@lucern/contracts 0.3.0-alpha.12 → 0.3.0-alpha.13

package/dist/index.js

@@ -189,7 +189,13 @@ var SESSION_AUTH_MODES = [
   "tenant_api_key",
   "session_token"
 ];
-var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_PRINCIPAL_TYPES = [
+  "human",
+  "service",
+  "agent",
+  "group",
+  "external_viewer"
+];
 var SESSION_LIFECYCLE_STATUSES = [
   "active",
   "expired",
@@ -202,6 +208,12 @@ function inferSessionPrincipalType(principalId) {
   if (principalId.startsWith("agent:")) {
     return "agent";
   }
+  if (principalId.startsWith("group:")) {
+    return "group";
+  }
+  if (principalId.startsWith("external:") || principalId.startsWith("external_viewer:")) {
+    return "external_viewer";
+  }
   return "service";
 }
 function normalizeDelegationChain(args) {
@@ -262,6 +274,7 @@ var TABLE_OWNERSHIP = {
   "deliberationContributions": "K",
   "deliberationSessions": "K",
   "deploymentHosts": "L",
+  "domainEvents": "K",
   "epistemicAudit": "K",
   "epistemicContracts": "K",
   "epistemicEdges": "K",
@@ -2491,6 +2504,35 @@ var systemLogs = defineTable({
     { kind: "index", name: "by_source", columns: ["source"] }
   ]
 });
+var domainEvents = defineTable({
+  name: "domainEvents",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    "eventId": z.string(),
+    "type": z.string(),
+    "version": z.string(),
+    "timestamp": z.number(),
+    "tenantId": z.string().optional(),
+    "workspaceId": z.string().optional(),
+    "topicId": z.string(),
+    "resourceId": z.string(),
+    "resourceType": z.string(),
+    "actorId": z.string(),
+    "actorType": z.enum(["human", "agent", "service"]),
+    "data": z.record(z.any()),
+    "correlationId": z.string().optional(),
+    "expiresAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_eventId", columns: ["eventId"] },
+    { kind: "index", name: "by_topic_timestamp", columns: ["topicId", "timestamp"] },
+    { kind: "index", name: "by_tenant_workspace_timestamp", columns: ["tenantId", "workspaceId", "timestamp"] },
+    { kind: "index", name: "by_type_timestamp", columns: ["type", "timestamp"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId", "timestamp"] },
+    { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
+  ]
+});
 var beliefConfidence = defineTable({
   name: "beliefConfidence",
   component: "kernel",
@@ -5897,7 +5939,10 @@ var permitPrincipalAliases = defineTable({
   }),
   indices: [
     { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "providerSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "providerSubjectId"] },
     { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
+    { kind: "index", name: "by_tenant_provider_project_subject", columns: ["tenantId", "provider", "providerProjectId", "providerSubjectId"] },
     {
       kind: "index",
       name: "by_tenant_provider_alias",
@@ -7106,6 +7151,7 @@ var KERNEL_TABLE_CONTRACTS = [
   decisionParticipants,
   decisionRiskLedger,
   decisionSnapshots,
+  domainEvents,
   deliberationContributions,
   deliberationSessions,
   stakeholderGroups,
@@ -7389,7 +7435,9 @@ var TENANT_CLIENT_AUTH_MODES = [
 var TENANT_CLIENT_PRINCIPAL_TYPES = [
   "human",
   "service",
-  "agent"
+  "agent",
+  "group",
+  "external_viewer"
 ];
 var TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [
   "tenantId",
@@ -7399,8 +7447,16 @@ var TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [
   "scopes"
 ];
 var TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [
+  "clerkId",
   "principalType",
   "roles",
+  "groupIds",
+  "permittedToolNames",
+  "permittedPackKeys",
+  "principalStatus",
+  "tenantStatus",
+  "workspaceStatus",
+  "permit",
   "sessionId",
   "delegationChain"
 ];
@@ -7678,6 +7734,7 @@ var TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [
   "ontologyLinks",
   "graphStateClassifier",
   "tools",
+  "controlPlane",
   "identity",
   "modelRuntime",
   "events",
@@ -7685,6 +7742,12 @@ var TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [
   "telemetry"
 ];
 var TENANT_CLIENT_CAPABILITIES = [
+  {
+    id: "identity.resolve_interactive_principal",
+    description: "Resolve a Clerk-authenticated user into a Permit-backed Lucern principal context.",
+    surfaces: ["@lucern/sdk", "@lucern/cli", "@lucern/mcp"],
+    requiredContextFields: ["principalId", "tenantId", "scopes"]
+  },
   {
     id: "identity.bootstrap_session",
     description: "Start a scoped Lucern session for a tenant principal.",
@@ -8435,6 +8498,27 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities."
   },
+  {
+    id: "platform.clerk.webhook-secret",
+    canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET",
+    aliases: ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+  },
   {
     id: "platform.clerk.jwks",
     canonicalName: "CLERK_JWKS_URL",
@@ -11048,6 +11132,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "CLERK_PROJECT_ID",
     "CLERK_PUBLISHABLE_KEY",
     "CLERK_SECRET_KEY",
+    "CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET",
     "CONVEX_CLOUD_URL",
     "CONVEX_DEPLOY_KEY",
     "CONVEX_DEPLOYMENT",
@@ -11111,6 +11197,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_AUTH_BASE_URL",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
+    "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS",
     "LUCERN_CONTRACTS_SKIP_DTS",
     "LUCERN_CONVEX_DEPLOY_KEY",
@@ -11283,6 +11370,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "CLERK_PROJECT_ID",
     "CLERK_PUBLISHABLE_KEY",
     "CLERK_SECRET_KEY",
+    "CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET",
     "CONVEX_CLOUD_URL",
     "CONVEX_DEPLOY_KEY",
     "CONVEX_DEPLOYMENT",
@@ -11360,6 +11449,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_AUTH_BASE_URL",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
+    "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS",
     "LUCERN_CONTRACTS_SKIP_DTS",
     "LUCERN_CONVEX_DEPLOY_KEY",
@@ -13672,6 +13762,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "stack/frontend: Lucern/MC gateway base URL used by tenant product apps. stack/stackos: Lucern/MC gateway base URL used by tenant product apps."
     },
+    "LUCERN_CLERK_WEBHOOK_SECRET": {
+      "secretId": "platform.clerk.webhook-secret",
+      "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+      "envNames": [
+        "CLERK_WEBHOOK_SECRET",
+        "CLERK_WEBHOOK_SIGNING_SECRET",
+        "LUCERN_CLERK_WEBHOOK_SECRET"
+      ],
+      "aliases": [
+        "CLERK_WEBHOOK_SECRET",
+        "CLERK_WEBHOOK_SIGNING_SECRET"
+      ],
+      "writeNames": [
+        "LUCERN_CLERK_WEBHOOK_SECRET"
+      ],
+      "required": true,
+      "secret": true,
+      "public": false,
+      "sourcePath": "/platform/auth",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-gateway"
+      ],
+      "destinations": [
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ]
+        }
+      ],
+      "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+    },
     "LUCERN_CLI_SESSION_TTL_MS": {
       "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
       "envNames": [
@@ -16940,6 +17064,9 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_API_URL": "LUCERN_API_URL",
     "LUCERN_BASE_URL": "LUCERN_BASE_URL",
     "LUCERN_GATEWAY_BASE_URL": "LUCERN_BASE_URL",
+    "CLERK_WEBHOOK_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
+    "LUCERN_CLERK_WEBHOOK_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS": "LUCERN_CLI_SESSION_TTL_MS",
     "CONVEX_DEPLOYMENT": "LUCERN_CONVEX_DEPLOYMENT_NAME",
     "CONVEX_DEV_DEPLOYMENT_NAME": "LUCERN_CONVEX_DEPLOYMENT_NAME",
@@ -17954,6 +18081,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Canonical Lucern API gateway URL. Canonical Lucern API gateway base URL. Older names remain aliases only."
         },
+        {
+          "secretId": "platform.clerk.webhook-secret",
+          "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+          "envNames": [
+            "CLERK_WEBHOOK_SECRET",
+            "CLERK_WEBHOOK_SIGNING_SECRET",
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ],
+          "aliases": [
+            "CLERK_WEBHOOK_SECRET",
+            "CLERK_WEBHOOK_SIGNING_SECRET"
+          ],
+          "writeNames": [
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ],
+          "required": true,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/auth",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-gateway"
+          ],
+          "destinations": [
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_CLERK_WEBHOOK_SECRET"
+              ]
+            }
+          ],
+          "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+        },
         {
           "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
           "envNames": [
@@ -33942,6 +34103,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Canonical Lucern API gateway base URL. Older names remain aliases only."
       },
+      {
+        "secretId": "platform.clerk.webhook-secret",
+        "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+        "envNames": [
+          "CLERK_WEBHOOK_SECRET",
+          "CLERK_WEBHOOK_SIGNING_SECRET",
+          "LUCERN_CLERK_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "CLERK_WEBHOOK_SECRET",
+          "CLERK_WEBHOOK_SIGNING_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_CLERK_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/auth",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-gateway"
+        ],
+        "destinations": [
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_CLERK_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+      },
       {
         "secretId": "platform.gateway.device-verification-base-url",
         "canonicalName": "LUCERN_DEVICE_VERIFICATION_BASE_URL",
@@ -38303,6 +38498,7 @@ __export(tool_contracts_exports, {
   REMOVE_EDGES_BETWEEN: () => REMOVE_EDGES_BETWEEN,
   REMOVE_LENS_FROM_TOPIC: () => REMOVE_LENS_FROM_TOPIC,
   RESOLVE_EFFECTIVE_ONTOLOGY: () => RESOLVE_EFFECTIVE_ONTOLOGY,
+  RESOLVE_INTERACTIVE_PRINCIPAL: () => RESOLVE_INTERACTIVE_PRINCIPAL,
   RUN_GRAPH_INTELLIGENCE_QUERY: () => RUN_GRAPH_INTELLIGENCE_QUERY,
   SEARCH_BELIEFS: () => SEARCH_BELIEFS,
   SEARCH_EVIDENCE: () => SEARCH_EVIDENCE,
@@ -40636,7 +40832,7 @@ var IDENTITY_WHOAMI = {
     description: "Canonical identity summary for the current session",
     fields: {
       principalId: "string \u2014 canonical federated principal identifier",
-      principalType: "string \u2014 human, service, or agent",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
       tenantId: "string | undefined \u2014 resolved tenant scope",
       workspaceId: "string | undefined \u2014 resolved workspace scope",
       scopes: "string[] | undefined \u2014 granted scopes for this session",
@@ -40647,6 +40843,49 @@ var IDENTITY_WHOAMI = {
   ontologyPrimitive: "identity",
   tier: "workhorse"
 };
+var RESOLVE_INTERACTIVE_PRINCIPAL = {
+  name: "resolve_interactive_principal",
+  description: "Read the Permit-backed Lucern principal context for an authenticated Clerk user. Like `git config --get user.email` plus the repository ACL \u2014 resolves the identity alias into the canonical authorization subject.",
+  parameters: {
+    clerkId: {
+      type: "string",
+      description: "Authenticated Clerk subject (`sub`). Clerk proves identity only; it is not the authorization record."
+    },
+    tenantId: {
+      type: "string",
+      description: "Optional tenant scope. Omit only when the Clerk alias is globally unambiguous."
+    },
+    workspaceId: {
+      type: "string",
+      description: "Optional workspace scope. Required when the principal has access to multiple workspaces and no default can be inferred."
+    },
+    providerProjectId: {
+      type: "string",
+      description: "Optional Clerk project or provider instance id for tenants with multiple identity providers."
+    }
+  },
+  required: ["clerkId"],
+  response: {
+    description: "Permit-backed Lucern principal context for tenant SDK bootstrap",
+    fields: {
+      principalId: "string \u2014 canonical Lucern principal identifier",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
+      clerkId: "string \u2014 authenticated Clerk subject alias",
+      tenantId: "string \u2014 resolved tenant scope",
+      workspaceId: "string | null \u2014 resolved workspace scope",
+      roles: "string[] \u2014 effective Permit roles",
+      scopes: "string[] \u2014 effective scopes derived from Permit/control-plane projection",
+      groupIds: "string[] \u2014 active Permit group memberships",
+      principalStatus: "string \u2014 active, invited, suspended, disabled, revoked, or missing",
+      tenantStatus: "string \u2014 projected tenant resource status",
+      workspaceStatus: "string \u2014 projected workspace resource status",
+      permit: "object \u2014 Permit subject, tenant, and optional workspace tuple"
+    }
+  },
+  ownerModule: "control-plane",
+  ontologyPrimitive: "identity",
+  tier: "workhorse"
+};
 var COMPILE_CONTEXT = {
   name: "compile_context",
   description: "Compile a focused reasoning context. If topicId is omitted, Lucern resolves the best topic from the query. Like `git log --graph --decorate` for the reasoning substrate \u2014 returns the canonical Pillar 3 context pack through the public API shape.",
@@ -42549,6 +42788,7 @@ var MCP_TOOL_CONTRACTS = {
   update_worktree_targets: UPDATE_WORKTREE_TARGETS,
   update_worktree_metadata: UPDATE_WORKTREE_METADATA,
   identity_whoami: IDENTITY_WHOAMI,
+  resolve_interactive_principal: RESOLVE_INTERACTIVE_PRINCIPAL,
   compile_context: COMPILE_CONTEXT,
   record_scope_learning: RECORD_SCOPE_LEARNING,
   pipeline_snapshot: PIPELINE_SNAPSHOT,
@@ -43025,6 +43265,7 @@ function mapPermitRoleToPlatformRole(role) {
     case "evidence_contributor":
     case "question_resolver":
     case "theme_promoter":
+    case "topic_promoter":
       return "editor";
     case "auditor":
       return "auditor";
@@ -43075,9 +43316,7 @@ function rolesForPrincipal(assignments, principal, groupIds) {
     (assignment) => isActivePermitProjectionStatus(assignment.status) && readPermitProjectionString(assignment.tenantId) === tenantId && (readPermitProjectionString(assignment.targetType) === "principal" && readPermitProjectionString(assignment.targetId) === principalId || readPermitProjectionString(assignment.targetType) === "group" && groupIds.includes(
       readPermitProjectionString(assignment.targetId) ?? ""
     ))
-  ).map((assignment) => mapPermitRoleToPlatformRole(assignment.role)).filter(
-    (role) => Boolean(role)
-  );
+  ).map((assignment) => mapPermitRoleToPlatformRole(assignment.role)).filter((role) => Boolean(role));
   if (readPermitProjectionString(principal.principalType) === "agent" || readPermitProjectionString(principal.principalType) === "service_principal") {
     roles.push("service_agent");
   }
@@ -44411,6 +44650,8 @@ var TENANT_BOOTSTRAP_SEED_COMPONENTS = {
   kernel: {
     componentName: "lucern",
     migrationModule: "adapters/migration",
+    templateMigrationModule: "dist/adapters/migration",
+    tenantMigrationModule: "adapters/migration",
     templateService: "services/kernel-template",
     templateDeployments: {
       staging: "kindly-goldfish-162",
@@ -44419,7 +44660,9 @@ var TENANT_BOOTSTRAP_SEED_COMPONENTS = {
   },
   "control-plane": {
     componentName: "controlPlane",
-    migrationModule: "dist/migration",
+    migrationModule: "migration",
+    templateMigrationModule: "dist/migration",
+    tenantMigrationModule: "migration",
     templateService: "services/control-plane-template",
     templateDeployments: {
       staging: "industrious-cheetah-864",
@@ -44580,6 +44823,13 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     copyMode: "none",
     description: "Deliberation sessions are created by tenant workflows."
   },
+  {
+    component: "kernel",
+    table: "domainEvents",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Domain event rows are append-only runtime audit/exhaust data."
+  },
   {
     component: "kernel",
     table: "epistemicAudit",
@@ -45141,12 +45391,15 @@ function isTenantBootstrapSeedTable(table) {
   return Boolean(findTenantBootstrapSeedTable(table));
 }
 function isTenantBootstrapForbiddenSeedTable(table) {
-  return TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES.some((entry) => entry === table);
+  return TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES.some(
+    (entry) => entry === table
+  );
 }
-var TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION = "2026-04-30.1";
+var TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION = "2026-05-11";
 var TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID = "tenant_template";
 var TENANT_BOOTSTRAP_TEMPLATE_ACTOR = "system:lucern-template-seed";
 var DEFAULT_SEED_TIME = Date.UTC(2026, 3, 30);
+var TEMPLATE_SEED_METADATA_SOURCE = "lucern-template";
 var ROLE_GRANTS = {
   viewer: ["viewer", "auditor", "editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
   auditor: ["auditor", "tenant_admin", "platform_admin", "service_agent"],
@@ -45157,7 +45410,7 @@ var ROLE_GRANTS = {
   service_agent: ["service_agent"]
 };
 var ENUM_VALUES = {
-  topic_type: ["domain", "theme", "deal", "strategy", "constitution", "project", "portfolio", "architecture", "capability", "runtime", "interface", "governance", "operations", "security", "data"],
+  topic_type: ["generic"],
   branch_schema: ["pillar", "track", "dimension", "axis", "phase"],
   belief_type: ["belief", "hypothesis", "principle", "invariant", "assumption", "tenet", "prior", "preference", "goal", "forecast", "decision", "constraint", "tradeoff", "policy", "implementation_choice", "implementation_decision", "interface_contract", "migration_state", "code_pattern", "deprecation_notice"],
   edge_type: ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme"],
@@ -45201,6 +45454,13 @@ var MODEL_SLOTS = [
 function labelFor(value) {
   return value.split(/[_-]/).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
+function templateSeedMetadata(version) {
+  return {
+    seedSource: TEMPLATE_SEED_METADATA_SOURCE,
+    seedVersion: version,
+    seedType: "template-default"
+  };
+}
 function seedContext(options) {
   return {
     now: options.now ?? DEFAULT_SEED_TIME,
@@ -45340,7 +45600,7 @@ function modelRegistryRows(now) {
     updatedAt: now
   }));
 }
-function modelFunctionSlotRows(now) {
+function modelFunctionSlotRows(now, version) {
   return MODEL_SLOTS.map(([slot, category, description, modelKey, promptName, temperature, maxTokens, requiredCapabilities]) => ({
     slot,
     category,
@@ -45352,24 +45612,24 @@ function modelFunctionSlotRows(now) {
     requiredCapabilities,
     enabled: true,
     isDefault: true,
-    notes: `Seeded by ${TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION}.`,
+    notes: `Seeded by ${version}.`,
     createdAt: now,
     updatedAt: now
   }));
 }
-function modelSlotConfigRows(now) {
+function modelSlotConfigRows(now, version) {
   return MODEL_SLOTS.map(([slot, , , modelKey, , temperature, maxTokens]) => ({
     slot,
     modelKey,
     temperature,
     maxTokens,
     enabled: true,
-    notes: `Default routing for ${slot}.`,
+    notes: `Default routing for ${slot}. Seeded by ${version}.`,
     createdAt: now,
     updatedAt: now
   }));
 }
-function schemaEnumRows(now) {
+function schemaEnumRows(now, version) {
   return Object.entries(ENUM_VALUES).flatMap(
     ([category, values]) => values.map((value, index) => ({
       category,
@@ -45377,7 +45637,7 @@ function schemaEnumRows(now) {
       label: labelFor(value),
       description: `${labelFor(value)} ${category} value.`,
       tier: "platform",
-      metadata: { seedVersion: TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION },
+      metadata: templateSeedMetadata(version),
       isDefault: index === 0,
       sortOrder: index + 1,
       status: "active",
@@ -45415,18 +45675,28 @@ function buildTenantBootstrapTemplateSeedRows(options = {}) {
       publicationRules: [
         { tenantId: ctx.templateTenantId, name: "publish-high-confidence-beliefs", description: "Publish high-confidence beliefs to tenant-level consumers.", conditionType: "confidence_threshold", conditions: { minConfidence: 0.85 }, enabled: true, priority: 100, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now }
       ],
-      schemaEnumConfig: schemaEnumRows(ctx.now)
+      schemaEnumConfig: schemaEnumRows(ctx.now, ctx.version)
     },
     "control-plane": {
       mcpWritePolicy: buildMcpWritePolicy(ctx.now, ctx.actor),
-      modelFunctionSlots: modelFunctionSlotRows(ctx.now),
+      modelFunctionSlots: modelFunctionSlotRows(ctx.now, ctx.version),
       modelRegistry: modelRegistryRows(ctx.now),
-      modelSlotConfigs: modelSlotConfigRows(ctx.now),
+      modelSlotConfigs: modelSlotConfigRows(ctx.now, ctx.version),
       platformAudiences: [
         ["internal", "Internal", "internal"],
         ["lp", "Limited Partners", "restricted_external"],
         ["public", "Public", "public"]
-      ].map(([audienceKey, audienceLabel, audienceClass]) => ({ tenantId: ctx.templateTenantId, audienceKey, audienceLabel, audienceClass, status: "active", metadata: { seedVersion: ctx.version }, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now })),
+      ].map(([audienceKey, audienceLabel, audienceClass]) => ({
+        tenantId: ctx.templateTenantId,
+        audienceKey,
+        audienceLabel,
+        audienceClass,
+        status: "active",
+        metadata: templateSeedMetadata(ctx.version),
+        createdBy: ctx.actor,
+        createdAt: ctx.now,
+        updatedAt: ctx.now
+      })),
       tenantConfig: [
         { tenantId: ctx.templateTenantId, authPolicyMode: "open", defaultSessionTTL: 28800, defaultTopicVisibility: "tenant", featureFlags: { sdkBootstrapSeeds: true, interactiveRoleAuth: true }, maxWorkspaceCount: 25, defaultModelSlotOverrides: {}, updatedAt: ctx.now, updatedBy: ctx.actor }
       ],