@lucern/contracts 0.3.0-alpha.2 → 0.3.0-alpha.3

package/dist/mcp-gateway-boundary.contract.d.ts

@@ -0,0 +1,181 @@
+import { SessionPrincipalType, SessionAuthMode } from './auth.contract.js';
+import './convex-admin.contract.js';
+
+/**
+ * MCP gateway boundary contract
+ *
+ * Defines the target thin-client boundary for the Lucern MCP server. MCP is a
+ * client of the Lucern gateway, not a privileged Convex or Master Control
+ * process. The gateway owns tenant resolution, deploy-key access, policy, and
+ * session persistence.
+ */
+
+declare const MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION: "2026-04-27";
+declare const MCP_GATEWAY_BOOTSTRAP_ENDPOINT: "/api/platform/v1/mcp/session";
+declare const MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT: "/api/platform/v1/mcp/write-policy/check";
+declare const MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT: "/api/platform/v1/mcp/build-session/begin";
+declare const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT: "/api/platform/v1/mcp/contracts/evaluate-engineering";
+declare const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT: "/api/platform/v1/mcp/contracts/evaluate-research";
+declare const MCP_GATEWAY_ALLOWED_CLIENT_ENV: readonly ["LUCERN_API_KEY", "LUCERN_API_BASE_URL", "LUCERN_ENVIRONMENT", "LUCERN_USER_TOKEN"];
+type McpGatewayAllowedClientEnv = (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];
+declare const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV: readonly ["MC_CONVEX_URL", "MC_DEPLOY_KEY", "LUCERN_CONVEX_URL", "LUCERN_DEPLOY_KEY", "TENANT_CONVEX_URL", "TENANT_DEPLOY_KEY"];
+type McpGatewayForbiddenClientEnv = (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];
+declare const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS: readonly ["tenant", "session", "permissions"];
+type McpGatewayBootstrapRequiredField = (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];
+type McpGatewayTenantContext = {
+    tenantId: string;
+    slug: string;
+    name: string;
+    tier: string;
+    methodologyPackIds: string[];
+    apiKeyId?: string;
+};
+type McpGatewaySessionContext = {
+    sessionType: "agent" | "user";
+    userId: string;
+    principalId: string;
+    principalType: SessionPrincipalType;
+    workspaceId?: string;
+    authMode: SessionAuthMode;
+    roles: string[];
+    scopes: string[];
+    sessionId?: string;
+    userEmail?: string;
+    expiresAt?: number;
+};
+type McpGatewayPermissionContext = {
+    allowedTools: string[] | null;
+    allowedTopics: string[] | null;
+    groupIds: string[];
+    permittedPackKeys: string[];
+    permittedToolNames: string[];
+    permittedTools: Array<{
+        toolName: string;
+        requiredRole?: string;
+        approvalGateId?: string;
+        isCore?: boolean;
+        category?: string;
+    }>;
+};
+type McpGatewayBootstrapRequest = {
+    transportKind?: "stdio" | "hosted";
+    sessionId?: string;
+    agentIdentity?: string;
+    workspaceId?: string;
+};
+type McpGatewayWritePolicyCheckRequest = {
+    topicId?: string;
+    role: string;
+    toolName: string;
+};
+type McpGatewayBeginBuildSessionRequest = {
+    worktreeId: string;
+    branch?: string;
+    branchBase?: string;
+    prBase?: string;
+    sessionMode?: string;
+    activateIfPlanning?: boolean;
+};
+type McpGatewayJsonObject = {
+    [key: string]: McpGatewayJsonValue | undefined;
+};
+type McpGatewayJsonArray = McpGatewayJsonValue[];
+type McpGatewayJsonValue = null | boolean | number | string | McpGatewayJsonArray | McpGatewayJsonObject;
+type McpGatewayEvaluateEngineeringContractRequest = {
+    beliefNodeId?: McpGatewayJsonValue;
+    trigger?: McpGatewayJsonValue;
+    testOutput?: McpGatewayJsonValue;
+    tscOutput?: McpGatewayJsonValue;
+    lintOutput?: McpGatewayJsonValue;
+    sentryData?: McpGatewayJsonValue;
+};
+type McpGatewayEvaluateResearchContractRequest = {
+    beliefNodeId?: McpGatewayJsonValue;
+    trigger?: McpGatewayJsonValue;
+    metricData?: McpGatewayJsonValue;
+    referenceCheckData?: McpGatewayJsonValue;
+    marketIndexData?: McpGatewayJsonValue;
+    temporalData?: McpGatewayJsonValue;
+};
+type McpGatewayContractEvaluationResponse = McpGatewayJsonObject;
+type McpGatewayWritePolicyCheckResponse = {
+    allowed: boolean;
+    permission: string;
+    rationale?: string;
+    maxWritesPerSession?: number;
+    toolCategory?: string | null;
+    policy?: McpGatewayJsonObject | null;
+    explanation?: McpGatewayJsonObject;
+    reason: string;
+};
+type McpGatewayBootstrapResponse = {
+    tenant: McpGatewayTenantContext;
+    session: McpGatewaySessionContext;
+    permissions: McpGatewayPermissionContext;
+};
+type McpGatewayBuildSessionBelief = {
+    nodeId: string;
+    text: string;
+    confidence: number | null;
+};
+type McpGatewayBuildSessionQuestion = {
+    nodeId: string;
+    text: string;
+    priority: string;
+};
+type McpGatewayBuildSessionDecision = {
+    question: string;
+    decision: string;
+};
+type McpGatewayBuildSessionWorktreeSummary = {
+    worktreeId: string;
+    title: string;
+    status?: string;
+};
+type McpGatewayBeginBuildSessionResponse = {
+    topicId: string;
+    topicName: string;
+    worktreeId: string;
+    worktreeName: string;
+    branch: string;
+    branchBase: string;
+    prBase: string;
+    campaign: number | null;
+    lane: string;
+    laneOrderInCampaign: number | null;
+    orderInLane: number | null;
+    gate: string;
+    hypothesis: string;
+    focus: string;
+    status: string;
+    sessionMode: string;
+    targetBeliefIds: string[];
+    targetQuestionIds: string[];
+    topBeliefs: McpGatewayBuildSessionBelief[];
+    openQuestions: McpGatewayBuildSessionQuestion[];
+    resolvedDecisions: McpGatewayBuildSessionDecision[];
+    exitCriteria: string[];
+    requiredDocs: string[];
+    keyFiles: string[];
+    pillarBeliefs: Array<{
+        pillar: string;
+        text: string;
+        nodeId: string;
+    }>;
+    visionDocs: Array<{
+        path: string;
+        description: string;
+    }>;
+    dependencies: McpGatewayBuildSessionWorktreeSummary[];
+    unblocks: Array<{
+        worktreeId: string;
+        title: string;
+    }>;
+    mergeOrderNotes: string;
+};
+declare const MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS: readonly ["validate_mcp_session", "record_key_usage", "resolve_default_workspace", "resolve_user_context", "create_user_session", "upsert_agent_principal"];
+type McpGatewayOwnedBootstrapOperation = (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS)[number];
+declare const MCP_GATEWAY_CLIENT_ONLY_PACKAGES: readonly ["@lucern/sdk", "@lucern/mcp", "@lucern/contracts"];
+type McpGatewayClientOnlyPackage = (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];
+
+export { MCP_GATEWAY_ALLOWED_CLIENT_ENV, MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS, MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION, MCP_GATEWAY_CLIENT_ONLY_PACKAGES, MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT, MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT, MCP_GATEWAY_FORBIDDEN_CLIENT_ENV, MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS, MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT, type McpGatewayAllowedClientEnv, type McpGatewayBeginBuildSessionRequest, type McpGatewayBeginBuildSessionResponse, type McpGatewayBootstrapRequest, type McpGatewayBootstrapRequiredField, type McpGatewayBootstrapResponse, type McpGatewayBuildSessionBelief, type McpGatewayBuildSessionDecision, type McpGatewayBuildSessionQuestion, type McpGatewayBuildSessionWorktreeSummary, type McpGatewayClientOnlyPackage, type McpGatewayContractEvaluationResponse, type McpGatewayEvaluateEngineeringContractRequest, type McpGatewayEvaluateResearchContractRequest, type McpGatewayForbiddenClientEnv, type McpGatewayJsonArray, type McpGatewayJsonObject, type McpGatewayJsonValue, type McpGatewayOwnedBootstrapOperation, type McpGatewayPermissionContext, type McpGatewaySessionContext, type McpGatewayTenantContext, type McpGatewayWritePolicyCheckRequest, type McpGatewayWritePolicyCheckResponse };

package/dist/mcp-gateway-boundary.contract.js

@@ -0,0 +1,43 @@
+// src/mcp-gateway-boundary.contract.ts
+var MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION = "2026-04-27";
+var MCP_GATEWAY_BOOTSTRAP_ENDPOINT = "/api/platform/v1/mcp/session";
+var MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT = "/api/platform/v1/mcp/write-policy/check";
+var MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT = "/api/platform/v1/mcp/build-session/begin";
+var MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT = "/api/platform/v1/mcp/contracts/evaluate-engineering";
+var MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT = "/api/platform/v1/mcp/contracts/evaluate-research";
+var MCP_GATEWAY_ALLOWED_CLIENT_ENV = [
+  "LUCERN_API_KEY",
+  "LUCERN_API_BASE_URL",
+  "LUCERN_ENVIRONMENT",
+  "LUCERN_USER_TOKEN"
+];
+var MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [
+  "MC_CONVEX_URL",
+  "MC_DEPLOY_KEY",
+  "LUCERN_CONVEX_URL",
+  "LUCERN_DEPLOY_KEY",
+  "TENANT_CONVEX_URL",
+  "TENANT_DEPLOY_KEY"
+];
+var MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS = [
+  "tenant",
+  "session",
+  "permissions"
+];
+var MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS = [
+  "validate_mcp_session",
+  "record_key_usage",
+  "resolve_default_workspace",
+  "resolve_user_context",
+  "create_user_session",
+  "upsert_agent_principal"
+];
+var MCP_GATEWAY_CLIENT_ONLY_PACKAGES = [
+  "@lucern/sdk",
+  "@lucern/mcp",
+  "@lucern/contracts"
+];
+
+export { MCP_GATEWAY_ALLOWED_CLIENT_ENV, MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS, MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION, MCP_GATEWAY_CLIENT_ONLY_PACKAGES, MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT, MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT, MCP_GATEWAY_FORBIDDEN_CLIENT_ENV, MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS, MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT };
+//# sourceMappingURL=mcp-gateway-boundary.contract.js.map
+//# sourceMappingURL=mcp-gateway-boundary.contract.js.map

package/dist/mcp-gateway-boundary.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp-gateway-boundary.contract.ts"],"names":[],"mappings":";AAcO,IAAM,qCAAA,GAAwC;AAE9C,IAAM,8BAAA,GACX;AAEK,IAAM,uCAAA,GACX;AAEK,IAAM,wCAAA,GACX;AAEK,IAAM,kDAAA,GACX;AAEK,IAAM,+CAAA,GACX;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C,gBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,eAAA;AAAA,EACA,eAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAoLO,IAAM,sCAAA,GAAyC;AAAA,EACpD,sBAAA;AAAA,EACA,kBAAA;AAAA,EACA,2BAAA;AAAA,EACA,sBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,aAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF","file":"mcp-gateway-boundary.contract.js","sourcesContent":["/**\n * MCP gateway boundary contract\n *\n * Defines the target thin-client boundary for the Lucern MCP server. MCP is a\n * client of the Lucern gateway, not a privileged Convex or Master Control\n * process. The gateway owns tenant resolution, deploy-key access, policy, and\n * session persistence.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const MCP_GATEWAY_BOOTSTRAP_ENDPOINT =\n  \"/api/platform/v1/mcp/session\" as const;\n\nexport const MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT =\n  \"/api/platform/v1/mcp/write-policy/check\" as const;\n\nexport const MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT =\n  \"/api/platform/v1/mcp/build-session/begin\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-engineering\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-research\" as const;\n\nexport const MCP_GATEWAY_ALLOWED_CLIENT_ENV = [\n  \"LUCERN_API_KEY\",\n  \"LUCERN_API_BASE_URL\",\n  \"LUCERN_ENVIRONMENT\",\n  \"LUCERN_USER_TOKEN\",\n] as const;\nexport type McpGatewayAllowedClientEnv =\n  (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [\n  \"MC_CONVEX_URL\",\n  \"MC_DEPLOY_KEY\",\n  \"LUCERN_CONVEX_URL\",\n  \"LUCERN_DEPLOY_KEY\",\n  \"TENANT_CONVEX_URL\",\n  \"TENANT_DEPLOY_KEY\",\n] as const;\nexport type McpGatewayForbiddenClientEnv =\n  (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS = [\n  \"tenant\",\n  \"session\",\n  \"permissions\",\n] as const;\nexport type McpGatewayBootstrapRequiredField =\n  (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];\n\nexport type McpGatewayTenantContext = {\n  tenantId: string;\n  slug: string;\n  name: string;\n  tier: string;\n  methodologyPackIds: string[];\n  apiKeyId?: string;\n};\n\nexport type McpGatewaySessionContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  workspaceId?: string;\n  authMode: SessionAuthMode;\n  roles: string[];\n  scopes: string[];\n  sessionId?: string;\n  userEmail?: string;\n  expiresAt?: number;\n};\n\nexport type McpGatewayPermissionContext = {\n  allowedTools: string[] | null;\n  allowedTopics: string[] | null;\n  groupIds: string[];\n  permittedPackKeys: string[];\n  permittedToolNames: string[];\n  permittedTools: Array<{\n    toolName: string;\n    requiredRole?: string;\n    approvalGateId?: string;\n    isCore?: boolean;\n    category?: string;\n  }>;\n};\n\nexport type McpGatewayBootstrapRequest = {\n  transportKind?: \"stdio\" | \"hosted\";\n  sessionId?: string;\n  agentIdentity?: string;\n  workspaceId?: string;\n};\n\nexport type McpGatewayWritePolicyCheckRequest = {\n  topicId?: string;\n  role: string;\n  toolName: string;\n};\n\nexport type McpGatewayBeginBuildSessionRequest = {\n  worktreeId: string;\n  branch?: string;\n  branchBase?: string;\n  prBase?: string;\n  sessionMode?: string;\n  activateIfPlanning?: boolean;\n};\n\nexport type McpGatewayJsonObject = {\n  [key: string]: McpGatewayJsonValue | undefined;\n};\n\nexport type McpGatewayJsonArray = McpGatewayJsonValue[];\n\nexport type McpGatewayJsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | McpGatewayJsonArray\n  | McpGatewayJsonObject;\n\nexport type McpGatewayEvaluateEngineeringContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  testOutput?: McpGatewayJsonValue;\n  tscOutput?: McpGatewayJsonValue;\n  lintOutput?: McpGatewayJsonValue;\n  sentryData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayEvaluateResearchContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  metricData?: McpGatewayJsonValue;\n  referenceCheckData?: McpGatewayJsonValue;\n  marketIndexData?: McpGatewayJsonValue;\n  temporalData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayContractEvaluationResponse = McpGatewayJsonObject;\n\nexport type McpGatewayWritePolicyCheckResponse = {\n  allowed: boolean;\n  permission: string;\n  rationale?: string;\n  maxWritesPerSession?: number;\n  toolCategory?: string | null;\n  policy?: McpGatewayJsonObject | null;\n  explanation?: McpGatewayJsonObject;\n  reason: string;\n};\n\nexport type McpGatewayBootstrapResponse = {\n  tenant: McpGatewayTenantContext;\n  session: McpGatewaySessionContext;\n  permissions: McpGatewayPermissionContext;\n};\n\nexport type McpGatewayBuildSessionBelief = {\n  nodeId: string;\n  text: string;\n  confidence: number | null;\n};\n\nexport type McpGatewayBuildSessionQuestion = {\n  nodeId: string;\n  text: string;\n  priority: string;\n};\n\nexport type McpGatewayBuildSessionDecision = {\n  question: string;\n  decision: string;\n};\n\nexport type McpGatewayBuildSessionWorktreeSummary = {\n  worktreeId: string;\n  title: string;\n  status?: string;\n};\n\nexport type McpGatewayBeginBuildSessionResponse = {\n  topicId: string;\n  topicName: string;\n  worktreeId: string;\n  worktreeName: string;\n  branch: string;\n  branchBase: string;\n  prBase: string;\n  campaign: number | null;\n  lane: string;\n  laneOrderInCampaign: number | null;\n  orderInLane: number | null;\n  gate: string;\n  hypothesis: string;\n  focus: string;\n  status: string;\n  sessionMode: string;\n  targetBeliefIds: string[];\n  targetQuestionIds: string[];\n  topBeliefs: McpGatewayBuildSessionBelief[];\n  openQuestions: McpGatewayBuildSessionQuestion[];\n  resolvedDecisions: McpGatewayBuildSessionDecision[];\n  exitCriteria: string[];\n  requiredDocs: string[];\n  keyFiles: string[];\n  pillarBeliefs: Array<{\n    pillar: string;\n    text: string;\n    nodeId: string;\n  }>;\n  visionDocs: Array<{\n    path: string;\n    description: string;\n  }>;\n  dependencies: McpGatewayBuildSessionWorktreeSummary[];\n  unblocks: Array<{\n    worktreeId: string;\n    title: string;\n  }>;\n  mergeOrderNotes: string;\n};\n\nexport const MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS = [\n  \"validate_mcp_session\",\n  \"record_key_usage\",\n  \"resolve_default_workspace\",\n  \"resolve_user_context\",\n  \"create_user_session\",\n  \"upsert_agent_principal\",\n] as const;\nexport type McpGatewayOwnedBootstrapOperation =\n  (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS)[number];\n\nexport const MCP_GATEWAY_CLIENT_ONLY_PACKAGES = [\n  \"@lucern/sdk\",\n  \"@lucern/mcp\",\n  \"@lucern/contracts\",\n] as const;\nexport type McpGatewayClientOnlyPackage =\n  (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];\n"]}

package/dist/schemas/component-table-manifest.d.ts

@@ -41,7 +41,7 @@ declare const ComponentTableManifestSchema: z.ZodObject<{
         }[];
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    tier: "K" | "I";
+    tier: "I" | "K";
     manifestVersion: string;
     componentName: "kernel" | "identity";
     packageVersion: string;
@@ -55,7 +55,7 @@ declare const ComponentTableManifestSchema: z.ZodObject<{
         }[];
     }[];
 }, {
-    tier: "K" | "I";
+    tier: "I" | "K";
     manifestVersion: string;
     componentName: "kernel" | "identity";
     packageVersion: string;

package/dist/schemas/index.js

@@ -1848,6 +1848,40 @@ var rateLimitWindows = defineTable({
     { kind: "index", name: "by_tier_window_end", columns: ["tier", "windowEndMs"] }
   ]
 });
+var oauthDeviceCodes = defineTable({
+  name: "oauthDeviceCodes",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "deviceCodeHash": z.string(),
+    "userCode": z.string(),
+    "clientId": z.string(),
+    "scope": z.string(),
+    "status": z.enum(["pending", "approved", "denied", "expired", "consumed"]),
+    "expiresAt": z.number(),
+    "intervalSeconds": z.number(),
+    "lastPolledAt": z.number().optional(),
+    "slowDownCount": z.number().optional(),
+    "clerkUserId": z.string().optional(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": z.string().optional(),
+    "principalId": z.string().optional(),
+    "role": z.string().optional(),
+    "scopes": z.array(z.string()).optional(),
+    "sessionId": z.string().optional(),
+    "approvedAt": z.number().optional(),
+    "deniedAt": z.number().optional(),
+    "consumedAt": z.number().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_deviceCodeHash", columns: ["deviceCodeHash"] },
+    { kind: "index", name: "by_userCode", columns: ["userCode"] },
+    { kind: "index", name: "by_status_expiresAt", columns: ["status", "expiresAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId"] }
+  ]
+});
 var servicePrincipalKeys = defineTable({
   name: "servicePrincipalKeys",
   component: "mc",
@@ -4212,6 +4246,7 @@ var MC_TABLE_CONTRACTS = [
   groupMemberships,
   groups,
   memberships,
+  oauthDeviceCodes,
   principals,
   rateLimitWindows,
   servicePrincipalKeys,