@lucern/contracts 0.3.0-alpha.12 → 0.3.0-alpha.13

package/dist/function-registry/types.d.ts

@@ -1,11 +1,11 @@
 import { z } from 'zod';
 import { F as FunctionEffect } from '../defineFunction-DO97DKs4.js';
-import { M as McpToolContract } from '../tool-contracts-BevD9Ho2.js';
+import { M as McpToolContract } from '../tool-contracts-C_xvM9q2.js';
 
 type FunctionKind = "query" | "mutation" | "action";
 type FunctionIdempotency = boolean | "required";
 type FunctionSurfaceIntent = "mcp_core" | "mcp_analysis" | "mcp_workflow" | "mcp_governance" | "system" | "compatibility" | "sdk_granular";
-type FunctionPrincipalType = "user" | "service" | "agent";
+type FunctionPrincipalType = "user" | "service" | "agent" | "group" | "external_viewer";
 type SurfaceClass = "platform_public" | "tenant_public" | "platform_internal" | "legacy_compat" | "application_tool" | "external_connector";
 type SurfaceExposure = "public" | "internal" | "none";
 type FunctionSurfaceMap = {

package/dist/function-registry/worktrees.d.ts

@@ -115,7 +115,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -155,7 +155,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -195,7 +195,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -235,7 +235,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -275,7 +275,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -315,7 +315,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -355,7 +355,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -395,7 +395,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -435,7 +435,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -475,7 +475,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;
@@ -515,7 +515,7 @@ declare const worktreesContracts: readonly [{
     };
     auth: {
         scopes: string[];
-        allowedPrincipalTypes: ("user" | "service" | "agent")[];
+        allowedPrincipalTypes: ("user" | "service" | "agent" | "group" | "external_viewer")[];
     };
     convex: FunctionConvexTarget | undefined;
     gateway: FunctionGatewayTarget | undefined;

package/dist/function-registry/worktrees.js

@@ -2328,7 +2328,7 @@ var IDENTITY_WHOAMI = {
     description: "Canonical identity summary for the current session",
     fields: {
       principalId: "string \u2014 canonical federated principal identifier",
-      principalType: "string \u2014 human, service, or agent",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
       tenantId: "string | undefined \u2014 resolved tenant scope",
       workspaceId: "string | undefined \u2014 resolved workspace scope",
       scopes: "string[] | undefined \u2014 granted scopes for this session",
@@ -2339,6 +2339,49 @@ var IDENTITY_WHOAMI = {
   ontologyPrimitive: "identity",
   tier: "workhorse"
 };
+var RESOLVE_INTERACTIVE_PRINCIPAL = {
+  name: "resolve_interactive_principal",
+  description: "Read the Permit-backed Lucern principal context for an authenticated Clerk user. Like `git config --get user.email` plus the repository ACL \u2014 resolves the identity alias into the canonical authorization subject.",
+  parameters: {
+    clerkId: {
+      type: "string",
+      description: "Authenticated Clerk subject (`sub`). Clerk proves identity only; it is not the authorization record."
+    },
+    tenantId: {
+      type: "string",
+      description: "Optional tenant scope. Omit only when the Clerk alias is globally unambiguous."
+    },
+    workspaceId: {
+      type: "string",
+      description: "Optional workspace scope. Required when the principal has access to multiple workspaces and no default can be inferred."
+    },
+    providerProjectId: {
+      type: "string",
+      description: "Optional Clerk project or provider instance id for tenants with multiple identity providers."
+    }
+  },
+  required: ["clerkId"],
+  response: {
+    description: "Permit-backed Lucern principal context for tenant SDK bootstrap",
+    fields: {
+      principalId: "string \u2014 canonical Lucern principal identifier",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
+      clerkId: "string \u2014 authenticated Clerk subject alias",
+      tenantId: "string \u2014 resolved tenant scope",
+      workspaceId: "string | null \u2014 resolved workspace scope",
+      roles: "string[] \u2014 effective Permit roles",
+      scopes: "string[] \u2014 effective scopes derived from Permit/control-plane projection",
+      groupIds: "string[] \u2014 active Permit group memberships",
+      principalStatus: "string \u2014 active, invited, suspended, disabled, revoked, or missing",
+      tenantStatus: "string \u2014 projected tenant resource status",
+      workspaceStatus: "string \u2014 projected workspace resource status",
+      permit: "object \u2014 Permit subject, tenant, and optional workspace tuple"
+    }
+  },
+  ownerModule: "control-plane",
+  ontologyPrimitive: "identity",
+  tier: "workhorse"
+};
 var COMPILE_CONTEXT = {
   name: "compile_context",
   description: "Compile a focused reasoning context. If topicId is omitted, Lucern resolves the best topic from the query. Like `git log --graph --decorate` for the reasoning substrate \u2014 returns the canonical Pillar 3 context pack through the public API shape.",
@@ -4241,6 +4284,7 @@ var MCP_TOOL_CONTRACTS = {
   update_worktree_targets: UPDATE_WORKTREE_TARGETS,
   update_worktree_metadata: UPDATE_WORKTREE_METADATA,
   identity_whoami: IDENTITY_WHOAMI,
+  resolve_interactive_principal: RESOLVE_INTERACTIVE_PRINCIPAL,
   compile_context: COMPILE_CONTEXT,
   record_scope_learning: RECORD_SCOPE_LEARNING,
   pipeline_snapshot: PIPELINE_SNAPSHOT,
@@ -4358,6 +4402,7 @@ function entries(names, surfaceClass, surfaceIntent, surfaces, rationale) {
 var MCP_CORE_OPERATION_NAMES = [
   "compile_context",
   "identity_whoami",
+  "resolve_interactive_principal",
   "check_permission",
   "filter_by_permission",
   "create_belief",
@@ -4915,7 +4960,13 @@ function surfaceContract(args) {
       scopes: args.scopes ?? [
         args.kind === "query" ? `${args.domain}.read` : `${args.domain}.write`
       ],
-      allowedPrincipalTypes: ["user", "service", "agent"]
+      allowedPrincipalTypes: [
+        "user",
+        "service",
+        "agent",
+        "group",
+        "external_viewer"
+      ]
     },
     convex: args.convex,
     gateway: args.gateway,