessionMode: string;\n  targetBeliefIds: string[];\n  targetQuestionIds: string[];\n  taskIds: string[];\n  incompleteTaskIds: string[];\n  tasks: McpGatewayBuildSessionTask[];\n  topBeliefs: McpGatewayBuildSessionBelief[];\n  openQuestions: McpGatewayBuildSessionQuestion[];\n  resolvedDecisions: McpGatewayBuildSessionDecision[];\n  exitCriteria: string[];\n  requiredDocs: string[];\n  keyFiles: string[];\n  pillarBeliefs: Array<{\n    pillar: string;\n    text: string;\n    nodeId: string;\n  }>;\n  visionDocs: Array<{\n    path: string;\n    description: string;\n  }>;\n  dependencies: McpGatewayBuildSessionWorktreeSummary[];\n  unblocks: Array<{\n    worktreeId: string;\n    title: string;\n  }>;\n  mergeOrderNotes: string;\n};\n\nexport const MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS = [\n  \"validate_mcp_session\",\n  \"record_key_usage\",\n  \"resolve_default_workspace\",\n  \"resolve_user_context\",\n  \"create_user_session\",\n  \"upsert_agent_principal\",\n] as const;\nexport type McpGatewayOwnedBootstrapOperation =\n  (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS)[number];\n\nexport const MCP_GATEWAY_CLIENT_ONLY_PACKAGES = [\n  \"@lucern/sdk\",\n  \"@lucern/mcp\",\n  \"@lucern/contracts\",\n] as const;\nexport type McpGatewayClientOnlyPackage =\n  (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];\n"]}

package/dist/permit-principal-projection.contract.d.ts

@@ -0,0 +1,74 @@
+type PermitProjectionPlatformRole = "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
+type PermitPrincipalProjection = Record<string, unknown> & {
+    principalId?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    principalType?: string;
+    status?: string;
+    displayName?: string;
+    metadata?: Record<string, unknown>;
+    createdAt?: number;
+    updatedAt?: number;
+    lastSeenAt?: number;
+};
+type PermitAliasProjection = Record<string, unknown> & {
+    principalId?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    provider?: string;
+    providerSubjectId?: string;
+    alias?: string;
+    aliasKind?: string;
+    status?: string;
+    metadata?: Record<string, unknown>;
+};
+type PermitRoleAssignmentProjection = Record<string, unknown> & {
+    tenantId?: string;
+    workspaceId?: string;
+    role?: string;
+    targetType?: string;
+    targetId?: string;
+    resourceType?: string;
+    resourceKey?: string;
+    status?: string;
+};
+type PermitGroupMembershipProjection = Record<string, unknown> & {
+    tenantId?: string;
+    workspaceId?: string;
+    groupId?: string;
+    memberType?: string;
+    memberId?: string;
+    principalId?: string;
+    status?: string;
+};
+type PermitProjectedUserRecord = {
+    clerkId: string;
+    email: string;
+    name?: string;
+    lastSeenAt: number;
+    chatCount: number;
+    messageCount: number;
+    mcRole: PermitProjectionPlatformRole;
+    mcRoleSyncedAt: number;
+    defaultTenantId: string;
+    defaultWorkspaceId: string;
+    defaultPrincipalId: string;
+    principalGroupIds: string[];
+    governanceGrantsSyncedAt: number;
+    createdAt: number;
+    updatedAt: number;
+};
+type PermitProjectionRows = {
+    principals: PermitPrincipalProjection[];
+    aliases: PermitAliasProjection[];
+    roleAssignments: PermitRoleAssignmentProjection[];
+    groupMemberships: PermitGroupMembershipProjection[];
+};
+declare function readPermitProjectionString(value: unknown): string | undefined;
+declare function isActivePermitProjectionStatus(value: unknown): boolean;
+declare function mapPermitRoleToPlatformRole(role: unknown): PermitProjectionPlatformRole | undefined;
+declare function buildProjectedUserFromPermitPrincipal(rows: PermitProjectionRows, principal: PermitPrincipalProjection, matchingAlias?: PermitAliasProjection, now?: number): PermitProjectedUserRecord | null;
+declare function findProjectedUserByPermitPrincipalId(rows: PermitProjectionRows, principalId: string, now?: number): PermitProjectedUserRecord | null;
+declare function findProjectedUserByPermitClerkId(rows: PermitProjectionRows, clerkId: string, now?: number): PermitProjectedUserRecord | null;
+
+export { type PermitAliasProjection, type PermitGroupMembershipProjection, type PermitPrincipalProjection, type PermitProjectedUserRecord, type PermitProjectionPlatformRole, type PermitProjectionRows, type PermitRoleAssignmentProjection, buildProjectedUserFromPermitPrincipal, findProjectedUserByPermitClerkId, findProjectedUserByPermitPrincipalId, isActivePermitProjectionStatus, mapPermitRoleToPlatformRole, readPermitProjectionString };