@lucern/contracts 0.3.0-alpha.4 → 0.3.0-alpha.6

package/dist/infisical-runtime.contract.js

@@ -1,5 +1,125 @@
 // src/tenant-client.contract.ts
 var TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH = "tenants/shared";
+var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
+  {
+    packageName: "@lucern/access-control",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/agent",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/auth",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/cli",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/client-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/confidence",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/config",
+    role: "configuration",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/contracts",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/control-plane",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/developer-kit",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/identity",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
+  (entry) => entry.packageName
+);
 
 // src/infisical-runtime.contract.ts
 var INFISICAL_RUNTIME_CONTRACT_VERSION = "2026-04-28";

package/dist/infisical-runtime.contract.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/tenant-client.contract.ts","../src/infisical-runtime.contract.ts"],"names":[],"mappings":";AAoDO,IAAM,0CAAA,GACX,gBAAA;;;ACxCK,IAAM,kCAAA,GAAqC;AAE3C,IAAM,iCAAA,GACX;AACK,IAAM,oCAAA,GACX;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C,KAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,aAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF;AAIO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,YAAA;AAAA,EACA,gBAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF;AAIO,IAAM,+BAAA,GAAkC;AAAA,EAC7C,MAAA,EAAQ,CAAC,mBAAA,EAAqB,eAAe,CAAA;AAAA,EAC7C,SAAA,EAAW,CAAC,sBAAA,EAAwB,wBAAwB,CAAA;AAAA,EAC5D,QAAA,EAAU;AAAA,IACR,qBAAA;AAAA,IACA,6BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,YAAA,EAAc;AAAA,IACZ,yBAAA;AAAA,IACA,iCAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,WAAA,EAAa,CAAC,eAAA,EAAiB,sBAAsB,CAAA;AAAA,EACrD,gBAAA,EAAkB,CAAC,oBAAA,EAAsB,6BAA6B,CAAA;AAAA,EACtE,QAAA,EAAU,CAAC,0BAAA,EAA4B,mBAAmB;AAC5D;AAoBO,IAAM,uBAAA,GAA0B;AAAA,EACrC;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,UAAA,EAAY,gBAAA;AAAA,IACZ,WAAA,EACE,qHAAA;AAAA,IACF,SAAA,EAAW;AAAA,MACT;AAAA,QACE,IAAA,EAAM,mCAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,IAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,kBAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,IAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,yBAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,+BAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,IAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,+BAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,IAAA;AAAA,QACR,WAAA,EAAa;AAAA;AACf;AACF,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,UAAA,EAAY,mBAAA;AAAA,IACZ,WAAA,EACE,6EAAA;AAAA,IACF,SAAA,EAAW;AAAA,MACT;AAAA,QACE,IAAA,EAAM,gBAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,CAAC,qBAAA,EAAuB,iBAAiB,CAAA;AAAA,QAClD,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,uBAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,CAAC,sBAAsB,CAAA;AAAA,QAChC,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,oBAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,CAAC,YAAY,CAAA;AAAA,QACtB,WAAA,EAAa;AAAA;AACf;AACF,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,UAAA,EAAY,0CAAA;AAAA,IACZ,WAAA,EACE,sGAAA;AAAA,IACF,SAAA,EAAW;AAAA,MACT;AAAA,QACE,IAAA,EAAM,oBAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,IAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa;AAAA;AACf;AACF;AAEJ;AAcO,IAAM,0BAAA,GAA6B;AAAA,EACxC;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,eAAA,EAAiB,kBAAkB,CAAA;AAAA,IACnD,QAAA,EAAU,mCAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,gBAAA;AAAA,IACJ,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,eAAA,EAAiB,kBAAkB,CAAA;AAAA,IACnD,QAAA,EAAU,+CAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EAAa,aAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,aAAA,EAAe,CAAC,kBAAkB,CAAA;AAAA,IAClC,QAAA,EAAU,oEAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EAAa,aAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,kBAAkB,CAAA;AAAA,IAClC,QAAA,EAAU,kCAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EAAa,aAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,kBAAkB,CAAA;AAAA,IAClC,QAAA,EAAU,6BAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,uBAAuB,CAAA;AAAA,IACvC,QAAA,EAAU,qCAAA;AAAA,IACV,WAAA,EACE;AAAA;AAEN;AAIO,SAAS,yBACd,MAAA,EACkC;AAClC,EAAA,OAAO,wBAAwB,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,OAAO,MAAM,CAAA;AAClE;AAEO,SAAS,4BACd,SAAA,EACqC;AACrC,EAAA,OAAO,0BAAA,CAA2B,IAAA;AAAA,IAChC,CAAC,OAAA,KAAY,OAAA,CAAQ,EAAA,KAAO;AAAA,GAC9B;AACF","file":"infisical-runtime.contract.js","sourcesContent":["/**\n * Tenant client contract\n *\n * Defines the generic boundary for any customer-owned product that consumes\n * Lucern through the SDK, hosted API, or MCP server. Tenant clients may run\n * their own UI, auth provider, deployment, and data plane, but reasoning\n * operations must enter through the published packages below.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const TENANT_CLIENT_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const TENANT_CLIENT_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const satisfies readonly SessionAuthMode[];\nexport type TenantClientAuthMode = (typeof TENANT_CLIENT_AUTH_MODES)[number];\n\nexport const TENANT_CLIENT_PRINCIPAL_TYPES = [\n  \"human\",\n  \"service\",\n  \"agent\",\n] as const satisfies readonly SessionPrincipalType[];\nexport type TenantClientPrincipalType =\n  (typeof TENANT_CLIENT_PRINCIPAL_TYPES)[number];\n\nexport const TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [\n  \"tenantId\",\n  \"workspaceId\",\n  \"principalId\",\n  \"authMode\",\n  \"scopes\",\n] as const;\nexport type TenantClientRequiredContextField =\n  (typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [\n  \"principalType\",\n  \"roles\",\n  \"sessionId\",\n  \"delegationChain\",\n] as const;\nexport type TenantClientOptionalContextField =\n  (typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_INSTALL_TOKEN_ENV = \"INSTALL_LUCERN_NPM\" as const;\nexport const TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH =\n  \"tenants/shared\" as const;\nexport const TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [\n  \"/platform/publish\",\n] as const;\nexport const TENANT_CLIENT_FORBIDDEN_SECRET_ENV = [\"NPM_TOKEN\"] as const;\nexport type TenantClientForbiddenInstallTokenInfisicalPath =\n  (typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS)[number];\nexport type TenantClientForbiddenSecretEnv =\n  (typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV)[number];\n\nexport const TENANT_CLIENT_INSTALLABLE_PACKAGES = [\n  {\n    packageName: \"@lucern/access-control\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/agent\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/auth\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/cli\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/client-core\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/confidence\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/config\",\n    role: \"configuration\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/control-plane\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/developer-kit\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/events\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-primitives\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/identity\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/pack-host\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/pack-installer\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/proof-compiler\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/react\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/sdk\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/server-core\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/testing\",\n    role: \"test_support\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/types\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n] as const;\nexport type TenantClientInstallablePackage =\n  (typeof TENANT_CLIENT_INSTALLABLE_PACKAGES)[number];\nexport type TenantClientPackageRole = TenantClientInstallablePackage[\"role\"];\nexport type TenantClientInstallablePackageName =\n  TenantClientInstallablePackage[\"packageName\"];\n\n/**\n * Direct imports tenant-owned product code may use. This is intentionally\n * smaller than TENANT_CLIENT_INSTALLABLE_PACKAGES: several publishable packages\n * are installed as SDK dependencies, tooling, or platform runtimes but should\n * not become the application integration surface.\n */\nexport const TENANT_CLIENT_PUBLIC_IMPORTS = [\n  {\n    packageName: \"@lucern/sdk\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"TypeScript SDK runtime and generated operation namespaces.\",\n  },\n  {\n    packageName: \"@lucern/react\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"React bindings for tenant-owned UI applications.\",\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"MCP client/server entry points and hosted route helpers.\",\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type and manifest contracts.\",\n  },\n  {\n    packageName: \"@lucern/types\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type-only helpers for tenant integration code.\",\n  },\n] as const;\nexport type TenantClientPublicImport =\n  (typeof TENANT_CLIENT_PUBLIC_IMPORTS)[number];\nexport type TenantClientPublicPackage =\n  TenantClientPublicImport[\"packageName\"];\nexport type TenantClientPublicSurface = TenantClientPublicImport[\"surface\"];\n\nexport const TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [\n  {\n    packageName: \"@lucern/identity\",\n    importPath: \"@lucern/identity/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install Lucern identity.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/runtime.config\",\n    surface: \"component_config\",\n    description:\n      \"Runtime config alias for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n] as const;\nexport type TenantClientComponentConfigImport =\n  (typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS)[number];\nexport type TenantClientAllowedImport =\n  | TenantClientPublicImport\n  | TenantClientComponentConfigImport;\n\nexport function findTenantClientInstallablePackage(\n  packageName: string\n): TenantClientInstallablePackage | undefined {\n  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(\n    (entry) => entry.packageName === packageName\n  );\n}\n\nexport function isTenantClientInstallablePackage(packageName: string): boolean {\n  return Boolean(findTenantClientInstallablePackage(packageName));\n}\n\nexport const TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [\n  \"bootstrap\",\n  \"context\",\n  \"beliefs\",\n  \"evidence\",\n  \"questions\",\n  \"graph\",\n  \"worktrees\",\n  \"topics\",\n  \"edges\",\n  \"contradictions\",\n  \"contracts\",\n  \"graphAnalysis\",\n  \"graphRecommendations\",\n  \"orgGraphSearch\",\n  \"embeddings\",\n  \"ontologyLinks\",\n  \"graphStateClassifier\",\n  \"tools\",\n  \"identity\",\n  \"modelRuntime\",\n  \"events\",\n  \"jobs\",\n  \"telemetry\",\n] as const;\nexport type TenantClientRequiredSdkNamespace =\n  (typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES)[number];\n\nexport const TENANT_CLIENT_CAPABILITIES = [\n  {\n    id: \"identity.bootstrap_session\",\n    description: \"Start a scoped Lucern session for a tenant principal.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.context.compile\",\n    description: \"Compile tenant and workspace scoped reasoning context.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.read\",\n    description: \"Read beliefs, evidence, questions, topics, and lineage.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.write\",\n    description: \"Create and update graph objects through authorized APIs.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"workflow.worktree_lifecycle\",\n    description: \"Create, review, merge, and close scoped worktrees.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n] as const;\nexport type TenantClientCapability =\n  (typeof TENANT_CLIENT_CAPABILITIES)[number];\nexport type TenantClientCapabilityId = TenantClientCapability[\"id\"];\n\nexport const TENANT_CLIENT_ISOLATION_RULES = [\n  {\n    id: \"tenant_workspace_scope_required\",\n    description:\n      \"Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state.\",\n  },\n  {\n    id: \"principal_audit_required\",\n    description:\n      \"Runtime operations must carry principalId, authMode, and scopes for audit attribution.\",\n  },\n  {\n    id: \"no_private_lucern_imports\",\n    description:\n      \"Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals.\",\n  },\n] as const;\nexport type TenantClientIsolationRule =\n  (typeof TENANT_CLIENT_ISOLATION_RULES)[number];\n\nexport const TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [\n  {\n    id: \"deep_src_import\",\n    pattern: \"^@lucern/[^/]+/src(?:/|$)\",\n    description: \"Published packages must not be bypassed through src paths.\",\n  },\n  {\n    id: \"deep_dist_import\",\n    pattern: \"^@lucern/[^/]+/dist(?:/|$)\",\n    description:\n      \"Published package exports must be used instead of dist file paths.\",\n  },\n  {\n    id: \"generated_adapter_import\",\n    pattern: \"^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)\",\n    description:\n      \"Generated Lucern adapters are internal deployment artifacts.\",\n  },\n  {\n    id: \"private_runtime_import\",\n    pattern: \"^@lucern/[^/]+/(?:internal|private)(?:/|$)\",\n    description: \"Internal and private package subpaths are not public SDK API.\",\n  },\n  {\n    id: \"workspace_source_import\",\n    pattern: \"^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)\",\n    description:\n      \"Tenant clients must not import source files from the Lucern monorepo.\",\n  },\n  {\n    id: \"root_alias_lucern_import\",\n    pattern: \"^@/(?:lucern|packages|modules|services|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not depend on Lucern repo-local path aliases.\",\n  },\n  {\n    id: \"relative_lucern_source_import\",\n    pattern: \"^\\\\.\\\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not reach back into Lucern source through relative paths.\",\n  },\n  {\n    id: \"monorepo_path_import\",\n    pattern: \"lucern-repo\",\n    description:\n      \"Absolute imports that name the Lucern repository are not portable tenant code.\",\n  },\n] as const;\nexport type TenantClientForbiddenImportPattern =\n  (typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS)[number];\nexport type TenantClientForbiddenImportPatternId =\n  TenantClientForbiddenImportPattern[\"id\"];\n\nexport type TenantClientImportDecision =\n  | \"public\"\n  | \"forbidden\"\n  | \"local\"\n  | \"external\";\n\nexport type TenantClientImportClassification = {\n  importPath: string;\n  decision: TenantClientImportDecision;\n  publicImport?: TenantClientAllowedImport;\n  pattern?: TenantClientForbiddenImportPattern;\n  reason: string;\n};\n\nfunction matchesPublicImport(\n  importPath: string\n): TenantClientAllowedImport | undefined {\n  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(\n    (entry) => importPath === entry.importPath\n  );\n  if (componentConfig) {\n    return componentConfig;\n  }\n\n  return TENANT_CLIENT_PUBLIC_IMPORTS.find(\n    (entry) =>\n      importPath === entry.packageName ||\n      importPath.startsWith(`${entry.packageName}/`)\n  );\n}\n\nfunction matchesForbiddenPattern(\n  importPath: string\n): TenantClientForbiddenImportPattern | undefined {\n  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find((entry) =>\n    new RegExp(entry.pattern, \"u\").test(importPath)\n  );\n}\n\nexport function classifyTenantClientImport(\n  importPath: string\n): TenantClientImportClassification {\n  const normalizedImportPath = importPath.trim();\n  const pattern = matchesForbiddenPattern(normalizedImportPath);\n\n  if (pattern) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      pattern,\n      reason: pattern.description,\n    };\n  }\n\n  const publicImport = matchesPublicImport(normalizedImportPath);\n  if (publicImport) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"public\",\n      publicImport,\n      reason: publicImport.description,\n    };\n  }\n\n  if (normalizedImportPath.startsWith(\"@lucern/\")) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      reason:\n        \"This @lucern package is not part of the tenant client public surface.\",\n    };\n  }\n\n  if (\n    normalizedImportPath.startsWith(\"./\") ||\n    normalizedImportPath.startsWith(\"../\")\n  ) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"local\",\n      reason: \"Local tenant-owned import.\",\n    };\n  }\n\n  return {\n    importPath: normalizedImportPath,\n    decision: \"external\",\n    reason: \"External dependency outside the Lucern package namespace.\",\n  };\n}\n\nexport function isTenantClientPublicImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function isTenantClientComponentConfigImport(\n  importPath: string\n): boolean {\n  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(\n    (entry) => importPath === entry.importPath\n  );\n}\n\nexport function isTenantClientAllowedImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function assertTenantClientImportAllowed(importPath: string): void {\n  const classification = classifyTenantClientImport(importPath);\n  if (classification.decision !== \"forbidden\") {\n    return;\n  }\n\n  throw new Error(formatTenantClientImportViolation(classification));\n}\n\nexport function formatTenantClientImportViolation(\n  classification: TenantClientImportClassification\n): string {\n  const patternId = classification.pattern\n    ? ` [${classification.pattern.id}]`\n    : \"\";\n  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;\n}\n","/**\n * Infisical runtime contract\n *\n * Defines how Lucern runtime surfaces receive platform configuration and\n * secrets. Vercel-owned apps consume Infisical through secret syncs. Server,\n * CLI, MCP, and SDK operator contexts may hydrate runtime config directly from\n * Infisical when they have a scoped machine identity. Tenant user auth still\n * flows through Lucern device login; tenant tools never receive platform Clerk\n * secrets.\n */\n\nimport { TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH } from \"./tenant-client.contract\";\n\nexport const INFISICAL_RUNTIME_CONTRACT_VERSION = \"2026-04-28\" as const;\n\nexport const INFISICAL_RUNTIME_DEFAULT_API_URL =\n  \"https://app.infisical.com\" as const;\nexport const INFISICAL_RUNTIME_DEFAULT_PROJECT_ID =\n  \"344b0526-90df-4606-ba50-22c647a36c65\" as const;\n\nexport const INFISICAL_RUNTIME_ENVIRONMENTS = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n] as const;\nexport type InfisicalRuntimeEnvironment =\n  (typeof INFISICAL_RUNTIME_ENVIRONMENTS)[number];\n\nexport const INFISICAL_RUNTIME_DELIVERY_MODES = [\n  \"vercel_sync\",\n  \"runtime_fetch\",\n  \"device_auth\",\n] as const;\nexport type InfisicalRuntimeDeliveryMode =\n  (typeof INFISICAL_RUNTIME_DELIVERY_MODES)[number];\n\nexport const INFISICAL_RUNTIME_SURFACE_IDS = [\n  \"lucern-web\",\n  \"lucern-gateway\",\n  \"lucern-sdk\",\n  \"lucern-cli\",\n  \"lucern-mcp\",\n  \"tenant-client\",\n] as const;\nexport type InfisicalRuntimeSurfaceId =\n  (typeof INFISICAL_RUNTIME_SURFACE_IDS)[number];\n\nexport const INFISICAL_RUNTIME_BOOTSTRAP_ENV = {\n  apiUrl: [\"INFISICAL_API_URL\", \"INFISICAL_URL\"],\n  projectId: [\"INFISICAL_PROJECT_ID\", \"INFISICAL_WORKSPACE_ID\"],\n  clientId: [\n    \"INFISICAL_CLIENT_ID\",\n    \"INFISICAL_MACHINE_CLIENT_ID\",\n    \"INFISICAL_UNIVERSAL_AUTH_CLIENT_ID\",\n  ],\n  clientSecret: [\n    \"INFISICAL_CLIENT_SECRET\",\n    \"INFISICAL_MACHINE_CLIENT_SECRET\",\n    \"INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET\",\n  ],\n  environment: [\"INFISICAL_ENV\", \"LUCERN_INFISICAL_ENV\"],\n  organizationSlug: [\"INFISICAL_ORG_SLUG\", \"INFISICAL_ORGANIZATION_SLUG\"],\n  disabled: [\"LUCERN_INFISICAL_DISABLE\", \"INFISICAL_DISABLE\"],\n} as const;\nexport type InfisicalRuntimeBootstrapEnv =\n  typeof INFISICAL_RUNTIME_BOOTSTRAP_ENV;\n\nexport type InfisicalRuntimeVariable = {\n  readonly name: string;\n  readonly required: boolean;\n  readonly secret: boolean;\n  readonly public: boolean;\n  readonly aliases?: readonly string[];\n  readonly description: string;\n};\n\nexport type InfisicalRuntimePathDefinition = {\n  readonly id: string;\n  readonly secretPath: string;\n  readonly description: string;\n  readonly variables: readonly InfisicalRuntimeVariable[];\n};\n\nexport const INFISICAL_RUNTIME_PATHS = [\n  {\n    id: \"platform-auth\",\n    secretPath: \"/platform/auth\",\n    description:\n      \"Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.\",\n    variables: [\n      {\n        name: \"NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY\",\n        required: true,\n        secret: false,\n        public: true,\n        description: \"Clerk publishable key for the Lucern web origin.\",\n      },\n      {\n        name: \"CLERK_SECRET_KEY\",\n        required: true,\n        secret: true,\n        public: false,\n        description: \"Clerk backend secret key for Lucern server runtimes.\",\n      },\n      {\n        name: \"CLERK_JWT_ISSUER_DOMAIN\",\n        required: false,\n        secret: false,\n        public: false,\n        description: \"Expected Clerk issuer/JWKS domain for JWT verification.\",\n      },\n      {\n        name: \"NEXT_PUBLIC_CLERK_SIGN_IN_URL\",\n        required: false,\n        secret: false,\n        public: true,\n        description: \"Public sign-in URL for Lucern-owned web flows.\",\n      },\n      {\n        name: \"NEXT_PUBLIC_CLERK_SIGN_UP_URL\",\n        required: false,\n        secret: false,\n        public: true,\n        description: \"Public sign-up URL for Lucern-owned web flows.\",\n      },\n    ],\n  },\n  {\n    id: \"platform-runtime\",\n    secretPath: \"/platform/runtime\",\n    description:\n      \"Runtime defaults shared by server-side Lucern clients and operator tooling.\",\n    variables: [\n      {\n        name: \"LUCERN_API_URL\",\n        required: true,\n        secret: false,\n        public: false,\n        aliases: [\"LUCERN_API_BASE_URL\", \"LUCERN_BASE_URL\"],\n        description: \"Canonical Lucern API gateway URL.\",\n      },\n      {\n        name: \"LUCERN_LOGIN_BASE_URL\",\n        required: false,\n        secret: false,\n        public: false,\n        aliases: [\"LUCERN_AUTH_BASE_URL\"],\n        description: \"Browser login origin used when it differs from the API.\",\n      },\n      {\n        name: \"LUCERN_ENVIRONMENT\",\n        required: false,\n        secret: false,\n        public: false,\n        aliases: [\"LUCERN_ENV\"],\n        description: \"Lucern environment label consumed by CLI profiles.\",\n      },\n    ],\n  },\n  {\n    id: \"tenant-shared-install\",\n    secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,\n    description:\n      \"Tenant package-install secrets. This is install-only and distinct from platform publish credentials.\",\n    variables: [\n      {\n        name: \"INSTALL_LUCERN_NPM\",\n        required: true,\n        secret: true,\n        public: false,\n        description: \"Read-only install token for the published @lucern/* suite.\",\n      },\n    ],\n  },\n] as const satisfies readonly InfisicalRuntimePathDefinition[];\nexport type InfisicalRuntimePath = (typeof INFISICAL_RUNTIME_PATHS)[number];\nexport type InfisicalRuntimePathId = InfisicalRuntimePath[\"id\"];\n\nexport type InfisicalRuntimeSurfaceDefinition = {\n  readonly id: InfisicalRuntimeSurfaceId;\n  readonly packageName?: string;\n  readonly delivery: InfisicalRuntimeDeliveryMode;\n  readonly fallback?: InfisicalRuntimeDeliveryMode;\n  readonly sourcePathIds: readonly InfisicalRuntimePathId[];\n  readonly consumer: string;\n  readonly description: string;\n};\n\nexport const INFISICAL_RUNTIME_SURFACES = [\n  {\n    id: \"lucern-web\",\n    delivery: \"vercel_sync\",\n    sourcePathIds: [\"platform-auth\", \"platform-runtime\"],\n    consumer: \"apps/web on Vercel project lucern\",\n    description:\n      \"Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs.\",\n  },\n  {\n    id: \"lucern-gateway\",\n    delivery: \"vercel_sync\",\n    sourcePathIds: [\"platform-auth\", \"platform-runtime\"],\n    consumer: \"apps/gateway on Vercel project lucern-gateway\",\n    description:\n      \"Lucern gateway consumes platform config via Infisical-to-Vercel syncs.\",\n  },\n  {\n    id: \"lucern-sdk\",\n    packageName: \"@lucern/sdk\",\n    delivery: \"runtime_fetch\",\n    sourcePathIds: [\"platform-runtime\"],\n    consumer: \"server-side SDK operator contexts with a scoped Infisical identity\",\n    description:\n      \"SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.\",\n  },\n  {\n    id: \"lucern-cli\",\n    packageName: \"@lucern/cli\",\n    delivery: \"runtime_fetch\",\n    fallback: \"device_auth\",\n    sourcePathIds: [\"platform-runtime\"],\n    consumer: \"developer/operator CLI processes\",\n    description:\n      \"CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.\",\n  },\n  {\n    id: \"lucern-mcp\",\n    packageName: \"@lucern/mcp\",\n    delivery: \"runtime_fetch\",\n    fallback: \"device_auth\",\n    sourcePathIds: [\"platform-runtime\"],\n    consumer: \"MCP server/client processes\",\n    description:\n      \"MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.\",\n  },\n  {\n    id: \"tenant-client\",\n    delivery: \"device_auth\",\n    sourcePathIds: [\"tenant-shared-install\"],\n    consumer: \"tenant-owned apps and coding agents\",\n    description:\n      \"Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces.\",\n  },\n] as const satisfies readonly InfisicalRuntimeSurfaceDefinition[];\nexport type InfisicalRuntimeSurface =\n  (typeof INFISICAL_RUNTIME_SURFACES)[number];\n\nexport function findInfisicalRuntimePath(\n  pathId: InfisicalRuntimePathId\n): InfisicalRuntimePath | undefined {\n  return INFISICAL_RUNTIME_PATHS.find((path) => path.id === pathId);\n}\n\nexport function findInfisicalRuntimeSurface(\n  surfaceId: InfisicalRuntimeSurfaceId\n): InfisicalRuntimeSurface | undefined {\n  return INFISICAL_RUNTIME_SURFACES.find(\n    (surface) => surface.id === surfaceId\n  );\n}\n"]}
+{"version":3,"sources":["../src/tenant-client.contract.ts","../src/infisical-runtime.contract.ts"],"names":[],"mappings":";AAoDO,IAAM,0CAAA,GACX,gBAAA;AAUK,IAAM,kCAAA,GAAqC;AAAA,EAChD;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,cAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,oBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,eAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,uBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,gBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,kBAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,mBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,wBAAA;AAAA,IACb,IAAA,EAAM,gBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,0BAAA;AAAA,IACb,IAAA,EAAM,mBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,aAAA;AAAA,IACb,IAAA,EAAM,oBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,qBAAA;AAAA,IACb,IAAA,EAAM,kBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,iBAAA;AAAA,IACb,IAAA,EAAM,cAAA;AAAA,IACN,kBAAA,EAAoB;AAAA,GACtB;AAAA,EACA;AAAA,IACE,WAAA,EAAa,eAAA;AAAA,IACb,IAAA,EAAM,qBAAA;AAAA,IACN,kBAAA,EAAoB;AAAA;AAExB,CAAA;AAyBE,kCAAA,CAAmC,GAAA;AAAA,EACjC,CAAC,UAAU,KAAA,CAAM;AACnB;;;ACjMK,IAAM,kCAAA,GAAqC;AAE3C,IAAM,iCAAA,GACX;AACK,IAAM,oCAAA,GACX;AAEK,IAAM,8BAAA,GAAiC;AAAA,EAC5C,KAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,aAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF;AAIO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,YAAA;AAAA,EACA,gBAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF;AAIO,IAAM,+BAAA,GAAkC;AAAA,EAC7C,MAAA,EAAQ,CAAC,mBAAA,EAAqB,eAAe,CAAA;AAAA,EAC7C,SAAA,EAAW,CAAC,sBAAA,EAAwB,wBAAwB,CAAA;AAAA,EAC5D,QAAA,EAAU;AAAA,IACR,qBAAA;AAAA,IACA,6BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,YAAA,EAAc;AAAA,IACZ,yBAAA;AAAA,IACA,iCAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,WAAA,EAAa,CAAC,eAAA,EAAiB,sBAAsB,CAAA;AAAA,EACrD,gBAAA,EAAkB,CAAC,oBAAA,EAAsB,6BAA6B,CAAA;AAAA,EACtE,QAAA,EAAU,CAAC,0BAAA,EAA4B,mBAAmB;AAC5D;AAoBO,IAAM,uBAAA,GAA0B;AAAA,EACrC;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,UAAA,EAAY,gBAAA;AAAA,IACZ,WAAA,EACE,qHAAA;AAAA,IACF,SAAA,EAAW;AAAA,MACT;AAAA,QACE,IAAA,EAAM,mCAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,IAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,kBAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,IAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,yBAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,+BAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,IAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,+BAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,IAAA;AAAA,QACR,WAAA,EAAa;AAAA;AACf;AACF,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,UAAA,EAAY,mBAAA;AAAA,IACZ,WAAA,EACE,6EAAA;AAAA,IACF,SAAA,EAAW;AAAA,MACT;AAAA,QACE,IAAA,EAAM,gBAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,CAAC,qBAAA,EAAuB,iBAAiB,CAAA;AAAA,QAClD,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,uBAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,CAAC,sBAAsB,CAAA;AAAA,QAChC,WAAA,EAAa;AAAA,OACf;AAAA,MACA;AAAA,QACE,IAAA,EAAM,oBAAA;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,CAAC,YAAY,CAAA;AAAA,QACtB,WAAA,EAAa;AAAA;AACf;AACF,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,uBAAA;AAAA,IACJ,UAAA,EAAY,0CAAA;AAAA,IACZ,WAAA,EACE,sGAAA;AAAA,IACF,SAAA,EAAW;AAAA,MACT;AAAA,QACE,IAAA,EAAM,oBAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,IAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa;AAAA;AACf;AACF;AAEJ;AAcO,IAAM,0BAAA,GAA6B;AAAA,EACxC;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,eAAA,EAAiB,kBAAkB,CAAA;AAAA,IACnD,QAAA,EAAU,mCAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,gBAAA;AAAA,IACJ,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,eAAA,EAAiB,kBAAkB,CAAA;AAAA,IACnD,QAAA,EAAU,+CAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EAAa,aAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,aAAA,EAAe,CAAC,kBAAkB,CAAA;AAAA,IAClC,QAAA,EAAU,oEAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EAAa,aAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,kBAAkB,CAAA;AAAA,IAClC,QAAA,EAAU,kCAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,WAAA,EAAa,aAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,kBAAkB,CAAA;AAAA,IAClC,QAAA,EAAU,6BAAA;AAAA,IACV,WAAA,EACE;AAAA,GACJ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,QAAA,EAAU,aAAA;AAAA,IACV,aAAA,EAAe,CAAC,uBAAuB,CAAA;AAAA,IACvC,QAAA,EAAU,qCAAA;AAAA,IACV,WAAA,EACE;AAAA;AAEN;AAIO,SAAS,yBACd,MAAA,EACkC;AAClC,EAAA,OAAO,wBAAwB,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,OAAO,MAAM,CAAA;AAClE;AAEO,SAAS,4BACd,SAAA,EACqC;AACrC,EAAA,OAAO,0BAAA,CAA2B,IAAA;AAAA,IAChC,CAAC,OAAA,KAAY,OAAA,CAAQ,EAAA,KAAO;AAAA,GAC9B;AACF","file":"infisical-runtime.contract.js","sourcesContent":["/**\n * Tenant client contract\n *\n * Defines the generic boundary for any customer-owned product that consumes\n * Lucern through the SDK, hosted API, or MCP server. Tenant clients may run\n * their own UI, auth provider, deployment, and data plane, but reasoning\n * operations must enter through the published packages below.\n */\n\nimport type {\n  SessionAuthMode,\n  SessionPrincipalType,\n} from \"./auth.contract\";\n\nexport const TENANT_CLIENT_CONTRACT_VERSION = \"2026-04-27\" as const;\n\nexport const TENANT_CLIENT_AUTH_MODES = [\n  \"interactive_user\",\n  \"service_principal\",\n  \"tenant_api_key\",\n  \"session_token\",\n] as const satisfies readonly SessionAuthMode[];\nexport type TenantClientAuthMode = (typeof TENANT_CLIENT_AUTH_MODES)[number];\n\nexport const TENANT_CLIENT_PRINCIPAL_TYPES = [\n  \"human\",\n  \"service\",\n  \"agent\",\n] as const satisfies readonly SessionPrincipalType[];\nexport type TenantClientPrincipalType =\n  (typeof TENANT_CLIENT_PRINCIPAL_TYPES)[number];\n\nexport const TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [\n  \"tenantId\",\n  \"workspaceId\",\n  \"principalId\",\n  \"authMode\",\n  \"scopes\",\n] as const;\nexport type TenantClientRequiredContextField =\n  (typeof TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [\n  \"principalType\",\n  \"roles\",\n  \"sessionId\",\n  \"delegationChain\",\n] as const;\nexport type TenantClientOptionalContextField =\n  (typeof TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS)[number];\n\nexport const TENANT_CLIENT_INSTALL_TOKEN_ENV = \"INSTALL_LUCERN_NPM\" as const;\nexport const TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH =\n  \"tenants/shared\" as const;\nexport const TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [\n  \"/platform/publish\",\n] as const;\nexport const TENANT_CLIENT_FORBIDDEN_SECRET_ENV = [\"NPM_TOKEN\"] as const;\nexport type TenantClientForbiddenInstallTokenInfisicalPath =\n  (typeof TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS)[number];\nexport type TenantClientForbiddenSecretEnv =\n  (typeof TENANT_CLIENT_FORBIDDEN_SECRET_ENV)[number];\n\nexport const TENANT_CLIENT_INSTALLABLE_PACKAGES = [\n  {\n    packageName: \"@lucern/access-control\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/agent\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/auth\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/cli\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/client-core\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/confidence\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/config\",\n    role: \"configuration\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/control-plane\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/developer-kit\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/events\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/graph-primitives\",\n    role: \"sdk_dependency\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/identity\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/pack-host\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/pack-installer\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/proof-compiler\",\n    role: \"developer_tool\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/react\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    role: \"component_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/sdk\",\n    role: \"runtime_entrypoint\",\n    directTenantImport: true,\n  },\n  {\n    packageName: \"@lucern/server-core\",\n    role: \"platform_runtime\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/testing\",\n    role: \"test_support\",\n    directTenantImport: false,\n  },\n  {\n    packageName: \"@lucern/types\",\n    role: \"contract_entrypoint\",\n    directTenantImport: true,\n  },\n] as const;\nexport type TenantClientInstallablePackage =\n  (typeof TENANT_CLIENT_INSTALLABLE_PACKAGES)[number];\nexport type TenantClientPackageRole = TenantClientInstallablePackage[\"role\"];\nexport type TenantClientInstallablePackageName =\n  TenantClientInstallablePackage[\"packageName\"];\n\n/**\n * Direct package installs are package.json entries owned by the tenant repo.\n * Direct imports are source-code imports that tenant application code may use.\n *\n * These concepts intentionally differ: `@lucern/cli` is a direct install when a\n * tenant repo needs the `lucern` binary, but it is not a direct application\n * import. `@lucern/reasoning-kernel` and `@lucern/identity` are direct installs\n * for Convex component binding, while tenant app code should only import their\n * explicit component config subpaths.\n */\nexport type TenantClientInstallProfile = {\n  id: string;\n  description: string;\n  packageNames: readonly TenantClientInstallablePackageName[];\n  dependencyField: \"dependencies\" | \"devDependencies\" | \"mixed\";\n};\n\nexport const TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES =\n  TENANT_CLIENT_INSTALLABLE_PACKAGES.map(\n    (entry) => entry.packageName\n  ) as readonly TenantClientInstallablePackageName[];\n\nexport const TENANT_CLIENT_INSTALL_PROFILES = [\n  {\n    id: \"core_app_runtime\",\n    description:\n      \"Smallest tenant app/runtime install for typed Lucern API calls plus tool-access policy helpers.\",\n    packageNames: [\"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"react_app_runtime\",\n    description:\n      \"React tenant app install for hooks, provider, curated graph components, and direct SDK calls.\",\n    packageNames: [\"@lucern/react\", \"@lucern/sdk\", \"@lucern/access-control\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"convex_components\",\n    description:\n      \"Tenant Convex host install for binding the Lucern identity and reasoning-kernel components.\",\n    packageNames: [\"@lucern/identity\", \"@lucern/reasoning-kernel\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"operator_cli\",\n    description:\n      \"Developer/operator install for the `lucern` binary, including tenant bootstrap seed commands.\",\n    packageNames: [\"@lucern/cli\"],\n    dependencyField: \"devDependencies\",\n  },\n  {\n    id: \"mcp_runtime\",\n    description:\n      \"Agent runtime install for the standalone Lucern MCP server and hosted route helpers.\",\n    packageNames: [\"@lucern/mcp\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"contracts_and_types\",\n    description:\n      \"Compile-time contract/type install for codegen, audits, and tenant integration validation.\",\n    packageNames: [\"@lucern/contracts\", \"@lucern/types\"],\n    dependencyField: \"dependencies\",\n  },\n  {\n    id: \"full_suite\",\n    description:\n      \"Full coherent Lucern package suite for design-partner repos that want every published runtime, tool, component, test, and config package pinned together.\",\n    packageNames: TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES,\n    dependencyField: \"mixed\",\n  },\n] as const satisfies readonly TenantClientInstallProfile[];\nexport type TenantClientInstallProfileId =\n  (typeof TENANT_CLIENT_INSTALL_PROFILES)[number][\"id\"];\n\n/**\n * Direct imports tenant-owned product code may use. This is intentionally\n * smaller than TENANT_CLIENT_INSTALLABLE_PACKAGES: several publishable packages\n * are installed as SDK dependencies, tooling, or platform runtimes but should\n * not become the application integration surface.\n */\nexport const TENANT_CLIENT_PUBLIC_IMPORTS = [\n  {\n    packageName: \"@lucern/sdk\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"TypeScript SDK runtime and generated operation namespaces.\",\n  },\n  {\n    packageName: \"@lucern/react\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"React bindings for tenant-owned UI applications.\",\n  },\n  {\n    packageName: \"@lucern/mcp\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description: \"MCP client/server entry points and hosted route helpers.\",\n  },\n  {\n    packageName: \"@lucern/contracts\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type and manifest contracts.\",\n  },\n  {\n    packageName: \"@lucern/access-control\",\n    surface: \"runtime\",\n    subpaths: \"published_exports\",\n    description:\n      \"Tenant runtime access-control helpers, including effective tool access.\",\n  },\n  {\n    packageName: \"@lucern/types\",\n    surface: \"contract\",\n    subpaths: \"published_exports\",\n    description: \"Published type-only helpers for tenant integration code.\",\n  },\n] as const;\nexport type TenantClientPublicImport =\n  (typeof TENANT_CLIENT_PUBLIC_IMPORTS)[number];\nexport type TenantClientPublicPackage =\n  TenantClientPublicImport[\"packageName\"];\nexport type TenantClientPublicSurface = TenantClientPublicImport[\"surface\"];\n\nexport const TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [\n  {\n    packageName: \"@lucern/identity\",\n    importPath: \"@lucern/identity/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install Lucern identity.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/convex.config\",\n    surface: \"component_config\",\n    description:\n      \"Convex component binding config for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n  {\n    packageName: \"@lucern/reasoning-kernel\",\n    importPath: \"@lucern/reasoning-kernel/runtime.config\",\n    surface: \"component_config\",\n    description:\n      \"Runtime config alias for tenant deployments that install the Lucern reasoning kernel.\",\n  },\n] as const;\nexport type TenantClientComponentConfigImport =\n  (typeof TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS)[number];\nexport type TenantClientAllowedImport =\n  | TenantClientPublicImport\n  | TenantClientComponentConfigImport;\n\nexport function findTenantClientInstallablePackage(\n  packageName: string\n): TenantClientInstallablePackage | undefined {\n  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(\n    (entry) => entry.packageName === packageName\n  );\n}\n\nexport function isTenantClientInstallablePackage(packageName: string): boolean {\n  return Boolean(findTenantClientInstallablePackage(packageName));\n}\n\nexport const TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [\n  \"bootstrap\",\n  \"context\",\n  \"beliefs\",\n  \"evidence\",\n  \"questions\",\n  \"graph\",\n  \"worktrees\",\n  \"topics\",\n  \"edges\",\n  \"contradictions\",\n  \"contracts\",\n  \"graphIntel\",\n  \"graphIntelligence\",\n  \"graphAnalysis\",\n  \"graphRecommendations\",\n  \"orgGraphSearch\",\n  \"embeddings\",\n  \"ontologyLinks\",\n  \"graphStateClassifier\",\n  \"tools\",\n  \"identity\",\n  \"modelRuntime\",\n  \"events\",\n  \"jobs\",\n  \"telemetry\",\n] as const;\nexport type TenantClientRequiredSdkNamespace =\n  (typeof TENANT_CLIENT_REQUIRED_SDK_NAMESPACES)[number];\n\nexport const TENANT_CLIENT_CAPABILITIES = [\n  {\n    id: \"identity.bootstrap_session\",\n    description: \"Start a scoped Lucern session for a tenant principal.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.context.compile\",\n    description: \"Compile tenant and workspace scoped reasoning context.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.read\",\n    description: \"Read beliefs, evidence, questions, topics, graph edges, and lineage.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph.write\",\n    description: \"Create and update graph objects through authorized APIs.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"reasoning.graph_intelligence.run\",\n    description:\n      \"Discover and run Graph Intelligence query recipes for structural graph analysis.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/cli\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n  {\n    id: \"workflow.worktree_lifecycle\",\n    description: \"Create, review, merge, and close scoped worktrees.\",\n    surfaces: [\"@lucern/sdk\", \"@lucern/react\", \"@lucern/mcp\"],\n    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,\n  },\n] as const;\nexport type TenantClientCapability =\n  (typeof TENANT_CLIENT_CAPABILITIES)[number];\nexport type TenantClientCapabilityId = TenantClientCapability[\"id\"];\n\nexport const TENANT_CLIENT_ISOLATION_RULES = [\n  {\n    id: \"tenant_workspace_scope_required\",\n    description:\n      \"Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state.\",\n  },\n  {\n    id: \"principal_audit_required\",\n    description:\n      \"Runtime operations must carry principalId, authMode, and scopes for audit attribution.\",\n  },\n  {\n    id: \"no_private_lucern_imports\",\n    description:\n      \"Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals.\",\n  },\n] as const;\nexport type TenantClientIsolationRule =\n  (typeof TENANT_CLIENT_ISOLATION_RULES)[number];\n\nexport const TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [\n  {\n    id: \"deep_src_import\",\n    pattern: \"^@lucern/[^/]+/src(?:/|$)\",\n    description: \"Published packages must not be bypassed through src paths.\",\n  },\n  {\n    id: \"deep_dist_import\",\n    pattern: \"^@lucern/[^/]+/dist(?:/|$)\",\n    description:\n      \"Published package exports must be used instead of dist file paths.\",\n  },\n  {\n    id: \"generated_adapter_import\",\n    pattern: \"^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)\",\n    description:\n      \"Generated Lucern adapters are internal deployment artifacts.\",\n  },\n  {\n    id: \"private_runtime_import\",\n    pattern: \"^@lucern/[^/]+/(?:internal|private)(?:/|$)\",\n    description: \"Internal and private package subpaths are not public SDK API.\",\n  },\n  {\n    id: \"workspace_source_import\",\n    pattern: \"^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)\",\n    description:\n      \"Tenant clients must not import source files from the Lucern monorepo.\",\n  },\n  {\n    id: \"root_alias_lucern_import\",\n    pattern: \"^@/(?:lucern|packages|modules|services|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not depend on Lucern repo-local path aliases.\",\n  },\n  {\n    id: \"relative_lucern_source_import\",\n    pattern: \"^\\\\.\\\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)\",\n    description:\n      \"Tenant clients must not reach back into Lucern source through relative paths.\",\n  },\n  {\n    id: \"monorepo_path_import\",\n    pattern: \"lucern-repo\",\n    description:\n      \"Absolute imports that name the Lucern repository are not portable tenant code.\",\n  },\n] as const;\nexport type TenantClientForbiddenImportPattern =\n  (typeof TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS)[number];\nexport type TenantClientForbiddenImportPatternId =\n  TenantClientForbiddenImportPattern[\"id\"];\n\nexport type TenantClientImportDecision =\n  | \"public\"\n  | \"forbidden\"\n  | \"local\"\n  | \"external\";\n\nexport type TenantClientImportClassification = {\n  importPath: string;\n  decision: TenantClientImportDecision;\n  publicImport?: TenantClientAllowedImport;\n  pattern?: TenantClientForbiddenImportPattern;\n  reason: string;\n};\n\nfunction matchesPublicImport(\n  importPath: string\n): TenantClientAllowedImport | undefined {\n  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(\n    (entry) => importPath === entry.importPath\n  );\n  if (componentConfig) {\n    return componentConfig;\n  }\n\n  return TENANT_CLIENT_PUBLIC_IMPORTS.find(\n    (entry) =>\n      importPath === entry.packageName ||\n      importPath.startsWith(`${entry.packageName}/`)\n  );\n}\n\nfunction matchesForbiddenPattern(\n  importPath: string\n): TenantClientForbiddenImportPattern | undefined {\n  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find((entry) =>\n    new RegExp(entry.pattern, \"u\").test(importPath)\n  );\n}\n\nexport function classifyTenantClientImport(\n  importPath: string\n): TenantClientImportClassification {\n  const normalizedImportPath = importPath.trim();\n  const pattern = matchesForbiddenPattern(normalizedImportPath);\n\n  if (pattern) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      pattern,\n      reason: pattern.description,\n    };\n  }\n\n  const publicImport = matchesPublicImport(normalizedImportPath);\n  if (publicImport) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"public\",\n      publicImport,\n      reason: publicImport.description,\n    };\n  }\n\n  if (normalizedImportPath.startsWith(\"@lucern/\")) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"forbidden\",\n      reason:\n        \"This @lucern package is not part of the tenant client public surface.\",\n    };\n  }\n\n  if (\n    normalizedImportPath.startsWith(\"./\") ||\n    normalizedImportPath.startsWith(\"../\")\n  ) {\n    return {\n      importPath: normalizedImportPath,\n      decision: \"local\",\n      reason: \"Local tenant-owned import.\",\n    };\n  }\n\n  return {\n    importPath: normalizedImportPath,\n    decision: \"external\",\n    reason: \"External dependency outside the Lucern package namespace.\",\n  };\n}\n\nexport function isTenantClientPublicImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function isTenantClientComponentConfigImport(\n  importPath: string\n): boolean {\n  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(\n    (entry) => importPath === entry.importPath\n  );\n}\n\nexport function isTenantClientAllowedImport(importPath: string): boolean {\n  return classifyTenantClientImport(importPath).decision === \"public\";\n}\n\nexport function assertTenantClientImportAllowed(importPath: string): void {\n  const classification = classifyTenantClientImport(importPath);\n  if (classification.decision !== \"forbidden\") {\n    return;\n  }\n\n  throw new Error(formatTenantClientImportViolation(classification));\n}\n\nexport function formatTenantClientImportViolation(\n  classification: TenantClientImportClassification\n): string {\n  const patternId = classification.pattern\n    ? ` [${classification.pattern.id}]`\n    : \"\";\n  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;\n}\n","/**\n * Infisical runtime contract\n *\n * Defines how Lucern runtime surfaces receive platform configuration and\n * secrets. Vercel-owned apps consume Infisical through secret syncs. Server,\n * CLI, MCP, and SDK operator contexts may hydrate runtime config directly from\n * Infisical when they have a scoped machine identity. Tenant user auth still\n * flows through Lucern device login; tenant tools never receive platform Clerk\n * secrets.\n */\n\nimport { TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH } from \"./tenant-client.contract\";\n\nexport const INFISICAL_RUNTIME_CONTRACT_VERSION = \"2026-04-28\" as const;\n\nexport const INFISICAL_RUNTIME_DEFAULT_API_URL =\n  \"https://app.infisical.com\" as const;\nexport const INFISICAL_RUNTIME_DEFAULT_PROJECT_ID =\n  \"344b0526-90df-4606-ba50-22c647a36c65\" as const;\n\nexport const INFISICAL_RUNTIME_ENVIRONMENTS = [\n  \"dev\",\n  \"staging\",\n  \"prod\",\n] as const;\nexport type InfisicalRuntimeEnvironment =\n  (typeof INFISICAL_RUNTIME_ENVIRONMENTS)[number];\n\nexport const INFISICAL_RUNTIME_DELIVERY_MODES = [\n  \"vercel_sync\",\n  \"runtime_fetch\",\n  \"device_auth\",\n] as const;\nexport type InfisicalRuntimeDeliveryMode =\n  (typeof INFISICAL_RUNTIME_DELIVERY_MODES)[number];\n\nexport const INFISICAL_RUNTIME_SURFACE_IDS = [\n  \"lucern-web\",\n  \"lucern-gateway\",\n  \"lucern-sdk\",\n  \"lucern-cli\",\n  \"lucern-mcp\",\n  \"tenant-client\",\n] as const;\nexport type InfisicalRuntimeSurfaceId =\n  (typeof INFISICAL_RUNTIME_SURFACE_IDS)[number];\n\nexport const INFISICAL_RUNTIME_BOOTSTRAP_ENV = {\n  apiUrl: [\"INFISICAL_API_URL\", \"INFISICAL_URL\"],\n  projectId: [\"INFISICAL_PROJECT_ID\", \"INFISICAL_WORKSPACE_ID\"],\n  clientId: [\n    \"INFISICAL_CLIENT_ID\",\n    \"INFISICAL_MACHINE_CLIENT_ID\",\n    \"INFISICAL_UNIVERSAL_AUTH_CLIENT_ID\",\n  ],\n  clientSecret: [\n    \"INFISICAL_CLIENT_SECRET\",\n    \"INFISICAL_MACHINE_CLIENT_SECRET\",\n    \"INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET\",\n  ],\n  environment: [\"INFISICAL_ENV\", \"LUCERN_INFISICAL_ENV\"],\n  organizationSlug: [\"INFISICAL_ORG_SLUG\", \"INFISICAL_ORGANIZATION_SLUG\"],\n  disabled: [\"LUCERN_INFISICAL_DISABLE\", \"INFISICAL_DISABLE\"],\n} as const;\nexport type InfisicalRuntimeBootstrapEnv =\n  typeof INFISICAL_RUNTIME_BOOTSTRAP_ENV;\n\nexport type InfisicalRuntimeVariable = {\n  readonly name: string;\n  readonly required: boolean;\n  readonly secret: boolean;\n  readonly public: boolean;\n  readonly aliases?: readonly string[];\n  readonly description: string;\n};\n\nexport type InfisicalRuntimePathDefinition = {\n  readonly id: string;\n  readonly secretPath: string;\n  readonly description: string;\n  readonly variables: readonly InfisicalRuntimeVariable[];\n};\n\nexport const INFISICAL_RUNTIME_PATHS = [\n  {\n    id: \"platform-auth\",\n    secretPath: \"/platform/auth\",\n    description:\n      \"Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.\",\n    variables: [\n      {\n        name: \"NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY\",\n        required: true,\n        secret: false,\n        public: true,\n        description: \"Clerk publishable key for the Lucern web origin.\",\n      },\n      {\n        name: \"CLERK_SECRET_KEY\",\n        required: true,\n        secret: true,\n        public: false,\n        description: \"Clerk backend secret key for Lucern server runtimes.\",\n      },\n      {\n        name: \"CLERK_JWT_ISSUER_DOMAIN\",\n        required: false,\n        secret: false,\n        public: false,\n        description: \"Expected Clerk issuer/JWKS domain for JWT verification.\",\n      },\n      {\n        name: \"NEXT_PUBLIC_CLERK_SIGN_IN_URL\",\n        required: false,\n        secret: false,\n        public: true,\n        description: \"Public sign-in URL for Lucern-owned web flows.\",\n      },\n      {\n        name: \"NEXT_PUBLIC_CLERK_SIGN_UP_URL\",\n        required: false,\n        secret: false,\n        public: true,\n        description: \"Public sign-up URL for Lucern-owned web flows.\",\n      },\n    ],\n  },\n  {\n    id: \"platform-runtime\",\n    secretPath: \"/platform/runtime\",\n    description:\n      \"Runtime defaults shared by server-side Lucern clients and operator tooling.\",\n    variables: [\n      {\n        name: \"LUCERN_API_URL\",\n        required: true,\n        secret: false,\n        public: false,\n        aliases: [\"LUCERN_API_BASE_URL\", \"LUCERN_BASE_URL\"],\n        description: \"Canonical Lucern API gateway URL.\",\n      },\n      {\n        name: \"LUCERN_LOGIN_BASE_URL\",\n        required: false,\n        secret: false,\n        public: false,\n        aliases: [\"LUCERN_AUTH_BASE_URL\"],\n        description: \"Browser login origin used when it differs from the API.\",\n      },\n      {\n        name: \"LUCERN_ENVIRONMENT\",\n        required: false,\n        secret: false,\n        public: false,\n        aliases: [\"LUCERN_ENV\"],\n        description: \"Lucern environment label consumed by CLI profiles.\",\n      },\n    ],\n  },\n  {\n    id: \"tenant-shared-install\",\n    secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,\n    description:\n      \"Tenant package-install secrets. This is install-only and distinct from platform publish credentials.\",\n    variables: [\n      {\n        name: \"INSTALL_LUCERN_NPM\",\n        required: true,\n        secret: true,\n        public: false,\n        description: \"Read-only install token for the published @lucern/* suite.\",\n      },\n    ],\n  },\n] as const satisfies readonly InfisicalRuntimePathDefinition[];\nexport type InfisicalRuntimePath = (typeof INFISICAL_RUNTIME_PATHS)[number];\nexport type InfisicalRuntimePathId = InfisicalRuntimePath[\"id\"];\n\nexport type InfisicalRuntimeSurfaceDefinition = {\n  readonly id: InfisicalRuntimeSurfaceId;\n  readonly packageName?: string;\n  readonly delivery: InfisicalRuntimeDeliveryMode;\n  readonly fallback?: InfisicalRuntimeDeliveryMode;\n  readonly sourcePathIds: readonly InfisicalRuntimePathId[];\n  readonly consumer: string;\n  readonly description: string;\n};\n\nexport const INFISICAL_RUNTIME_SURFACES = [\n  {\n    id: \"lucern-web\",\n    delivery: \"vercel_sync\",\n    sourcePathIds: [\"platform-auth\", \"platform-runtime\"],\n    consumer: \"apps/web on Vercel project lucern\",\n    description:\n      \"Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs.\",\n  },\n  {\n    id: \"lucern-gateway\",\n    delivery: \"vercel_sync\",\n    sourcePathIds: [\"platform-auth\", \"platform-runtime\"],\n    consumer: \"apps/gateway on Vercel project lucern-gateway\",\n    description:\n      \"Lucern gateway consumes platform config via Infisical-to-Vercel syncs.\",\n  },\n  {\n    id: \"lucern-sdk\",\n    packageName: \"@lucern/sdk\",\n    delivery: \"runtime_fetch\",\n    sourcePathIds: [\"platform-runtime\"],\n    consumer: \"server-side SDK operator contexts with a scoped Infisical identity\",\n    description:\n      \"SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.\",\n  },\n  {\n    id: \"lucern-cli\",\n    packageName: \"@lucern/cli\",\n    delivery: \"runtime_fetch\",\n    fallback: \"device_auth\",\n    sourcePathIds: [\"platform-runtime\"],\n    consumer: \"developer/operator CLI processes\",\n    description:\n      \"CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.\",\n  },\n  {\n    id: \"lucern-mcp\",\n    packageName: \"@lucern/mcp\",\n    delivery: \"runtime_fetch\",\n    fallback: \"device_auth\",\n    sourcePathIds: [\"platform-runtime\"],\n    consumer: \"MCP server/client processes\",\n    description:\n      \"MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.\",\n  },\n  {\n    id: \"tenant-client\",\n    delivery: \"device_auth\",\n    sourcePathIds: [\"tenant-shared-install\"],\n    consumer: \"tenant-owned apps and coding agents\",\n    description:\n      \"Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces.\",\n  },\n] as const satisfies readonly InfisicalRuntimeSurfaceDefinition[];\nexport type InfisicalRuntimeSurface =\n  (typeof INFISICAL_RUNTIME_SURFACES)[number];\n\nexport function findInfisicalRuntimePath(\n  pathId: InfisicalRuntimePathId\n): InfisicalRuntimePath | undefined {\n  return INFISICAL_RUNTIME_PATHS.find((path) => path.id === pathId);\n}\n\nexport function findInfisicalRuntimeSurface(\n  surfaceId: InfisicalRuntimeSurfaceId\n): InfisicalRuntimeSurface | undefined {\n  return INFISICAL_RUNTIME_SURFACES.find(\n    (surface) => surface.id === surfaceId\n  );\n}\n"]}

package/dist/manifests/edge-policy-manifest.d.ts

@@ -0,0 +1,2 @@
+import 'zod';
+export { e as EdgePolicyEntry, c as EdgePolicyEntrySchema, f as EdgePolicyManifest, d as EdgePolicyManifestSchema, g as EdgePolicyViolation, i as assertEdgePolicyAllowed, h as findEdgePolicy } from '../edge-policy-manifest-DpmTtjmm.js';

package/dist/manifests/edge-policy-manifest.data.d.ts

@@ -0,0 +1,27 @@
+declare const edgePolicyManifest: {
+    manifestVersion: "1.0.0";
+    policies: ({
+        edgeType: string;
+        fromKinds: "epistemic_node"[];
+        fromNodeTypes: "evidence"[];
+        toKinds: "epistemic_node"[];
+        toNodeTypes: "evidence"[];
+        description: string;
+    } | {
+        edgeType: string;
+        fromKinds: "epistemic_node"[];
+        fromNodeTypes: "evidence"[];
+        toKinds: "epistemic_node"[];
+        toNodeTypes: "belief"[];
+        description: string;
+    } | {
+        edgeType: string;
+        fromKinds: "epistemic_node"[];
+        fromNodeTypes: "evidence"[];
+        toKinds: "epistemic_node"[];
+        toNodeTypes: "question"[];
+        description: string;
+    })[];
+};
+
+export { edgePolicyManifest };

package/dist/manifests/edge-policy-manifest.data.js

@@ -0,0 +1,34 @@
+// src/manifests/edge-policy-manifest.data.ts
+var edgePolicyManifest = {
+  manifestVersion: "1.0.0",
+  policies: [
+    {
+      edgeType: "evidence_derived_from_evidence",
+      fromKinds: ["epistemic_node"],
+      fromNodeTypes: ["evidence"],
+      toKinds: ["epistemic_node"],
+      toNodeTypes: ["evidence"],
+      description: "Evidence E2 was synthesized from evidence E1 by a transformation. Provides chain-of-evidence lineage."
+    },
+    {
+      edgeType: "evidence_supports_belief",
+      fromKinds: ["epistemic_node"],
+      fromNodeTypes: ["evidence"],
+      toKinds: ["epistemic_node"],
+      toNodeTypes: ["belief"],
+      description: "Existing link_evidence_to_belief semantics promoted to the create_edge policy source."
+    },
+    {
+      edgeType: "evidence_supports_question",
+      fromKinds: ["epistemic_node"],
+      fromNodeTypes: ["evidence"],
+      toKinds: ["epistemic_node"],
+      toNodeTypes: ["question"],
+      description: "Existing link_evidence_to_question semantics promoted to the create_edge policy source."
+    }
+  ]
+};
+
+export { edgePolicyManifest };
+//# sourceMappingURL=edge-policy-manifest.data.js.map
+//# sourceMappingURL=edge-policy-manifest.data.js.map

package/dist/manifests/edge-policy-manifest.data.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/manifests/edge-policy-manifest.data.ts"],"names":[],"mappings":";AAEO,IAAM,kBAAA,GAAqB;AAAA,EAChC,eAAA,EAAiB,OAAA;AAAA,EACjB,QAAA,EAAU;AAAA,IACR;AAAA,MACE,QAAA,EAAU,gCAAA;AAAA,MACV,SAAA,EAAW,CAAC,gBAAgB,CAAA;AAAA,MAC5B,aAAA,EAAe,CAAC,UAAU,CAAA;AAAA,MAC1B,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,MAC1B,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,WAAA,EACE;AAAA,KACJ;AAAA,IACA;AAAA,MACE,QAAA,EAAU,0BAAA;AAAA,MACV,SAAA,EAAW,CAAC,gBAAgB,CAAA;AAAA,MAC5B,aAAA,EAAe,CAAC,UAAU,CAAA;AAAA,MAC1B,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,MAC1B,WAAA,EAAa,CAAC,QAAQ,CAAA;AAAA,MACtB,WAAA,EACE;AAAA,KACJ;AAAA,IACA;AAAA,MACE,QAAA,EAAU,4BAAA;AAAA,MACV,SAAA,EAAW,CAAC,gBAAgB,CAAA;AAAA,MAC5B,aAAA,EAAe,CAAC,UAAU,CAAA;AAAA,MAC1B,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,MAC1B,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,WAAA,EACE;AAAA;AACJ;AAEJ","file":"edge-policy-manifest.data.js","sourcesContent":["import type { EdgePolicyManifest } from \"./edge-policy-manifest.js\";\n\nexport const edgePolicyManifest = {\n  manifestVersion: \"1.0.0\",\n  policies: [\n    {\n      edgeType: \"evidence_derived_from_evidence\",\n      fromKinds: [\"epistemic_node\"],\n      fromNodeTypes: [\"evidence\"],\n      toKinds: [\"epistemic_node\"],\n      toNodeTypes: [\"evidence\"],\n      description:\n        \"Evidence E2 was synthesized from evidence E1 by a transformation. Provides chain-of-evidence lineage.\",\n    },\n    {\n      edgeType: \"evidence_supports_belief\",\n      fromKinds: [\"epistemic_node\"],\n      fromNodeTypes: [\"evidence\"],\n      toKinds: [\"epistemic_node\"],\n      toNodeTypes: [\"belief\"],\n      description:\n        \"Existing link_evidence_to_belief semantics promoted to the create_edge policy source.\",\n    },\n    {\n      edgeType: \"evidence_supports_question\",\n      fromKinds: [\"epistemic_node\"],\n      fromNodeTypes: [\"evidence\"],\n      toKinds: [\"epistemic_node\"],\n      toNodeTypes: [\"question\"],\n      description:\n        \"Existing link_evidence_to_question semantics promoted to the create_edge policy source.\",\n    },\n  ],\n} satisfies EdgePolicyManifest;\n"]}

package/dist/manifests/edge-policy-manifest.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+
+// src/manifests/edge-policy-manifest.ts
+var EpistemicNodeTypeSchema = z.enum([
+  "belief",
+  "evidence",
+  "question",
+  "answer",
+  "topic",
+  "edge",
+  "ontology",
+  "lens",
+  "contradiction"
+]);
+z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("epistemic_node"),
+    nodeId: z.string(),
+    nodeType: EpistemicNodeTypeSchema
+  }),
+  z.object({
+    kind: z.literal("external_belief"),
+    ref: z.object({
+      tenantId: z.string(),
+      beliefId: z.string()
+    })
+  })
+]);
+
+// src/manifests/edge-policy-manifest.ts
+var graphRefKind = z.enum(["epistemic_node", "external_belief"]);
+var EdgePolicyEntrySchema = z.object({
+  edgeType: z.string(),
+  fromKinds: z.array(graphRefKind),
+  fromNodeTypes: z.array(EpistemicNodeTypeSchema).optional(),
+  toKinds: z.array(graphRefKind),
+  toNodeTypes: z.array(EpistemicNodeTypeSchema).optional(),
+  description: z.string()
+});
+var EdgePolicyManifestSchema = z.object({
+  manifestVersion: z.literal("1.0.0"),
+  policies: z.array(EdgePolicyEntrySchema)
+});
+function findEdgePolicy(manifest, edgeType) {
+  return manifest.policies.find((policy) => policy.edgeType === edgeType);
+}
+function nodeTypeAllowed(allowed, ref) {
+  return ref.kind !== "epistemic_node" || !allowed || allowed.includes(ref.nodeType);
+}
+function assertEdgePolicyAllowed(manifest, edgeType, from, to) {
+  const policy = findEdgePolicy(manifest, edgeType);
+  const allowed = Boolean(policy) && policy.fromKinds.includes(from.kind) && policy.toKinds.includes(to.kind) && nodeTypeAllowed(policy.fromNodeTypes, from) && nodeTypeAllowed(policy.toNodeTypes, to);
+  if (!allowed) {
+    const error = new Error(
+      `Edge policy violation for ${edgeType}: ${from.kind} -> ${to.kind}`
+    );
+    error.code = "POLICY_VIOLATION";
+    error.details = { code: "POLICY_VIOLATION", edgeType, from, to };
+    throw error;
+  }
+}
+
+export { EdgePolicyEntrySchema, EdgePolicyManifestSchema, assertEdgePolicyAllowed, findEdgePolicy };
+//# sourceMappingURL=edge-policy-manifest.js.map
+//# sourceMappingURL=edge-policy-manifest.js.map

package/dist/manifests/edge-policy-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/types/graph-ref.ts","../../src/manifests/edge-policy-manifest.ts"],"names":["z"],"mappings":";;;AAEO,IAAM,uBAAA,GAA0B,EAAE,IAAA,CAAK;AAAA,EAC5C,QAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQ6B,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EACzD,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IAChC,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,IACjB,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,iBAAiB,CAAA;AAAA,IACjC,GAAA,EAAK,EAAE,MAAA,CAAO;AAAA,MACZ,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,MACnB,QAAA,EAAU,EAAE,MAAA;AAAO,KACpB;AAAA,GACF;AACH,CAAC;;;AC1BD,IAAM,eAAeA,CAAAA,CAAE,IAAA,CAAK,CAAC,gBAAA,EAAkB,iBAAiB,CAAC,CAAA;AAE1D,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA,EAC5C,QAAA,EAAUA,EAAE,MAAA,EAAO;AAAA,EACnB,SAAA,EAAWA,CAAAA,CAAE,KAAA,CAAM,YAAY,CAAA;AAAA,EAC/B,aAAA,EAAeA,CAAAA,CAAE,KAAA,CAAM,uBAAuB,EAAE,QAAA,EAAS;AAAA,EACzD,OAAA,EAASA,CAAAA,CAAE,KAAA,CAAM,YAAY,CAAA;AAAA,EAC7B,WAAA,EAAaA,CAAAA,CAAE,KAAA,CAAM,uBAAuB,EAAE,QAAA,EAAS;AAAA,EACvD,WAAA,EAAaA,EAAE,MAAA;AACjB,CAAC;AAEM,IAAM,wBAAA,GAA2BA,EAAE,MAAA,CAAO;AAAA,EAC/C,eAAA,EAAiBA,CAAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,EAClC,QAAA,EAAUA,CAAAA,CAAE,KAAA,CAAM,qBAAqB;AACzC,CAAC;AAYM,SAAS,cAAA,CACd,UACA,QAAA,EAC6B;AAC7B,EAAA,OAAO,SAAS,QAAA,CAAS,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,CAAO,aAAa,QAAQ,CAAA;AACxE;AAEA,SAAS,eAAA,CACP,SACA,GAAA,EACS;AACT,EAAA,OACE,GAAA,CAAI,SAAS,gBAAA,IACb,CAAC,WACD,OAAA,CAAQ,QAAA,CAAS,IAAI,QAAQ,CAAA;AAEjC;AAEO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACA,EAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,QAAA,EAAU,QAAQ,CAAA;AAChD,EAAA,MAAM,OAAA,GACJ,OAAA,CAAQ,MAAM,CAAA,IACd,MAAA,CAAQ,UAAU,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,IACpC,MAAA,CAAQ,OAAA,CAAQ,SAAS,EAAA,CAAG,IAAI,CAAA,IAChC,eAAA,CAAgB,MAAA,CAAQ,aAAA,EAAe,IAAI,CAAA,IAC3C,eAAA,CAAgB,MAAA,CAAQ,WAAA,EAAa,EAAE,CAAA;AAEzC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,QAAQ,IAAI,KAAA;AAAA,MAChB,6BAA6B,QAAQ,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,IAAA,EAAO,GAAG,IAAI,CAAA;AAAA,KACnE;AACA,IAAA,KAAA,CAAM,IAAA,GAAO,kBAAA;AACb,IAAA,KAAA,CAAM,UAAU,EAAE,IAAA,EAAM,kBAAA,EAAoB,QAAA,EAAU,MAAM,EAAA,EAAG;AAC/D,IAAA,MAAM,KAAA;AAAA,EACR;AACF","file":"edge-policy-manifest.js","sourcesContent":["import { z } from \"zod\";\n\nexport const EpistemicNodeTypeSchema = z.enum([\n  \"belief\",\n  \"evidence\",\n  \"question\",\n  \"answer\",\n  \"topic\",\n  \"edge\",\n  \"ontology\",\n  \"lens\",\n  \"contradiction\",\n]);\n\nexport type EpistemicNodeType = z.infer<typeof EpistemicNodeTypeSchema>;\n\nexport type GraphRef =\n  | { kind: \"epistemic_node\"; nodeId: string; nodeType: EpistemicNodeType }\n  | { kind: \"external_belief\"; ref: { tenantId: string; beliefId: string } };\n\nexport const GraphRefSchema = z.discriminatedUnion(\"kind\", [\n  z.object({\n    kind: z.literal(\"epistemic_node\"),\n    nodeId: z.string(),\n    nodeType: EpistemicNodeTypeSchema,\n  }),\n  z.object({\n    kind: z.literal(\"external_belief\"),\n    ref: z.object({\n      tenantId: z.string(),\n      beliefId: z.string(),\n    }),\n  }),\n]);\n","import { z } from \"zod\";\nimport {\n  EpistemicNodeTypeSchema,\n  type EpistemicNodeType,\n  type GraphRef,\n} from \"../types/graph-ref.js\";\n\nconst graphRefKind = z.enum([\"epistemic_node\", \"external_belief\"]);\n\nexport const EdgePolicyEntrySchema = z.object({\n  edgeType: z.string(),\n  fromKinds: z.array(graphRefKind),\n  fromNodeTypes: z.array(EpistemicNodeTypeSchema).optional(),\n  toKinds: z.array(graphRefKind),\n  toNodeTypes: z.array(EpistemicNodeTypeSchema).optional(),\n  description: z.string(),\n});\n\nexport const EdgePolicyManifestSchema = z.object({\n  manifestVersion: z.literal(\"1.0.0\"),\n  policies: z.array(EdgePolicyEntrySchema),\n});\n\nexport type EdgePolicyEntry = z.infer<typeof EdgePolicyEntrySchema>;\nexport type EdgePolicyManifest = z.infer<typeof EdgePolicyManifestSchema>;\n\nexport type EdgePolicyViolation = {\n  code: \"POLICY_VIOLATION\";\n  edgeType: string;\n  from: GraphRef;\n  to: GraphRef;\n};\n\nexport function findEdgePolicy(\n  manifest: EdgePolicyManifest,\n  edgeType: string\n): EdgePolicyEntry | undefined {\n  return manifest.policies.find((policy) => policy.edgeType === edgeType);\n}\n\nfunction nodeTypeAllowed(\n  allowed: EpistemicNodeType[] | undefined,\n  ref: GraphRef\n): boolean {\n  return (\n    ref.kind !== \"epistemic_node\" ||\n    !allowed ||\n    allowed.includes(ref.nodeType)\n  );\n}\n\nexport function assertEdgePolicyAllowed(\n  manifest: EdgePolicyManifest,\n  edgeType: string,\n  from: GraphRef,\n  to: GraphRef\n): void {\n  const policy = findEdgePolicy(manifest, edgeType);\n  const allowed =\n    Boolean(policy) &&\n    policy!.fromKinds.includes(from.kind) &&\n    policy!.toKinds.includes(to.kind) &&\n    nodeTypeAllowed(policy!.fromNodeTypes, from) &&\n    nodeTypeAllowed(policy!.toNodeTypes, to);\n\n  if (!allowed) {\n    const error = new Error(\n      `Edge policy violation for ${edgeType}: ${from.kind} -> ${to.kind}`\n    ) as Error & { code: \"POLICY_VIOLATION\"; details: EdgePolicyViolation };\n    error.code = \"POLICY_VIOLATION\";\n    error.details = { code: \"POLICY_VIOLATION\", edgeType, from, to };\n    throw error;\n  }\n}\n"]}

package/dist/manifests/infisical-runtime-manifest.d.ts

@@ -0,0 +1,151 @@
+import { INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, InfisicalRuntimeEnvironment, InfisicalRuntimeDeliveryMode, InfisicalRuntimeBootstrapEnv, InfisicalRuntimePath, InfisicalRuntimeSurface } from '../infisical-runtime.contract.js';
+
+type InfisicalRuntimeManifest = {
+    readonly manifestVersion: "1.0.0";
+    readonly contractVersion: typeof INFISICAL_RUNTIME_CONTRACT_VERSION;
+    readonly project: {
+        readonly id: typeof INFISICAL_RUNTIME_DEFAULT_PROJECT_ID;
+        readonly apiUrl: typeof INFISICAL_RUNTIME_DEFAULT_API_URL;
+    };
+    readonly environments: readonly InfisicalRuntimeEnvironment[];
+    readonly deliveryModes: readonly InfisicalRuntimeDeliveryMode[];
+    readonly bootstrapEnv: InfisicalRuntimeBootstrapEnv;
+    readonly paths: readonly InfisicalRuntimePath[];
+    readonly surfaces: readonly InfisicalRuntimeSurface[];
+};
+declare const INFISICAL_RUNTIME_MANIFEST: {
+    readonly manifestVersion: "1.0.0";
+    readonly contractVersion: "2026-04-28";
+    readonly project: {
+        readonly id: "344b0526-90df-4606-ba50-22c647a36c65";
+        readonly apiUrl: "https://app.infisical.com";
+    };
+    readonly environments: readonly ["dev", "staging", "prod"];
+    readonly deliveryModes: readonly ["vercel_sync", "runtime_fetch", "device_auth"];
+    readonly bootstrapEnv: {
+        readonly apiUrl: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+        readonly projectId: readonly ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"];
+        readonly clientId: readonly ["INFISICAL_CLIENT_ID", "INFISICAL_MACHINE_CLIENT_ID", "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"];
+        readonly clientSecret: readonly ["INFISICAL_CLIENT_SECRET", "INFISICAL_MACHINE_CLIENT_SECRET", "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"];
+        readonly environment: readonly ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"];
+        readonly organizationSlug: readonly ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"];
+        readonly disabled: readonly ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"];
+    };
+    readonly paths: readonly [{
+        readonly id: "platform-auth";
+        readonly secretPath: "/platform/auth";
+        readonly description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.";
+        readonly variables: readonly [{
+            readonly name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+            readonly required: true;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Clerk publishable key for the Lucern web origin.";
+        }, {
+            readonly name: "CLERK_SECRET_KEY";
+            readonly required: true;
+            readonly secret: true;
+            readonly public: false;
+            readonly description: "Clerk backend secret key for Lucern server runtimes.";
+        }, {
+            readonly name: "CLERK_JWT_ISSUER_DOMAIN";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly description: "Expected Clerk issuer/JWKS domain for JWT verification.";
+        }, {
+            readonly name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Public sign-in URL for Lucern-owned web flows.";
+        }, {
+            readonly name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Public sign-up URL for Lucern-owned web flows.";
+        }];
+    }, {
+        readonly id: "platform-runtime";
+        readonly secretPath: "/platform/runtime";
+        readonly description: "Runtime defaults shared by server-side Lucern clients and operator tooling.";
+        readonly variables: readonly [{
+            readonly name: "LUCERN_API_URL";
+            readonly required: true;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+            readonly description: "Canonical Lucern API gateway URL.";
+        }, {
+            readonly name: "LUCERN_LOGIN_BASE_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_AUTH_BASE_URL"];
+            readonly description: "Browser login origin used when it differs from the API.";
+        }, {
+            readonly name: "LUCERN_ENVIRONMENT";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_ENV"];
+            readonly description: "Lucern environment label consumed by CLI profiles.";
+        }];
+    }, {
+        readonly id: "tenant-shared-install";
+        readonly secretPath: "tenants/shared";
+        readonly description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.";
+        readonly variables: readonly [{
+            readonly name: "INSTALL_LUCERN_NPM";
+            readonly required: true;
+            readonly secret: true;
+            readonly public: false;
+            readonly description: "Read-only install token for the published @lucern/* suite.";
+        }];
+    }];
+    readonly surfaces: readonly [{
+        readonly id: "lucern-web";
+        readonly delivery: "vercel_sync";
+        readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+        readonly consumer: "apps/web on Vercel project lucern";
+        readonly description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs.";
+    }, {
+        readonly id: "lucern-gateway";
+        readonly delivery: "vercel_sync";
+        readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+        readonly consumer: "apps/gateway on Vercel project lucern-gateway";
+        readonly description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs.";
+    }, {
+        readonly id: "lucern-sdk";
+        readonly packageName: "@lucern/sdk";
+        readonly delivery: "runtime_fetch";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "server-side SDK operator contexts with a scoped Infisical identity";
+        readonly description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.";
+    }, {
+        readonly id: "lucern-cli";
+        readonly packageName: "@lucern/cli";
+        readonly delivery: "runtime_fetch";
+        readonly fallback: "device_auth";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "developer/operator CLI processes";
+        readonly description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.";
+    }, {
+        readonly id: "lucern-mcp";
+        readonly packageName: "@lucern/mcp";
+        readonly delivery: "runtime_fetch";
+        readonly fallback: "device_auth";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "MCP server/client processes";
+        readonly description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.";
+    }, {
+        readonly id: "tenant-client";
+        readonly delivery: "device_auth";
+        readonly sourcePathIds: readonly ["tenant-shared-install"];
+        readonly consumer: "tenant-owned apps and coding agents";
+        readonly description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces.";
+    }];
+};
+
+export { INFISICAL_RUNTIME_MANIFEST, type InfisicalRuntimeManifest };