@lucern/contracts 0.3.0-alpha.2 → 0.3.0-alpha.4

package/dist/component-boundary.contract.d.ts

@@ -0,0 +1,14 @@
+import { TableOwnershipLayer, TABLE_OWNERSHIP } from './generated/tableOwnership.js';
+
+declare const COMPONENT_BOUNDARY_CONTRACT_VERSION: "2026-04-27";
+declare const COMPONENT_BOUNDARY_COMPONENT_LAYERS: readonly ["I", "K"];
+type ComponentBoundaryComponentLayer = (typeof COMPONENT_BOUNDARY_COMPONENT_LAYERS)[number];
+declare const COMPONENT_BOUNDARY_DIRECT_DB_METHODS: readonly ["insert", "patch", "replace", "delete", "query"];
+type ComponentBoundaryDirectDbMethod = (typeof COMPONENT_BOUNDARY_DIRECT_DB_METHODS)[number];
+declare const COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS: readonly ["services", "apps", "convex"];
+declare const COMPONENT_BOUNDARY_HIGH_RISK_TABLES: readonly ["backgroundJobRuns", "backgroundJobSettings", "systemLogs", "epistemicAudit", "platformPolicyDecisionLogs", "tenantApiKeys", "projectGrants", "userSessions"];
+type ComponentBoundaryHighRiskTable = (typeof COMPONENT_BOUNDARY_HIGH_RISK_TABLES)[number];
+declare function getComponentBoundaryTableLayer(tableName: string): TableOwnershipLayer | undefined;
+declare function isComponentBoundaryComponentOwnedTable(tableName: string): tableName is keyof typeof TABLE_OWNERSHIP;
+
+export { COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, type ComponentBoundaryComponentLayer, type ComponentBoundaryDirectDbMethod, type ComponentBoundaryHighRiskTable, getComponentBoundaryTableLayer, isComponentBoundaryComponentOwnedTable };

package/dist/component-boundary.contract.js

@@ -0,0 +1,155 @@
+// src/generated/tableOwnership.ts
+var TABLE_OWNERSHIP = {
+  "agentMessages": "K",
+  "agentRegistryEntries": "L",
+  "agents": "I",
+  "agentSessions": "K",
+  "apiKeys": "L",
+  "auditLog": "L",
+  "autofixJobs": "K",
+  "backgroundJobRuns": "K",
+  "backgroundJobSettings": "K",
+  "beliefConfidence": "K",
+  "beliefEvidenceLinks": "K",
+  "beliefHistory": "K",
+  "beliefScenarios": "K",
+  "beliefVotes": "K",
+  "calibrationScores": "K",
+  "compatibilityShims": "L",
+  "contractEvaluations": "K",
+  "contradictions": "K",
+  "controlPlaneTenantModelSlotBindings": "L",
+  "controlPlaneTenantProviderSecrets": "L",
+  "controlPlaneTenantProxyGatewayUsage": "L",
+  "controlPlaneToolAcls": "L",
+  "crossProjectConnections": "K",
+  "cutoverFlags": "L",
+  "decisionComputedSummaries": "K",
+  "decisionEvents": "K",
+  "decisionParticipants": "K",
+  "decisionRiskLedger": "K",
+  "decisionSnapshots": "K",
+  "deliberationContributions": "K",
+  "deliberationSessions": "K",
+  "epistemicAudit": "K",
+  "epistemicContracts": "K",
+  "epistemicEdges": "K",
+  "epistemicNodeEmbeddings": "K",
+  "epistemicNodes": "K",
+  "graphAnalysisCache": "K",
+  "graphAnalysisResults": "K",
+  "graphSuggestions": "K",
+  "groupMemberships": "L",
+  "groups": "L",
+  "harnessReplays": "K",
+  "harnessRuns": "K",
+  "idempotencyTokens": "K",
+  "lenses": "K",
+  "lensTopicBindings": "K",
+  "mcpWritePolicy": "I",
+  "memberships": "L",
+  "methodologyPacks": "L",
+  "modelCallLogs": "I",
+  "modelFunctionSlots": "I",
+  "modelRegistry": "I",
+  "modelSlotConfigs": "I",
+  "neo4jSyncQueue": "K",
+  "oauthDeviceCodes": "L",
+  "ontologyDefinitions": "K",
+  "ontologyVersions": "K",
+  "packAssignments": "L",
+  "packDefinitions": "L",
+  "packEntitlements": "L",
+  "packGroupAssignments": "L",
+  "packInstallations": "L",
+  "packVersions": "L",
+  "platformAgentRunPolicyDecisions": "K",
+  "platformAgentRunPromptResolutions": "K",
+  "platformAgentRuns": "K",
+  "platformAgentRunToolCalls": "K",
+  "platformAudienceGrants": "I",
+  "platformAudiences": "I",
+  "platformHarnessShadowAudit": "K",
+  "platformPolicyDecisionLogs": "I",
+  "policyBundles": "L",
+  "policyDecisionLogs": "L",
+  "policySimulations": "L",
+  "principals": "L",
+  "projectGrants": "I",
+  "publicationRules": "K",
+  "questionEvidenceLinks": "K",
+  "rateLimitWindows": "L",
+  "reasoningPermissions": "I",
+  "researchJobs": "K",
+  "schemaEnumConfig": "K",
+  "servicePrincipalKeys": "L",
+  "stakeholderGroups": "K",
+  "systemLogs": "K",
+  "tasks": "K",
+  "tenantApiKeys": "I",
+  "tenantConfig": "I",
+  "tenantDeploymentCredentials": "L",
+  "tenantIntegrations": "I",
+  "tenantMethodologyAssignments": "L",
+  "tenantModelSlotBindings": "I",
+  "tenantPolicies": "I",
+  "tenantProviderSecrets": "I",
+  "tenantProxyGatewayUsage": "I",
+  "tenantProxyTokenMints": "I",
+  "tenants": "L",
+  "tenantSandboxAuditEvents": "I",
+  "tenantSecrets": "I",
+  "toolAcls": "I",
+  "toolCatalog": "L",
+  "toolRegistry": "I",
+  "toolRegistryEntries": "L",
+  "topics": "K",
+  "users": "I",
+  "userSessions": "L",
+  "workflowDefinitions": "K",
+  "workflowPullRequests": "K",
+  "workflowStages": "K",
+  "workspaces": "L",
+  "worktreeBeliefCluster": "K",
+  "worktrees": "K"
+};
+
+// src/component-boundary.contract.ts
+var COMPONENT_BOUNDARY_CONTRACT_VERSION = "2026-04-27";
+var COMPONENT_BOUNDARY_COMPONENT_LAYERS = [
+  "I",
+  "K"
+];
+var COMPONENT_BOUNDARY_DIRECT_DB_METHODS = [
+  "insert",
+  "patch",
+  "replace",
+  "delete",
+  "query"
+];
+var COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS = [
+  "services",
+  "apps",
+  "convex"
+];
+var COMPONENT_BOUNDARY_HIGH_RISK_TABLES = [
+  "backgroundJobRuns",
+  "backgroundJobSettings",
+  "systemLogs",
+  "epistemicAudit",
+  "platformPolicyDecisionLogs",
+  "tenantApiKeys",
+  "projectGrants",
+  "userSessions"
+];
+function getComponentBoundaryTableLayer(tableName) {
+  return TABLE_OWNERSHIP[tableName];
+}
+function isComponentBoundaryComponentOwnedTable(tableName) {
+  const layer = getComponentBoundaryTableLayer(tableName);
+  return layer === "I" || layer === "K";
+}
+
+export { COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, getComponentBoundaryTableLayer, isComponentBoundaryComponentOwnedTable };
+//# sourceMappingURL=component-boundary.contract.js.map
+//# sourceMappingURL=component-boundary.contract.js.map

package/dist/component-boundary.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/generated/tableOwnership.ts","../src/component-boundary.contract.ts"],"names":[],"mappings":";AA+HO,IAAM,eAAA,GAAkB;AAAA,EAC7B,eAAA,EAAiB,GAAA;AAAA,EACjB,sBAAA,EAAwB,GAAA;AAAA,EACxB,QAAA,EAAU,GAAA;AAAA,EACV,eAAA,EAAiB,GAAA;AAAA,EACjB,SAAA,EAAW,GAAA;AAAA,EACX,UAAA,EAAY,GAAA;AAAA,EACZ,aAAA,EAAe,GAAA;AAAA,EACf,mBAAA,EAAqB,GAAA;AAAA,EACrB,uBAAA,EAAyB,GAAA;AAAA,EACzB,kBAAA,EAAoB,GAAA;AAAA,EACpB,qBAAA,EAAuB,GAAA;AAAA,EACvB,eAAA,EAAiB,GAAA;AAAA,EACjB,iBAAA,EAAmB,GAAA;AAAA,EACnB,aAAA,EAAe,GAAA;AAAA,EACf,mBAAA,EAAqB,GAAA;AAAA,EACrB,oBAAA,EAAsB,GAAA;AAAA,EACtB,qBAAA,EAAuB,GAAA;AAAA,EACvB,gBAAA,EAAkB,GAAA;AAAA,EAClB,qCAAA,EAAuC,GAAA;AAAA,EACvC,mCAAA,EAAqC,GAAA;AAAA,EACrC,qCAAA,EAAuC,GAAA;AAAA,EACvC,sBAAA,EAAwB,GAAA;AAAA,EACxB,yBAAA,EAA2B,GAAA;AAAA,EAC3B,cAAA,EAAgB,GAAA;AAAA,EAChB,2BAAA,EAA6B,GAAA;AAAA,EAC7B,gBAAA,EAAkB,GAAA;AAAA,EAClB,sBAAA,EAAwB,GAAA;AAAA,EACxB,oBAAA,EAAsB,GAAA;AAAA,EACtB,mBAAA,EAAqB,GAAA;AAAA,EACrB,2BAAA,EAA6B,GAAA;AAAA,EAC7B,sBAAA,EAAwB,GAAA;AAAA,EACxB,gBAAA,EAAkB,GAAA;AAAA,EAClB,oBAAA,EAAsB,GAAA;AAAA,EACtB,gBAAA,EAAkB,GAAA;AAAA,EAClB,yBAAA,EAA2B,GAAA;AAAA,EAC3B,gBAAA,EAAkB,GAAA;AAAA,EAClB,oBAAA,EAAsB,GAAA;AAAA,EACtB,sBAAA,EAAwB,GAAA;AAAA,EACxB,kBAAA,EAAoB,GAAA;AAAA,EACpB,kBAAA,EAAoB,GAAA;AAAA,EACpB,QAAA,EAAU,GAAA;AAAA,EACV,gBAAA,EAAkB,GAAA;AAAA,EAClB,aAAA,EAAe,GAAA;AAAA,EACf,mBAAA,EAAqB,GAAA;AAAA,EACrB,QAAA,EAAU,GAAA;AAAA,EACV,mBAAA,EAAqB,GAAA;AAAA,EACrB,gBAAA,EAAkB,GAAA;AAAA,EAClB,aAAA,EAAe,GAAA;AAAA,EACf,kBAAA,EAAoB,GAAA;AAAA,EACpB,eAAA,EAAiB,GAAA;AAAA,EACjB,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB,GAAA;AAAA,EACjB,kBAAA,EAAoB,GAAA;AAAA,EACpB,gBAAA,EAAkB,GAAA;AAAA,EAClB,kBAAA,EAAoB,GAAA;AAAA,EACpB,qBAAA,EAAuB,GAAA;AAAA,EACvB,kBAAA,EAAoB,GAAA;AAAA,EACpB,iBAAA,EAAmB,GAAA;AAAA,EACnB,iBAAA,EAAmB,GAAA;AAAA,EACnB,kBAAA,EAAoB,GAAA;AAAA,EACpB,sBAAA,EAAwB,GAAA;AAAA,EACxB,mBAAA,EAAqB,GAAA;AAAA,EACrB,cAAA,EAAgB,GAAA;AAAA,EAChB,iCAAA,EAAmC,GAAA;AAAA,EACnC,mCAAA,EAAqC,GAAA;AAAA,EACrC,mBAAA,EAAqB,GAAA;AAAA,EACrB,2BAAA,EAA6B,GAAA;AAAA,EAC7B,wBAAA,EAA0B,GAAA;AAAA,EAC1B,mBAAA,EAAqB,GAAA;AAAA,EACrB,4BAAA,EAA8B,GAAA;AAAA,EAC9B,4BAAA,EAA8B,GAAA;AAAA,EAC9B,eAAA,EAAiB,GAAA;AAAA,EACjB,oBAAA,EAAsB,GAAA;AAAA,EACtB,mBAAA,EAAqB,GAAA;AAAA,EACrB,YAAA,EAAc,GAAA;AAAA,EACd,eAAA,EAAiB,GAAA;AAAA,EACjB,kBAAA,EAAoB,GAAA;AAAA,EACpB,uBAAA,EAAyB,GAAA;AAAA,EACzB,kBAAA,EAAoB,GAAA;AAAA,EACpB,sBAAA,EAAwB,GAAA;AAAA,EACxB,cAAA,EAAgB,GAAA;AAAA,EAChB,kBAAA,EAAoB,GAAA;AAAA,EACpB,sBAAA,EAAwB,GAAA;AAAA,EACxB,mBAAA,EAAqB,GAAA;AAAA,EACrB,YAAA,EAAc,GAAA;AAAA,EACd,OAAA,EAAS,GAAA;AAAA,EACT,eAAA,EAAiB,GAAA;AAAA,EACjB,cAAA,EAAgB,GAAA;AAAA,EAChB,6BAAA,EAA+B,GAAA;AAAA,EAC/B,oBAAA,EAAsB,GAAA;AAAA,EACtB,8BAAA,EAAgC,GAAA;AAAA,EAChC,yBAAA,EAA2B,GAAA;AAAA,EAC3B,gBAAA,EAAkB,GAAA;AAAA,EAClB,uBAAA,EAAyB,GAAA;AAAA,EACzB,yBAAA,EAA2B,GAAA;AAAA,EAC3B,uBAAA,EAAyB,GAAA;AAAA,EACzB,SAAA,EAAW,GAAA;AAAA,EACX,0BAAA,EAA4B,GAAA;AAAA,EAC5B,eAAA,EAAiB,GAAA;AAAA,EACjB,UAAA,EAAY,GAAA;AAAA,EACZ,aAAA,EAAe,GAAA;AAAA,EACf,cAAA,EAAgB,GAAA;AAAA,EAChB,qBAAA,EAAuB,GAAA;AAAA,EACvB,QAAA,EAAU,GAAA;AAAA,EACV,OAAA,EAAS,GAAA;AAAA,EACT,cAAA,EAAgB,GAAA;AAAA,EAChB,qBAAA,EAAuB,GAAA;AAAA,EACvB,sBAAA,EAAwB,GAAA;AAAA,EACxB,gBAAA,EAAkB,GAAA;AAAA,EAClB,YAAA,EAAc,GAAA;AAAA,EACd,uBAAA,EAAyB,GAAA;AAAA,EACzB,WAAA,EAAa;AACf,CAAA;;;AC3OO,IAAM,mCAAA,GAAsC;AAE5C,IAAM,mCAAA,GAAsC;AAAA,EACjD,GAAA;AAAA,EACA;AACF;AAIO,IAAM,oCAAA,GAAuC;AAAA,EAClD,QAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAIO,IAAM,oCAAA,GAAuC;AAAA,EAClD,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF;AAEO,IAAM,mCAAA,GAAsC;AAAA,EACjD,mBAAA;AAAA,EACA,uBAAA;AAAA,EACA,YAAA;AAAA,EACA,gBAAA;AAAA,EACA,4BAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF;AAIO,SAAS,+BACd,SAAA,EACiC;AACjC,EAAA,OAAO,gBAAgB,SAAyC,CAAA;AAClE;AAEO,SAAS,uCACd,SAAA,EAC2C;AAC3C,EAAA,MAAM,KAAA,GAAQ,+BAA+B,SAAS,CAAA;AACtD,EAAA,OACE,KAAA,KAAU,OACV,KAAA,KAAU,GAAA;AAEd","file":"component-boundary.contract.js","sourcesContent":["/* GENERATED by scripts/generate-contract-schema.ts. DO NOT EDIT. */\n\nexport type TableOwnershipLayer = \"L\" | \"I\" | \"K\" | \"D\" | \"A\";\n\nexport const TABLES_BY_LAYER = {\n  \"L\": [\n    \"agentRegistryEntries\",\n    \"apiKeys\",\n    \"auditLog\",\n    \"compatibilityShims\",\n    \"controlPlaneTenantModelSlotBindings\",\n    \"controlPlaneTenantProviderSecrets\",\n    \"controlPlaneTenantProxyGatewayUsage\",\n    \"controlPlaneToolAcls\",\n    \"cutoverFlags\",\n    \"groupMemberships\",\n    \"groups\",\n    \"memberships\",\n    \"methodologyPacks\",\n    \"oauthDeviceCodes\",\n    \"packAssignments\",\n    \"packDefinitions\",\n    \"packEntitlements\",\n    \"packGroupAssignments\",\n    \"packInstallations\",\n    \"packVersions\",\n    \"policyBundles\",\n    \"policyDecisionLogs\",\n    \"policySimulations\",\n    \"principals\",\n    \"rateLimitWindows\",\n    \"servicePrincipalKeys\",\n    \"tenantDeploymentCredentials\",\n    \"tenantMethodologyAssignments\",\n    \"tenants\",\n    \"toolCatalog\",\n    \"toolRegistryEntries\",\n    \"userSessions\",\n    \"workspaces\"\n  ],\n  \"I\": [\n    \"agents\",\n    \"mcpWritePolicy\",\n    \"modelCallLogs\",\n    \"modelFunctionSlots\",\n    \"modelRegistry\",\n    \"modelSlotConfigs\",\n    \"platformAudienceGrants\",\n    \"platformAudiences\",\n    \"platformPolicyDecisionLogs\",\n    \"projectGrants\",\n    \"reasoningPermissions\",\n    \"tenantApiKeys\",\n    \"tenantConfig\",\n    \"tenantIntegrations\",\n    \"tenantModelSlotBindings\",\n    \"tenantPolicies\",\n    \"tenantProviderSecrets\",\n    \"tenantProxyGatewayUsage\",\n    \"tenantProxyTokenMints\",\n    \"tenantSandboxAuditEvents\",\n    \"tenantSecrets\",\n    \"toolAcls\",\n    \"toolRegistry\",\n    \"users\"\n  ],\n  \"K\": [\n    \"agentMessages\",\n    \"agentSessions\",\n    \"autofixJobs\",\n    \"backgroundJobRuns\",\n    \"backgroundJobSettings\",\n    \"beliefConfidence\",\n    \"beliefEvidenceLinks\",\n    \"beliefHistory\",\n    \"beliefScenarios\",\n    \"beliefVotes\",\n    \"calibrationScores\",\n    \"contractEvaluations\",\n    \"contradictions\",\n    \"crossProjectConnections\",\n    \"decisionComputedSummaries\",\n    \"decisionEvents\",\n    \"decisionParticipants\",\n    \"decisionRiskLedger\",\n    \"decisionSnapshots\",\n    \"deliberationContributions\",\n    \"deliberationSessions\",\n    \"epistemicAudit\",\n    \"epistemicContracts\",\n    \"epistemicEdges\",\n    \"epistemicNodeEmbeddings\",\n    \"epistemicNodes\",\n    \"graphAnalysisCache\",\n    \"graphAnalysisResults\",\n    \"graphSuggestions\",\n    \"harnessReplays\",\n    \"harnessRuns\",\n    \"idempotencyTokens\",\n    \"lenses\",\n    \"lensTopicBindings\",\n    \"neo4jSyncQueue\",\n    \"ontologyDefinitions\",\n    \"ontologyVersions\",\n    \"platformAgentRunPolicyDecisions\",\n    \"platformAgentRunPromptResolutions\",\n    \"platformAgentRuns\",\n    \"platformAgentRunToolCalls\",\n    \"platformHarnessShadowAudit\",\n    \"publicationRules\",\n    \"questionEvidenceLinks\",\n    \"researchJobs\",\n    \"schemaEnumConfig\",\n    \"stakeholderGroups\",\n    \"systemLogs\",\n    \"tasks\",\n    \"topics\",\n    \"workflowDefinitions\",\n    \"workflowPullRequests\",\n    \"workflowStages\",\n    \"worktreeBeliefCluster\",\n    \"worktrees\"\n  ],\n  \"D\": [],\n  \"A\": []\n} as const;\n\nexport const TABLE_OWNERSHIP = {\n  \"agentMessages\": \"K\",\n  \"agentRegistryEntries\": \"L\",\n  \"agents\": \"I\",\n  \"agentSessions\": \"K\",\n  \"apiKeys\": \"L\",\n  \"auditLog\": \"L\",\n  \"autofixJobs\": \"K\",\n  \"backgroundJobRuns\": \"K\",\n  \"backgroundJobSettings\": \"K\",\n  \"beliefConfidence\": \"K\",\n  \"beliefEvidenceLinks\": \"K\",\n  \"beliefHistory\": \"K\",\n  \"beliefScenarios\": \"K\",\n  \"beliefVotes\": \"K\",\n  \"calibrationScores\": \"K\",\n  \"compatibilityShims\": \"L\",\n  \"contractEvaluations\": \"K\",\n  \"contradictions\": \"K\",\n  \"controlPlaneTenantModelSlotBindings\": \"L\",\n  \"controlPlaneTenantProviderSecrets\": \"L\",\n  \"controlPlaneTenantProxyGatewayUsage\": \"L\",\n  \"controlPlaneToolAcls\": \"L\",\n  \"crossProjectConnections\": \"K\",\n  \"cutoverFlags\": \"L\",\n  \"decisionComputedSummaries\": \"K\",\n  \"decisionEvents\": \"K\",\n  \"decisionParticipants\": \"K\",\n  \"decisionRiskLedger\": \"K\",\n  \"decisionSnapshots\": \"K\",\n  \"deliberationContributions\": \"K\",\n  \"deliberationSessions\": \"K\",\n  \"epistemicAudit\": \"K\",\n  \"epistemicContracts\": \"K\",\n  \"epistemicEdges\": \"K\",\n  \"epistemicNodeEmbeddings\": \"K\",\n  \"epistemicNodes\": \"K\",\n  \"graphAnalysisCache\": \"K\",\n  \"graphAnalysisResults\": \"K\",\n  \"graphSuggestions\": \"K\",\n  \"groupMemberships\": \"L\",\n  \"groups\": \"L\",\n  \"harnessReplays\": \"K\",\n  \"harnessRuns\": \"K\",\n  \"idempotencyTokens\": \"K\",\n  \"lenses\": \"K\",\n  \"lensTopicBindings\": \"K\",\n  \"mcpWritePolicy\": \"I\",\n  \"memberships\": \"L\",\n  \"methodologyPacks\": \"L\",\n  \"modelCallLogs\": \"I\",\n  \"modelFunctionSlots\": \"I\",\n  \"modelRegistry\": \"I\",\n  \"modelSlotConfigs\": \"I\",\n  \"neo4jSyncQueue\": \"K\",\n  \"oauthDeviceCodes\": \"L\",\n  \"ontologyDefinitions\": \"K\",\n  \"ontologyVersions\": \"K\",\n  \"packAssignments\": \"L\",\n  \"packDefinitions\": \"L\",\n  \"packEntitlements\": \"L\",\n  \"packGroupAssignments\": \"L\",\n  \"packInstallations\": \"L\",\n  \"packVersions\": \"L\",\n  \"platformAgentRunPolicyDecisions\": \"K\",\n  \"platformAgentRunPromptResolutions\": \"K\",\n  \"platformAgentRuns\": \"K\",\n  \"platformAgentRunToolCalls\": \"K\",\n  \"platformAudienceGrants\": \"I\",\n  \"platformAudiences\": \"I\",\n  \"platformHarnessShadowAudit\": \"K\",\n  \"platformPolicyDecisionLogs\": \"I\",\n  \"policyBundles\": \"L\",\n  \"policyDecisionLogs\": \"L\",\n  \"policySimulations\": \"L\",\n  \"principals\": \"L\",\n  \"projectGrants\": \"I\",\n  \"publicationRules\": \"K\",\n  \"questionEvidenceLinks\": \"K\",\n  \"rateLimitWindows\": \"L\",\n  \"reasoningPermissions\": \"I\",\n  \"researchJobs\": \"K\",\n  \"schemaEnumConfig\": \"K\",\n  \"servicePrincipalKeys\": \"L\",\n  \"stakeholderGroups\": \"K\",\n  \"systemLogs\": \"K\",\n  \"tasks\": \"K\",\n  \"tenantApiKeys\": \"I\",\n  \"tenantConfig\": \"I\",\n  \"tenantDeploymentCredentials\": \"L\",\n  \"tenantIntegrations\": \"I\",\n  \"tenantMethodologyAssignments\": \"L\",\n  \"tenantModelSlotBindings\": \"I\",\n  \"tenantPolicies\": \"I\",\n  \"tenantProviderSecrets\": \"I\",\n  \"tenantProxyGatewayUsage\": \"I\",\n  \"tenantProxyTokenMints\": \"I\",\n  \"tenants\": \"L\",\n  \"tenantSandboxAuditEvents\": \"I\",\n  \"tenantSecrets\": \"I\",\n  \"toolAcls\": \"I\",\n  \"toolCatalog\": \"L\",\n  \"toolRegistry\": \"I\",\n  \"toolRegistryEntries\": \"L\",\n  \"topics\": \"K\",\n  \"users\": \"I\",\n  \"userSessions\": \"L\",\n  \"workflowDefinitions\": \"K\",\n  \"workflowPullRequests\": \"K\",\n  \"workflowStages\": \"K\",\n  \"workspaces\": \"L\",\n  \"worktreeBeliefCluster\": \"K\",\n  \"worktrees\": \"K\",\n} as const satisfies Readonly<Record<string, TableOwnershipLayer>>;\n\nexport type GeneratedTableName = keyof typeof TABLE_OWNERSHIP;\n\nexport function classifyTableOwnership(\n  tableName: string\n): TableOwnershipLayer | null {\n  return TABLE_OWNERSHIP[tableName as GeneratedTableName] ?? null;\n}\n\nexport function listTablesByOwnership(\n  layer: TableOwnershipLayer\n): readonly string[] {\n  return TABLES_BY_LAYER[layer];\n}\n\nexport function summarizeTableOwnership(\n  tableNames: readonly string[]\n): Record<TableOwnershipLayer, number> {\n  const summary: Record<TableOwnershipLayer, number> = {\n    L: 0,\n    I: 0,\n    K: 0,\n    D: 0,\n    A: 0,\n  };\n  for (const name of tableNames) {\n    const layer = classifyTableOwnership(name);\n    if (layer) {\n      summary[layer] += 1;\n    }\n  }\n  return summary;\n}\n\nexport function assertTableOwnershipCoverage(tableNames: readonly string[]): void {\n  const missing = tableNames.filter((name) => !classifyTableOwnership(name));\n  const tableNameSet = new Set(tableNames);\n  const extras = Object.keys(TABLE_OWNERSHIP).filter(\n    (name) => !tableNameSet.has(name)\n  );\n  if (missing.length > 0 || extras.length > 0) {\n    const lines: string[] = [];\n    if (missing.length > 0) {\n      lines.push(`Missing ownership classification: ${missing.join(\", \")}`);\n    }\n    if (extras.length > 0) {\n      lines.push(`Ownership map contains unknown tables: ${extras.join(\", \")}`);\n    }\n    throw new Error(lines.join(\"\\n\"));\n  }\n}\n","import {\n  TABLE_OWNERSHIP,\n  type TableOwnershipLayer,\n} from \"./generated/tableOwnership.js\";\n\nexport const COMPONENT_BOUNDARY_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const COMPONENT_BOUNDARY_COMPONENT_LAYERS = [\n  \"I\",\n  \"K\",\n] as const satisfies readonly TableOwnershipLayer[];\nexport type ComponentBoundaryComponentLayer =\n  (typeof COMPONENT_BOUNDARY_COMPONENT_LAYERS)[number];\n\nexport const COMPONENT_BOUNDARY_DIRECT_DB_METHODS = [\n  \"insert\",\n  \"patch\",\n  \"replace\",\n  \"delete\",\n  \"query\",\n] as const;\nexport type ComponentBoundaryDirectDbMethod =\n  (typeof COMPONENT_BOUNDARY_DIRECT_DB_METHODS)[number];\n\nexport const COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS = [\n  \"services\",\n  \"apps\",\n  \"convex\",\n] as const;\n\nexport const COMPONENT_BOUNDARY_HIGH_RISK_TABLES = [\n  \"backgroundJobRuns\",\n  \"backgroundJobSettings\",\n  \"systemLogs\",\n  \"epistemicAudit\",\n  \"platformPolicyDecisionLogs\",\n  \"tenantApiKeys\",\n  \"projectGrants\",\n  \"userSessions\",\n] as const;\nexport type ComponentBoundaryHighRiskTable =\n  (typeof COMPONENT_BOUNDARY_HIGH_RISK_TABLES)[number];\n\nexport function getComponentBoundaryTableLayer(\n  tableName: string\n): TableOwnershipLayer | undefined {\n  return TABLE_OWNERSHIP[tableName as keyof typeof TABLE_OWNERSHIP];\n}\n\nexport function isComponentBoundaryComponentOwnedTable(\n  tableName: string\n): tableName is keyof typeof TABLE_OWNERSHIP {\n  const layer = getComponentBoundaryTableLayer(tableName);\n  return (\n    layer === \"I\" ||\n    layer === \"K\"\n  );\n}\n\n"]}

package/dist/component-host-boundary.contract.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Component host persistence boundary
+ *
+ * Host deployments may call component APIs, but they must not create or mutate
+ * component-owned tables directly through top-level ctx.db. This contract keeps
+ * tenant SDK clients from accidentally recreating Lucern kernel/identity tables
+ * as host "ghost tables".
+ */
+declare const COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION: "2026-04-28";
+declare const COMPONENT_HOST_PROTECTED_TABLES: readonly ["backgroundJobRuns", "backgroundJobSettings", "systemLogs", "epistemicAudit", "platformPolicyDecisionLogs", "tenantApiKeys", "projectGrants", "userSessions"];
+type ComponentHostProtectedTable = (typeof COMPONENT_HOST_PROTECTED_TABLES)[number];
+declare const COMPONENT_HOST_PROTECTED_TABLE_OWNERS: {
+    readonly backgroundJobRuns: "kernel_component";
+    readonly backgroundJobSettings: "kernel_component";
+    readonly systemLogs: "kernel_component";
+    readonly epistemicAudit: "reasoning_kernel_component";
+    readonly platformPolicyDecisionLogs: "identity_component";
+    readonly tenantApiKeys: "identity_component";
+    readonly projectGrants: "identity_component";
+    readonly userSessions: "tenant_or_control_plane_schema";
+};
+declare const COMPONENT_HOST_DB_WRITE_OPERATIONS: readonly ["insert", "patch", "replace", "delete"];
+type ComponentHostDbWriteOperation = (typeof COMPONENT_HOST_DB_WRITE_OPERATIONS)[number];
+declare const COMPONENT_HOST_DB_READ_OPERATIONS: readonly ["query"];
+type ComponentHostDbReadOperation = (typeof COMPONENT_HOST_DB_READ_OPERATIONS)[number];
+type ComponentHostDbOperation = ComponentHostDbWriteOperation | ComponentHostDbReadOperation;
+declare const COMPONENT_HOST_WRITE_AUDIT_ROOTS: readonly ["apps/web/convex", "packages/server-core/src", "services/kernel-template/convex", "services/identity-template/convex", "services/master-control/convex"];
+type ComponentHostWriteAuditRoot = (typeof COMPONENT_HOST_WRITE_AUDIT_ROOTS)[number];
+declare const COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS: readonly [{
+    readonly file: "services/master-control/convex/userSessions.ts";
+    readonly table: "userSessions";
+    readonly operation: "insert";
+    readonly reason: "Master Control declares and owns its own userSessions table for gateway session validation.";
+}, {
+    readonly file: "services/master-control/convex/userSessions.ts";
+    readonly table: "userSessions";
+    readonly operation: "query";
+    readonly reason: "Master Control declares and owns its own userSessions table for gateway session validation.";
+}];
+
+export { COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, type ComponentHostDbOperation, type ComponentHostDbReadOperation, type ComponentHostDbWriteOperation, type ComponentHostProtectedTable, type ComponentHostWriteAuditRoot };

package/dist/component-host-boundary.contract.js

@@ -0,0 +1,54 @@
+// src/component-host-boundary.contract.ts
+var COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION = "2026-04-28";
+var COMPONENT_HOST_PROTECTED_TABLES = [
+  "backgroundJobRuns",
+  "backgroundJobSettings",
+  "systemLogs",
+  "epistemicAudit",
+  "platformPolicyDecisionLogs",
+  "tenantApiKeys",
+  "projectGrants",
+  "userSessions"
+];
+var COMPONENT_HOST_PROTECTED_TABLE_OWNERS = {
+  backgroundJobRuns: "kernel_component",
+  backgroundJobSettings: "kernel_component",
+  systemLogs: "kernel_component",
+  epistemicAudit: "reasoning_kernel_component",
+  platformPolicyDecisionLogs: "identity_component",
+  tenantApiKeys: "identity_component",
+  projectGrants: "identity_component",
+  userSessions: "tenant_or_control_plane_schema"
+};
+var COMPONENT_HOST_DB_WRITE_OPERATIONS = [
+  "insert",
+  "patch",
+  "replace",
+  "delete"
+];
+var COMPONENT_HOST_DB_READ_OPERATIONS = ["query"];
+var COMPONENT_HOST_WRITE_AUDIT_ROOTS = [
+  "apps/web/convex",
+  "packages/server-core/src",
+  "services/kernel-template/convex",
+  "services/identity-template/convex",
+  "services/master-control/convex"
+];
+var COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS = [
+  {
+    file: "services/master-control/convex/userSessions.ts",
+    table: "userSessions",
+    operation: "insert",
+    reason: "Master Control declares and owns its own userSessions table for gateway session validation."
+  },
+  {
+    file: "services/master-control/convex/userSessions.ts",
+    table: "userSessions",
+    operation: "query",
+    reason: "Master Control declares and owns its own userSessions table for gateway session validation."
+  }
+];
+
+export { COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS };
+//# sourceMappingURL=component-host-boundary.contract.js.map
+//# sourceMappingURL=component-host-boundary.contract.js.map

package/dist/component-host-boundary.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/component-host-boundary.contract.ts"],"names":[],"mappings":";AASO,IAAM,wCAAA,GAA2C;AAEjD,IAAM,+BAAA,GAAkC;AAAA,EAC7C,mBAAA;AAAA,EACA,uBAAA;AAAA,EACA,YAAA;AAAA,EACA,gBAAA;AAAA,EACA,4BAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,iBAAA,EAAmB,kBAAA;AAAA,EACnB,qBAAA,EAAuB,kBAAA;AAAA,EACvB,UAAA,EAAY,kBAAA;AAAA,EACZ,cAAA,EAAgB,4BAAA;AAAA,EAChB,0BAAA,EAA4B,oBAAA;AAAA,EAC5B,aAAA,EAAe,oBAAA;AAAA,EACf,aAAA,EAAe,oBAAA;AAAA,EACf,YAAA,EAAc;AAChB;AAEO,IAAM,kCAAA,GAAqC;AAAA,EAChD,QAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAIO,IAAM,iCAAA,GAAoC,CAAC,OAAO;AAQlD,IAAM,gCAAA,GAAmC;AAAA,EAC9C,iBAAA;AAAA,EACA,0BAAA;AAAA,EACA,iCAAA;AAAA,EACA,mCAAA;AAAA,EACA;AACF;AAIO,IAAM,uCAAA,GAA0C;AAAA,EACrD;AAAA,IACE,IAAA,EAAM,gDAAA;AAAA,IACN,KAAA,EAAO,cAAA;AAAA,IACP,SAAA,EAAW,QAAA;AAAA,IACX,MAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,IAAA,EAAM,gDAAA;AAAA,IACN,KAAA,EAAO,cAAA;AAAA,IACP,SAAA,EAAW,OAAA;AAAA,IACX,MAAA,EACE;AAAA;AAEN","file":"component-host-boundary.contract.js","sourcesContent":["/**\n * Component host persistence boundary\n *\n * Host deployments may call component APIs, but they must not create or mutate\n * component-owned tables directly through top-level ctx.db. This contract keeps\n * tenant SDK clients from accidentally recreating Lucern kernel/identity tables\n * as host \"ghost tables\".\n */\n\nexport const COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION = \"2026-04-28\" as const;\n\nexport const COMPONENT_HOST_PROTECTED_TABLES = [\n  \"backgroundJobRuns\",\n  \"backgroundJobSettings\",\n  \"systemLogs\",\n  \"epistemicAudit\",\n  \"platformPolicyDecisionLogs\",\n  \"tenantApiKeys\",\n  \"projectGrants\",\n  \"userSessions\",\n] as const;\nexport type ComponentHostProtectedTable =\n  (typeof COMPONENT_HOST_PROTECTED_TABLES)[number];\n\nexport const COMPONENT_HOST_PROTECTED_TABLE_OWNERS = {\n  backgroundJobRuns: \"kernel_component\",\n  backgroundJobSettings: \"kernel_component\",\n  systemLogs: \"kernel_component\",\n  epistemicAudit: \"reasoning_kernel_component\",\n  platformPolicyDecisionLogs: \"identity_component\",\n  tenantApiKeys: \"identity_component\",\n  projectGrants: \"identity_component\",\n  userSessions: \"tenant_or_control_plane_schema\",\n} as const satisfies Record<ComponentHostProtectedTable, string>;\n\nexport const COMPONENT_HOST_DB_WRITE_OPERATIONS = [\n  \"insert\",\n  \"patch\",\n  \"replace\",\n  \"delete\",\n] as const;\nexport type ComponentHostDbWriteOperation =\n  (typeof COMPONENT_HOST_DB_WRITE_OPERATIONS)[number];\n\nexport const COMPONENT_HOST_DB_READ_OPERATIONS = [\"query\"] as const;\nexport type ComponentHostDbReadOperation =\n  (typeof COMPONENT_HOST_DB_READ_OPERATIONS)[number];\n\nexport type ComponentHostDbOperation =\n  | ComponentHostDbWriteOperation\n  | ComponentHostDbReadOperation;\n\nexport const COMPONENT_HOST_WRITE_AUDIT_ROOTS = [\n  \"apps/web/convex\",\n  \"packages/server-core/src\",\n  \"services/kernel-template/convex\",\n  \"services/identity-template/convex\",\n  \"services/master-control/convex\",\n] as const;\nexport type ComponentHostWriteAuditRoot =\n  (typeof COMPONENT_HOST_WRITE_AUDIT_ROOTS)[number];\n\nexport const COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS = [\n  {\n    file: \"services/master-control/convex/userSessions.ts\",\n    table: \"userSessions\",\n    operation: \"insert\",\n    reason:\n      \"Master Control declares and owns its own userSessions table for gateway session validation.\",\n  },\n  {\n    file: \"services/master-control/convex/userSessions.ts\",\n    table: \"userSessions\",\n    operation: \"query\",\n    reason:\n      \"Master Control declares and owns its own userSessions table for gateway session validation.\",\n  },\n] as const satisfies ReadonlyArray<{\n  file: string;\n  table: ComponentHostProtectedTable;\n  operation: ComponentHostDbOperation;\n  reason: string;\n}>;\n"]}

package/dist/function-registry/beliefs.d.ts

@@ -1,4 +1,4 @@
-import * as zod from 'zod';
+import { z } from 'zod';
 
 /**
  * MCP Tool Contract Definitions
@@ -115,10 +115,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -154,10 +154,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -193,10 +193,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -232,10 +232,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -271,10 +271,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -310,10 +310,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -349,10 +349,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -388,10 +388,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -427,10 +427,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];
@@ -466,10 +466,10 @@ declare const beliefsContracts: readonly [{
         allowedPrincipalTypes: ("user" | "service" | "agent")[];
     };
     convex: FunctionConvexTarget | undefined;
-    args: zod.ZodTypeAny;
-    returns: zod.ZodTypeAny;
-    input: zod.ZodTypeAny;
-    output: zod.ZodTypeAny;
+    args: z.ZodTypeAny;
+    returns: z.ZodTypeAny;
+    input: z.ZodTypeAny;
+    output: z.ZodTypeAny;
     openapi: {
         summary: string;
         tags: string[];