@lucern/contracts 0.3.0-alpha.11 → 0.3.0-alpha.13

package/dist/index.js

@@ -189,7 +189,13 @@ var SESSION_AUTH_MODES = [
   "tenant_api_key",
   "session_token"
 ];
-var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_PRINCIPAL_TYPES = [
+  "human",
+  "service",
+  "agent",
+  "group",
+  "external_viewer"
+];
 var SESSION_LIFECYCLE_STATUSES = [
   "active",
   "expired",
@@ -202,6 +208,12 @@ function inferSessionPrincipalType(principalId) {
   if (principalId.startsWith("agent:")) {
     return "agent";
   }
+  if (principalId.startsWith("group:")) {
+    return "group";
+  }
+  if (principalId.startsWith("external:") || principalId.startsWith("external_viewer:")) {
+    return "external_viewer";
+  }
   return "service";
 }
 function normalizeDelegationChain(args) {
@@ -262,6 +274,7 @@ var TABLE_OWNERSHIP = {
   "deliberationContributions": "K",
   "deliberationSessions": "K",
   "deploymentHosts": "L",
+  "domainEvents": "K",
   "epistemicAudit": "K",
   "epistemicContracts": "K",
   "epistemicEdges": "K",
@@ -2491,6 +2504,35 @@ var systemLogs = defineTable({
     { kind: "index", name: "by_source", columns: ["source"] }
   ]
 });
+var domainEvents = defineTable({
+  name: "domainEvents",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    "eventId": z.string(),
+    "type": z.string(),
+    "version": z.string(),
+    "timestamp": z.number(),
+    "tenantId": z.string().optional(),
+    "workspaceId": z.string().optional(),
+    "topicId": z.string(),
+    "resourceId": z.string(),
+    "resourceType": z.string(),
+    "actorId": z.string(),
+    "actorType": z.enum(["human", "agent", "service"]),
+    "data": z.record(z.any()),
+    "correlationId": z.string().optional(),
+    "expiresAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_eventId", columns: ["eventId"] },
+    { kind: "index", name: "by_topic_timestamp", columns: ["topicId", "timestamp"] },
+    { kind: "index", name: "by_tenant_workspace_timestamp", columns: ["tenantId", "workspaceId", "timestamp"] },
+    { kind: "index", name: "by_type_timestamp", columns: ["type", "timestamp"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId", "timestamp"] },
+    { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
+  ]
+});
 var beliefConfidence = defineTable({
   name: "beliefConfidence",
   component: "kernel",
@@ -5789,7 +5831,9 @@ var permitObjectType = z.enum([
   "group",
   "resource_instance",
   "relationship_tuple",
-  "role_assignment"
+  "role_assignment",
+  "attribute_binding",
+  "policy_bundle"
 ]);
 var permitOutboxOperation = z.enum([
   "upsert",
@@ -5895,7 +5939,10 @@ var permitPrincipalAliases = defineTable({
   }),
   indices: [
     { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "providerSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "providerSubjectId"] },
     { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
+    { kind: "index", name: "by_tenant_provider_project_subject", columns: ["tenantId", "provider", "providerProjectId", "providerSubjectId"] },
     {
       kind: "index",
       name: "by_tenant_provider_alias",
@@ -7104,6 +7151,7 @@ var KERNEL_TABLE_CONTRACTS = [
   decisionParticipants,
   decisionRiskLedger,
   decisionSnapshots,
+  domainEvents,
   deliberationContributions,
   deliberationSessions,
   stakeholderGroups,
@@ -7387,7 +7435,9 @@ var TENANT_CLIENT_AUTH_MODES = [
 var TENANT_CLIENT_PRINCIPAL_TYPES = [
   "human",
   "service",
-  "agent"
+  "agent",
+  "group",
+  "external_viewer"
 ];
 var TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [
   "tenantId",
@@ -7397,8 +7447,16 @@ var TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [
   "scopes"
 ];
 var TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [
+  "clerkId",
   "principalType",
   "roles",
+  "groupIds",
+  "permittedToolNames",
+  "permittedPackKeys",
+  "principalStatus",
+  "tenantStatus",
+  "workspaceStatus",
+  "permit",
   "sessionId",
   "delegationChain"
 ];
@@ -7676,6 +7734,7 @@ var TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [
   "ontologyLinks",
   "graphStateClassifier",
   "tools",
+  "controlPlane",
   "identity",
   "modelRuntime",
   "events",
@@ -7683,6 +7742,12 @@ var TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [
   "telemetry"
 ];
 var TENANT_CLIENT_CAPABILITIES = [
+  {
+    id: "identity.resolve_interactive_principal",
+    description: "Resolve a Clerk-authenticated user into a Permit-backed Lucern principal context.",
+    surfaces: ["@lucern/sdk", "@lucern/cli", "@lucern/mcp"],
+    requiredContextFields: ["principalId", "tenantId", "scopes"]
+  },
   {
     id: "identity.bootstrap_session",
     description: "Start a scoped Lucern session for a tenant principal.",
@@ -8433,6 +8498,27 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities."
   },
+  {
+    id: "platform.clerk.webhook-secret",
+    canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET",
+    aliases: ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+  },
   {
     id: "platform.clerk.jwks",
     canonicalName: "CLERK_JWKS_URL",
@@ -8732,6 +8818,37 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing."
   },
+  {
+    id: "platform.permit.webhook-secret",
+    canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET",
+    aliases: ["PERMIT_WEBHOOK_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-gateway", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+  },
   {
     id: "platform.permit.pdp-url",
     canonicalName: "LUCERN_PERMIT_PDP_URL",
@@ -11015,6 +11132,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "CLERK_PROJECT_ID",
     "CLERK_PUBLISHABLE_KEY",
     "CLERK_SECRET_KEY",
+    "CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET",
     "CONVEX_CLOUD_URL",
     "CONVEX_DEPLOY_KEY",
     "CONVEX_DEPLOYMENT",
@@ -11078,6 +11197,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_AUTH_BASE_URL",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
+    "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS",
     "LUCERN_CONTRACTS_SKIP_DTS",
     "LUCERN_CONVEX_DEPLOY_KEY",
@@ -11127,6 +11247,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PERMIT_API_KEY",
     "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROD_DEPLOY_KEY",
     "LUCERN_PROD_URL",
     "LUCERN_PROFILE",
@@ -11197,6 +11318,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
+    "PERMIT_WEBHOOK_SECRET",
     "PINECONE_API_KEY",
     "PINECONE_HOST",
     "PINECONE_INDEX",
@@ -11248,6 +11370,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "CLERK_PROJECT_ID",
     "CLERK_PUBLISHABLE_KEY",
     "CLERK_SECRET_KEY",
+    "CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET",
     "CONVEX_CLOUD_URL",
     "CONVEX_DEPLOY_KEY",
     "CONVEX_DEPLOYMENT",
@@ -11325,6 +11449,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_AUTH_BASE_URL",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
+    "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS",
     "LUCERN_CONTRACTS_SKIP_DTS",
     "LUCERN_CONVEX_DEPLOY_KEY",
@@ -11376,6 +11501,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PERMIT_API_KEY",
     "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROD_DEPLOY_KEY",
     "LUCERN_PROD_URL",
     "LUCERN_PROFILE",
@@ -11449,6 +11575,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
+    "PERMIT_WEBHOOK_SECRET",
     "PINECONE_API_KEY",
     "PINECONE_HOST",
     "PINECONE_INDEX",
@@ -13635,6 +13762,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "stack/frontend: Lucern/MC gateway base URL used by tenant product apps. stack/stackos: Lucern/MC gateway base URL used by tenant product apps."
     },
+    "LUCERN_CLERK_WEBHOOK_SECRET": {
+      "secretId": "platform.clerk.webhook-secret",
+      "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+      "envNames": [
+        "CLERK_WEBHOOK_SECRET",
+        "CLERK_WEBHOOK_SIGNING_SECRET",
+        "LUCERN_CLERK_WEBHOOK_SECRET"
+      ],
+      "aliases": [
+        "CLERK_WEBHOOK_SECRET",
+        "CLERK_WEBHOOK_SIGNING_SECRET"
+      ],
+      "writeNames": [
+        "LUCERN_CLERK_WEBHOOK_SECRET"
+      ],
+      "required": true,
+      "secret": true,
+      "public": false,
+      "sourcePath": "/platform/auth",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-gateway"
+      ],
+      "destinations": [
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ]
+        }
+      ],
+      "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+    },
     "LUCERN_CLI_SESSION_TTL_MS": {
       "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
       "envNames": [
@@ -14209,6 +14370,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "Optional Permit PDP URL override."
     },
+    "LUCERN_PERMIT_WEBHOOK_SECRET": {
+      "secretId": "platform.permit.webhook-secret",
+      "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+      "envNames": [
+        "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "PERMIT_WEBHOOK_SECRET"
+      ],
+      "aliases": [
+        "PERMIT_WEBHOOK_SECRET"
+      ],
+      "writeNames": [
+        "LUCERN_PERMIT_WEBHOOK_SECRET"
+      ],
+      "required": true,
+      "secret": true,
+      "public": false,
+      "sourcePath": "/platform/permit",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "mc-convex",
+        "lucern-gateway",
+        "mc-operator-tooling"
+      ],
+      "destinations": [
+        {
+          "kind": "convex",
+          "target": "master-control",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        },
+        {
+          "kind": "operator_local",
+          "target": "mc-credential-maintenance",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        }
+      ],
+      "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+    },
     "LUCERN_PROXY_TOKEN_SECRET": {
       "secretId": "tenant.stack-frontend.lucern.proxy-token-secret",
       "canonicalName": "LUCERN_PROXY_TOKEN_SECRET",
@@ -16855,6 +17064,9 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_API_URL": "LUCERN_API_URL",
     "LUCERN_BASE_URL": "LUCERN_BASE_URL",
     "LUCERN_GATEWAY_BASE_URL": "LUCERN_BASE_URL",
+    "CLERK_WEBHOOK_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
+    "LUCERN_CLERK_WEBHOOK_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS": "LUCERN_CLI_SESSION_TTL_MS",
     "CONVEX_DEPLOYMENT": "LUCERN_CONVEX_DEPLOYMENT_NAME",
     "CONVEX_DEV_DEPLOYMENT_NAME": "LUCERN_CONVEX_DEPLOYMENT_NAME",
@@ -16907,6 +17119,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_URL": "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL": "LUCERN_PERMIT_PDP_URL",
     "PERMIT_PDP_URL": "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET": "LUCERN_PERMIT_WEBHOOK_SECRET",
+    "PERMIT_WEBHOOK_SECRET": "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROXY_TOKEN_SECRET": "LUCERN_PROXY_TOKEN_SECRET",
     "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
     "LUCERN_KERNEL_INSTALL_SPEC": "LUCERN_SDK_NPM_TOKEN",
@@ -17867,6 +18081,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Canonical Lucern API gateway URL. Canonical Lucern API gateway base URL. Older names remain aliases only."
         },
+        {
+          "secretId": "platform.clerk.webhook-secret",
+          "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+          "envNames": [
+            "CLERK_WEBHOOK_SECRET",
+            "CLERK_WEBHOOK_SIGNING_SECRET",
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ],
+          "aliases": [
+            "CLERK_WEBHOOK_SECRET",
+            "CLERK_WEBHOOK_SIGNING_SECRET"
+          ],
+          "writeNames": [
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ],
+          "required": true,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/auth",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-gateway"
+          ],
+          "destinations": [
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_CLERK_WEBHOOK_SECRET"
+              ]
+            }
+          ],
+          "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+        },
         {
           "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
           "envNames": [
@@ -18190,6 +18438,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Optional Permit PDP URL override."
         },
+        {
+          "secretId": "platform.permit.webhook-secret",
+          "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "envNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET",
+            "PERMIT_WEBHOOK_SECRET"
+          ],
+          "aliases": [
+            "PERMIT_WEBHOOK_SECRET"
+          ],
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ],
+          "required": true,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/permit",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "mc-convex",
+            "lucern-gateway",
+            "mc-operator-tooling"
+          ],
+          "destinations": [
+            {
+              "kind": "convex",
+              "target": "master-control",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "mc-credential-maintenance",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            }
+          ],
+          "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+        },
         {
           "secretId": "platform.runtime.require-deployment-host-registry",
           "canonicalName": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
@@ -21882,6 +22178,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Optional Permit PDP URL override."
       },
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.mc.session-token-secret",
         "canonicalName": "LUCERN_SESSION_TOKEN_SECRET",
@@ -29694,6 +30038,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       }
     ],
     "operator_local:mc-credential-maintenance": [
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.mc.tenant-secret-encryption-key",
         "canonicalName": "LUCERN_TENANT_SECRET_ENCRYPTION_KEY",
@@ -33711,6 +34103,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Canonical Lucern API gateway base URL. Older names remain aliases only."
       },
+      {
+        "secretId": "platform.clerk.webhook-secret",
+        "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+        "envNames": [
+          "CLERK_WEBHOOK_SECRET",
+          "CLERK_WEBHOOK_SIGNING_SECRET",
+          "LUCERN_CLERK_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "CLERK_WEBHOOK_SECRET",
+          "CLERK_WEBHOOK_SIGNING_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_CLERK_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/auth",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-gateway"
+        ],
+        "destinations": [
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_CLERK_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+      },
       {
         "secretId": "platform.gateway.device-verification-base-url",
         "canonicalName": "LUCERN_DEVICE_VERIFICATION_BASE_URL",
@@ -34016,6 +34442,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Optional Permit PDP URL override."
       },
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.runtime.require-deployment-host-registry",
         "canonicalName": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
@@ -38024,6 +38498,7 @@ __export(tool_contracts_exports, {
   REMOVE_EDGES_BETWEEN: () => REMOVE_EDGES_BETWEEN,
   REMOVE_LENS_FROM_TOPIC: () => REMOVE_LENS_FROM_TOPIC,
   RESOLVE_EFFECTIVE_ONTOLOGY: () => RESOLVE_EFFECTIVE_ONTOLOGY,
+  RESOLVE_INTERACTIVE_PRINCIPAL: () => RESOLVE_INTERACTIVE_PRINCIPAL,
   RUN_GRAPH_INTELLIGENCE_QUERY: () => RUN_GRAPH_INTELLIGENCE_QUERY,
   SEARCH_BELIEFS: () => SEARCH_BELIEFS,
   SEARCH_EVIDENCE: () => SEARCH_EVIDENCE,
@@ -40357,7 +40832,7 @@ var IDENTITY_WHOAMI = {
     description: "Canonical identity summary for the current session",
     fields: {
       principalId: "string \u2014 canonical federated principal identifier",
-      principalType: "string \u2014 human, service, or agent",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
       tenantId: "string | undefined \u2014 resolved tenant scope",
       workspaceId: "string | undefined \u2014 resolved workspace scope",
       scopes: "string[] | undefined \u2014 granted scopes for this session",
@@ -40368,6 +40843,49 @@ var IDENTITY_WHOAMI = {
   ontologyPrimitive: "identity",
   tier: "workhorse"
 };
+var RESOLVE_INTERACTIVE_PRINCIPAL = {
+  name: "resolve_interactive_principal",
+  description: "Read the Permit-backed Lucern principal context for an authenticated Clerk user. Like `git config --get user.email` plus the repository ACL \u2014 resolves the identity alias into the canonical authorization subject.",
+  parameters: {
+    clerkId: {
+      type: "string",
+      description: "Authenticated Clerk subject (`sub`). Clerk proves identity only; it is not the authorization record."
+    },
+    tenantId: {
+      type: "string",
+      description: "Optional tenant scope. Omit only when the Clerk alias is globally unambiguous."
+    },
+    workspaceId: {
+      type: "string",
+      description: "Optional workspace scope. Required when the principal has access to multiple workspaces and no default can be inferred."
+    },
+    providerProjectId: {
+      type: "string",
+      description: "Optional Clerk project or provider instance id for tenants with multiple identity providers."
+    }
+  },
+  required: ["clerkId"],
+  response: {
+    description: "Permit-backed Lucern principal context for tenant SDK bootstrap",
+    fields: {
+      principalId: "string \u2014 canonical Lucern principal identifier",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
+      clerkId: "string \u2014 authenticated Clerk subject alias",
+      tenantId: "string \u2014 resolved tenant scope",
+      workspaceId: "string | null \u2014 resolved workspace scope",
+      roles: "string[] \u2014 effective Permit roles",
+      scopes: "string[] \u2014 effective scopes derived from Permit/control-plane projection",
+      groupIds: "string[] \u2014 active Permit group memberships",
+      principalStatus: "string \u2014 active, invited, suspended, disabled, revoked, or missing",
+      tenantStatus: "string \u2014 projected tenant resource status",
+      workspaceStatus: "string \u2014 projected workspace resource status",
+      permit: "object \u2014 Permit subject, tenant, and optional workspace tuple"
+    }
+  },
+  ownerModule: "control-plane",
+  ontologyPrimitive: "identity",
+  tier: "workhorse"
+};
 var COMPILE_CONTEXT = {
   name: "compile_context",
   description: "Compile a focused reasoning context. If topicId is omitted, Lucern resolves the best topic from the query. Like `git log --graph --decorate` for the reasoning substrate \u2014 returns the canonical Pillar 3 context pack through the public API shape.",
@@ -42270,6 +42788,7 @@ var MCP_TOOL_CONTRACTS = {
   update_worktree_targets: UPDATE_WORKTREE_TARGETS,
   update_worktree_metadata: UPDATE_WORKTREE_METADATA,
   identity_whoami: IDENTITY_WHOAMI,
+  resolve_interactive_principal: RESOLVE_INTERACTIVE_PRINCIPAL,
   compile_context: COMPILE_CONTEXT,
   record_scope_learning: RECORD_SCOPE_LEARNING,
   pipeline_snapshot: PIPELINE_SNAPSHOT,
@@ -42713,6 +43232,163 @@ function rankEntityConnections(nodeText, candidates, options) {
   ).filter((m) => m.score >= minScore).sort((a, b) => b.score - a.score).slice(0, limit);
 }
 
+// src/permit-principal-projection.contract.ts
+var PLATFORM_ROLE_PRIORITY = {
+  platform_admin: 70,
+  tenant_admin: 60,
+  workspace_admin: 50,
+  editor: 40,
+  auditor: 30,
+  viewer: 20,
+  service_agent: 10
+};
+function readPermitProjectionString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function isActivePermitProjectionStatus(value) {
+  const status = readPermitProjectionString(value)?.toLowerCase();
+  return !status || status === "active" || status === "synced";
+}
+function mapPermitRoleToPlatformRole(role) {
+  switch (readPermitProjectionString(role)?.toLowerCase()) {
+    case "platform_admin":
+      return "platform_admin";
+    case "tenant_admin":
+      return "tenant_admin";
+    case "workspace_admin":
+    case "deployment_admin":
+    case "graph_admin":
+      return "workspace_admin";
+    case "editor":
+    case "workspace_member":
+    case "graph_editor":
+    case "evidence_contributor":
+    case "question_resolver":
+    case "theme_promoter":
+    case "topic_promoter":
+      return "editor";
+    case "auditor":
+      return "auditor";
+    case "viewer":
+    case "graph_viewer":
+    case "stakeholder_viewer":
+    case "stakeholder_summarizer":
+    case "source_drilldown_viewer":
+    case "restricted_data_viewer":
+    case "proprietary_data_viewer":
+      return "viewer";
+    case "service_agent":
+    case "agent_runner":
+      return "service_agent";
+    default:
+      return void 0;
+  }
+}
+function highestPlatformRole(roles) {
+  return roles.reduce(
+    (best, role) => PLATFORM_ROLE_PRIORITY[role] > PLATFORM_ROLE_PRIORITY[best] ? role : best,
+    "viewer"
+  );
+}
+function isClerkAliasFor(alias, clerkId) {
+  return isActivePermitProjectionStatus(alias.status) && readPermitProjectionString(alias.provider)?.toLowerCase() === "clerk" && (readPermitProjectionString(alias.providerSubjectId) === clerkId || readPermitProjectionString(alias.alias) === clerkId);
+}
+function emailFromAlias(aliases, principal) {
+  return aliases.find(
+    (alias) => readPermitProjectionString(alias.aliasKind)?.toLowerCase() === "email"
+  )?.alias ?? readPermitProjectionString(principal.metadata?.email);
+}
+function groupIdsForPrincipal(memberships2, principal) {
+  const principalId = readPermitProjectionString(principal.principalId);
+  if (!principalId) return [];
+  return [
+    ...new Set(
+      memberships2.filter(
+        (membership) => isActivePermitProjectionStatus(membership.status) && readPermitProjectionString(membership.tenantId) === readPermitProjectionString(principal.tenantId) && readPermitProjectionString(membership.memberType) === "principal" && (readPermitProjectionString(membership.memberId) === principalId || readPermitProjectionString(membership.principalId) === principalId)
+      ).map((membership) => readPermitProjectionString(membership.groupId)).filter((groupId) => Boolean(groupId))
+    )
+  ];
+}
+function rolesForPrincipal(assignments, principal, groupIds) {
+  const principalId = readPermitProjectionString(principal.principalId);
+  const tenantId = readPermitProjectionString(principal.tenantId);
+  const roles = assignments.filter(
+    (assignment) => isActivePermitProjectionStatus(assignment.status) && readPermitProjectionString(assignment.tenantId) === tenantId && (readPermitProjectionString(assignment.targetType) === "principal" && readPermitProjectionString(assignment.targetId) === principalId || readPermitProjectionString(assignment.targetType) === "group" && groupIds.includes(
+      readPermitProjectionString(assignment.targetId) ?? ""
+    ))
+  ).map((assignment) => mapPermitRoleToPlatformRole(assignment.role)).filter((role) => Boolean(role));
+  if (readPermitProjectionString(principal.principalType) === "agent" || readPermitProjectionString(principal.principalType) === "service_principal") {
+    roles.push("service_agent");
+  }
+  return [...new Set(roles)];
+}
+function workspaceFromPermitProjection(principal, alias, assignments) {
+  return readPermitProjectionString(principal.workspaceId) ?? readPermitProjectionString(alias?.workspaceId) ?? readPermitProjectionString(
+    assignments.find(
+      (assignment) => readPermitProjectionString(assignment.targetId) === readPermitProjectionString(principal.principalId) && readPermitProjectionString(assignment.resourceType) === "workspace"
+    )?.resourceKey
+  ) ?? readPermitProjectionString(
+    assignments.find((assignment) => assignment.workspaceId)?.workspaceId
+  );
+}
+function buildProjectedUserFromPermitPrincipal(rows, principal, matchingAlias, now = Date.now()) {
+  const principalId = readPermitProjectionString(principal.principalId);
+  const tenantId = readPermitProjectionString(principal.tenantId);
+  if (!principalId || !tenantId || !isActivePermitProjectionStatus(principal.status)) {
+    return null;
+  }
+  const aliases = rows.aliases.filter(
+    (alias2) => readPermitProjectionString(alias2.tenantId) === tenantId && readPermitProjectionString(alias2.principalId) === principalId && isActivePermitProjectionStatus(alias2.status)
+  );
+  const groupIds = groupIdsForPrincipal(rows.groupMemberships, principal);
+  const roles = rolesForPrincipal(rows.roleAssignments, principal, groupIds);
+  if (roles.length === 0) {
+    return null;
+  }
+  const alias = matchingAlias ?? aliases[0];
+  const clerkId = readPermitProjectionString(
+    aliases.find(
+      (entry) => readPermitProjectionString(entry.provider)?.toLowerCase() === "clerk"
+    )?.providerSubjectId
+  ) ?? principalId;
+  return {
+    clerkId,
+    email: emailFromAlias(aliases, principal) ?? `${principalId}@permit.local`,
+    name: readPermitProjectionString(principal.displayName),
+    lastSeenAt: principal.lastSeenAt ?? principal.updatedAt ?? now,
+    chatCount: 0,
+    messageCount: 0,
+    mcRole: highestPlatformRole(roles),
+    mcRoleSyncedAt: principal.updatedAt ?? now,
+    defaultTenantId: tenantId,
+    defaultWorkspaceId: workspaceFromPermitProjection(principal, alias, rows.roleAssignments) ?? tenantId,
+    defaultPrincipalId: principalId,
+    principalGroupIds: groupIds,
+    governanceGrantsSyncedAt: principal.updatedAt ?? now,
+    createdAt: principal.createdAt ?? now,
+    updatedAt: principal.updatedAt ?? now
+  };
+}
+function findProjectedUserByPermitPrincipalId(rows, principalId, now = Date.now()) {
+  const normalizedPrincipalId = principalId.trim();
+  const principal = rows.principals.find(
+    (row) => isActivePermitProjectionStatus(row.status) && readPermitProjectionString(row.principalId) === normalizedPrincipalId
+  );
+  return principal ? buildProjectedUserFromPermitPrincipal(rows, principal, void 0, now) : null;
+}
+function findProjectedUserByPermitClerkId(rows, clerkId, now = Date.now()) {
+  const normalizedClerkId = clerkId.trim();
+  const matchingAlias = rows.aliases.find(
+    (alias) => isClerkAliasFor(alias, normalizedClerkId)
+  );
+  const principal = matchingAlias ? rows.principals.find(
+    (row) => readPermitProjectionString(row.tenantId) === readPermitProjectionString(matchingAlias.tenantId) && readPermitProjectionString(row.principalId) === readPermitProjectionString(matchingAlias.principalId)
+  ) : rows.principals.find(
+    (row) => readPermitProjectionString(row.principalId) === normalizedClerkId || readPermitProjectionString(row.principalId) === `user:${normalizedClerkId}`
+  );
+  return principal ? buildProjectedUserFromPermitPrincipal(rows, principal, matchingAlias, now) : null;
+}
+
 // src/prompt.contract.ts
 function isLucernPrompt(value) {
   if (!value || typeof value !== "object") {
@@ -43974,6 +44650,8 @@ var TENANT_BOOTSTRAP_SEED_COMPONENTS = {
   kernel: {
     componentName: "lucern",
     migrationModule: "adapters/migration",
+    templateMigrationModule: "dist/adapters/migration",
+    tenantMigrationModule: "adapters/migration",
     templateService: "services/kernel-template",
     templateDeployments: {
       staging: "kindly-goldfish-162",
@@ -43982,7 +44660,9 @@ var TENANT_BOOTSTRAP_SEED_COMPONENTS = {
   },
   "control-plane": {
     componentName: "controlPlane",
-    migrationModule: "dist/migration",
+    migrationModule: "migration",
+    templateMigrationModule: "dist/migration",
+    tenantMigrationModule: "migration",
     templateService: "services/control-plane-template",
     templateDeployments: {
       staging: "industrious-cheetah-864",
@@ -44143,6 +44823,13 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     copyMode: "none",
     description: "Deliberation sessions are created by tenant workflows."
   },
+  {
+    component: "kernel",
+    table: "domainEvents",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Domain event rows are append-only runtime audit/exhaust data."
+  },
   {
     component: "kernel",
     table: "epistemicAudit",
@@ -44704,12 +45391,15 @@ function isTenantBootstrapSeedTable(table) {
   return Boolean(findTenantBootstrapSeedTable(table));
 }
 function isTenantBootstrapForbiddenSeedTable(table) {
-  return TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES.some((entry) => entry === table);
+  return TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES.some(
+    (entry) => entry === table
+  );
 }
-var TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION = "2026-04-30.1";
+var TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION = "2026-05-11";
 var TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID = "tenant_template";
 var TENANT_BOOTSTRAP_TEMPLATE_ACTOR = "system:lucern-template-seed";
 var DEFAULT_SEED_TIME = Date.UTC(2026, 3, 30);
+var TEMPLATE_SEED_METADATA_SOURCE = "lucern-template";
 var ROLE_GRANTS = {
   viewer: ["viewer", "auditor", "editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
   auditor: ["auditor", "tenant_admin", "platform_admin", "service_agent"],
@@ -44720,7 +45410,7 @@ var ROLE_GRANTS = {
   service_agent: ["service_agent"]
 };
 var ENUM_VALUES = {
-  topic_type: ["domain", "theme", "deal", "strategy", "constitution", "project", "portfolio", "architecture", "capability", "runtime", "interface", "governance", "operations", "security", "data"],
+  topic_type: ["generic"],
   branch_schema: ["pillar", "track", "dimension", "axis", "phase"],
   belief_type: ["belief", "hypothesis", "principle", "invariant", "assumption", "tenet", "prior", "preference", "goal", "forecast", "decision", "constraint", "tradeoff", "policy", "implementation_choice", "implementation_decision", "interface_contract", "migration_state", "code_pattern", "deprecation_notice"],
   edge_type: ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme"],
@@ -44764,6 +45454,13 @@ var MODEL_SLOTS = [
 function labelFor(value) {
   return value.split(/[_-]/).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
+function templateSeedMetadata(version) {
+  return {
+    seedSource: TEMPLATE_SEED_METADATA_SOURCE,
+    seedVersion: version,
+    seedType: "template-default"
+  };
+}
 function seedContext(options) {
   return {
     now: options.now ?? DEFAULT_SEED_TIME,
@@ -44903,7 +45600,7 @@ function modelRegistryRows(now) {
     updatedAt: now
   }));
 }
-function modelFunctionSlotRows(now) {
+function modelFunctionSlotRows(now, version) {
   return MODEL_SLOTS.map(([slot, category, description, modelKey, promptName, temperature, maxTokens, requiredCapabilities]) => ({
     slot,
     category,
@@ -44915,24 +45612,24 @@ function modelFunctionSlotRows(now) {
     requiredCapabilities,
     enabled: true,
     isDefault: true,
-    notes: `Seeded by ${TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION}.`,
+    notes: `Seeded by ${version}.`,
     createdAt: now,
     updatedAt: now
   }));
 }
-function modelSlotConfigRows(now) {
+function modelSlotConfigRows(now, version) {
   return MODEL_SLOTS.map(([slot, , , modelKey, , temperature, maxTokens]) => ({
     slot,
     modelKey,
     temperature,
     maxTokens,
     enabled: true,
-    notes: `Default routing for ${slot}.`,
+    notes: `Default routing for ${slot}. Seeded by ${version}.`,
     createdAt: now,
     updatedAt: now
   }));
 }
-function schemaEnumRows(now) {
+function schemaEnumRows(now, version) {
   return Object.entries(ENUM_VALUES).flatMap(
     ([category, values]) => values.map((value, index) => ({
       category,
@@ -44940,7 +45637,7 @@ function schemaEnumRows(now) {
       label: labelFor(value),
       description: `${labelFor(value)} ${category} value.`,
       tier: "platform",
-      metadata: { seedVersion: TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION },
+      metadata: templateSeedMetadata(version),
       isDefault: index === 0,
       sortOrder: index + 1,
       status: "active",
@@ -44978,18 +45675,28 @@ function buildTenantBootstrapTemplateSeedRows(options = {}) {
       publicationRules: [
         { tenantId: ctx.templateTenantId, name: "publish-high-confidence-beliefs", description: "Publish high-confidence beliefs to tenant-level consumers.", conditionType: "confidence_threshold", conditions: { minConfidence: 0.85 }, enabled: true, priority: 100, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now }
       ],
-      schemaEnumConfig: schemaEnumRows(ctx.now)
+      schemaEnumConfig: schemaEnumRows(ctx.now, ctx.version)
     },
     "control-plane": {
       mcpWritePolicy: buildMcpWritePolicy(ctx.now, ctx.actor),
-      modelFunctionSlots: modelFunctionSlotRows(ctx.now),
+      modelFunctionSlots: modelFunctionSlotRows(ctx.now, ctx.version),
       modelRegistry: modelRegistryRows(ctx.now),
-      modelSlotConfigs: modelSlotConfigRows(ctx.now),
+      modelSlotConfigs: modelSlotConfigRows(ctx.now, ctx.version),
       platformAudiences: [
         ["internal", "Internal", "internal"],
         ["lp", "Limited Partners", "restricted_external"],
         ["public", "Public", "public"]
-      ].map(([audienceKey, audienceLabel, audienceClass]) => ({ tenantId: ctx.templateTenantId, audienceKey, audienceLabel, audienceClass, status: "active", metadata: { seedVersion: ctx.version }, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now })),
+      ].map(([audienceKey, audienceLabel, audienceClass]) => ({
+        tenantId: ctx.templateTenantId,
+        audienceKey,
+        audienceLabel,
+        audienceClass,
+        status: "active",
+        metadata: templateSeedMetadata(ctx.version),
+        createdBy: ctx.actor,
+        createdAt: ctx.now,
+        updatedAt: ctx.now
+      })),
       tenantConfig: [
         { tenantId: ctx.templateTenantId, authPolicyMode: "open", defaultSessionTTL: 28800, defaultTopicVisibility: "tenant", featureFlags: { sdkBootstrapSeeds: true, interactiveRoleAuth: true }, maxWorkspaceCount: 25, defaultModelSlotOverrides: {}, updatedAt: ctx.now, updatedBy: ctx.actor }
       ],
@@ -45296,6 +46003,6 @@ var CANONICAL_WORKFLOW_DEFINITIONS = [
   }
 ];
 
-export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GENERATED_INFISICAL_BOOTSTRAP_ENV_NAMES, GENERATED_INFISICAL_CONTROL_ENV_NAMES, GENERATED_INFISICAL_KNOWN_ENV_NAMES, GENERATED_INFISICAL_MANAGED_ENV_NAMES, GENERATED_INFISICAL_RUNTIME_ENV, GENERATED_LUCERN_GATEWAY_ENV_NAMES, GENERATED_LUCERN_WEB_PUBLIC_ENV_NAMES, GENERATED_LUCERN_WEB_SERVER_ENV_NAMES, GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUICK_QUERIES, GRAPH_REF_NODE_TYPES, GraphRefSchema, INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DEFINITIONS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION, TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_PROFILES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, assertTenantClientImportAllowed, bigramTokenize, buildDomainEvent, buildTenantBootstrapTemplateSeedRows, canonicalGeneratedInfisicalEnvName, classifyTenantClientImport, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, convexTierForVercelDestinationEnvironment, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, expectedTenantConvexDeploymentForVercelEnvironment, fillGraphIntelligencePromptTemplate, findEdgePolicy, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalSecretDefinition, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, findTenantClientInstallablePackage, formatTenantClientImportViolation, generatedInfisicalVariableForName, getComponentBoundaryTableLayer, getGraphIntelligenceQuery, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, infisicalSecretDefinitionsForConsumer, infisicalSecretDefinitionsForDestination, isAfterCursor, isComponentBoundaryComponentOwnedTable, isGeneratedInfisicalKnownEnvName, isGeneratedInfisicalManagedEnvName, isGraphIntelligenceQueryMode, isLucernPrompt, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport, jaccardSimilarity, lastDelegator, listBeliefsProjection, listGraphIntelligenceQueries, listTasksProjection, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, readGeneratedInfisicalDestinationEnv, readGeneratedInfisicalEnvValue, readGeneratedInfisicalRuntimeEnvSurface, readGeneratedLucernGatewayEnv, readGeneratedLucernWebPublicEnv, readGeneratedLucernWebServerEnv, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, tokenOverlapScore, tokenizeSearchText, validateInfisicalSecretDefinitions, vercelCustomEnvironmentIdForTenantSoftwareSystem, wordOverlapScore, wordTokenize };
+export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GENERATED_INFISICAL_BOOTSTRAP_ENV_NAMES, GENERATED_INFISICAL_CONTROL_ENV_NAMES, GENERATED_INFISICAL_KNOWN_ENV_NAMES, GENERATED_INFISICAL_MANAGED_ENV_NAMES, GENERATED_INFISICAL_RUNTIME_ENV, GENERATED_LUCERN_GATEWAY_ENV_NAMES, GENERATED_LUCERN_WEB_PUBLIC_ENV_NAMES, GENERATED_LUCERN_WEB_SERVER_ENV_NAMES, GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUICK_QUERIES, GRAPH_REF_NODE_TYPES, GraphRefSchema, INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DEFINITIONS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION, TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_PROFILES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, assertTenantClientImportAllowed, bigramTokenize, buildDomainEvent, buildProjectedUserFromPermitPrincipal, buildTenantBootstrapTemplateSeedRows, canonicalGeneratedInfisicalEnvName, classifyTenantClientImport, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, convexTierForVercelDestinationEnvironment, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, expectedTenantConvexDeploymentForVercelEnvironment, fillGraphIntelligencePromptTemplate, findEdgePolicy, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalSecretDefinition, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, findProjectedUserByPermitClerkId, findProjectedUserByPermitPrincipalId, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, findTenantClientInstallablePackage, formatTenantClientImportViolation, generatedInfisicalVariableForName, getComponentBoundaryTableLayer, getGraphIntelligenceQuery, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, infisicalSecretDefinitionsForConsumer, infisicalSecretDefinitionsForDestination, isActivePermitProjectionStatus, isAfterCursor, isComponentBoundaryComponentOwnedTable, isGeneratedInfisicalKnownEnvName, isGeneratedInfisicalManagedEnvName, isGraphIntelligenceQueryMode, isLucernPrompt, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport, jaccardSimilarity, lastDelegator, listBeliefsProjection, listGraphIntelligenceQueries, listTasksProjection, mapPermitRoleToPlatformRole, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, readGeneratedInfisicalDestinationEnv, readGeneratedInfisicalEnvValue, readGeneratedInfisicalRuntimeEnvSurface, readGeneratedLucernGatewayEnv, readGeneratedLucernWebPublicEnv, readGeneratedLucernWebServerEnv, readPermitProjectionString, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, tokenOverlapScore, tokenizeSearchText, validateInfisicalSecretDefinitions, vercelCustomEnvironmentIdForTenantSoftwareSystem, wordOverlapScore, wordTokenize };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map