@lucern/contracts 0.3.0-alpha.8 → 1.0.0

package/dist/gateway.contract.d.ts

@@ -41,7 +41,11 @@ type GatewayAuthContext = {
     principalId?: string;
     principalType?: SessionPrincipalType;
     tenantId?: string;
+    canonicalTenantId?: string;
+    tenantSlug?: string;
     workspaceId?: string;
+    workspaceSlug?: string;
+    workspaceKey?: string;
     roles?: string[];
     membershipId?: string;
     sessionId?: string;

package/dist/gateway.contract.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gateway.contract.ts"],"names":[],"mappings":";AA6IO,SAAS,wBACd,WAAA,EACQ;AACR,EAAA,MAAM,WAAA,GACJ,OAAO,WAAA,CAAY,WAAA,KAAgB,WAC/B,WAAA,CAAY,WAAA,CAAY,MAAK,GAC7B,EAAA;AACN,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,OAAO,WAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AACxE","file":"gateway.contract.js","sourcesContent":["/**\n * Gateway contract types — shared between Stack's gateway middleware and\n * Lucern's server-core / gateway route handlers.\n *\n * These types describe the authenticated request context that flows from\n * the gateway into Lucern route handlers. The gateway (Stack-side) creates\n * the context; Lucern consumes it read-only.\n *\n * @module @lucern/contracts/src/gateway\n */\n\nimport type {\n  SessionAuthMode,\n  SessionDelegationHop,\n  SessionPrincipalType,\n} from \"./auth-session.contract\";\n\n// ---------------------------------------------------------------------------\n// Error codes\n// ---------------------------------------------------------------------------\n\nexport type PlatformApiErrorCode =\n  | \"AUTH_REQUIRED\"\n  | \"AUTHENTICATION_REQUIRED\"\n  | \"AUTH_TOKEN_MISSING\"\n  | \"INVALID_REQUEST\"\n  | \"IDEMPOTENCY_KEY_REQUIRED\"\n  | \"FORBIDDEN\"\n  | \"SCOPE_INSUFFICIENT\"\n  | \"ENVIRONMENT_MISMATCH\"\n  | \"KEY_EXPIRED\"\n  | \"KEY_REVOKED\"\n  | \"RATE_LIMIT_EXCEEDED\"\n  | \"NOT_FOUND\"\n  | \"CONFLICT\"\n  | \"UPSTREAM_ERROR\"\n  | \"INTERNAL_ERROR\";\n\n// ---------------------------------------------------------------------------\n// Gateway scope and environment\n// ---------------------------------------------------------------------------\n\nexport type GatewayScope = {\n  tenantId?: string;\n  workspaceId?: string;\n};\n\nexport type GatewayEnvironment = \"sandbox\" | \"production\";\n\nexport type GatewayAuthMode =\n  | \"interactive_user\"\n  | \"service_principal\"\n  | \"tenant_api_key\"\n  | \"session_token\";\n\nexport type KeyLifecycleStatus =\n  | \"active\"\n  | \"rotating\"\n  | \"rotated\"\n  | \"expired\"\n  | \"revoked\";\n\nexport type CutoverDomain =\n  | \"graph\"\n  | \"schema\"\n  | \"identity\"\n  | \"policy\"\n  | \"audit\"\n  | \"admin\"\n  | \"agent\"\n  | \"tool\"\n  | \"prompt\"\n  | \"intelligence\";\n\nexport type CutoverFlagState = \"legacy\" | \"cutover\" | \"disabled\";\n\n// ---------------------------------------------------------------------------\n// Gateway auth context — the canonical authenticated request shape\n// ---------------------------------------------------------------------------\n\n/**\n * Authenticated request context created by the gateway middleware.\n * Lucern route handlers receive this as a read-only parameter.\n *\n * The `convex` field is typed as `unknown` in the contract because Lucern\n * consumers should not use the gateway's Convex client directly — they\n * have their own kernel client. The gateway (Stack-side) narrows this to\n * `ConvexHttpClient` at the construction site.\n */\nexport type GatewayAuthContext = {\n  userId: string;\n  clerkId?: string;\n  convexToken?: string;\n  /** Opaque in contract — narrowed to ConvexHttpClient at the gateway. */\n  convex: any; // eslint-disable-line @typescript-eslint/no-explicit-any\n  authMode: GatewayAuthMode;\n  principalId?: string;\n  principalType?: SessionPrincipalType;\n  tenantId?: string;\n  workspaceId?: string;\n  roles?: string[];\n  membershipId?: string;\n  sessionId?: string;\n  sessionAuthMode?: SessionAuthMode;\n  sessionExpiresAt?: number;\n  delegationChain?: SessionDelegationHop[];\n  servicePrincipalId?: string;\n  servicePrincipalKeyId?: string;\n  servicePrincipalTenantId?: string;\n  servicePrincipalWorkspaceId?: string;\n  requestEnvironment: GatewayEnvironment;\n  keyEnvironment?: GatewayEnvironment;\n  keyStatus: KeyLifecycleStatus | \"unknown\";\n  grantedScopes: Set<string>;\n  cutoverDomain: CutoverDomain;\n  cutoverState: CutoverFlagState;\n};\n\n// ---------------------------------------------------------------------------\n// Gateway response helpers — portable (no Next.js dependency)\n// ---------------------------------------------------------------------------\n\nexport type GatewayErrorArgs = {\n  code: PlatformApiErrorCode;\n  message: string;\n  status: number;\n  correlationId: string;\n  policyTraceId?: string;\n  invariant?: string;\n  suggestion?: string;\n  details?: unknown;\n  headers?: HeadersInit;\n};\n\nexport type GatewaySuccessArgs = {\n  status?: number;\n  correlationId: string;\n  policyTraceId?: string;\n  idempotentReplay?: boolean;\n};\n\nexport function requireActorPrincipalId(\n  authContext: GatewayAuthContext\n): string {\n  const principalId =\n    typeof authContext.principalId === \"string\"\n      ? authContext.principalId.trim()\n      : \"\";\n  if (principalId.length > 0) {\n    return principalId;\n  }\n  throw new Error(\"Access denied: federated principal context required.\");\n}\n"]}
+{"version":3,"sources":["../src/gateway.contract.ts"],"names":[],"mappings":";AAiJO,SAAS,wBACd,WAAA,EACQ;AACR,EAAA,MAAM,WAAA,GACJ,OAAO,WAAA,CAAY,WAAA,KAAgB,WAC/B,WAAA,CAAY,WAAA,CAAY,MAAK,GAC7B,EAAA;AACN,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,OAAO,WAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AACxE","file":"gateway.contract.js","sourcesContent":["/**\n * Gateway contract types — shared between Stack's gateway middleware and\n * Lucern's server-core / gateway route handlers.\n *\n * These types describe the authenticated request context that flows from\n * the gateway into Lucern route handlers. The gateway (Stack-side) creates\n * the context; Lucern consumes it read-only.\n *\n * @module @lucern/contracts/src/gateway\n */\n\nimport type {\n  SessionAuthMode,\n  SessionDelegationHop,\n  SessionPrincipalType,\n} from \"./auth-session.contract\";\n\n// ---------------------------------------------------------------------------\n// Error codes\n// ---------------------------------------------------------------------------\n\nexport type PlatformApiErrorCode =\n  | \"AUTH_REQUIRED\"\n  | \"AUTHENTICATION_REQUIRED\"\n  | \"AUTH_TOKEN_MISSING\"\n  | \"INVALID_REQUEST\"\n  | \"IDEMPOTENCY_KEY_REQUIRED\"\n  | \"FORBIDDEN\"\n  | \"SCOPE_INSUFFICIENT\"\n  | \"ENVIRONMENT_MISMATCH\"\n  | \"KEY_EXPIRED\"\n  | \"KEY_REVOKED\"\n  | \"RATE_LIMIT_EXCEEDED\"\n  | \"NOT_FOUND\"\n  | \"CONFLICT\"\n  | \"UPSTREAM_ERROR\"\n  | \"INTERNAL_ERROR\";\n\n// ---------------------------------------------------------------------------\n// Gateway scope and environment\n// ---------------------------------------------------------------------------\n\nexport type GatewayScope = {\n  tenantId?: string;\n  workspaceId?: string;\n};\n\nexport type GatewayEnvironment = \"sandbox\" | \"production\";\n\nexport type GatewayAuthMode =\n  | \"interactive_user\"\n  | \"service_principal\"\n  | \"tenant_api_key\"\n  | \"session_token\";\n\nexport type KeyLifecycleStatus =\n  | \"active\"\n  | \"rotating\"\n  | \"rotated\"\n  | \"expired\"\n  | \"revoked\";\n\nexport type CutoverDomain =\n  | \"graph\"\n  | \"schema\"\n  | \"identity\"\n  | \"policy\"\n  | \"audit\"\n  | \"admin\"\n  | \"agent\"\n  | \"tool\"\n  | \"prompt\"\n  | \"intelligence\";\n\nexport type CutoverFlagState = \"legacy\" | \"cutover\" | \"disabled\";\n\n// ---------------------------------------------------------------------------\n// Gateway auth context — the canonical authenticated request shape\n// ---------------------------------------------------------------------------\n\n/**\n * Authenticated request context created by the gateway middleware.\n * Lucern route handlers receive this as a read-only parameter.\n *\n * The `convex` field is typed as `unknown` in the contract because Lucern\n * consumers should not use the gateway's Convex client directly — they\n * have their own kernel client. The gateway (Stack-side) narrows this to\n * `ConvexHttpClient` at the construction site.\n */\nexport type GatewayAuthContext = {\n  userId: string;\n  clerkId?: string;\n  convexToken?: string;\n  /** Opaque in contract — narrowed to ConvexHttpClient at the gateway. */\n  convex: any; // eslint-disable-line @typescript-eslint/no-explicit-any\n  authMode: GatewayAuthMode;\n  principalId?: string;\n  principalType?: SessionPrincipalType;\n  tenantId?: string;\n  canonicalTenantId?: string;\n  tenantSlug?: string;\n  workspaceId?: string;\n  workspaceSlug?: string;\n  workspaceKey?: string;\n  roles?: string[];\n  membershipId?: string;\n  sessionId?: string;\n  sessionAuthMode?: SessionAuthMode;\n  sessionExpiresAt?: number;\n  delegationChain?: SessionDelegationHop[];\n  servicePrincipalId?: string;\n  servicePrincipalKeyId?: string;\n  servicePrincipalTenantId?: string;\n  servicePrincipalWorkspaceId?: string;\n  requestEnvironment: GatewayEnvironment;\n  keyEnvironment?: GatewayEnvironment;\n  keyStatus: KeyLifecycleStatus | \"unknown\";\n  grantedScopes: Set<string>;\n  cutoverDomain: CutoverDomain;\n  cutoverState: CutoverFlagState;\n};\n\n// ---------------------------------------------------------------------------\n// Gateway response helpers — portable (no Next.js dependency)\n// ---------------------------------------------------------------------------\n\nexport type GatewayErrorArgs = {\n  code: PlatformApiErrorCode;\n  message: string;\n  status: number;\n  correlationId: string;\n  policyTraceId?: string;\n  invariant?: string;\n  suggestion?: string;\n  details?: unknown;\n  headers?: HeadersInit;\n};\n\nexport type GatewaySuccessArgs = {\n  status?: number;\n  correlationId: string;\n  policyTraceId?: string;\n  idempotentReplay?: boolean;\n};\n\nexport function requireActorPrincipalId(\n  authContext: GatewayAuthContext\n): string {\n  const principalId =\n    typeof authContext.principalId === \"string\"\n      ? authContext.principalId.trim()\n      : \"\";\n  if (principalId.length > 0) {\n    return principalId;\n  }\n  throw new Error(\"Access denied: federated principal context required.\");\n}\n"]}

package/dist/generated/convexSchemas.d.ts

@@ -3,11 +3,11 @@ import { GenericSchema } from 'convex/server';
 
 type GeneratedSchemaTables = GenericSchema;
 declare const KERNEL_SCHEMA_TABLES: GeneratedSchemaTables;
-declare const IDENTITY_SCHEMA_TABLES: GeneratedSchemaTables;
+declare const CONTROL_PLANE_SCHEMA_TABLES: GeneratedSchemaTables;
 declare const MC_SCHEMA_TABLES: GeneratedSchemaTables;
 declare const DEVELOPER_PACK_SCHEMA_TABLES: GeneratedSchemaTables;
 declare const EMPTY_SCHEMA_TABLES: GeneratedSchemaTables;
-declare const IDENTITY_TIER_SCHEMA_TABLES: GeneratedSchemaTables;
+declare const CONTROL_PLANE_TIER_SCHEMA_TABLES: GeneratedSchemaTables;
 declare const KERNEL_TIER_SCHEMA_TABLES: GeneratedSchemaTables;
 declare const KERNEL_COMPONENT_TIER_SCHEMA_TABLES: GeneratedSchemaTables;
 declare const STACK_TIER_SCHEMA_TABLES: GeneratedSchemaTables;
@@ -17,4 +17,4 @@ declare const FULL_TIER_SCHEMA_TABLES: GeneratedSchemaTables;
 declare const TIER_SCHEMA_TABLES: Record<string, GeneratedSchemaTables>;
 declare const _default: convex_server.SchemaDefinition<GenericSchema, true>;
 
-export { DEVELOPER_PACK_SCHEMA_TABLES, EMPTY_SCHEMA_TABLES, FULL_TIER_SCHEMA_TABLES, IDENTITY_SCHEMA_TABLES, IDENTITY_TIER_SCHEMA_TABLES, KERNEL_COMPONENT_TIER_SCHEMA_TABLES, KERNEL_SCHEMA_TABLES, KERNEL_TIER_SCHEMA_TABLES, MC_SCHEMA_TABLES, MC_TIER_SCHEMA_TABLES, STACK_TIER_SCHEMA_TABLES, STACK_V2_TIER_SCHEMA_TABLES, TIER_SCHEMA_TABLES, _default as default };
+export { CONTROL_PLANE_SCHEMA_TABLES, CONTROL_PLANE_TIER_SCHEMA_TABLES, DEVELOPER_PACK_SCHEMA_TABLES, EMPTY_SCHEMA_TABLES, FULL_TIER_SCHEMA_TABLES, KERNEL_COMPONENT_TIER_SCHEMA_TABLES, KERNEL_SCHEMA_TABLES, KERNEL_TIER_SCHEMA_TABLES, MC_SCHEMA_TABLES, MC_TIER_SCHEMA_TABLES, STACK_TIER_SCHEMA_TABLES, STACK_V2_TIER_SCHEMA_TABLES, TIER_SCHEMA_TABLES, _default as default };