@lucern/contracts 0.3.0-alpha.2 → 0.3.0-alpha.4

package/dist/mcp-gateway-boundary.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp-gateway-boundary.contract.ts"],"names":[],"mappings":";AAcO,IAAM,qCAAA,GAAwC;AAE9C,IAAM,8BAAA,GACX;AAEK,IAAM,uCAAA,GACX;AAEK,IAAM,wCAAA,GACX;AAEK,IAAM,kDAAA,GACX;AAEK,IAAM,+CAAA,GACX;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C,gBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,eAAA;AAAA,EACA,eAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAIO,IAAM,qCAAA,GAAwC;AAAA,EACnD,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAoLO,IAAM,sCAAA,GAAyC;AAAA,EACpD,sBAAA;AAAA,EACA,kBAAA;AAAA,EACA,2BAAA;AAAA,EACA,sBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,aAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF","file":"mcp-gateway-boundary.contract.js","sourcesContent":["/**\n * MCP gateway boundary contract\n *\n * Defines the target thin-client boundary for the Lucern MCP server. MCP is a\n * client of the Lucern gateway, not a privileged Convex or Master Control\n * process. The gateway owns tenant resolution, deploy-key access, policy, and\n * session persistence.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const MCP_GATEWAY_BOUNDARY_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const MCP_GATEWAY_BOOTSTRAP_ENDPOINT =\n  \"/api/platform/v1/mcp/session\" as const;\n\nexport const MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT =\n  \"/api/platform/v1/mcp/write-policy/check\" as const;\n\nexport const MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT =\n  \"/api/platform/v1/mcp/build-session/begin\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-engineering\" as const;\n\nexport const MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT =\n  \"/api/platform/v1/mcp/contracts/evaluate-research\" as const;\n\nexport const MCP_GATEWAY_ALLOWED_CLIENT_ENV = [\n  \"LUCERN_API_KEY\",\n  \"LUCERN_API_BASE_URL\",\n  \"LUCERN_ENVIRONMENT\",\n  \"LUCERN_USER_TOKEN\",\n] as const;\nexport type McpGatewayAllowedClientEnv =\n  (typeof MCP_GATEWAY_ALLOWED_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_FORBIDDEN_CLIENT_ENV = [\n  \"MC_CONVEX_URL\",\n  \"MC_DEPLOY_KEY\",\n  \"LUCERN_CONVEX_URL\",\n  \"LUCERN_DEPLOY_KEY\",\n  \"TENANT_CONVEX_URL\",\n  \"TENANT_DEPLOY_KEY\",\n] as const;\nexport type McpGatewayForbiddenClientEnv =\n  (typeof MCP_GATEWAY_FORBIDDEN_CLIENT_ENV)[number];\n\nexport const MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS = [\n  \"tenant\",\n  \"session\",\n  \"permissions\",\n] as const;\nexport type McpGatewayBootstrapRequiredField =\n  (typeof MCP_GATEWAY_BOOTSTRAP_REQUIRED_FIELDS)[number];\n\nexport type McpGatewayTenantContext = {\n  tenantId: string;\n  slug: string;\n  name: string;\n  tier: string;\n  methodologyPackIds: string[];\n  apiKeyId?: string;\n};\n\nexport type McpGatewaySessionContext = {\n  sessionType: \"agent\" | \"user\";\n  userId: string;\n  principalId: string;\n  principalType: SessionPrincipalType;\n  workspaceId?: string;\n  authMode: SessionAuthMode;\n  roles: string[];\n  scopes: string[];\n  sessionId?: string;\n  userEmail?: string;\n  expiresAt?: number;\n};\n\nexport type McpGatewayPermissionContext = {\n  allowedTools: string[] | null;\n  allowedTopics: string[] | null;\n  groupIds: string[];\n  permittedPackKeys: string[];\n  permittedToolNames: string[];\n  permittedTools: Array<{\n    toolName: string;\n    requiredRole?: string;\n    approvalGateId?: string;\n    isCore?: boolean;\n    category?: string;\n  }>;\n};\n\nexport type McpGatewayBootstrapRequest = {\n  transportKind?: \"stdio\" | \"hosted\";\n  sessionId?: string;\n  agentIdentity?: string;\n  workspaceId?: string;\n};\n\nexport type McpGatewayWritePolicyCheckRequest = {\n  topicId?: string;\n  role: string;\n  toolName: string;\n};\n\nexport type McpGatewayBeginBuildSessionRequest = {\n  worktreeId: string;\n  branch?: string;\n  branchBase?: string;\n  prBase?: string;\n  sessionMode?: string;\n  activateIfPlanning?: boolean;\n};\n\nexport type McpGatewayJsonObject = {\n  [key: string]: McpGatewayJsonValue | undefined;\n};\n\nexport type McpGatewayJsonArray = McpGatewayJsonValue[];\n\nexport type McpGatewayJsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | McpGatewayJsonArray\n  | McpGatewayJsonObject;\n\nexport type McpGatewayEvaluateEngineeringContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  testOutput?: McpGatewayJsonValue;\n  tscOutput?: McpGatewayJsonValue;\n  lintOutput?: McpGatewayJsonValue;\n  sentryData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayEvaluateResearchContractRequest = {\n  beliefNodeId?: McpGatewayJsonValue;\n  trigger?: McpGatewayJsonValue;\n  metricData?: McpGatewayJsonValue;\n  referenceCheckData?: McpGatewayJsonValue;\n  marketIndexData?: McpGatewayJsonValue;\n  temporalData?: McpGatewayJsonValue;\n};\n\nexport type McpGatewayContractEvaluationResponse = McpGatewayJsonObject;\n\nexport type McpGatewayWritePolicyCheckResponse = {\n  allowed: boolean;\n  permission: string;\n  rationale?: string;\n  maxWritesPerSession?: number;\n  toolCategory?: string | null;\n  policy?: McpGatewayJsonObject | null;\n  explanation?: McpGatewayJsonObject;\n  reason: string;\n};\n\nexport type McpGatewayBootstrapResponse = {\n  tenant: McpGatewayTenantContext;\n  session: McpGatewaySessionContext;\n  permissions: McpGatewayPermissionContext;\n};\n\nexport type McpGatewayBuildSessionBelief = {\n  nodeId: string;\n  text: string;\n  confidence: number | null;\n};\n\nexport type McpGatewayBuildSessionQuestion = {\n  nodeId: string;\n  text: string;\n  priority: string;\n};\n\nexport type McpGatewayBuildSessionDecision = {\n  question: string;\n  decision: string;\n};\n\nexport type McpGatewayBuildSessionWorktreeSummary = {\n  worktreeId: string;\n  title: string;\n  status?: string;\n};\n\nexport type McpGatewayBeginBuildSessionResponse = {\n  topicId: string;\n  topicName: string;\n  worktreeId: string;\n  worktreeName: string;\n  branch: string;\n  branchBase: string;\n  prBase: string;\n  campaign: number | null;\n  lane: string;\n  laneOrderInCampaign: number | null;\n  orderInLane: number | null;\n  gate: string;\n  hypothesis: string;\n  focus: string;\n  status: string;\n  sessionMode: string;\n  targetBeliefIds: string[];\n  targetQuestionIds: string[];\n  topBeliefs: McpGatewayBuildSessionBelief[];\n  openQuestions: McpGatewayBuildSessionQuestion[];\n  resolvedDecisions: McpGatewayBuildSessionDecision[];\n  exitCriteria: string[];\n  requiredDocs: string[];\n  keyFiles: string[];\n  pillarBeliefs: Array<{\n    pillar: string;\n    text: string;\n    nodeId: string;\n  }>;\n  visionDocs: Array<{\n    path: string;\n    description: string;\n  }>;\n  dependencies: McpGatewayBuildSessionWorktreeSummary[];\n  unblocks: Array<{\n    worktreeId: string;\n    title: string;\n  }>;\n  mergeOrderNotes: string;\n};\n\nexport const MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS = [\n  \"validate_mcp_session\",\n  \"record_key_usage\",\n  \"resolve_default_workspace\",\n  \"resolve_user_context\",\n  \"create_user_session\",\n  \"upsert_agent_principal\",\n] as const;\nexport type McpGatewayOwnedBootstrapOperation =\n  (typeof MCP_GATEWAY_OWNED_BOOTSTRAP_OPERATIONS)[number];\n\nexport const MCP_GATEWAY_CLIENT_ONLY_PACKAGES = [\n  \"@lucern/sdk\",\n  \"@lucern/mcp\",\n  \"@lucern/contracts\",\n] as const;\nexport type McpGatewayClientOnlyPackage =\n  (typeof MCP_GATEWAY_CLIENT_ONLY_PACKAGES)[number];\n"]}

package/dist/schemas/component-table-manifest.d.ts

@@ -41,7 +41,7 @@ declare const ComponentTableManifestSchema: z.ZodObject<{
         }[];
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    tier: "K" | "I";
+    tier: "I" | "K";
     manifestVersion: string;
     componentName: "kernel" | "identity";
     packageVersion: string;
@@ -55,7 +55,7 @@ declare const ComponentTableManifestSchema: z.ZodObject<{
         }[];
     }[];
 }, {
-    tier: "K" | "I";
+    tier: "I" | "K";
     manifestVersion: string;
     componentName: "kernel" | "identity";
     packageVersion: string;

package/dist/schemas/index.js

@@ -1848,6 +1848,40 @@ var rateLimitWindows = defineTable({
     { kind: "index", name: "by_tier_window_end", columns: ["tier", "windowEndMs"] }
   ]
 });
+var oauthDeviceCodes = defineTable({
+  name: "oauthDeviceCodes",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "deviceCodeHash": z.string(),
+    "userCode": z.string(),
+    "clientId": z.string(),
+    "scope": z.string(),
+    "status": z.enum(["pending", "approved", "denied", "expired", "consumed"]),
+    "expiresAt": z.number(),
+    "intervalSeconds": z.number(),
+    "lastPolledAt": z.number().optional(),
+    "slowDownCount": z.number().optional(),
+    "clerkUserId": z.string().optional(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": z.string().optional(),
+    "principalId": z.string().optional(),
+    "role": z.string().optional(),
+    "scopes": z.array(z.string()).optional(),
+    "sessionId": z.string().optional(),
+    "approvedAt": z.number().optional(),
+    "deniedAt": z.number().optional(),
+    "consumedAt": z.number().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_deviceCodeHash", columns: ["deviceCodeHash"] },
+    { kind: "index", name: "by_userCode", columns: ["userCode"] },
+    { kind: "index", name: "by_status_expiresAt", columns: ["status", "expiresAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId"] }
+  ]
+});
 var servicePrincipalKeys = defineTable({
   name: "servicePrincipalKeys",
   component: "mc",
@@ -3804,7 +3838,9 @@ var workspaces = defineTable({
     "defaultProjectVisibility": z.enum(["private", "team", "firm", "external", "public"]).optional(),
     "deployments": z.record(z.object({
       "url": z.string(),
-      "encryptedDeployKey": z.string()
+      "target": z.enum(["kernelDeployment", "appDeployment"]).optional(),
+      "encryptedDeployKey": z.string().optional(),
+      "credentialRef": z.string().optional()
     })).optional(),
     "metadata": z.record(z.any()).optional(),
     "createdBy": z.string().optional(),
@@ -4212,6 +4248,7 @@ var MC_TABLE_CONTRACTS = [
   groupMemberships,
   groups,
   memberships,
+  oauthDeviceCodes,
   principals,
   rateLimitWindows,
   servicePrincipalKeys,