@lucern/contracts 0.3.0-alpha.2 → 0.3.0-alpha.3

package/dist/schemas/tables/kernel/worktree.d.ts

@@ -589,9 +589,9 @@ declare const worktrees: TableContract<{
     }, "strip", z.ZodTypeAny, {
         status: "ai_draft" | "user_draft" | "final";
         content: string;
+        approvedAt?: number | undefined;
         memoContent?: string | undefined;
         generatedAt?: number | undefined;
-        approvedAt?: number | undefined;
         approvedBy?: string | undefined;
         generationMetadata?: {
             promptName: string;
@@ -601,9 +601,9 @@ declare const worktrees: TableContract<{
     }, {
         status: "ai_draft" | "user_draft" | "final";
         content: string;
+        approvedAt?: number | undefined;
         memoContent?: string | undefined;
         generatedAt?: number | undefined;
-        approvedAt?: number | undefined;
         approvedBy?: string | undefined;
         generationMetadata?: {
             promptName: string;

package/dist/schemas/tables/mc/identity.d.ts

@@ -62,6 +62,29 @@ declare const rateLimitWindows: TableContract<{
     createdAt: z.ZodNumber;
     updatedAt: z.ZodNumber;
 }>;
+declare const oauthDeviceCodes: TableContract<{
+    deviceCodeHash: z.ZodString;
+    userCode: z.ZodString;
+    clientId: z.ZodString;
+    scope: z.ZodString;
+    status: z.ZodEnum<["pending", "approved", "denied", "expired", "consumed"]>;
+    expiresAt: z.ZodNumber;
+    intervalSeconds: z.ZodNumber;
+    lastPolledAt: z.ZodOptional<z.ZodNumber>;
+    slowDownCount: z.ZodOptional<z.ZodNumber>;
+    clerkUserId: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<ConvexIdSchema<"tenants">>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    principalId: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    approvedAt: z.ZodOptional<z.ZodNumber>;
+    deniedAt: z.ZodOptional<z.ZodNumber>;
+    consumedAt: z.ZodOptional<z.ZodNumber>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
 declare const servicePrincipalKeys: TableContract<{
     keyId: z.ZodString;
     tokenHash: z.ZodString;
@@ -131,4 +154,4 @@ declare const userSessions: TableContract<{
     updatedAt: z.ZodNumber;
 }>;
 
-export { groupMemberships, groups, memberships, principals, rateLimitWindows, servicePrincipalKeys, userSessions };
+export { groupMemberships, groups, memberships, oauthDeviceCodes, principals, rateLimitWindows, servicePrincipalKeys, userSessions };

package/dist/schemas/tables/mc/identity.js

@@ -135,6 +135,40 @@ var rateLimitWindows = defineTable({
     { kind: "index", name: "by_tier_window_end", columns: ["tier", "windowEndMs"] }
   ]
 });
+var oauthDeviceCodes = defineTable({
+  name: "oauthDeviceCodes",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "deviceCodeHash": z.string(),
+    "userCode": z.string(),
+    "clientId": z.string(),
+    "scope": z.string(),
+    "status": z.enum(["pending", "approved", "denied", "expired", "consumed"]),
+    "expiresAt": z.number(),
+    "intervalSeconds": z.number(),
+    "lastPolledAt": z.number().optional(),
+    "slowDownCount": z.number().optional(),
+    "clerkUserId": z.string().optional(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": z.string().optional(),
+    "principalId": z.string().optional(),
+    "role": z.string().optional(),
+    "scopes": z.array(z.string()).optional(),
+    "sessionId": z.string().optional(),
+    "approvedAt": z.number().optional(),
+    "deniedAt": z.number().optional(),
+    "consumedAt": z.number().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_deviceCodeHash", columns: ["deviceCodeHash"] },
+    { kind: "index", name: "by_userCode", columns: ["userCode"] },
+    { kind: "index", name: "by_status_expiresAt", columns: ["status", "expiresAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId"] }
+  ]
+});
 var servicePrincipalKeys = defineTable({
   name: "servicePrincipalKeys",
   component: "mc",
@@ -216,6 +250,6 @@ var userSessions = defineTable({
   ]
 });
 
-export { groupMemberships, groups, memberships, principals, rateLimitWindows, servicePrincipalKeys, userSessions };
+export { groupMemberships, groups, memberships, oauthDeviceCodes, principals, rateLimitWindows, servicePrincipalKeys, userSessions };
 //# sourceMappingURL=identity.js.map
 //# sourceMappingURL=identity.js.map

package/dist/schemas/tables/mc/identity.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/dsl/defineTable.ts","../../../../src/dsl/idOf.ts","../../../../src/schemas/tables/mc/identity.ts"],"names":["z"],"mappings":";;;;;AAwCO,SAAS,YACd,IAAA,EACkB;AAClB,EAAA,OAAO,IAAA;AACT;AC1CO,IAAM,eAAA,mBAAkB,MAAA,CAAO,GAAA,CAAI,gCAAgC,CAAA;AASnE,SAAS,KAAuB,KAAA,EAA6B;AAClE,EAAA,MAAM,MAAA,GAAS,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAkB;AAC5C,EAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,eAAA,EAAiB;AAAA,IAC7C,YAAA,EAAc,KAAA;AAAA,IACd,UAAA,EAAY,KAAA;AAAA,IACZ,KAAA,EAAO,KAAA;AAAA,IACP,QAAA,EAAU;AAAA,GACX,CAAA;AACD,EAAA,OAAO,MAAA;AACT;;;ACVO,IAAM,mBAAmB,WAAA,CAAY;AAAA,EAC1C,IAAA,EAAM,kBAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,SAAA,EAAW,KAAK,QAAQ,CAAA;AAAA,IACxB,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACjD,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,cAAc,OAAA,EAAS,CAAC,SAAS,CAAA,EAAE;AAAA,IAC1D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,sBAAsB,OAAA,EAAS,CAAC,aAAA,EAAe,SAAS,CAAA,EAAE;AAAA,IACjF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC;AAEM,IAAM,SAAS,WAAA,CAAY;AAAA,EAChC,IAAA,EAAM,QAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,IACrB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,IACjB,aAAaA,CAAAA,CAAE,IAAA,CAAK,CAAC,UAAA,EAAY,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA,IACtD,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,YAAYA,CAAAA,CAAE,MAAA,CAAOA,EAAE,GAAA,EAAK,EAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,wBAAwB,OAAA,EAAS,CAAC,UAAA,EAAY,UAAU,CAAA;AAAE;AAEvF,CAAC;AAEM,IAAM,cAAc,WAAA,CAAY;AAAA,EACrC,IAAA,EAAM,aAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,gBAAA,EAAkB,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,MAAA,EAAQA,CAAAA,CAAE,IAAA,CAAK,CAAC,gBAAA,EAAkB,cAAA,EAAgB,iBAAA,EAAmB,QAAA,EAAU,QAAA,EAAU,SAAA,EAAW,eAAe,CAAC,CAAA;AAAA,IACpH,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACjD,QAAA,EAAUA,EAAE,IAAA,CAAK,CAAC,UAAU,KAAA,EAAO,WAAA,EAAa,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,IAC9D,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,uBAAuB,OAAA,EAAS,CAAC,aAAA,EAAe,UAAU,CAAA,EAAE;AAAA,IACnF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,0BAA0B,OAAA,EAAS,CAAC,aAAA,EAAe,aAAa,CAAA,EAAE;AAAA,IACzF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,UAAA,EAAY,MAAM,CAAA,EAAE;AAAA,IACvE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC;AAEM,IAAM,aAAa,WAAA,CAAY;AAAA,EACpC,IAAA,EAAM,YAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,eAAA,EAAiBA,EAAE,IAAA,CAAK,CAAC,QAAQ,OAAA,EAAS,SAAA,EAAW,iBAAiB,CAAC,CAAA;AAAA,IACvE,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC7B,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,YAAYA,CAAAA,CAAE,KAAA,CAAM,KAAK,QAAQ,CAAC,EAAE,QAAA,EAAS;AAAA,IAC7C,UAAA,EAAY,IAAA,CAAK,SAAS,CAAA,CAAE,QAAA,EAAS;AAAA,IACrC,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,QAAA,EAAUA,EAAE,IAAA,CAAK,CAAC,UAAU,SAAA,EAAW,WAAA,EAAa,UAAU,CAAC,CAAA;AAAA,IAC/D,YAAYA,CAAAA,CAAE,MAAA,CAAOA,EAAE,GAAA,EAAK,EAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,cAAc,OAAA,EAAS,CAAC,SAAS,CAAA,EAAE;AAAA,IAC1D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC;AAEM,IAAM,mBAAmB,WAAA,CAAY;AAAA,EAC1C,IAAA,EAAM,kBAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC7B,UAAA,EAAY,IAAA,CAAK,SAAS,CAAA,CAAE,QAAA,EAAS;AAAA,IACrC,cAAcA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,MAAM,CAAC,CAAA;AAAA,IACvC,eAAA,EAAiBA,EAAE,MAAA,EAAO;AAAA,IAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,cAAA,EAAgBA,EAAE,MAAA,EAAO;AAAA,IACzB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,QAAQA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,WAAA,EAAa,SAAS,CAAC,CAAA;AAAA,IAC/C,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,qBAAA,EAAuB,SAAS,CAAC,aAAA,EAAe,YAAA,EAAc,eAAe,CAAA,EAAE;AAAA,IACtG,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,wBAAwB,OAAA,EAAS,CAAC,YAAA,EAAc,eAAe,CAAA,EAAE;AAAA,IACxF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,iBAAiB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IACjE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,sBAAsB,OAAA,EAAS,CAAC,MAAA,EAAQ,aAAa,CAAA;AAAE;AAEpF,CAAC;AAEM,IAAM,uBAAuB,WAAA,CAAY;AAAA,EAC9C,IAAA,EAAM,sBAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,QAAA,EAAUA,CAAAA,CAAE,KAAA,CAAMA,CAAAA,CAAE,QAAQ,CAAA;AAAA,IAC5B,eAAeA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,YAAY,CAAC,CAAA;AAAA,IAC/C,QAAA,EAAUA,EAAE,IAAA,CAAK,CAAC,UAAU,UAAA,EAAY,SAAA,EAAW,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACxE,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,qBAAA,EAAuBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC3C,gBAAA,EAAkBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACtC,eAAA,EAAiBA,EAAE,IAAA,CAAK,CAAC,QAAQ,WAAA,EAAa,SAAS,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IACnE,YAAYA,CAAAA,CAAE,MAAA,CAAOA,EAAE,GAAA,EAAK,EAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAClC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,YAAY,OAAA,EAAS,CAAC,OAAO,CAAA,EAAE;AAAA,IACtD,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,gBAAgB,OAAA,EAAS,CAAC,WAAW,CAAA,EAAE;AAAA,IAC9D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA,EAAE;AAAA,IACxD,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,uBAAuB,OAAA,EAAS,CAAC,aAAA,EAAe,QAAQ,CAAA;AAAE;AAEvF,CAAC;AAEM,IAAM,eAAe,WAAA,CAAY;AAAA,EACtC,IAAA,EAAM,cAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,eAAA,EAAiBA,EAAE,IAAA,CAAK,CAAC,SAAS,SAAA,EAAW,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IAChE,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,eAAeA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAO,CAAC,CAAA;AAAA,IACvC,UAAA,EAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,kBAAA,EAAoB,qBAAqB,gBAAA,EAAkB,eAAe,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IAC1G,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC5B,UAAUA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvC,iBAAA,EAAmBA,CAAAA,CAAE,KAAA,CAAMA,CAAAA,CAAE,MAAA,CAAO;AAAA,MACpC,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,MACxB,iBAAiBA,CAAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,SAAA,EAAW,OAAO,CAAC,CAAA;AAAA,MACrD,UAAA,EAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,kBAAA,EAAoB,qBAAqB,gBAAA,EAAkB,eAAe,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,MAC1G,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACnC,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,KAC/B,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IACX,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACvC,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACjD,kBAAA,EAAoBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACxC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACpC,gBAAA,EAAkBA,EAAE,MAAA,EAAO;AAAA,IAC3B,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACpC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,gBAAgB,OAAA,EAAS,CAAC,WAAW,CAAA,EAAE;AAAA,IAC9D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,sBAAsB,OAAA,EAAS,CAAC,iBAAiB,CAAA,EAAE;AAAA,IAC1E,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC","file":"identity.js","sourcesContent":["import type { ZodObject, ZodRawShape } from \"zod\";\n\nexport type TableComponent = \"mc\" | \"kernel\" | \"identity\" | \"developer-pack\";\n\nexport type TableIndex =\n  | {\n      kind: \"index\";\n      name: string;\n      columns: readonly string[];\n    }\n  | {\n      kind: \"search\";\n      name: string;\n      searchField: string;\n      filterFields?: readonly string[];\n    }\n  | {\n      kind: \"vector\";\n      name: string;\n      vectorField: string;\n      dimensions: number;\n      filterFields?: readonly string[];\n    };\n\nexport type TableDeprecation = {\n  since: string;\n  reason: string;\n  replacement?: string;\n};\n\nexport type TableContract<S extends ZodRawShape = ZodRawShape> = {\n  name: string;\n  component: TableComponent;\n  category: string;\n  shape: ZodObject<S>;\n  indices: readonly TableIndex[];\n  deprecated?: TableDeprecation;\n  invariants?: readonly string[];\n};\n\nexport function defineTable<S extends ZodRawShape>(\n  spec: TableContract<S>\n): TableContract<S> {\n  return spec;\n}\n","import { z } from \"zod\";\n\nexport const CONVEX_ID_TABLE = Symbol.for(\"lucern.contracts.convexIdTable\");\n\nexport type ConvexIdSchema<T extends string> = z.ZodBranded<\n  z.ZodString,\n  `Id<${T}>`\n> & {\n  readonly [CONVEX_ID_TABLE]: T;\n};\n\nexport function idOf<T extends string>(table: T): ConvexIdSchema<T> {\n  const schema = z.string().brand<`Id<${T}>`>();\n  Object.defineProperty(schema, CONVEX_ID_TABLE, {\n    configurable: false,\n    enumerable: false,\n    value: table,\n    writable: false,\n  });\n  return schema as ConvexIdSchema<T>;\n}\n\nexport function getConvexIdTable(schema: z.ZodTypeAny): string | undefined {\n  return (schema as Partial<Record<typeof CONVEX_ID_TABLE, string>>)[\n    CONVEX_ID_TABLE\n  ];\n}\n","/**\n * Schema contracts for mc/identity.\n *\n * Mirrored from:\n *   - services/master-control/convex/schema.ts\n */\n\nimport { z } from 'zod';\nimport { defineTable, idOf } from '../../../dsl.js';\n\nexport const groupMemberships = defineTable({\n  name: \"groupMemberships\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"groupId\": idOf(\"groups\"),\n    \"principalId\": z.string(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"status\": z.enum([\"active\", \"invited\", \"revoked\"]),\n    \"addedBy\": z.string().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_groupId\", columns: [\"groupId\"] },\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_principal_group\", columns: [\"principalId\", \"groupId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n\nexport const groups = defineTable({\n  name: \"groups\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"groupKey\": z.string(),\n    \"name\": z.string(),\n    \"groupType\": z.enum([\"internal\", \"external\", \"system\"]),\n    \"description\": z.string().optional(),\n    \"metadata\": z.record(z.any()).optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_workspaceId\", columns: [\"workspaceId\"] },\n      { kind: 'index', name: \"by_tenantId_groupKey\", columns: [\"tenantId\", \"groupKey\"] }\n    ],\n});\n\nexport const memberships = defineTable({\n  name: \"memberships\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"principalId\": z.string(),\n    \"principalRefId\": idOf(\"principals\").optional(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"role\": z.enum([\"platform_admin\", \"tenant_admin\", \"workspace_admin\", \"editor\", \"viewer\", \"auditor\", \"service_agent\"]),\n    \"status\": z.enum([\"active\", \"invited\", \"revoked\"]),\n    \"source\": z.enum([\"manual\", \"sso\", \"bootstrap\", \"api\", \"scim\"]),\n    \"grantedBy\": z.string().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_principal_tenant\", columns: [\"principalId\", \"tenantId\"] },\n      { kind: 'index', name: \"by_workspace_principal\", columns: [\"workspaceId\", \"principalId\"] },\n      { kind: 'index', name: \"by_tenant_role\", columns: [\"tenantId\", \"role\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n\nexport const principals = defineTable({\n  name: \"principals\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"principalId\": z.string(),\n    \"principalType\": z.enum([\"user\", \"group\", \"service\", \"external_viewer\"]),\n    \"clerkId\": z.string().optional(),\n    \"email\": z.string().optional(),\n    \"displayName\": z.string().optional(),\n    \"groupIds\": z.array(idOf(\"groups\")).optional(),\n    \"tenantId\": idOf(\"tenants\").optional(),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"status\": z.enum([\"active\", \"invited\", \"suspended\", \"disabled\"]),\n    \"metadata\": z.record(z.any()).optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_clerkId\", columns: [\"clerkId\"] },\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_workspaceId\", columns: [\"workspaceId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n\nexport const rateLimitWindows = defineTable({\n  name: \"rateLimitWindows\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"principalId\": z.string(),\n    \"keyId\": z.string().optional(),\n    \"tenantId\": idOf(\"tenants\").optional(),\n    \"windowType\": z.enum([\"minute\", \"hour\"]),\n    \"windowStartMs\": z.number(),\n    \"windowEndMs\": z.number(),\n    \"requestCount\": z.number(),\n    \"limit\": z.number(),\n    \"tier\": z.enum([\"free\", \"developer\", \"partner\"]),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_principal_window\", columns: [\"principalId\", \"windowType\", \"windowStartMs\"] },\n      { kind: 'index', name: \"by_window_type_start\", columns: [\"windowType\", \"windowStartMs\"] },\n      { kind: 'index', name: \"by_window_end\", columns: [\"windowEndMs\"] },\n      { kind: 'index', name: \"by_tier_window_end\", columns: [\"tier\", \"windowEndMs\"] }\n    ],\n});\n\nexport const servicePrincipalKeys = defineTable({\n  name: \"servicePrincipalKeys\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"keyId\": z.string(),\n    \"tokenHash\": z.string(),\n    \"principalId\": z.string(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"scopes\": z.array(z.string()),\n    \"environment\": z.enum([\"sandbox\", \"production\"]),\n    \"status\": z.enum([\"active\", \"rotating\", \"rotated\", \"expired\", \"revoked\"]),\n    \"expiresAt\": z.number(),\n    \"rotationGracePeriod\": z.number().optional(),\n    \"rotatedToKeyId\": z.string().optional(),\n    \"rateLimitTier\": z.enum([\"free\", \"developer\", \"partner\"]).optional(),\n    \"metadata\": z.record(z.any()).optional(),\n    \"createdBy\": z.string(),\n    \"revokedBy\": z.string().optional(),\n    \"revokedAt\": z.number().optional(),\n    \"lastUsedAt\": z.number().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_keyId\", columns: [\"keyId\"] },\n      { kind: 'index', name: \"by_tokenHash\", columns: [\"tokenHash\"] },\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_workspaceId\", columns: [\"workspaceId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] },\n      { kind: 'index', name: \"by_principal_status\", columns: [\"principalId\", \"status\"] }\n    ],\n});\n\nexport const userSessions = defineTable({\n  name: \"userSessions\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"sessionId\": z.string(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"clerkUserId\": z.string(),\n    \"principalId\": z.string().optional(),\n    \"principalType\": z.enum([\"human\", \"service\", \"agent\"]).optional(),\n    \"workspaceId\": z.string().optional(),\n    \"apiKeyId\": idOf(\"apiKeys\"),\n    \"sessionType\": z.enum([\"user\", \"agent\"]),\n    \"authMode\": z.enum([\"interactive_user\", \"service_principal\", \"tenant_api_key\", \"session_token\"]).optional(),\n    \"role\": z.string().optional(),\n    \"scopes\": z.array(z.string()).optional(),\n    \"delegationChain\": z.array(z.object({\n    \"principalId\": z.string(),\n    \"principalType\": z.enum([\"human\", \"service\", \"agent\"]),\n    \"authMode\": z.enum([\"interactive_user\", \"service_principal\", \"tenant_api_key\", \"session_token\"]).optional(),\n    \"sessionId\": z.string().optional(),\n    \"delegatedAt\": z.number().optional(),\n    \"reason\": z.string().optional()\n  })).optional(),\n    \"sourceSessionId\": z.string().optional(),\n    \"status\": z.enum([\"active\", \"expired\", \"revoked\"]),\n    \"sessionExpiresAt\": z.number().optional(),\n    \"jwtIssuedAt\": z.number().optional(),\n    \"jwtExpiresAt\": z.number().optional(),\n    \"lastActivityAt\": z.number(),\n    \"lastValidatedAt\": z.number().optional(),\n    \"revokedAt\": z.number().optional(),\n    \"revokedBy\": z.string().optional(),\n    \"revokeReason\": z.string().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_sessionId\", columns: [\"sessionId\"] },\n      { kind: 'index', name: \"by_sourceSessionId\", columns: [\"sourceSessionId\"] },\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_clerkUserId\", columns: [\"clerkUserId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n"]}
+{"version":3,"sources":["../../../../src/dsl/defineTable.ts","../../../../src/dsl/idOf.ts","../../../../src/schemas/tables/mc/identity.ts"],"names":["z"],"mappings":";;;;;AAwCO,SAAS,YACd,IAAA,EACkB;AAClB,EAAA,OAAO,IAAA;AACT;AC1CO,IAAM,eAAA,mBAAkB,MAAA,CAAO,GAAA,CAAI,gCAAgC,CAAA;AASnE,SAAS,KAAuB,KAAA,EAA6B;AAClE,EAAA,MAAM,MAAA,GAAS,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAkB;AAC5C,EAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,eAAA,EAAiB;AAAA,IAC7C,YAAA,EAAc,KAAA;AAAA,IACd,UAAA,EAAY,KAAA;AAAA,IACZ,KAAA,EAAO,KAAA;AAAA,IACP,QAAA,EAAU;AAAA,GACX,CAAA;AACD,EAAA,OAAO,MAAA;AACT;;;ACVO,IAAM,mBAAmB,WAAA,CAAY;AAAA,EAC1C,IAAA,EAAM,kBAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,SAAA,EAAW,KAAK,QAAQ,CAAA;AAAA,IACxB,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACjD,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,cAAc,OAAA,EAAS,CAAC,SAAS,CAAA,EAAE;AAAA,IAC1D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,sBAAsB,OAAA,EAAS,CAAC,aAAA,EAAe,SAAS,CAAA,EAAE;AAAA,IACjF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC;AAEM,IAAM,SAAS,WAAA,CAAY;AAAA,EAChC,IAAA,EAAM,QAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,IACrB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,IACjB,aAAaA,CAAAA,CAAE,IAAA,CAAK,CAAC,UAAA,EAAY,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA,IACtD,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,YAAYA,CAAAA,CAAE,MAAA,CAAOA,EAAE,GAAA,EAAK,EAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,wBAAwB,OAAA,EAAS,CAAC,UAAA,EAAY,UAAU,CAAA;AAAE;AAEvF,CAAC;AAEM,IAAM,cAAc,WAAA,CAAY;AAAA,EACrC,IAAA,EAAM,aAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,gBAAA,EAAkB,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,MAAA,EAAQA,CAAAA,CAAE,IAAA,CAAK,CAAC,gBAAA,EAAkB,cAAA,EAAgB,iBAAA,EAAmB,QAAA,EAAU,QAAA,EAAU,SAAA,EAAW,eAAe,CAAC,CAAA;AAAA,IACpH,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACjD,QAAA,EAAUA,EAAE,IAAA,CAAK,CAAC,UAAU,KAAA,EAAO,WAAA,EAAa,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,IAC9D,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,uBAAuB,OAAA,EAAS,CAAC,aAAA,EAAe,UAAU,CAAA,EAAE;AAAA,IACnF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,0BAA0B,OAAA,EAAS,CAAC,aAAA,EAAe,aAAa,CAAA,EAAE;AAAA,IACzF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,UAAA,EAAY,MAAM,CAAA,EAAE;AAAA,IACvE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC;AAEM,IAAM,aAAa,WAAA,CAAY;AAAA,EACpC,IAAA,EAAM,YAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,eAAA,EAAiBA,EAAE,IAAA,CAAK,CAAC,QAAQ,OAAA,EAAS,SAAA,EAAW,iBAAiB,CAAC,CAAA;AAAA,IACvE,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC7B,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,YAAYA,CAAAA,CAAE,KAAA,CAAM,KAAK,QAAQ,CAAC,EAAE,QAAA,EAAS;AAAA,IAC7C,UAAA,EAAY,IAAA,CAAK,SAAS,CAAA,CAAE,QAAA,EAAS;AAAA,IACrC,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,QAAA,EAAUA,EAAE,IAAA,CAAK,CAAC,UAAU,SAAA,EAAW,WAAA,EAAa,UAAU,CAAC,CAAA;AAAA,IAC/D,YAAYA,CAAAA,CAAE,MAAA,CAAOA,EAAE,GAAA,EAAK,EAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,cAAc,OAAA,EAAS,CAAC,SAAS,CAAA,EAAE;AAAA,IAC1D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC;AAEM,IAAM,mBAAmB,WAAA,CAAY;AAAA,EAC1C,IAAA,EAAM,kBAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC7B,UAAA,EAAY,IAAA,CAAK,SAAS,CAAA,CAAE,QAAA,EAAS;AAAA,IACrC,cAAcA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,MAAM,CAAC,CAAA;AAAA,IACvC,eAAA,EAAiBA,EAAE,MAAA,EAAO;AAAA,IAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,cAAA,EAAgBA,EAAE,MAAA,EAAO;AAAA,IACzB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,QAAQA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,WAAA,EAAa,SAAS,CAAC,CAAA;AAAA,IAC/C,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,qBAAA,EAAuB,SAAS,CAAC,aAAA,EAAe,YAAA,EAAc,eAAe,CAAA,EAAE;AAAA,IACtG,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,wBAAwB,OAAA,EAAS,CAAC,YAAA,EAAc,eAAe,CAAA,EAAE;AAAA,IACxF,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,iBAAiB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IACjE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,sBAAsB,OAAA,EAAS,CAAC,MAAA,EAAQ,aAAa,CAAA;AAAE;AAEpF,CAAC;AAEM,IAAM,mBAAmB,WAAA,CAAY;AAAA,EAC1C,IAAA,EAAM,kBAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,gBAAA,EAAkBA,EAAE,MAAA,EAAO;AAAA,IAC3B,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,IACrB,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,IACrB,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,QAAA,EAAUA,EAAE,IAAA,CAAK,CAAC,WAAW,UAAA,EAAY,QAAA,EAAU,SAAA,EAAW,UAAU,CAAC,CAAA;AAAA,IACzE,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,iBAAA,EAAmBA,EAAE,MAAA,EAAO;AAAA,IAC5B,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACpC,eAAA,EAAiBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACrC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,UAAA,EAAY,IAAA,CAAK,SAAS,CAAA,CAAE,QAAA,EAAS;AAAA,IACrC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC5B,UAAUA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAClC,UAAA,EAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAChC,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAClC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,qBAAqB,OAAA,EAAS,CAAC,gBAAgB,CAAA,EAAE;AAAA,IACxE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,uBAAuB,OAAA,EAAS,CAAC,QAAA,EAAU,WAAW,CAAA,EAAE;AAAA,IAC/E,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,gBAAgB,OAAA,EAAS,CAAC,WAAW,CAAA;AAAE;AAEpE,CAAC;AAEM,IAAM,uBAAuB,WAAA,CAAY;AAAA,EAC9C,IAAA,EAAM,sBAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,OAAA,EAASA,EAAE,MAAA,EAAO;AAAA,IAClB,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAe,IAAA,CAAK,YAAY,CAAA,CAAE,QAAA,EAAS;AAAA,IAC3C,QAAA,EAAUA,CAAAA,CAAE,KAAA,CAAMA,CAAAA,CAAE,QAAQ,CAAA;AAAA,IAC5B,eAAeA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,YAAY,CAAC,CAAA;AAAA,IAC/C,QAAA,EAAUA,EAAE,IAAA,CAAK,CAAC,UAAU,UAAA,EAAY,SAAA,EAAW,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACxE,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,qBAAA,EAAuBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC3C,gBAAA,EAAkBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACtC,eAAA,EAAiBA,EAAE,IAAA,CAAK,CAAC,QAAQ,WAAA,EAAa,SAAS,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IACnE,YAAYA,CAAAA,CAAE,MAAA,CAAOA,EAAE,GAAA,EAAK,EAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAClC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,YAAY,OAAA,EAAS,CAAC,OAAO,CAAA,EAAE;AAAA,IACtD,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,gBAAgB,OAAA,EAAS,CAAC,WAAW,CAAA,EAAE;AAAA,IAC9D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA,EAAE;AAAA,IACxD,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,uBAAuB,OAAA,EAAS,CAAC,aAAA,EAAe,QAAQ,CAAA;AAAE;AAEvF,CAAC;AAEM,IAAM,eAAe,WAAA,CAAY;AAAA,EACtC,IAAA,EAAM,cAAA;AAAA,EACN,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAOA,EAAE,MAAA,CAAO;AAAA,IACd,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,IACxB,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,eAAA,EAAiBA,EAAE,IAAA,CAAK,CAAC,SAAS,SAAA,EAAW,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IAChE,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,UAAA,EAAY,KAAK,SAAS,CAAA;AAAA,IAC1B,eAAeA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAO,CAAC,CAAA;AAAA,IACvC,UAAA,EAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,kBAAA,EAAoB,qBAAqB,gBAAA,EAAkB,eAAe,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IAC1G,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC5B,UAAUA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvC,iBAAA,EAAmBA,CAAAA,CAAE,KAAA,CAAMA,CAAAA,CAAE,MAAA,CAAO;AAAA,MACpC,aAAA,EAAeA,EAAE,MAAA,EAAO;AAAA,MACxB,iBAAiBA,CAAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,SAAA,EAAW,OAAO,CAAC,CAAA;AAAA,MACrD,UAAA,EAAYA,CAAAA,CAAE,IAAA,CAAK,CAAC,kBAAA,EAAoB,qBAAqB,gBAAA,EAAkB,eAAe,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,MAC1G,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACnC,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,KAC/B,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,IACX,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACvC,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA,IACjD,kBAAA,EAAoBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACxC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACnC,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACpC,gBAAA,EAAkBA,EAAE,MAAA,EAAO;AAAA,IAC3B,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACvC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACpC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,IACtB,WAAA,EAAaA,EAAE,MAAA;AAAO,GACvB,CAAA;AAAA,EACD,OAAA,EAAS;AAAA,IACL,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,gBAAgB,OAAA,EAAS,CAAC,WAAW,CAAA,EAAE;AAAA,IAC9D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,sBAAsB,OAAA,EAAS,CAAC,iBAAiB,CAAA,EAAE;AAAA,IAC1E,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,eAAe,OAAA,EAAS,CAAC,UAAU,CAAA,EAAE;AAAA,IAC5D,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,kBAAkB,OAAA,EAAS,CAAC,aAAa,CAAA,EAAE;AAAA,IAClE,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,aAAa,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAE;AAE9D,CAAC","file":"identity.js","sourcesContent":["import type { ZodObject, ZodRawShape } from \"zod\";\n\nexport type TableComponent = \"mc\" | \"kernel\" | \"identity\" | \"developer-pack\";\n\nexport type TableIndex =\n  | {\n      kind: \"index\";\n      name: string;\n      columns: readonly string[];\n    }\n  | {\n      kind: \"search\";\n      name: string;\n      searchField: string;\n      filterFields?: readonly string[];\n    }\n  | {\n      kind: \"vector\";\n      name: string;\n      vectorField: string;\n      dimensions: number;\n      filterFields?: readonly string[];\n    };\n\nexport type TableDeprecation = {\n  since: string;\n  reason: string;\n  replacement?: string;\n};\n\nexport type TableContract<S extends ZodRawShape = ZodRawShape> = {\n  name: string;\n  component: TableComponent;\n  category: string;\n  shape: ZodObject<S>;\n  indices: readonly TableIndex[];\n  deprecated?: TableDeprecation;\n  invariants?: readonly string[];\n};\n\nexport function defineTable<S extends ZodRawShape>(\n  spec: TableContract<S>\n): TableContract<S> {\n  return spec;\n}\n","import { z } from \"zod\";\n\nexport const CONVEX_ID_TABLE = Symbol.for(\"lucern.contracts.convexIdTable\");\n\nexport type ConvexIdSchema<T extends string> = z.ZodBranded<\n  z.ZodString,\n  `Id<${T}>`\n> & {\n  readonly [CONVEX_ID_TABLE]: T;\n};\n\nexport function idOf<T extends string>(table: T): ConvexIdSchema<T> {\n  const schema = z.string().brand<`Id<${T}>`>();\n  Object.defineProperty(schema, CONVEX_ID_TABLE, {\n    configurable: false,\n    enumerable: false,\n    value: table,\n    writable: false,\n  });\n  return schema as ConvexIdSchema<T>;\n}\n\nexport function getConvexIdTable(schema: z.ZodTypeAny): string | undefined {\n  return (schema as Partial<Record<typeof CONVEX_ID_TABLE, string>>)[\n    CONVEX_ID_TABLE\n  ];\n}\n","/**\n * Schema contracts for mc/identity.\n *\n * Mirrored from:\n *   - services/master-control/convex/schema.ts\n */\n\nimport { z } from 'zod';\nimport { defineTable, idOf } from '../../../dsl.js';\n\nexport const groupMemberships = defineTable({\n  name: \"groupMemberships\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"groupId\": idOf(\"groups\"),\n    \"principalId\": z.string(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"status\": z.enum([\"active\", \"invited\", \"revoked\"]),\n    \"addedBy\": z.string().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_groupId\", columns: [\"groupId\"] },\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_principal_group\", columns: [\"principalId\", \"groupId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n\nexport const groups = defineTable({\n  name: \"groups\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"groupKey\": z.string(),\n    \"name\": z.string(),\n    \"groupType\": z.enum([\"internal\", \"external\", \"system\"]),\n    \"description\": z.string().optional(),\n    \"metadata\": z.record(z.any()).optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_workspaceId\", columns: [\"workspaceId\"] },\n      { kind: 'index', name: \"by_tenantId_groupKey\", columns: [\"tenantId\", \"groupKey\"] }\n    ],\n});\n\nexport const memberships = defineTable({\n  name: \"memberships\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"principalId\": z.string(),\n    \"principalRefId\": idOf(\"principals\").optional(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"role\": z.enum([\"platform_admin\", \"tenant_admin\", \"workspace_admin\", \"editor\", \"viewer\", \"auditor\", \"service_agent\"]),\n    \"status\": z.enum([\"active\", \"invited\", \"revoked\"]),\n    \"source\": z.enum([\"manual\", \"sso\", \"bootstrap\", \"api\", \"scim\"]),\n    \"grantedBy\": z.string().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_principal_tenant\", columns: [\"principalId\", \"tenantId\"] },\n      { kind: 'index', name: \"by_workspace_principal\", columns: [\"workspaceId\", \"principalId\"] },\n      { kind: 'index', name: \"by_tenant_role\", columns: [\"tenantId\", \"role\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n\nexport const principals = defineTable({\n  name: \"principals\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"principalId\": z.string(),\n    \"principalType\": z.enum([\"user\", \"group\", \"service\", \"external_viewer\"]),\n    \"clerkId\": z.string().optional(),\n    \"email\": z.string().optional(),\n    \"displayName\": z.string().optional(),\n    \"groupIds\": z.array(idOf(\"groups\")).optional(),\n    \"tenantId\": idOf(\"tenants\").optional(),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"status\": z.enum([\"active\", \"invited\", \"suspended\", \"disabled\"]),\n    \"metadata\": z.record(z.any()).optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_clerkId\", columns: [\"clerkId\"] },\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_workspaceId\", columns: [\"workspaceId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n\nexport const rateLimitWindows = defineTable({\n  name: \"rateLimitWindows\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"principalId\": z.string(),\n    \"keyId\": z.string().optional(),\n    \"tenantId\": idOf(\"tenants\").optional(),\n    \"windowType\": z.enum([\"minute\", \"hour\"]),\n    \"windowStartMs\": z.number(),\n    \"windowEndMs\": z.number(),\n    \"requestCount\": z.number(),\n    \"limit\": z.number(),\n    \"tier\": z.enum([\"free\", \"developer\", \"partner\"]),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_principal_window\", columns: [\"principalId\", \"windowType\", \"windowStartMs\"] },\n      { kind: 'index', name: \"by_window_type_start\", columns: [\"windowType\", \"windowStartMs\"] },\n      { kind: 'index', name: \"by_window_end\", columns: [\"windowEndMs\"] },\n      { kind: 'index', name: \"by_tier_window_end\", columns: [\"tier\", \"windowEndMs\"] }\n    ],\n});\n\nexport const oauthDeviceCodes = defineTable({\n  name: \"oauthDeviceCodes\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"deviceCodeHash\": z.string(),\n    \"userCode\": z.string(),\n    \"clientId\": z.string(),\n    \"scope\": z.string(),\n    \"status\": z.enum([\"pending\", \"approved\", \"denied\", \"expired\", \"consumed\"]),\n    \"expiresAt\": z.number(),\n    \"intervalSeconds\": z.number(),\n    \"lastPolledAt\": z.number().optional(),\n    \"slowDownCount\": z.number().optional(),\n    \"clerkUserId\": z.string().optional(),\n    \"tenantId\": idOf(\"tenants\").optional(),\n    \"workspaceId\": z.string().optional(),\n    \"principalId\": z.string().optional(),\n    \"role\": z.string().optional(),\n    \"scopes\": z.array(z.string()).optional(),\n    \"sessionId\": z.string().optional(),\n    \"approvedAt\": z.number().optional(),\n    \"deniedAt\": z.number().optional(),\n    \"consumedAt\": z.number().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_deviceCodeHash\", columns: [\"deviceCodeHash\"] },\n      { kind: 'index', name: \"by_userCode\", columns: [\"userCode\"] },\n      { kind: 'index', name: \"by_status_expiresAt\", columns: [\"status\", \"expiresAt\"] },\n      { kind: 'index', name: \"by_sessionId\", columns: [\"sessionId\"] }\n    ],\n});\n\nexport const servicePrincipalKeys = defineTable({\n  name: \"servicePrincipalKeys\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"keyId\": z.string(),\n    \"tokenHash\": z.string(),\n    \"principalId\": z.string(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"workspaceId\": idOf(\"workspaces\").optional(),\n    \"scopes\": z.array(z.string()),\n    \"environment\": z.enum([\"sandbox\", \"production\"]),\n    \"status\": z.enum([\"active\", \"rotating\", \"rotated\", \"expired\", \"revoked\"]),\n    \"expiresAt\": z.number(),\n    \"rotationGracePeriod\": z.number().optional(),\n    \"rotatedToKeyId\": z.string().optional(),\n    \"rateLimitTier\": z.enum([\"free\", \"developer\", \"partner\"]).optional(),\n    \"metadata\": z.record(z.any()).optional(),\n    \"createdBy\": z.string(),\n    \"revokedBy\": z.string().optional(),\n    \"revokedAt\": z.number().optional(),\n    \"lastUsedAt\": z.number().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_keyId\", columns: [\"keyId\"] },\n      { kind: 'index', name: \"by_tokenHash\", columns: [\"tokenHash\"] },\n      { kind: 'index', name: \"by_principalId\", columns: [\"principalId\"] },\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_workspaceId\", columns: [\"workspaceId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] },\n      { kind: 'index', name: \"by_principal_status\", columns: [\"principalId\", \"status\"] }\n    ],\n});\n\nexport const userSessions = defineTable({\n  name: \"userSessions\",\n  component: \"mc\",\n  category: \"identity\",\n  shape: z.object({\n    \"sessionId\": z.string(),\n    \"tenantId\": idOf(\"tenants\"),\n    \"clerkUserId\": z.string(),\n    \"principalId\": z.string().optional(),\n    \"principalType\": z.enum([\"human\", \"service\", \"agent\"]).optional(),\n    \"workspaceId\": z.string().optional(),\n    \"apiKeyId\": idOf(\"apiKeys\"),\n    \"sessionType\": z.enum([\"user\", \"agent\"]),\n    \"authMode\": z.enum([\"interactive_user\", \"service_principal\", \"tenant_api_key\", \"session_token\"]).optional(),\n    \"role\": z.string().optional(),\n    \"scopes\": z.array(z.string()).optional(),\n    \"delegationChain\": z.array(z.object({\n    \"principalId\": z.string(),\n    \"principalType\": z.enum([\"human\", \"service\", \"agent\"]),\n    \"authMode\": z.enum([\"interactive_user\", \"service_principal\", \"tenant_api_key\", \"session_token\"]).optional(),\n    \"sessionId\": z.string().optional(),\n    \"delegatedAt\": z.number().optional(),\n    \"reason\": z.string().optional()\n  })).optional(),\n    \"sourceSessionId\": z.string().optional(),\n    \"status\": z.enum([\"active\", \"expired\", \"revoked\"]),\n    \"sessionExpiresAt\": z.number().optional(),\n    \"jwtIssuedAt\": z.number().optional(),\n    \"jwtExpiresAt\": z.number().optional(),\n    \"lastActivityAt\": z.number(),\n    \"lastValidatedAt\": z.number().optional(),\n    \"revokedAt\": z.number().optional(),\n    \"revokedBy\": z.string().optional(),\n    \"revokeReason\": z.string().optional(),\n    \"createdAt\": z.number(),\n    \"updatedAt\": z.number()\n  }),\n  indices: [\n      { kind: 'index', name: \"by_sessionId\", columns: [\"sessionId\"] },\n      { kind: 'index', name: \"by_sourceSessionId\", columns: [\"sourceSessionId\"] },\n      { kind: 'index', name: \"by_tenantId\", columns: [\"tenantId\"] },\n      { kind: 'index', name: \"by_clerkUserId\", columns: [\"clerkUserId\"] },\n      { kind: 'index', name: \"by_status\", columns: [\"status\"] }\n    ],\n});\n"]}

package/dist/schemas/tables/mc/pack.d.ts

@@ -151,7 +151,7 @@ declare const packVersions: TableContract<{
         parameterSchema?: Record<string, any> | undefined;
         category?: "read" | "write" | "admin" | "system" | undefined;
         requiredRole?: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent" | undefined;
-        requiredAction?: "read" | "admin" | "mutate" | "summarize" | "export" | "create" | "delete" | "grant" | "revoke" | undefined;
+        requiredAction?: "delete" | "read" | "admin" | "mutate" | "summarize" | "export" | "create" | "grant" | "revoke" | undefined;
         surfaces?: ("cli" | "mcp" | "chat" | "voice" | "sprint" | "api" | "sdk")[] | undefined;
         returnSchema?: Record<string, any> | undefined;
         handlerRef?: string | undefined;
@@ -168,7 +168,7 @@ declare const packVersions: TableContract<{
         parameterSchema?: Record<string, any> | undefined;
         category?: "read" | "write" | "admin" | "system" | undefined;
         requiredRole?: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent" | undefined;
-        requiredAction?: "read" | "admin" | "mutate" | "summarize" | "export" | "create" | "delete" | "grant" | "revoke" | undefined;
+        requiredAction?: "delete" | "read" | "admin" | "mutate" | "summarize" | "export" | "create" | "grant" | "revoke" | undefined;
         surfaces?: ("cli" | "mcp" | "chat" | "voice" | "sprint" | "api" | "sdk")[] | undefined;
         returnSchema?: Record<string, any> | undefined;
         handlerRef?: string | undefined;

package/dist/tenant-client.contract.d.ts

@@ -0,0 +1,266 @@
+/**
+ * Tenant client contract
+ *
+ * Defines the generic boundary for any customer-owned product that consumes
+ * Lucern through the SDK, hosted API, or MCP server. Tenant clients may run
+ * their own UI, auth provider, deployment, and data plane, but reasoning
+ * operations must enter through the published packages below.
+ */
+declare const TENANT_CLIENT_CONTRACT_VERSION: "2026-04-27";
+declare const TENANT_CLIENT_AUTH_MODES: readonly ["interactive_user", "service_principal", "tenant_api_key", "session_token"];
+type TenantClientAuthMode = (typeof TENANT_CLIENT_AUTH_MODES)[number];
+declare const TENANT_CLIENT_PRINCIPAL_TYPES: readonly ["human", "service", "agent"];
+type TenantClientPrincipalType = (typeof TENANT_CLIENT_PRINCIPAL_TYPES)[number];
+declare const TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS: readonly ["tenantId", "workspaceId", "principalId", "authMode", "scopes"];
+type TenantClientRequiredContextField = (typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS)[number];
+declare const TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS: readonly ["principalType", "roles", "sessionId", "delegationChain"];
+type TenantClientOptionalContextField = (typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS)[number];
+declare const TENANT_CLIENT_INSTALL_TOKEN_ENV: "INSTALL_LUCERN_NPM";
+declare const TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH: "tenants/shared";
+declare const TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS: readonly ["/platform/publish"];
+declare const TENANT_CLIENT_FORBIDDEN_SECRET_ENV: readonly ["NPM_TOKEN"];
+type TenantClientForbiddenInstallTokenInfisicalPath = (typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS)[number];
+type TenantClientForbiddenSecretEnv = (typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV)[number];
+declare const TENANT_CLIENT_INSTALLABLE_PACKAGES: readonly [{
+    readonly packageName: "@lucern/access-control";
+    readonly role: "sdk_dependency";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/agent";
+    readonly role: "platform_runtime";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/auth";
+    readonly role: "sdk_dependency";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/cli";
+    readonly role: "developer_tool";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/client-core";
+    readonly role: "sdk_dependency";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/confidence";
+    readonly role: "sdk_dependency";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/config";
+    readonly role: "configuration";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/contracts";
+    readonly role: "contract_entrypoint";
+    readonly directTenantImport: true;
+}, {
+    readonly packageName: "@lucern/control-plane";
+    readonly role: "platform_runtime";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/developer-kit";
+    readonly role: "developer_tool";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/events";
+    readonly role: "sdk_dependency";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/graph-primitives";
+    readonly role: "sdk_dependency";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/identity";
+    readonly role: "component_runtime";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/mcp";
+    readonly role: "runtime_entrypoint";
+    readonly directTenantImport: true;
+}, {
+    readonly packageName: "@lucern/pack-host";
+    readonly role: "platform_runtime";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/pack-installer";
+    readonly role: "developer_tool";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/proof-compiler";
+    readonly role: "developer_tool";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/react";
+    readonly role: "runtime_entrypoint";
+    readonly directTenantImport: true;
+}, {
+    readonly packageName: "@lucern/reasoning-kernel";
+    readonly role: "component_runtime";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/sdk";
+    readonly role: "runtime_entrypoint";
+    readonly directTenantImport: true;
+}, {
+    readonly packageName: "@lucern/server-core";
+    readonly role: "platform_runtime";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/testing";
+    readonly role: "test_support";
+    readonly directTenantImport: false;
+}, {
+    readonly packageName: "@lucern/types";
+    readonly role: "contract_entrypoint";
+    readonly directTenantImport: true;
+}];
+type TenantClientInstallablePackage = (typeof TENANT_CLIENT_INSTALLABLE_PACKAGES)[number];
+type TenantClientPackageRole = TenantClientInstallablePackage["role"];
+type TenantClientInstallablePackageName = TenantClientInstallablePackage["packageName"];
+/**
+ * Direct imports tenant-owned product code may use. This is intentionally
+ * smaller than TENANT_CLIENT_INSTALLABLE_PACKAGES: several publishable packages
+ * are installed as SDK dependencies, tooling, or platform runtimes but should
+ * not become the application integration surface.
+ */
+declare const TENANT_CLIENT_PUBLIC_IMPORTS: readonly [{
+    readonly packageName: "@lucern/sdk";
+    readonly surface: "runtime";
+    readonly subpaths: "published_exports";
+    readonly description: "TypeScript SDK runtime and generated operation namespaces.";
+}, {
+    readonly packageName: "@lucern/react";
+    readonly surface: "runtime";
+    readonly subpaths: "published_exports";
+    readonly description: "React bindings for tenant-owned UI applications.";
+}, {
+    readonly packageName: "@lucern/mcp";
+    readonly surface: "runtime";
+    readonly subpaths: "published_exports";
+    readonly description: "MCP client/server entry points and hosted route helpers.";
+}, {
+    readonly packageName: "@lucern/contracts";
+    readonly surface: "contract";
+    readonly subpaths: "published_exports";
+    readonly description: "Published type and manifest contracts.";
+}, {
+    readonly packageName: "@lucern/types";
+    readonly surface: "contract";
+    readonly subpaths: "published_exports";
+    readonly description: "Published type-only helpers for tenant integration code.";
+}];
+type TenantClientPublicImport = (typeof TENANT_CLIENT_PUBLIC_IMPORTS)[number];
+type TenantClientPublicPackage = TenantClientPublicImport["packageName"];
+type TenantClientPublicSurface = TenantClientPublicImport["surface"];
+declare const TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS: readonly [{
+    readonly packageName: "@lucern/identity";
+    readonly importPath: "@lucern/identity/convex.config";
+    readonly surface: "component_config";
+    readonly description: "Convex component binding config for tenant deployments that install Lucern identity.";
+}, {
+    readonly packageName: "@lucern/reasoning-kernel";
+    readonly importPath: "@lucern/reasoning-kernel/convex.config";
+    readonly surface: "component_config";
+    readonly description: "Convex component binding config for tenant deployments that install the Lucern reasoning kernel.";
+}, {
+    readonly packageName: "@lucern/reasoning-kernel";
+    readonly importPath: "@lucern/reasoning-kernel/runtime.config";
+    readonly surface: "component_config";
+    readonly description: "Runtime config alias for tenant deployments that install the Lucern reasoning kernel.";
+}];
+type TenantClientComponentConfigImport = (typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS)[number];
+type TenantClientAllowedImport = TenantClientPublicImport | TenantClientComponentConfigImport;
+declare function findTenantClientInstallablePackage(packageName: string): TenantClientInstallablePackage | undefined;
+declare function isTenantClientInstallablePackage(packageName: string): boolean;
+declare const TENANT_CLIENT_REQUIRED_SDK_NAMESPACES: readonly ["bootstrap", "context", "beliefs", "evidence", "questions", "graph", "worktrees", "topics", "edges", "contradictions", "contracts", "graphAnalysis", "graphRecommendations", "orgGraphSearch", "embeddings", "ontologyLinks", "graphStateClassifier", "tools", "identity", "modelRuntime", "events", "jobs", "telemetry"];
+type TenantClientRequiredSdkNamespace = (typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES)[number];
+declare const TENANT_CLIENT_CAPABILITIES: readonly [{
+    readonly id: "identity.bootstrap_session";
+    readonly description: "Start a scoped Lucern session for a tenant principal.";
+    readonly surfaces: readonly ["@lucern/sdk", "@lucern/mcp"];
+    readonly requiredContextFields: readonly ["tenantId", "workspaceId", "principalId", "authMode", "scopes"];
+}, {
+    readonly id: "reasoning.context.compile";
+    readonly description: "Compile tenant and workspace scoped reasoning context.";
+    readonly surfaces: readonly ["@lucern/sdk", "@lucern/react", "@lucern/mcp"];
+    readonly requiredContextFields: readonly ["tenantId", "workspaceId", "principalId", "authMode", "scopes"];
+}, {
+    readonly id: "reasoning.graph.read";
+    readonly description: "Read beliefs, evidence, questions, topics, and lineage.";
+    readonly surfaces: readonly ["@lucern/sdk", "@lucern/react", "@lucern/mcp"];
+    readonly requiredContextFields: readonly ["tenantId", "workspaceId", "principalId", "authMode", "scopes"];
+}, {
+    readonly id: "reasoning.graph.write";
+    readonly description: "Create and update graph objects through authorized APIs.";
+    readonly surfaces: readonly ["@lucern/sdk", "@lucern/mcp"];
+    readonly requiredContextFields: readonly ["tenantId", "workspaceId", "principalId", "authMode", "scopes"];
+}, {
+    readonly id: "workflow.worktree_lifecycle";
+    readonly description: "Create, review, merge, and close scoped worktrees.";
+    readonly surfaces: readonly ["@lucern/sdk", "@lucern/react", "@lucern/mcp"];
+    readonly requiredContextFields: readonly ["tenantId", "workspaceId", "principalId", "authMode", "scopes"];
+}];
+type TenantClientCapability = (typeof TENANT_CLIENT_CAPABILITIES)[number];
+type TenantClientCapabilityId = TenantClientCapability["id"];
+declare const TENANT_CLIENT_ISOLATION_RULES: readonly [{
+    readonly id: "tenant_workspace_scope_required";
+    readonly description: "Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state.";
+}, {
+    readonly id: "principal_audit_required";
+    readonly description: "Runtime operations must carry principalId, authMode, and scopes for audit attribution.";
+}, {
+    readonly id: "no_private_lucern_imports";
+    readonly description: "Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals.";
+}];
+type TenantClientIsolationRule = (typeof TENANT_CLIENT_ISOLATION_RULES)[number];
+declare const TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS: readonly [{
+    readonly id: "deep_src_import";
+    readonly pattern: "^@lucern/[^/]+/src(?:/|$)";
+    readonly description: "Published packages must not be bypassed through src paths.";
+}, {
+    readonly id: "deep_dist_import";
+    readonly pattern: "^@lucern/[^/]+/dist(?:/|$)";
+    readonly description: "Published package exports must be used instead of dist file paths.";
+}, {
+    readonly id: "generated_adapter_import";
+    readonly pattern: "^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)";
+    readonly description: "Generated Lucern adapters are internal deployment artifacts.";
+}, {
+    readonly id: "private_runtime_import";
+    readonly pattern: "^@lucern/[^/]+/(?:internal|private)(?:/|$)";
+    readonly description: "Internal and private package subpaths are not public SDK API.";
+}, {
+    readonly id: "workspace_source_import";
+    readonly pattern: "^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)";
+    readonly description: "Tenant clients must not import source files from the Lucern monorepo.";
+}, {
+    readonly id: "root_alias_lucern_import";
+    readonly pattern: "^@/(?:lucern|packages|modules|services|apps)(?:/|$)";
+    readonly description: "Tenant clients must not depend on Lucern repo-local path aliases.";
+}, {
+    readonly id: "relative_lucern_source_import";
+    readonly pattern: "^\\.\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)";
+    readonly description: "Tenant clients must not reach back into Lucern source through relative paths.";
+}, {
+    readonly id: "monorepo_path_import";
+    readonly pattern: "lucern-repo";
+    readonly description: "Absolute imports that name the Lucern repository are not portable tenant code.";
+}];
+type TenantClientForbiddenImportPattern = (typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS)[number];
+type TenantClientForbiddenImportPatternId = TenantClientForbiddenImportPattern["id"];
+type TenantClientImportDecision = "public" | "forbidden" | "local" | "external";
+type TenantClientImportClassification = {
+    importPath: string;
+    decision: TenantClientImportDecision;
+    publicImport?: TenantClientAllowedImport;
+    pattern?: TenantClientForbiddenImportPattern;
+    reason: string;
+};
+declare function classifyTenantClientImport(importPath: string): TenantClientImportClassification;
+declare function isTenantClientPublicImport(importPath: string): boolean;
+declare function isTenantClientComponentConfigImport(importPath: string): boolean;
+declare function isTenantClientAllowedImport(importPath: string): boolean;
+declare function assertTenantClientImportAllowed(importPath: string): void;
+declare function formatTenantClientImportViolation(classification: TenantClientImportClassification): string;
+
+export { TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, type TenantClientAllowedImport, type TenantClientAuthMode, type TenantClientCapability, type TenantClientCapabilityId, type TenantClientComponentConfigImport, type TenantClientForbiddenImportPattern, type TenantClientForbiddenImportPatternId, type TenantClientForbiddenInstallTokenInfisicalPath, type TenantClientForbiddenSecretEnv, type TenantClientImportClassification, type TenantClientImportDecision, type TenantClientInstallablePackage, type TenantClientInstallablePackageName, type TenantClientIsolationRule, type TenantClientOptionalContextField, type TenantClientPackageRole, type TenantClientPrincipalType, type TenantClientPublicImport, type TenantClientPublicPackage, type TenantClientPublicSurface, type TenantClientRequiredContextField, type TenantClientRequiredSdkNamespace, assertTenantClientImportAllowed, classifyTenantClientImport, findTenantClientInstallablePackage, formatTenantClientImportViolation, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport };