@lucern/contracts 0.3.0-alpha.16 → 0.3.0-alpha.2

package/dist/mcp-gateway-boundary.contract.d.ts

@@ -1,201 +0,0 @@
-import { SessionPrincipalType, SessionAuthMode, SessionDelegationHop } from './auth.contract.js';
-import './convex-admin.contract.js';
-
-/**
- * MCP gateway boundary contract
- *
- * Defines the target thin-client boundary for the Lucern MCP server. MCP is a
- * client of the Lucern gateway, not a privileged Convex or Master Control
- * process. The gateway owns tenant resolution, deploy-key access, policy, and
- * session persistence.
- */
-
-declare const MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION: "2026-04-27";
-declare const MCP_GATEWAY_BOOTSTRAP_ENDPOINT: "/api/platform/v1/mcp/session";
-declare const MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT: "/api/platform/v1/mcp/write-policy/check";
-declare const MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT: "/api/platform/v1/mcp/build-session/begin";
-declare const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT: "/api/platform/v1/mcp/contracts/evaluate-engineering";
-declare const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT: "/api/platform/v1/mcp/contracts/evaluate-research";
-declare const MCP_GATEWAY_ALLOWED_CLIENT_ENV: readonly ["LUCERN_API_KEY", "LUCERN_API_BASE_URL", "LUCERN_ENVIRONMENT", "LUCERN_USER_TOKEN"];
-type McpGatewayAllowedClientEnv = (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];
-declare const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV: readonly ["CONVEX_MC_URL", "CONVEX_MC_DEPLOY_KEY", "MC_CONVEX_URL", "MC_DEPLOY_KEY", "LUCERN_CONVEX_URL", "LUCERN_DEPLOY_KEY", "TENANT_CONVEX_URL", "TENANT_DEPLOY_KEY"];
-type McpGatewayForbiddenClientEnv = (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];
-declare const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS: readonly ["tenant", "session", "permissions"];
-type McpGatewayBootstrapRequiredField = (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];
-type McpGatewayTenantContext = {
-    tenantId: string;
-    slug: string;
-    name: string;
-    tier: string;
-    methodologyPackIds: string[];
-    apiKeyId?: string;
-};
-type McpGatewaySessionContext = {
-    sessionType: "agent" | "user";
-    userId: string;
-    principalId: string;
-    principalType: SessionPrincipalType;
-    workspaceId?: string;
-    authMode: SessionAuthMode;
-    roles: string[];
-    scopes: string[];
-    sessionId?: string;
-    userEmail?: string;
-    expiresAt?: number;
-    delegatedBy?: string;
-    delegationChain?: SessionDelegationHop[];
-    worktreeId?: string;
-};
-type McpGatewayPermissionContext = {
-    allowedTools: string[] | null;
-    allowedTopics: string[] | null;
-    groupIds: string[];
-    permittedPackKeys: string[];
-    permittedToolNames: string[];
-    permittedTools: Array<{
-        toolName: string;
-        requiredRole?: string;
-        approvalGateId?: string;
-        isCore?: boolean;
-        category?: string;
-    }>;
-};
-type McpGatewayBootstrapRequest = {
-    transportKind?: "stdio" | "hosted";
-    sessionId?: string;
-    agentIdentity?: string;
-    workspaceId?: string;
-    worktreeId?: string;
-};
-type McpGatewayWritePolicyCheckRequest = {
-    topicId?: string;
-    role: string;
-    toolName: string;
-};
-type McpGatewayBeginBuildSessionRequest = {
-    worktreeId: string;
-    branch?: string;
-    branchBase?: string;
-    prBase?: string;
-    sessionMode?: string;
-    activateIfPlanning?: boolean;
-};
-type McpGatewayJsonObject = {
-    [key: string]: McpGatewayJsonValue | undefined;
-};
-type McpGatewayJsonArray = McpGatewayJsonValue[];
-type McpGatewayJsonValue = null | boolean | number | string | McpGatewayJsonArray | McpGatewayJsonObject;
-type McpGatewayEvaluateEngineeringContractRequest = {
-    beliefNodeId?: McpGatewayJsonValue;
-    trigger?: McpGatewayJsonValue;
-    testOutput?: McpGatewayJsonValue;
-    tscOutput?: McpGatewayJsonValue;
-    lintOutput?: McpGatewayJsonValue;
-    sentryData?: McpGatewayJsonValue;
-};
-type McpGatewayEvaluateResearchContractRequest = {
-    beliefNodeId?: McpGatewayJsonValue;
-    trigger?: McpGatewayJsonValue;
-    metricData?: McpGatewayJsonValue;
-    referenceCheckData?: McpGatewayJsonValue;
-    marketIndexData?: McpGatewayJsonValue;
-    temporalData?: McpGatewayJsonValue;
-};
-type McpGatewayContractEvaluationResponse = McpGatewayJsonObject;
-type McpGatewayWritePolicyCheckResponse = {
-    allowed: boolean;
-    permission: string;
-    rationale?: string;
-    maxWritesPerSession?: number;
-    toolCategory?: string | null;
-    policy?: McpGatewayJsonObject | null;
-    explanation?: McpGatewayJsonObject;
-    reason: string;
-};
-type McpGatewayBootstrapResponse = {
-    tenant: McpGatewayTenantContext;
-    session: McpGatewaySessionContext;
-    permissions: McpGatewayPermissionContext;
-};
-type McpGatewayBuildSessionBelief = {
-    nodeId: string;
-    text: string;
-    confidence: number | null;
-};
-type McpGatewayBuildSessionQuestion = {
-    nodeId: string;
-    text: string;
-    priority: string;
-};
-type McpGatewayBuildSessionDecision = {
-    question: string;
-    decision: string;
-};
-type McpGatewayBuildSessionTask = {
-    taskId: string;
-    title: string;
-    status: "todo" | "in_progress" | "blocked" | "done";
-    priority: "low" | "medium" | "high" | "urgent";
-    description?: string;
-    taskType?: string;
-    linkedBeliefId?: string;
-    linkedQuestionId?: string;
-    linkedWorktreeId?: string;
-    outputSummary?: string;
-    tags?: string[];
-};
-type McpGatewayBuildSessionWorktreeSummary = {
-    worktreeId: string;
-    title: string;
-    status?: string;
-};
-type McpGatewayBeginBuildSessionResponse = {
-    topicId: string;
-    topicName: string;
-    worktreeId: string;
-    worktreeName: string;
-    branch: string;
-    branchBase: string;
-    prBase: string;
-    campaign: number | null;
-    lane: string;
-    laneOrderInCampaign: number | null;
-    orderInLane: number | null;
-    gate: string;
-    hypothesis: string;
-    focus: string;
-    status: string;
-    sessionMode: string;
-    targetBeliefIds: string[];
-    targetQuestionIds: string[];
-    taskIds: string[];
-    incompleteTaskIds: string[];
-    tasks: McpGatewayBuildSessionTask[];
-    topBeliefs: McpGatewayBuildSessionBelief[];
-    openQuestions: McpGatewayBuildSessionQuestion[];
-    resolvedDecisions: McpGatewayBuildSessionDecision[];
-    exitCriteria: string[];
-    requiredDocs: string[];
-    keyFiles: string[];
-    pillarBeliefs: Array<{
-        pillar: string;
-        text: string;
-        nodeId: string;
-    }>;
-    visionDocs: Array<{
-        path: string;
-        description: string;
-    }>;
-    dependencies: McpGatewayBuildSessionWorktreeSummary[];
-    unblocks: Array<{
-        worktreeId: string;
-        title: string;
-    }>;
-    mergeOrderNotes: string;
-};
-declare const MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS: readonly ["validate_mcp_session", "record_key_usage", "resolve_default_workspace", "resolve_user_context", "create_user_session", "upsert_agent_principal"];
-type McpGatewayOwnedBootstrapOperation = (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS)[number];
-declare const MCP_GATEWAY_CLIENT_ONLY_PACKAGES: readonly ["@lucern/sdk", "@lucern/mcp", "@lucern/contracts"];
-type McpGatewayClientOnlyPackage = (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];
-
-export { MCP_GATEWAY_ALLOWED_CLIENT_ENV, MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS, MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION, MCP_GATEWAY_CLIENT_ONLY_PACKAGES, MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT, MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT, MCP_GATEWAY_FORBIDDEN_CLIENT_ENV, MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS, MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT, type McpGatewayAllowedClientEnv, type McpGatewayBeginBuildSessionRequest, type McpGatewayBeginBuildSessionResponse, type McpGatewayBootstrapRequest, type McpGatewayBootstrapRequiredField, type McpGatewayBootstrapResponse, type McpGatewayBuildSessionBelief, type McpGatewayBuildSessionDecision, type McpGatewayBuildSessionQuestion, type McpGatewayBuildSessionTask, type McpGatewayBuildSessionWorktreeSummary, type McpGatewayClientOnlyPackage, type McpGatewayContractEvaluationResponse, type McpGatewayEvaluateEngineeringContractRequest, type McpGatewayEvaluateResearchContractRequest, type McpGatewayForbiddenClientEnv, type McpGatewayJsonArray, type McpGatewayJsonObject, type McpGatewayJsonValue, type McpGatewayOwnedBootstrapOperation, type McpGatewayPermissionContext, type McpGatewaySessionContext, type McpGatewayTenantContext, type McpGatewayWritePolicyCheckRequest, type McpGatewayWritePolicyCheckResponse };

package/dist/mcp-gateway-boundary.contract.js

@@ -1,45 +0,0 @@
-// src/mcp-gateway-boundary.contract.ts
-var MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION = "2026-04-27";
-var MCP_GATEWAY_BOOTSTRAP_ENDPOINT = "/api/platform/v1/mcp/session";
-var MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT = "/api/platform/v1/mcp/write-policy/check";
-var MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT = "/api/platform/v1/mcp/build-session/begin";
-var MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT = "/api/platform/v1/mcp/contracts/evaluate-engineering";
-var MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT = "/api/platform/v1/mcp/contracts/evaluate-research";
-var MCP_GATEWAY_ALLOWED_CLIENT_ENV = [
-  "LUCERN_API_KEY",
-  "LUCERN_API_BASE_URL",
-  "LUCERN_ENVIRONMENT",
-  "LUCERN_USER_TOKEN"
-];
-var MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [
-  "CONVEX_MC_URL",
-  "CONVEX_MC_DEPLOY_KEY",
-  "MC_CONVEX_URL",
-  "MC_DEPLOY_KEY",
-  "LUCERN_CONVEX_URL",
-  "LUCERN_DEPLOY_KEY",
-  "TENANT_CONVEX_URL",
-  "TENANT_DEPLOY_KEY"
-];
-var MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS = [
-  "tenant",
-  "session",
-  "permissions"
-];
-var MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS = [
-  "validate_mcp_session",
-  "record_key_usage",
-  "resolve_default_workspace",
-  "resolve_user_context",
-  "create_user_session",
-  "upsert_agent_principal"
-];
-var MCP_GATEWAY_CLIENT_ONLY_PACKAGES = [
-  "@lucern/sdk",
-  "@lucern/mcp",
-  "@lucern/contracts"
-];
-
-export { MCP_GATEWAY_ALLOWED_CLIENT_ENV, MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS, MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION, MCP_GATEWAY_CLIENT_ONLY_PACKAGES, MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT, MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT, MCP_GATEWAY_FORBIDDEN_CLIENT_ENV, MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS, MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT };
-//# sourceMappingURL=mcp-gateway-boundary.contract.js.map
-//# sourceMappingURL=mcp-gateway-boundary.contract.js.map

package/dist/mcp-gateway-boundary.contract.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mcp-gateway-boundary.contract.ts"],"names":[],"mappings":";AAeO,IAAM,qCAAA,GAAwC;AAE9C,IAAM,8BAAA,GACX;AAEK,IAAM,uCAAA,GACX;AAEK,IAAM,wCAAA,GACX;AAEK,IAAM,kDAAA,GACX;AAEK,IAAM,+CAAA,GACX;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C,gBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAyMO,IAAM,sCAAA,GAAyC;AAAA,EACpD,sBAAA;AAAA,EACA,kBAAA;AAAA,EACA,2BAAA;AAAA,EACA,sBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,aAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF","file":"mcp-gateway-boundary.contract.js","sourcesContent":["/**\n * MCP gateway boundary contract\n *\n * Defines the target thin-client boundary for the Lucern MCP server. MCP is a\n * client of the Lucern gateway, not a privileged Convex or Master Control\n * process. The gateway owns tenant resolution, deploy-key access, policy, and\n * session persistence.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionDelegationHop,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const MCP_GATEWAY_BOOTSTRAP_ENDPOINT =\n  \"/api/platform/v1/mcp/session\" as const;\n\nexport const MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT =\n  \"/api/platform/v1/mcp/write-policy/check\" as const;\n\nexport const MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT =\n  \"/api/platform/v1/mcp/build-session/begin\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-engineering\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-research\" as const;\n\nexport const MCP_GATEWAY_ALLOWED_CLIENT_ENV = [\n  \"LUCERN_API_KEY\",\n  \"LUCERN_API_BASE_URL\",\n  \"LUCERN_ENVIRONMENT\",\n  \"LUCERN_USER_TOKEN\",\n] as const;\nexport type McpGatewayAllowedClientEnv =\n  (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [\n  \"CONVEX_MC_URL\",\n  \"CONVEX_MC_DEPLOY_KEY\",\n  \"MC_CONVEX_URL\",\n  \"MC_DEPLOY_KEY\",\n  \"LUCERN_CONVEX_URL\",\n  \"LUCERN_DEPLOY_KEY\",\n  \"TENANT_CONVEX_URL\",\n  \"TENANT_DEPLOY_KEY\",\n] as const;\nexport type McpGatewayForbiddenClientEnv =\n  (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS = [\n  \"tenant\",\n  \"session\",\n  \"permissions\",\n] as const;\nexport type McpGatewayBootstrapRequiredField =\n  (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];\n\nexport type McpGatewayTenantContext = {\n  tenantId: string;\n  slug: string;\n  name: string;\n  tier: string;\n  methodologyPackIds: string[];\n  apiKeyId?: string;\n};\n\nexport type McpGatewaySessionContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  workspaceId?: string;\n  authMode: SessionAuthMode;\n  roles: string[];\n  scopes: string[];\n  sessionId?: string;\n  userEmail?: string;\n  expiresAt?: number;\n  delegatedBy?: string;\n  delegationChain?: SessionDelegationHop[];\n  worktreeId?: string;\n};\n\nexport type McpGatewayPermissionContext = {\n  allowedTools: string[] | null;\n  allowedTopics: string[] | null;\n  groupIds: string[];\n  permittedPackKeys: string[];\n  permittedToolNames: string[];\n  permittedTools: Array<{\n    toolName: string;\n    requiredRole?: string;\n    approvalGateId?: string;\n    isCore?: boolean;\n    category?: string;\n  }>;\n};\n\nexport type McpGatewayBootstrapRequest = {\n  transportKind?: \"stdio\" | \"hosted\";\n  sessionId?: string;\n  agentIdentity?: string;\n  workspaceId?: string;\n  worktreeId?: string;\n};\n\nexport type McpGatewayWritePolicyCheckRequest = {\n  topicId?: string;\n  role: string;\n  toolName: string;\n};\n\nexport type McpGatewayBeginBuildSessionRequest = {\n  worktreeId: string;\n  branch?: string;\n  branchBase?: string;\n  prBase?: string;\n  sessionMode?: string;\n  activateIfPlanning?: boolean;\n};\n\nexport type McpGatewayJsonObject = {\n  [key: string]: McpGatewayJsonValue | undefined;\n};\n\nexport type McpGatewayJsonArray = McpGatewayJsonValue[];\n\nexport type McpGatewayJsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | McpGatewayJsonArray\n  | McpGatewayJsonObject;\n\nexport type McpGatewayEvaluateEngineeringContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  testOutput?: McpGatewayJsonValue;\n  tscOutput?: McpGatewayJsonValue;\n  lintOutput?: McpGatewayJsonValue;\n  sentryData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayEvaluateResearchContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  metricData?: McpGatewayJsonValue;\n  referenceCheckData?: McpGatewayJsonValue;\n  marketIndexData?: McpGatewayJsonValue;\n  temporalData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayContractEvaluationResponse = McpGatewayJsonObject;\n\nexport type McpGatewayWritePolicyCheckResponse = {\n  allowed: boolean;\n  permission: string;\n  rationale?: string;\n  maxWritesPerSession?: number;\n  toolCategory?: string | null;\n  policy?: McpGatewayJsonObject | null;\n  explanation?: McpGatewayJsonObject;\n  reason: string;\n};\n\nexport type McpGatewayBootstrapResponse = {\n  tenant: McpGatewayTenantContext;\n  session: McpGatewaySessionContext;\n  permissions: McpGatewayPermissionContext;\n};\n\nexport type McpGatewayBuildSessionBelief = {\n  nodeId: string;\n  text: string;\n  confidence: number | null;\n};\n\nexport type McpGatewayBuildSessionQuestion = {\n  nodeId: string;\n  text: string;\n  priority: string;\n};\n\nexport type McpGatewayBuildSessionDecision = {\n  question: string;\n  decision: string;\n};\n\nexport type McpGatewayBuildSessionTask = {\n  taskId: string;\n  title: string;\n  status: \"todo\" | \"in_progress\" | \"blocked\" | \"done\";\n  priority: \"low\" | \"medium\" | \"high\" | \"urgent\";\n  description?: string;\n  taskType?: string;\n  linkedBeliefId?: string;\n  linkedQuestionId?: string;\n  linkedWorktreeId?: string;\n  outputSummary?: string;\n  tags?: string[];\n};\n\nexport type McpGatewayBuildSessionWorktreeSummary = {\n  worktreeId: string;\n  title: string;\n  status?: string;\n};\n\nexport type McpGatewayBeginBuildSessionResponse = {\n  topicId: string;\n  topicName: string;\n  worktreeId: string;\n  worktreeName: string;\n  branch: string;\n  branchBase: string;\n  prBase: string;\n  campaign: number | null;\n  lane: string;\n  laneOrderInCampaign: number | null;\n  orderInLane: number | null;\n  gate: string;\n  hypothesis: string;\n  focus: string;\n  status: string;\n  sessionMode: string;\n  targetBeliefIds: string[];\n  targetQuestionIds: string[];\n  taskIds: string[];\n  incompleteTaskIds: string[];\n  tasks: McpGatewayBuildSessionTask[];\n  topBeliefs: McpGatewayBuildSessionBelief[];\n  openQuestions: McpGatewayBuildSessionQuestion[];\n  resolvedDecisions: McpGatewayBuildSessionDecision[];\n  exitCriteria: string[];\n  requiredDocs: string[];\n  keyFiles: string[];\n  pillarBeliefs: Array<{\n    pillar: string;\n    text: string;\n    nodeId: string;\n  }>;\n  visionDocs: Array<{\n    path: string;\n    description: string;\n  }>;\n  dependencies: McpGatewayBuildSessionWorktreeSummary[];\n  unblocks: Array<{\n    worktreeId: string;\n    title: string;\n  }>;\n  mergeOrderNotes: string;\n};\n\nexport const MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS = [\n  \"validate_mcp_session\",\n  \"record_key_usage\",\n  \"resolve_default_workspace\",\n  \"resolve_user_context\",\n  \"create_user_session\",\n  \"upsert_agent_principal\",\n] as const;\nexport type McpGatewayOwnedBootstrapOperation =\n  (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS)[number];\n\nexport const MCP_GATEWAY_CLIENT_ONLY_PACKAGES = [\n  \"@lucern/sdk\",\n  \"@lucern/mcp\",\n  \"@lucern/contracts\",\n] as const;\nexport type McpGatewayClientOnlyPackage =\n  (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];\n"]}

package/dist/permit-principal-projection.contract.d.ts

@@ -1,74 +0,0 @@
-type PermitProjectionPlatformRole = "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
-type PermitPrincipalProjection = Record<string, unknown> & {
-    principalId?: string;
-    tenantId?: string;
-    workspaceId?: string;
-    principalType?: string;
-    status?: string;
-    displayName?: string;
-    metadata?: Record<string, unknown>;
-    createdAt?: number;
-    updatedAt?: number;
-    lastSeenAt?: number;
-};
-type PermitAliasProjection = Record<string, unknown> & {
-    principalId?: string;
-    tenantId?: string;
-    workspaceId?: string;
-    provider?: string;
-    providerSubjectId?: string;
-    alias?: string;
-    aliasKind?: string;
-    status?: string;
-    metadata?: Record<string, unknown>;
-};
-type PermitRoleAssignmentProjection = Record<string, unknown> & {
-    tenantId?: string;
-    workspaceId?: string;
-    role?: string;
-    targetType?: string;
-    targetId?: string;
-    resourceType?: string;
-    resourceKey?: string;
-    status?: string;
-};
-type PermitGroupMembershipProjection = Record<string, unknown> & {
-    tenantId?: string;
-    workspaceId?: string;
-    groupId?: string;
-    memberType?: string;
-    memberId?: string;
-    principalId?: string;
-    status?: string;
-};
-type PermitProjectedUserRecord = {
-    clerkId: string;
-    email: string;
-    name?: string;
-    lastSeenAt: number;
-    chatCount: number;
-    messageCount: number;
-    mcRole: PermitProjectionPlatformRole;
-    mcRoleSyncedAt: number;
-    defaultTenantId: string;
-    defaultWorkspaceId: string;
-    defaultPrincipalId: string;
-    principalGroupIds: string[];
-    governanceGrantsSyncedAt: number;
-    createdAt: number;
-    updatedAt: number;
-};
-type PermitProjectionRows = {
-    principals: PermitPrincipalProjection[];
-    aliases: PermitAliasProjection[];
-    roleAssignments: PermitRoleAssignmentProjection[];
-    groupMemberships: PermitGroupMembershipProjection[];
-};
-declare function readPermitProjectionString(value: unknown): string | undefined;
-declare function isActivePermitProjectionStatus(value: unknown): boolean;
-declare function mapPermitRoleToPlatformRole(role: unknown): PermitProjectionPlatformRole | undefined;
-declare function buildProjectedUserFromPermitPrincipal(rows: PermitProjectionRows, principal: PermitPrincipalProjection, matchingAlias?: PermitAliasProjection, now?: number): PermitProjectedUserRecord | null;
-declare function findProjectedUserByPermitPrincipalId(rows: PermitProjectionRows, principalId: string, now?: number): PermitProjectedUserRecord | null;
-declare function findProjectedUserByPermitClerkId(rows: PermitProjectionRows, clerkId: string, now?: number): PermitProjectedUserRecord | null;
-
-export { type PermitAliasProjection, type PermitGroupMembershipProjection, type PermitPrincipalProjection, type PermitProjectedUserRecord, type PermitProjectionPlatformRole, type PermitProjectionRows, type PermitRoleAssignmentProjection, buildProjectedUserFromPermitPrincipal, findProjectedUserByPermitClerkId, findProjectedUserByPermitPrincipalId, isActivePermitProjectionStatus, mapPermitRoleToPlatformRole, readPermitProjectionString };

package/dist/permit-principal-projection.contract.js

@@ -1,160 +0,0 @@
-// src/permit-principal-projection.contract.ts
-var PLATFORM_ROLE_PRIORITY = {
-  platform_admin: 70,
-  tenant_admin: 60,
-  workspace_admin: 50,
-  editor: 40,
-  auditor: 30,
-  viewer: 20,
-  service_agent: 10
-};
-function readPermitProjectionString(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
-function isActivePermitProjectionStatus(value) {
-  const status = readPermitProjectionString(value)?.toLowerCase();
-  return !status || status === "active" || status === "synced";
-}
-function mapPermitRoleToPlatformRole(role) {
-  switch (readPermitProjectionString(role)?.toLowerCase()) {
-    case "platform_admin":
-      return "platform_admin";
-    case "tenant_admin":
-      return "tenant_admin";
-    case "workspace_admin":
-    case "deployment_admin":
-    case "graph_admin":
-      return "workspace_admin";
-    case "editor":
-    case "workspace_member":
-    case "graph_editor":
-    case "evidence_contributor":
-    case "question_resolver":
-    case "theme_promoter":
-    case "topic_promoter":
-      return "editor";
-    case "auditor":
-      return "auditor";
-    case "viewer":
-    case "graph_viewer":
-    case "stakeholder_viewer":
-    case "stakeholder_summarizer":
-    case "source_drilldown_viewer":
-    case "restricted_data_viewer":
-    case "proprietary_data_viewer":
-      return "viewer";
-    case "service_agent":
-    case "agent_runner":
-      return "service_agent";
-    default:
-      return void 0;
-  }
-}
-function highestPlatformRole(roles) {
-  return roles.reduce(
-    (best, role) => PLATFORM_ROLE_PRIORITY[role] > PLATFORM_ROLE_PRIORITY[best] ? role : best,
-    "viewer"
-  );
-}
-function isClerkAliasFor(alias, clerkId) {
-  return isActivePermitProjectionStatus(alias.status) && readPermitProjectionString(alias.provider)?.toLowerCase() === "clerk" && (readPermitProjectionString(alias.providerSubjectId) === clerkId || readPermitProjectionString(alias.alias) === clerkId);
-}
-function emailFromAlias(aliases, principal) {
-  return aliases.find(
-    (alias) => readPermitProjectionString(alias.aliasKind)?.toLowerCase() === "email"
-  )?.alias ?? readPermitProjectionString(principal.metadata?.email);
-}
-function groupIdsForPrincipal(memberships, principal) {
-  const principalId = readPermitProjectionString(principal.principalId);
-  if (!principalId) return [];
-  return [
-    ...new Set(
-      memberships.filter(
-        (membership) => isActivePermitProjectionStatus(membership.status) && readPermitProjectionString(membership.tenantId) === readPermitProjectionString(principal.tenantId) && readPermitProjectionString(membership.memberType) === "principal" && (readPermitProjectionString(membership.memberId) === principalId || readPermitProjectionString(membership.principalId) === principalId)
-      ).map((membership) => readPermitProjectionString(membership.groupId)).filter((groupId) => Boolean(groupId))
-    )
-  ];
-}
-function rolesForPrincipal(assignments, principal, groupIds) {
-  const principalId = readPermitProjectionString(principal.principalId);
-  const tenantId = readPermitProjectionString(principal.tenantId);
-  const roles = assignments.filter(
-    (assignment) => isActivePermitProjectionStatus(assignment.status) && readPermitProjectionString(assignment.tenantId) === tenantId && (readPermitProjectionString(assignment.targetType) === "principal" && readPermitProjectionString(assignment.targetId) === principalId || readPermitProjectionString(assignment.targetType) === "group" && groupIds.includes(
-      readPermitProjectionString(assignment.targetId) ?? ""
-    ))
-  ).map((assignment) => mapPermitRoleToPlatformRole(assignment.role)).filter((role) => Boolean(role));
-  if (readPermitProjectionString(principal.principalType) === "agent" || readPermitProjectionString(principal.principalType) === "service_principal") {
-    roles.push("service_agent");
-  }
-  return [...new Set(roles)];
-}
-function workspaceFromPermitProjection(principal, alias, assignments) {
-  return readPermitProjectionString(principal.workspaceId) ?? readPermitProjectionString(alias?.workspaceId) ?? readPermitProjectionString(
-    assignments.find(
-      (assignment) => readPermitProjectionString(assignment.targetId) === readPermitProjectionString(principal.principalId) && readPermitProjectionString(assignment.resourceType) === "workspace"
-    )?.resourceKey
-  ) ?? readPermitProjectionString(
-    assignments.find((assignment) => assignment.workspaceId)?.workspaceId
-  );
-}
-function buildProjectedUserFromPermitPrincipal(rows, principal, matchingAlias, now = Date.now()) {
-  const principalId = readPermitProjectionString(principal.principalId);
-  const tenantId = readPermitProjectionString(principal.tenantId);
-  if (!principalId || !tenantId || !isActivePermitProjectionStatus(principal.status)) {
-    return null;
-  }
-  const aliases = rows.aliases.filter(
-    (alias2) => readPermitProjectionString(alias2.tenantId) === tenantId && readPermitProjectionString(alias2.principalId) === principalId && isActivePermitProjectionStatus(alias2.status)
-  );
-  const groupIds = groupIdsForPrincipal(rows.groupMemberships, principal);
-  const roles = rolesForPrincipal(rows.roleAssignments, principal, groupIds);
-  if (roles.length === 0) {
-    return null;
-  }
-  const alias = matchingAlias ?? aliases[0];
-  const clerkId = readPermitProjectionString(
-    aliases.find(
-      (entry) => readPermitProjectionString(entry.provider)?.toLowerCase() === "clerk"
-    )?.providerSubjectId
-  ) ?? principalId;
-  return {
-    clerkId,
-    email: emailFromAlias(aliases, principal) ?? `${principalId}@permit.local`,
-    name: readPermitProjectionString(principal.displayName),
-    lastSeenAt: principal.lastSeenAt ?? principal.updatedAt ?? now,
-    chatCount: 0,
-    messageCount: 0,
-    mcRole: highestPlatformRole(roles),
-    mcRoleSyncedAt: principal.updatedAt ?? now,
-    defaultTenantId: tenantId,
-    defaultWorkspaceId: workspaceFromPermitProjection(principal, alias, rows.roleAssignments) ?? tenantId,
-    defaultPrincipalId: principalId,
-    principalGroupIds: groupIds,
-    governanceGrantsSyncedAt: principal.updatedAt ?? now,
-    createdAt: principal.createdAt ?? now,
-    updatedAt: principal.updatedAt ?? now
-  };
-}
-function findProjectedUserByPermitPrincipalId(rows, principalId, now = Date.now()) {
-  const normalizedPrincipalId = principalId.trim();
-  const principal = rows.principals.find(
-    (row) => isActivePermitProjectionStatus(row.status) && readPermitProjectionString(row.principalId) === normalizedPrincipalId
-  );
-  return principal ? buildProjectedUserFromPermitPrincipal(rows, principal, void 0, now) : null;
-}
-function findProjectedUserByPermitClerkId(rows, clerkId, now = Date.now()) {
-  const normalizedClerkId = clerkId.trim();
-  const matchingAlias = rows.aliases.find(
-    (alias) => isClerkAliasFor(alias, normalizedClerkId)
-  );
-  const principal = matchingAlias ? rows.principals.find(
-    (row) => readPermitProjectionString(row.tenantId) === readPermitProjectionString(matchingAlias.tenantId) && readPermitProjectionString(row.principalId) === readPermitProjectionString(matchingAlias.principalId)
-  ) : rows.principals.find(
-    (row) => readPermitProjectionString(row.principalId) === normalizedClerkId || readPermitProjectionString(row.principalId) === `user:${normalizedClerkId}`
-  );
-  return principal ? buildProjectedUserFromPermitPrincipal(rows, principal, matchingAlias, now) : null;
-}
-
-export { buildProjectedUserFromPermitPrincipal, findProjectedUserByPermitClerkId, findProjectedUserByPermitPrincipalId, isActivePermitProjectionStatus, mapPermitRoleToPlatformRole, readPermitProjectionString };
-//# sourceMappingURL=permit-principal-projection.contract.js.map
-//# sourceMappingURL=permit-principal-projection.contract.js.map

package/dist/permit-principal-projection.contract.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/permit-principal-projection.contract.ts"],"names":["alias"],"mappings":";AAgFA,IAAM,sBAAA,GAAuE;AAAA,EAC3E,cAAA,EAAgB,EAAA;AAAA,EAChB,YAAA,EAAc,EAAA;AAAA,EACd,eAAA,EAAiB,EAAA;AAAA,EACjB,MAAA,EAAQ,EAAA;AAAA,EACR,OAAA,EAAS,EAAA;AAAA,EACT,MAAA,EAAQ,EAAA;AAAA,EACR,aAAA,EAAe;AACjB,CAAA;AAEO,SAAS,2BAA2B,KAAA,EAAoC;AAC7E,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,CAAM,MAAK,GAAI,KAAA,CAAM,MAAK,GAAI,MAAA;AACpE;AAEO,SAAS,+BAA+B,KAAA,EAAyB;AACtE,EAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,KAAK,CAAA,EAAG,WAAA,EAAY;AAC9D,EAAA,OAAO,CAAC,MAAA,IAAU,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,QAAA;AACtD;AAEO,SAAS,4BACd,IAAA,EAC0C;AAC1C,EAAA,QAAQ,0BAAA,CAA2B,IAAI,CAAA,EAAG,WAAA,EAAY;AAAG,IACvD,KAAK,gBAAA;AACH,MAAA,OAAO,gBAAA;AAAA,IACT,KAAK,cAAA;AACH,MAAA,OAAO,cAAA;AAAA,IACT,KAAK,iBAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,OAAO,iBAAA;AAAA,IACT,KAAK,QAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,cAAA;AAAA,IACL,KAAK,sBAAA;AAAA,IACL,KAAK,mBAAA;AAAA,IACL,KAAK,gBAAA;AAAA,IACL,KAAK,gBAAA;AACH,MAAA,OAAO,QAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,SAAA;AAAA,IACT,KAAK,QAAA;AAAA,IACL,KAAK,cAAA;AAAA,IACL,KAAK,oBAAA;AAAA,IACL,KAAK,wBAAA;AAAA,IACL,KAAK,yBAAA;AAAA,IACL,KAAK,wBAAA;AAAA,IACL,KAAK,yBAAA;AACH,MAAA,OAAO,QAAA;AAAA,IACT,KAAK,eAAA;AAAA,IACL,KAAK,cAAA;AACH,MAAA,OAAO,eAAA;AAAA,IACT;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEA,SAAS,oBACP,KAAA,EAC8B;AAC9B,EAAA,OAAO,KAAA,CAAM,MAAA;AAAA,IACX,CAAC,MAAM,IAAA,KACL,sBAAA,CAAuB,IAAI,CAAA,GAAI,sBAAA,CAAuB,IAAI,CAAA,GAAI,IAAA,GAAO,IAAA;AAAA,IACvE;AAAA,GACF;AACF;AAEA,SAAS,eAAA,CACP,OACA,OAAA,EACS;AACT,EAAA,OACE,+BAA+B,KAAA,CAAM,MAAM,KAC3C,0BAAA,CAA2B,KAAA,CAAM,QAAQ,CAAA,EAAG,WAAA,OAAkB,OAAA,KAC7D,0BAAA,CAA2B,MAAM,iBAAiB,CAAA,KAAM,WACvD,0BAAA,CAA2B,KAAA,CAAM,KAAK,CAAA,KAAM,OAAA,CAAA;AAElD;AAEA,SAAS,cAAA,CACP,SACA,SAAA,EACoB;AACpB,EAAA,OACE,OAAA,CAAQ,IAAA;AAAA,IACN,CAAC,KAAA,KACC,0BAAA,CAA2B,MAAM,SAAS,CAAA,EAAG,aAAY,KAAM;AAAA,GACnE,EAAG,KAAA,IAAS,0BAAA,CAA2B,SAAA,CAAU,UAAU,KAAK,CAAA;AAEpE;AAEA,SAAS,oBAAA,CACP,aACA,SAAA,EACU;AACV,EAAA,MAAM,WAAA,GAAc,0BAAA,CAA2B,SAAA,CAAU,WAAW,CAAA;AACpE,EAAA,IAAI,CAAC,WAAA,EAAa,OAAO,EAAC;AAC1B,EAAA,OAAO;AAAA,IACL,GAAG,IAAI,GAAA;AAAA,MACL,WAAA,CACG,MAAA;AAAA,QACC,CAAC,UAAA,KACC,8BAAA,CAA+B,UAAA,CAAW,MAAM,CAAA,IAChD,0BAAA,CAA2B,UAAA,CAAW,QAAQ,CAAA,KAC5C,0BAAA,CAA2B,SAAA,CAAU,QAAQ,CAAA,IAC/C,0BAAA,CAA2B,UAAA,CAAW,UAAU,CAAA,KAAM,WAAA,KACrD,0BAAA,CAA2B,UAAA,CAAW,QAAQ,CAAA,KAAM,WAAA,IACnD,0BAAA,CAA2B,UAAA,CAAW,WAAW,CAAA,KAC/C,WAAA;AAAA,OACR,CACC,GAAA,CAAI,CAAC,UAAA,KAAe,2BAA2B,UAAA,CAAW,OAAO,CAAC,CAAA,CAClE,MAAA,CAAO,CAAC,OAAA,KAA+B,OAAA,CAAQ,OAAO,CAAC;AAAA;AAC5D,GACF;AACF;AAEA,SAAS,iBAAA,CACP,WAAA,EACA,SAAA,EACA,QAAA,EACgC;AAChC,EAAA,MAAM,WAAA,GAAc,0BAAA,CAA2B,SAAA,CAAU,WAAW,CAAA;AACpE,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,SAAA,CAAU,QAAQ,CAAA;AAC9D,EAAA,MAAM,QAAQ,WAAA,CACX,MAAA;AAAA,IACC,CAAC,UAAA,KACC,8BAAA,CAA+B,UAAA,CAAW,MAAM,CAAA,IAChD,0BAAA,CAA2B,UAAA,CAAW,QAAQ,CAAA,KAAM,QAAA,KAClD,0BAAA,CAA2B,UAAA,CAAW,UAAU,CAAA,KAAM,WAAA,IACtD,0BAAA,CAA2B,UAAA,CAAW,QAAQ,CAAA,KAAM,WAAA,IACnD,0BAAA,CAA2B,UAAA,CAAW,UAAU,CAAA,KAAM,OAAA,IACrD,QAAA,CAAS,QAAA;AAAA,MACP,0BAAA,CAA2B,UAAA,CAAW,QAAQ,CAAA,IAAK;AAAA,KACrD;AAAA,GACR,CACC,GAAA,CAAI,CAAC,UAAA,KAAe,4BAA4B,UAAA,CAAW,IAAI,CAAC,CAAA,CAChE,MAAA,CAAO,CAAC,IAAA,KAA+C,OAAA,CAAQ,IAAI,CAAC,CAAA;AAEvE,EAAA,IACE,0BAAA,CAA2B,UAAU,aAAa,CAAA,KAAM,WACxD,0BAAA,CAA2B,SAAA,CAAU,aAAa,CAAA,KAAM,mBAAA,EACxD;AACA,IAAA,KAAA,CAAM,KAAK,eAAe,CAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,CAAC,CAAA;AAC3B;AAEA,SAAS,6BAAA,CACP,SAAA,EACA,KAAA,EACA,WAAA,EACoB;AACpB,EAAA,OACE,2BAA2B,SAAA,CAAU,WAAW,KAChD,0BAAA,CAA2B,KAAA,EAAO,WAAW,CAAA,IAC7C,0BAAA;AAAA,IACE,WAAA,CAAY,IAAA;AAAA,MACV,CAAC,UAAA,KACC,0BAAA,CAA2B,UAAA,CAAW,QAAQ,CAAA,KAC5C,0BAAA,CAA2B,SAAA,CAAU,WAAW,CAAA,IAClD,0BAAA,CAA2B,UAAA,CAAW,YAAY,CAAA,KAAM;AAAA,KAC5D,EAAG;AAAA,GACL,IACA,0BAAA;AAAA,IACE,YAAY,IAAA,CAAK,CAAC,UAAA,KAAe,UAAA,CAAW,WAAW,CAAA,EAAG;AAAA,GAC5D;AAEJ;AAEO,SAAS,sCACd,IAAA,EACA,SAAA,EACA,eACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACmB;AAClC,EAAA,MAAM,WAAA,GAAc,0BAAA,CAA2B,SAAA,CAAU,WAAW,CAAA;AACpE,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,SAAA,CAAU,QAAQ,CAAA;AAC9D,EAAA,IACE,CAAC,eACD,CAAC,QAAA,IACD,CAAC,8BAAA,CAA+B,SAAA,CAAU,MAAM,CAAA,EAChD;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,KAAK,OAAA,CAAQ,MAAA;AAAA,IAC3B,CAACA,MAAAA,KACC,0BAAA,CAA2BA,MAAAA,CAAM,QAAQ,CAAA,KAAM,QAAA,IAC/C,0BAAA,CAA2BA,MAAAA,CAAM,WAAW,CAAA,KAAM,WAAA,IAClD,8BAAA,CAA+BA,OAAM,MAAM;AAAA,GAC/C;AACA,EAAA,MAAM,QAAA,GAAW,oBAAA,CAAqB,IAAA,CAAK,gBAAA,EAAkB,SAAS,CAAA;AACtE,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,CAAK,eAAA,EAAiB,WAAW,QAAQ,CAAA;AACzE,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,aAAA,IAAiB,OAAA,CAAQ,CAAC,CAAA;AACxC,EAAA,MAAM,OAAA,GACJ,0BAAA;AAAA,IACE,OAAA,CAAQ,IAAA;AAAA,MACN,CAAC,KAAA,KACC,0BAAA,CAA2B,MAAM,QAAQ,CAAA,EAAG,aAAY,KAAM;AAAA,KAClE,EAAG;AAAA,GACL,IAAK,WAAA;AAEP,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,OAAO,cAAA,CAAe,OAAA,EAAS,SAAS,CAAA,IAAK,GAAG,WAAW,CAAA,aAAA,CAAA;AAAA,IAC3D,IAAA,EAAM,0BAAA,CAA2B,SAAA,CAAU,WAAW,CAAA;AAAA,IACtD,UAAA,EAAY,SAAA,CAAU,UAAA,IAAc,SAAA,CAAU,SAAA,IAAa,GAAA;AAAA,IAC3D,SAAA,EAAW,CAAA;AAAA,IACX,YAAA,EAAc,CAAA;AAAA,IACd,MAAA,EAAQ,oBAAoB,KAAK,CAAA;AAAA,IACjC,cAAA,EAAgB,UAAU,SAAA,IAAa,GAAA;AAAA,IACvC,eAAA,EAAiB,QAAA;AAAA,IACjB,oBACE,6BAAA,CAA8B,SAAA,EAAW,KAAA,EAAO,IAAA,CAAK,eAAe,CAAA,IACpE,QAAA;AAAA,IACF,kBAAA,EAAoB,WAAA;AAAA,IACpB,iBAAA,EAAmB,QAAA;AAAA,IACnB,wBAAA,EAA0B,UAAU,SAAA,IAAa,GAAA;AAAA,IACjD,SAAA,EAAW,UAAU,SAAA,IAAa,GAAA;AAAA,IAClC,SAAA,EAAW,UAAU,SAAA,IAAa;AAAA,GACpC;AACF;AAEO,SAAS,qCACd,IAAA,EACA,WAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACmB;AAClC,EAAA,MAAM,qBAAA,GAAwB,YAAY,IAAA,EAAK;AAC/C,EAAA,MAAM,SAAA,GAAY,KAAK,UAAA,CAAW,IAAA;AAAA,IAChC,CAAC,QACC,8BAAA,CAA+B,GAAA,CAAI,MAAM,CAAA,IACzC,0BAAA,CAA2B,GAAA,CAAI,WAAW,CAAA,KAAM;AAAA,GACpD;AACA,EAAA,OAAO,YACH,qCAAA,CAAsC,IAAA,EAAM,SAAA,EAAW,MAAA,EAAW,GAAG,CAAA,GACrE,IAAA;AACN;AAEO,SAAS,iCACd,IAAA,EACA,OAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACmB;AAClC,EAAA,MAAM,iBAAA,GAAoB,QAAQ,IAAA,EAAK;AACvC,EAAA,MAAM,aAAA,GAAgB,KAAK,OAAA,CAAQ,IAAA;AAAA,IAAK,CAAC,KAAA,KACvC,eAAA,CAAgB,KAAA,EAAO,iBAAiB;AAAA,GAC1C;AACA,EAAA,MAAM,SAAA,GAAY,aAAA,GACd,IAAA,CAAK,UAAA,CAAW,IAAA;AAAA,IACd,CAAC,GAAA,KACC,0BAAA,CAA2B,GAAA,CAAI,QAAQ,MACrC,0BAAA,CAA2B,aAAA,CAAc,QAAQ,CAAA,IACnD,2BAA2B,GAAA,CAAI,WAAW,CAAA,KACxC,0BAAA,CAA2B,cAAc,WAAW;AAAA,GAC1D,GACA,KAAK,UAAA,CAAW,IAAA;AAAA,IACd,CAAC,GAAA,KACC,0BAAA,CAA2B,GAAA,CAAI,WAAW,CAAA,KAAM,iBAAA,IAChD,0BAAA,CAA2B,GAAA,CAAI,WAAW,CAAA,KACxC,CAAA,KAAA,EAAQ,iBAAiB,CAAA;AAAA,GAC/B;AACJ,EAAA,OAAO,YACH,qCAAA,CAAsC,IAAA,EAAM,SAAA,EAAW,aAAA,EAAe,GAAG,CAAA,GACzE,IAAA;AACN","file":"permit-principal-projection.contract.js","sourcesContent":["export type PermitProjectionPlatformRole =\n  | \"platform_admin\"\n  | \"tenant_admin\"\n  | \"workspace_admin\"\n  | \"editor\"\n  | \"viewer\"\n  | \"auditor\"\n  | \"service_agent\";\n\nexport type PermitPrincipalProjection = Record<string, unknown> & {\n  principalId?: string;\n  tenantId?: string;\n  workspaceId?: string;\n  principalType?: string;\n  status?: string;\n  displayName?: string;\n  metadata?: Record<string, unknown>;\n  createdAt?: number;\n  updatedAt?: number;\n  lastSeenAt?: number;\n};\n\nexport type PermitAliasProjection = Record<string, unknown> & {\n  principalId?: string;\n  tenantId?: string;\n  workspaceId?: string;\n  provider?: string;\n  providerSubjectId?: string;\n  alias?: string;\n  aliasKind?: string;\n  status?: string;\n  metadata?: Record<string, unknown>;\n};\n\nexport type PermitRoleAssignmentProjection = Record<string, unknown> & {\n  tenantId?: string;\n  workspaceId?: string;\n  role?: string;\n  targetType?: string;\n  targetId?: string;\n  resourceType?: string;\n  resourceKey?: string;\n  status?: string;\n};\n\nexport type PermitGroupMembershipProjection = Record<string, unknown> & {\n  tenantId?: string;\n  workspaceId?: string;\n  groupId?: string;\n  memberType?: string;\n  memberId?: string;\n  principalId?: string;\n  status?: string;\n};\n\nexport type PermitProjectedUserRecord = {\n  clerkId: string;\n  email: string;\n  name?: string;\n  lastSeenAt: number;\n  chatCount: number;\n  messageCount: number;\n  mcRole: PermitProjectionPlatformRole;\n  mcRoleSyncedAt: number;\n  defaultTenantId: string;\n  defaultWorkspaceId: string;\n  defaultPrincipalId: string;\n  principalGroupIds: string[];\n  governanceGrantsSyncedAt: number;\n  createdAt: number;\n  updatedAt: number;\n};\n\nexport type PermitProjectionRows = {\n  principals: PermitPrincipalProjection[];\n  aliases: PermitAliasProjection[];\n  roleAssignments: PermitRoleAssignmentProjection[];\n  groupMemberships: PermitGroupMembershipProjection[];\n};\n\nconst PLATFORM_ROLE_PRIORITY: Record<PermitProjectionPlatformRole, number> = {\n  platform_admin: 70,\n  tenant_admin: 60,\n  workspace_admin: 50,\n  editor: 40,\n  auditor: 30,\n  viewer: 20,\n  service_agent: 10,\n};\n\nexport function readPermitProjectionString(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nexport function isActivePermitProjectionStatus(value: unknown): boolean {\n  const status = readPermitProjectionString(value)?.toLowerCase();\n  return !status || status === \"active\" || status === \"synced\";\n}\n\nexport function mapPermitRoleToPlatformRole(\n  role: unknown,\n): PermitProjectionPlatformRole | undefined {\n  switch (readPermitProjectionString(role)?.toLowerCase()) {\n    case \"platform_admin\":\n      return \"platform_admin\";\n    case \"tenant_admin\":\n      return \"tenant_admin\";\n    case \"workspace_admin\":\n    case \"deployment_admin\":\n    case \"graph_admin\":\n      return \"workspace_admin\";\n    case \"editor\":\n    case \"workspace_member\":\n    case \"graph_editor\":\n    case \"evidence_contributor\":\n    case \"question_resolver\":\n    case \"theme_promoter\":\n    case \"topic_promoter\":\n      return \"editor\";\n    case \"auditor\":\n      return \"auditor\";\n    case \"viewer\":\n    case \"graph_viewer\":\n    case \"stakeholder_viewer\":\n    case \"stakeholder_summarizer\":\n    case \"source_drilldown_viewer\":\n    case \"restricted_data_viewer\":\n    case \"proprietary_data_viewer\":\n      return \"viewer\";\n    case \"service_agent\":\n    case \"agent_runner\":\n      return \"service_agent\";\n    default:\n      return undefined;\n  }\n}\n\nfunction highestPlatformRole(\n  roles: PermitProjectionPlatformRole[],\n): PermitProjectionPlatformRole {\n  return roles.reduce<PermitProjectionPlatformRole>(\n    (best, role) =>\n      PLATFORM_ROLE_PRIORITY[role] > PLATFORM_ROLE_PRIORITY[best] ? role : best,\n    \"viewer\",\n  );\n}\n\nfunction isClerkAliasFor(\n  alias: PermitAliasProjection,\n  clerkId: string,\n): boolean {\n  return (\n    isActivePermitProjectionStatus(alias.status) &&\n    readPermitProjectionString(alias.provider)?.toLowerCase() === \"clerk\" &&\n    (readPermitProjectionString(alias.providerSubjectId) === clerkId ||\n      readPermitProjectionString(alias.alias) === clerkId)\n  );\n}\n\nfunction emailFromAlias(\n  aliases: PermitAliasProjection[],\n  principal: PermitPrincipalProjection,\n): string | undefined {\n  return (\n    aliases.find(\n      (alias) =>\n        readPermitProjectionString(alias.aliasKind)?.toLowerCase() === \"email\",\n    )?.alias ?? readPermitProjectionString(principal.metadata?.email)\n  );\n}\n\nfunction groupIdsForPrincipal(\n  memberships: PermitGroupMembershipProjection[],\n  principal: PermitPrincipalProjection,\n): string[] {\n  const principalId = readPermitProjectionString(principal.principalId);\n  if (!principalId) return [];\n  return [\n    ...new Set(\n      memberships\n        .filter(\n          (membership) =>\n            isActivePermitProjectionStatus(membership.status) &&\n            readPermitProjectionString(membership.tenantId) ===\n              readPermitProjectionString(principal.tenantId) &&\n            readPermitProjectionString(membership.memberType) === \"principal\" &&\n            (readPermitProjectionString(membership.memberId) === principalId ||\n              readPermitProjectionString(membership.principalId) ===\n                principalId),\n        )\n        .map((membership) => readPermitProjectionString(membership.groupId))\n        .filter((groupId): groupId is string => Boolean(groupId)),\n    ),\n  ];\n}\n\nfunction rolesForPrincipal(\n  assignments: PermitRoleAssignmentProjection[],\n  principal: PermitPrincipalProjection,\n  groupIds: string[],\n): PermitProjectionPlatformRole[] {\n  const principalId = readPermitProjectionString(principal.principalId);\n  const tenantId = readPermitProjectionString(principal.tenantId);\n  const roles = assignments\n    .filter(\n      (assignment) =>\n        isActivePermitProjectionStatus(assignment.status) &&\n        readPermitProjectionString(assignment.tenantId) === tenantId &&\n        ((readPermitProjectionString(assignment.targetType) === \"principal\" &&\n          readPermitProjectionString(assignment.targetId) === principalId) ||\n          (readPermitProjectionString(assignment.targetType) === \"group\" &&\n            groupIds.includes(\n              readPermitProjectionString(assignment.targetId) ?? \"\",\n            ))),\n    )\n    .map((assignment) => mapPermitRoleToPlatformRole(assignment.role))\n    .filter((role): role is PermitProjectionPlatformRole => Boolean(role));\n\n  if (\n    readPermitProjectionString(principal.principalType) === \"agent\" ||\n    readPermitProjectionString(principal.principalType) === \"service_principal\"\n  ) {\n    roles.push(\"service_agent\");\n  }\n\n  return [...new Set(roles)];\n}\n\nfunction workspaceFromPermitProjection(\n  principal: PermitPrincipalProjection,\n  alias: PermitAliasProjection | undefined,\n  assignments: PermitRoleAssignmentProjection[],\n): string | undefined {\n  return (\n    readPermitProjectionString(principal.workspaceId) ??\n    readPermitProjectionString(alias?.workspaceId) ??\n    readPermitProjectionString(\n      assignments.find(\n        (assignment) =>\n          readPermitProjectionString(assignment.targetId) ===\n            readPermitProjectionString(principal.principalId) &&\n          readPermitProjectionString(assignment.resourceType) === \"workspace\",\n      )?.resourceKey,\n    ) ??\n    readPermitProjectionString(\n      assignments.find((assignment) => assignment.workspaceId)?.workspaceId,\n    )\n  );\n}\n\nexport function buildProjectedUserFromPermitPrincipal(\n  rows: PermitProjectionRows,\n  principal: PermitPrincipalProjection,\n  matchingAlias?: PermitAliasProjection,\n  now = Date.now(),\n): PermitProjectedUserRecord | null {\n  const principalId = readPermitProjectionString(principal.principalId);\n  const tenantId = readPermitProjectionString(principal.tenantId);\n  if (\n    !principalId ||\n    !tenantId ||\n    !isActivePermitProjectionStatus(principal.status)\n  ) {\n    return null;\n  }\n\n  const aliases = rows.aliases.filter(\n    (alias) =>\n      readPermitProjectionString(alias.tenantId) === tenantId &&\n      readPermitProjectionString(alias.principalId) === principalId &&\n      isActivePermitProjectionStatus(alias.status),\n  );\n  const groupIds = groupIdsForPrincipal(rows.groupMemberships, principal);\n  const roles = rolesForPrincipal(rows.roleAssignments, principal, groupIds);\n  if (roles.length === 0) {\n    return null;\n  }\n\n  const alias = matchingAlias ?? aliases[0];\n  const clerkId =\n    readPermitProjectionString(\n      aliases.find(\n        (entry) =>\n          readPermitProjectionString(entry.provider)?.toLowerCase() === \"clerk\",\n      )?.providerSubjectId,\n    ) ?? principalId;\n\n  return {\n    clerkId,\n    email: emailFromAlias(aliases, principal) ?? `${principalId}@permit.local`,\n    name: readPermitProjectionString(principal.displayName),\n    lastSeenAt: principal.lastSeenAt ?? principal.updatedAt ?? now,\n    chatCount: 0,\n    messageCount: 0,\n    mcRole: highestPlatformRole(roles),\n    mcRoleSyncedAt: principal.updatedAt ?? now,\n    defaultTenantId: tenantId,\n    defaultWorkspaceId:\n      workspaceFromPermitProjection(principal, alias, rows.roleAssignments) ??\n      tenantId,\n    defaultPrincipalId: principalId,\n    principalGroupIds: groupIds,\n    governanceGrantsSyncedAt: principal.updatedAt ?? now,\n    createdAt: principal.createdAt ?? now,\n    updatedAt: principal.updatedAt ?? now,\n  };\n}\n\nexport function findProjectedUserByPermitPrincipalId(\n  rows: PermitProjectionRows,\n  principalId: string,\n  now = Date.now(),\n): PermitProjectedUserRecord | null {\n  const normalizedPrincipalId = principalId.trim();\n  const principal = rows.principals.find(\n    (row) =>\n      isActivePermitProjectionStatus(row.status) &&\n      readPermitProjectionString(row.principalId) === normalizedPrincipalId,\n  );\n  return principal\n    ? buildProjectedUserFromPermitPrincipal(rows, principal, undefined, now)\n    : null;\n}\n\nexport function findProjectedUserByPermitClerkId(\n  rows: PermitProjectionRows,\n  clerkId: string,\n  now = Date.now(),\n): PermitProjectedUserRecord | null {\n  const normalizedClerkId = clerkId.trim();\n  const matchingAlias = rows.aliases.find((alias) =>\n    isClerkAliasFor(alias, normalizedClerkId),\n  );\n  const principal = matchingAlias\n    ? rows.principals.find(\n        (row) =>\n          readPermitProjectionString(row.tenantId) ===\n            readPermitProjectionString(matchingAlias.tenantId) &&\n          readPermitProjectionString(row.principalId) ===\n            readPermitProjectionString(matchingAlias.principalId),\n      )\n    : rows.principals.find(\n        (row) =>\n          readPermitProjectionString(row.principalId) === normalizedClerkId ||\n          readPermitProjectionString(row.principalId) ===\n            `user:${normalizedClerkId}`,\n      );\n  return principal\n    ? buildProjectedUserFromPermitPrincipal(rows, principal, matchingAlias, now)\n    : null;\n}\n"]}

package/dist/projections/check-convex-args-shape.d.ts

@@ -1,3 +0,0 @@
-declare function checkConvexArgsShape(): void;
-
-export { checkConvexArgsShape };