@lucern/contracts 0.3.0-alpha.17 → 0.3.0-alpha.2

package/dist/schemas/manifest.js

@@ -203,7 +203,7 @@ var toolRegistryEntries = defineTable({
 });
 var agents = defineTable({
   name: "agents",
-  component: "control-plane",
+  component: "identity",
   category: "agent",
   shape: z.object({
     "slug": z.string(),
@@ -234,8 +234,6 @@ var apiKeys = defineTable({
   category: "tenant",
   shape: z.object({
     "tenantId": idOf("tenants"),
-    "workspaceId": idOf("workspaces").optional(),
-    "environment": z.enum(["dev", "staging", "prod"]).optional(),
     "keyPrefix": z.enum(["luc", "stk"]),
     "keyHash": z.string(),
     "keyHint": z.string(),
@@ -263,7 +261,7 @@ var auditLog = defineTable({
   shape: z.object({
     "tenantId": idOf("tenants").optional(),
     "apiKeyId": idOf("apiKeys").optional(),
-    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_token_lease_issued", "proxy_token_lease_renewed", "proxy_token_lease_revoked", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "tenant_clerk_organization_linked", "principal_created", "principal_updated", "principal_suspended", "principal_identity_alias_upserted", "principal_identity_alias_revoked", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "deployment_host_registered", "deployment_host_revoked", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "permit_sync_enqueued", "permit_sync_succeeded", "permit_sync_failed", "permit_sync_skipped", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
+    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "principal_created", "principal_updated", "principal_suspended", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
     "actorClerkId": z.string(),
     "details": z.any().optional(),
     "createdAt": z.number()
@@ -487,35 +485,6 @@ var systemLogs = defineTable({
     { kind: "index", name: "by_source", columns: ["source"] }
   ]
 });
-var domainEvents = defineTable({
-  name: "domainEvents",
-  component: "kernel",
-  category: "events",
-  shape: z.object({
-    "eventId": z.string(),
-    "type": z.string(),
-    "version": z.string(),
-    "timestamp": z.number(),
-    "tenantId": z.string().optional(),
-    "workspaceId": z.string().optional(),
-    "topicId": z.string(),
-    "resourceId": z.string(),
-    "resourceType": z.string(),
-    "actorId": z.string(),
-    "actorType": z.enum(["human", "agent", "service"]),
-    "data": z.record(z.any()),
-    "correlationId": z.string().optional(),
-    "expiresAt": z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_eventId", columns: ["eventId"] },
-    { kind: "index", name: "by_topic_timestamp", columns: ["topicId", "timestamp"] },
-    { kind: "index", name: "by_tenant_workspace_timestamp", columns: ["tenantId", "workspaceId", "timestamp"] },
-    { kind: "index", name: "by_type_timestamp", columns: ["type", "timestamp"] },
-    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId", "timestamp"] },
-    { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
-  ]
-});
 var beliefConfidence = defineTable({
   name: "beliefConfidence",
   component: "kernel",
@@ -1171,37 +1140,29 @@ var compatibilityShims = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    shimId: z.string(),
-    gateId: z.string(),
-    removalDate: z.string(),
-    removalPriority: z.enum(["P1", "P2", "P3"]),
-    description: z.string(),
-    owner: z.string(),
-    createdAt: z.string(),
-    status: z.enum(["active", "overdue", "removed"]),
-    bridgeType: z.enum(["tool", "agent"]),
-    bridgeTarget: z.object({
-      type: z.enum(["tool", "agent"]),
-      legacyPath: z.string(),
-      harnessPath: z.string()
+    "shimId": z.string(),
+    "gateId": z.string(),
+    "removalDate": z.string(),
+    "removalPriority": z.enum(["P1", "P2", "P3"]),
+    "description": z.string(),
+    "owner": z.string(),
+    "createdAt": z.string(),
+    "status": z.enum(["active", "overdue", "removed"]),
+    "bridgeType": z.enum(["tool", "agent"]),
+    "bridgeTarget": z.object({
+      "type": z.enum(["tool", "agent"]),
+      "legacyPath": z.string(),
+      "harnessPath": z.string()
     }),
-    shimBehavior: z.enum([
-      "passthrough_with_logging",
-      "adapter",
-      "feature_flag_gate"
-    ]),
-    producesLedgerEntries: z.boolean(),
-    lastAuditedAt: z.number(),
-    metadata: z.record(z.any()).optional()
+    "shimBehavior": z.enum(["passthrough_with_logging", "adapter", "feature_flag_gate"]),
+    "producesLedgerEntries": z.boolean(),
+    "lastAuditedAt": z.number(),
+    "metadata": z.record(z.any()).optional()
   }),
   indices: [
     { kind: "index", name: "by_shimId", columns: ["shimId"] },
     { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_bridgeType_status",
-      columns: ["bridgeType", "status"]
-    }
+    { kind: "index", name: "by_bridgeType_status", columns: ["bridgeType", "status"] }
   ]
 });
 var cutoverFlags = defineTable({
@@ -1209,23 +1170,12 @@ var cutoverFlags = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    domain: z.enum([
-      "graph",
-      "schema",
-      "identity",
-      "policy",
-      "audit",
-      "admin",
-      "agent",
-      "tool",
-      "prompt",
-      "intelligence"
-    ]),
-    state: z.enum(["legacy", "cutover", "disabled"]),
-    metadata: z.record(z.any()).optional(),
-    updatedBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number()
+    "domain": z.enum(["graph", "schema", "identity", "policy", "audit", "admin", "agent", "tool", "prompt", "intelligence"]),
+    "state": z.enum(["legacy", "cutover", "disabled"]),
+    "metadata": z.record(z.any()).optional(),
+    "updatedBy": z.string(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
   }),
   indices: [
     { kind: "index", name: "by_domain", columns: ["domain"] },
@@ -1237,193 +1187,57 @@ var tenantDeploymentCredentials = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    credentialRef: z.string(),
-    tenantId: idOf("tenants"),
-    workspaceId: idOf("workspaces").optional(),
-    target: z.enum(["kernelDeployment", "appDeployment"]),
-    environment: z.enum(["dev", "staging", "prod"]),
-    encryptedDeployKey: z.string(),
-    encryptionVersion: z.string(),
-    keyFingerprint: z.string(),
-    keyHint: z.string(),
-    status: z.enum(["active", "revoked"]),
-    rotatedFromCredentialRef: z.string().optional(),
-    revokedAt: z.number().optional(),
-    revokedBy: z.string().optional(),
-    lastUsedAt: z.number().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number()
+    "credentialRef": z.string(),
+    "tenantId": idOf("tenants"),
+    "target": z.enum(["kernelDeployment", "appDeployment"]),
+    "environment": z.enum(["dev", "staging", "prod"]),
+    "encryptedDeployKey": z.string(),
+    "encryptionVersion": z.string(),
+    "keyFingerprint": z.string(),
+    "keyHint": z.string(),
+    "status": z.enum(["active", "revoked"]),
+    "rotatedFromCredentialRef": z.string().optional(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional(),
+    "lastUsedAt": z.number().optional(),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
   }),
   indices: [
     { kind: "index", name: "by_credentialRef", columns: ["credentialRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    {
-      kind: "index",
-      name: "by_tenant_target",
-      columns: ["tenantId", "target"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_target_environment",
-      columns: ["tenantId", "target", "environment"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_target_environment_status",
-      columns: ["tenantId", "target", "environment", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_workspace_target_environment_status",
-      columns: ["tenantId", "workspaceId", "target", "environment", "status"]
-    },
+    { kind: "index", name: "by_tenant_target", columns: ["tenantId", "target"] },
+    { kind: "index", name: "by_tenant_target_environment", columns: ["tenantId", "target", "environment"] },
+    { kind: "index", name: "by_tenant_target_environment_status", columns: ["tenantId", "target", "environment", "status"] },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
-var permitSyncStates = defineTable({
-  name: "permitSyncStates",
-  component: "mc",
-  category: "runtime",
-  shape: z.object({
-    syncKey: z.string(),
-    objectType: z.enum([
-      "resource",
-      "role",
-      "resource_role",
-      "resource_relation",
-      "tenant",
-      "workspace",
-      "principal",
-      "membership",
-      "group",
-      "resource_instance",
-      "relationship_tuple",
-      "role_assignment"
-    ]),
-    objectId: z.string(),
-    tenantId: idOf("tenants").optional(),
-    workspaceId: idOf("workspaces").optional(),
-    principalId: z.string().optional(),
-    permitTenantKey: z.string().optional(),
-    permitResourceType: z.string().optional(),
-    permitResourceKey: z.string().optional(),
-    desiredPayload: z.record(z.any()),
-    lastAppliedPayloadHash: z.string().optional(),
-    status: z.enum(["pending", "synced", "error", "skipped"]),
-    attemptCount: z.number(),
-    lastError: z.string().optional(),
-    nextAttemptAt: z.number().optional(),
-    lastSyncedAt: z.number().optional(),
-    createdBy: z.string(),
-    updatedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_workspace_status",
-      columns: ["workspaceId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_principal_status",
-      columns: ["principalId", "status"]
-    }
-  ]
-});
-var secretSyncDriftReports = defineTable({
-  name: "secretSyncDriftReports",
-  component: "mc",
-  category: "runtime",
-  shape: z.object({
-    reportId: z.string(),
-    source: z.enum(["infisical_manifest", "manual", "ci"]),
-    generatedAt: z.number(),
-    recordedAt: z.number(),
-    recordedBy: z.string(),
-    status: z.enum([
-      "in_sync",
-      "drift",
-      "exception",
-      "blocked",
-      "not_observed"
-    ]),
-    reportHash: z.string(),
-    manifestHash: z.string().optional(),
-    dryRunReceiptId: z.string().optional(),
-    appliedReceiptId: z.string().optional(),
-    summary: z.object({
-      totalPipelines: z.number(),
-      inSync: z.number(),
-      drift: z.number(),
-      exception: z.number(),
-      blocked: z.number(),
-      notObserved: z.number(),
-      missingKeys: z.number(),
-      valueDriftKeys: z.number(),
-      extraKeys: z.number(),
-      deniedConvexLeakage: z.number(),
-      approvedExceptions: z.number()
-    }),
-    redactedReport: z.record(z.any()),
-    metadata: z.record(z.any()).optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_reportId", columns: ["reportId"] },
-    { kind: "index", name: "by_reportHash", columns: ["reportHash"] },
-    { kind: "index", name: "by_generatedAt", columns: ["generatedAt"] },
-    {
-      kind: "index",
-      name: "by_status_generatedAt",
-      columns: ["status", "generatedAt"]
-    }
-  ]
-});
 var controlPlaneTenantModelSlotBindings = defineTable({
   name: "controlPlaneTenantModelSlotBindings",
   component: "mc",
   category: "runtime",
   shape: z.object({
-    bindingId: z.string(),
-    tenantId: idOf("tenants"),
-    workspaceId: idOf("workspaces").optional(),
-    environment: z.enum(["dev", "staging", "prod"]).optional(),
-    providerId: z.string(),
-    modelSlotId: z.string(),
-    secretRef: z.string(),
-    status: z.enum(["active", "revoked"]),
-    passThroughOnly: z.boolean(),
-    revokedAt: z.number().optional(),
-    revokedBy: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number()
+    "bindingId": z.string(),
+    "tenantId": idOf("tenants"),
+    "providerId": z.string(),
+    "modelSlotId": z.string(),
+    "secretRef": z.string(),
+    "status": z.enum(["active", "revoked"]),
+    "passThroughOnly": z.boolean(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional(),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
   }),
   indices: [
     { kind: "index", name: "by_bindingId", columns: ["bindingId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    {
-      kind: "index",
-      name: "by_tenant_slot",
-      columns: ["tenantId", "modelSlotId"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_provider_slot",
-      columns: ["tenantId", "providerId", "modelSlotId"]
-    },
+    { kind: "index", name: "by_tenant_slot", columns: ["tenantId", "modelSlotId"] },
+    { kind: "index", name: "by_tenant_provider_slot", columns: ["tenantId", "providerId", "modelSlotId"] },
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
@@ -1433,42 +1247,29 @@ var controlPlaneTenantProviderSecrets = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    secretRef: z.string(),
-    tenantId: idOf("tenants"),
-    workspaceId: idOf("workspaces").optional(),
-    environment: z.enum(["dev", "staging", "prod"]).optional(),
-    providerId: z.string(),
-    label: z.string().optional(),
-    encryptedSecret: z.string().optional(),
-    infisicalPath: z.string().optional(),
-    infisicalSecretKey: z.string().optional(),
-    infisicalProjectId: z.string().optional(),
-    encryptionVersion: z.string(),
-    secretFingerprint: z.string(),
-    keyHint: z.string(),
-    status: z.enum(["active", "revoked"]),
-    rotatedFromSecretRef: z.string().optional(),
-    revokedAt: z.number().optional(),
-    revokedBy: z.string().optional(),
-    lastUsedAt: z.number().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number()
+    "secretRef": z.string(),
+    "tenantId": idOf("tenants"),
+    "providerId": z.string(),
+    "label": z.string().optional(),
+    "encryptedSecret": z.string(),
+    "encryptionVersion": z.string(),
+    "secretFingerprint": z.string(),
+    "keyHint": z.string(),
+    "status": z.enum(["active", "revoked"]),
+    "rotatedFromSecretRef": z.string().optional(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional(),
+    "lastUsedAt": z.number().optional(),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
   }),
   indices: [
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    {
-      kind: "index",
-      name: "by_tenant_provider",
-      columns: ["tenantId", "providerId"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_provider_status",
-      columns: ["tenantId", "providerId", "status"]
-    },
+    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId"] },
+    { kind: "index", name: "by_tenant_provider_status", columns: ["tenantId", "providerId", "status"] },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
@@ -1477,93 +1278,35 @@ var controlPlaneTenantProxyGatewayUsage = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    usageId: z.string(),
-    tenantId: idOf("tenants"),
-    providerId: z.string(),
-    modelSlotId: z.string(),
-    secretRef: z.string(),
-    proxyTokenId: z.string(),
-    sessionId: z.string(),
-    principalId: z.string(),
-    workspaceId: z.string().optional(),
-    modelId: z.string().optional(),
-    requestPath: z.string(),
-    status: z.enum(["success", "error"]),
-    responseStatus: z.number().optional(),
-    inputTokens: z.number().optional(),
-    outputTokens: z.number().optional(),
-    tokenCount: z.number().optional(),
-    latencyMs: z.number(),
-    estimatedCostUsd: z.number().optional(),
-    failureCode: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
+    "usageId": z.string(),
+    "tenantId": idOf("tenants"),
+    "providerId": z.string(),
+    "modelSlotId": z.string(),
+    "secretRef": z.string(),
+    "proxyTokenId": z.string(),
+    "sessionId": z.string(),
+    "principalId": z.string(),
+    "workspaceId": z.string().optional(),
+    "modelId": z.string().optional(),
+    "requestPath": z.string(),
+    "status": z.enum(["success", "error"]),
+    "responseStatus": z.number().optional(),
+    "inputTokens": z.number().optional(),
+    "outputTokens": z.number().optional(),
+    "tokenCount": z.number().optional(),
+    "latencyMs": z.number(),
+    "estimatedCostUsd": z.number().optional(),
+    "failureCode": z.string().optional(),
+    "metadata": z.record(z.any()).optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
   }),
   indices: [
     { kind: "index", name: "by_usageId", columns: ["usageId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
-    {
-      kind: "index",
-      name: "by_tenant_provider",
-      columns: ["tenantId", "providerId", "createdAt"]
-    },
-    {
-      kind: "index",
-      name: "by_proxyTokenId",
-      columns: ["proxyTokenId", "createdAt"]
-    },
-    {
-      kind: "index",
-      name: "by_sessionId",
-      columns: ["sessionId", "createdAt"]
-    }
-  ]
-});
-var controlPlaneTenantProxyTokenLeases = defineTable({
-  name: "controlPlaneTenantProxyTokenLeases",
-  component: "mc",
-  category: "runtime",
-  shape: z.object({
-    leaseId: z.string(),
-    proxyTokenId: z.string(),
-    tenantId: idOf("tenants"),
-    workspaceId: idOf("workspaces").optional(),
-    environment: z.enum(["dev", "staging", "prod"]),
-    providerId: z.string(),
-    modelSlotId: z.string(),
-    bindingId: z.string(),
-    secretRef: z.string(),
-    sessionId: z.string(),
-    principalId: z.string(),
-    agentSessionId: z.string().optional(),
-    status: z.enum(["active", "revoked"]),
-    expiresAt: z.number(),
-    renewedAt: z.number().optional(),
-    revokedAt: z.number().optional(),
-    revokedBy: z.string().optional(),
-    revokeReason: z.string().optional(),
-    permitDecisionLogId: idOf("policyDecisionLogs").optional(),
-    permitTraceId: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_leaseId", columns: ["leaseId"] },
-    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId"] },
-    { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
-    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] },
-    {
-      kind: "index",
-      name: "by_principalId",
-      columns: ["principalId", "createdAt"]
-    },
-    {
-      kind: "index",
-      name: "by_status_expiresAt",
-      columns: ["status", "expiresAt"]
-    }
+    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId", "createdAt"] },
+    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId", "createdAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] }
   ]
 });
 var crossProjectConnections = defineTable({
@@ -1749,10 +1492,7 @@ var graphSuggestions = defineTable({
   ]
 });
 var NODE_TYPE = z.enum(["decision", "belief", "question", "theme", "deal", "topic", "claim", "evidence", "synthesis", "answer", "atomic_fact", "excerpt", "source", "company", "person", "investor", "function", "value_chain"]);
-var EDGE_TYPE_VALUES = ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme", "answers", "explores", "qualifies", "based_on", "based_on_belief", "based_on_question", "blocked_by_contradiction", "informed_by_theme", "same_as", "reinforces", "parent_of", "child_of", "falsified_by", "exclusive_with", "collapses_if", "cascade_from", "counterfactual_of", "cascade_to", "mutually_exclusive", "correlates_with", "amplifies", "precondition_for", "in_tension_with", "strengthened_by", "weakened_by", "alternative_to", "subsumes", "validated_by", "required_for", "blocks", "prerequisite_for", "parallel_to", "corroborates", "extends", "same_source_as", "same_theme_as", "assumes", "would_predict", "analogous_to", "independent_of", "implements", "violates", "co_changes_with", "migrating_from", "migrating_to", "scoped_by", "about_entity", "entity_referenced_in", "contradicts", "cites", "summarizes", "related_to", "partially_answers", "refines", "branches_from"];
-var STORAGE_EDGE_TYPE_VALUES = [...EDGE_TYPE_VALUES, "extracted_from"];
-z.enum(EDGE_TYPE_VALUES);
-var STORAGE_EDGE_TYPE = z.enum(STORAGE_EDGE_TYPE_VALUES);
+var EDGE_TYPE = z.enum(["supports", "informs", "depends_on", "extracted_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme", "answers", "explores", "qualifies", "based_on", "based_on_belief", "based_on_question", "blocked_by_contradiction", "informed_by_theme", "same_as", "reinforces", "parent_of", "child_of", "falsified_by", "exclusive_with", "collapses_if", "cascade_from", "counterfactual_of", "cascade_to", "mutually_exclusive", "correlates_with", "amplifies", "precondition_for", "in_tension_with", "strengthened_by", "weakened_by", "alternative_to", "subsumes", "validated_by", "required_for", "blocks", "prerequisite_for", "parallel_to", "corroborates", "extends", "same_source_as", "same_theme_as", "assumes", "would_predict", "analogous_to", "independent_of", "implements", "violates", "co_changes_with", "migrating_from", "migrating_to", "scoped_by", "about_entity", "entity_referenced_in", "contradicts", "cites", "summarizes", "related_to", "partially_answers", "refines", "branches_from"]);
 var TOPIC_STATUS = z.enum(["active", "archived", "watching"]);
 var TOPIC_VISIBILITY = z.enum(["private", "team", "firm", "external", "public"]);
 
@@ -1767,7 +1507,7 @@ var epistemicEdges = defineTable({
     "toNodeId": z.string().optional(),
     "sourceGlobalId": z.string().optional(),
     "targetGlobalId": z.string().optional(),
-    "edgeType": STORAGE_EDGE_TYPE,
+    "edgeType": EDGE_TYPE,
     "edgeTier": z.string().optional(),
     "domainNamespace": z.string().optional(),
     "constraint": z.string().optional(),
@@ -1905,7 +1645,6 @@ var epistemicNodes = defineTable({
     "questionType": z.enum(["validation", "falsification", "assumption_probe", "prediction_test", "counterfactual", "discovery", "clarification", "comparison", "causal", "mechanism", "general"]).optional(),
     "questionPriority": z.enum(["critical", "high", "medium", "low"]).optional(),
     "answerQuality": z.enum(["definitive", "strong", "moderate", "weak", "speculative", "unanswered"]).optional(),
-    "themeStatus": z.enum(["emerging", "active", "mature", "declining", "archived"]).optional(),
     "themeConviction": z.enum(["high", "medium", "low", "negative"]).optional(),
     "decisionType": z.enum(["invest", "pass", "follow_on", "exit", "deep_dive", "monitor", "deprioritize", "thesis_adopt", "thesis_revise", "thesis_abandon"]).optional(),
     "decisionOutcome": z.enum(["pending", "successful", "unsuccessful", "mixed", "unknown"]).optional(),
@@ -2056,7 +1795,6 @@ var memberships = defineTable({
   indices: [
     { kind: "index", name: "by_principalId", columns: ["principalId"] },
     { kind: "index", name: "by_principal_tenant", columns: ["principalId", "tenantId"] },
-    { kind: "index", name: "by_principal_tenant_workspace", columns: ["principalId", "tenantId", "workspaceId"] },
     { kind: "index", name: "by_workspace_principal", columns: ["workspaceId", "principalId"] },
     { kind: "index", name: "by_tenant_role", columns: ["tenantId", "role"] },
     { kind: "index", name: "by_status", columns: ["status"] }
@@ -2088,36 +1826,6 @@ var principals = defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
-var principalIdentityAliases = defineTable({
-  name: "principalIdentityAliases",
-  component: "mc",
-  category: "identity",
-  shape: z.object({
-    "principalId": z.string(),
-    "principalRefId": idOf("principals").optional(),
-    "provider": z.string(),
-    "providerProjectId": z.string().optional(),
-    "externalSubjectId": z.string(),
-    "tenantId": idOf("tenants").optional(),
-    "workspaceId": idOf("workspaces").optional(),
-    "email": z.string().optional(),
-    "status": z.enum(["active", "revoked"]),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_provider_subject", columns: ["provider", "externalSubjectId"] },
-    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "externalSubjectId"] },
-    { kind: "index", name: "by_principalId", columns: ["principalId"] },
-    { kind: "index", name: "by_principal_status", columns: ["principalId", "status"] },
-    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "externalSubjectId"] },
-    { kind: "index", name: "by_workspace_provider_subject", columns: ["workspaceId", "provider", "externalSubjectId"] }
-  ]
-});
 var rateLimitWindows = defineTable({
   name: "rateLimitWindows",
   component: "mc",
@@ -2142,40 +1850,6 @@ var rateLimitWindows = defineTable({
     { kind: "index", name: "by_tier_window_end", columns: ["tier", "windowEndMs"] }
   ]
 });
-var oauthDeviceCodes = defineTable({
-  name: "oauthDeviceCodes",
-  component: "mc",
-  category: "identity",
-  shape: z.object({
-    "deviceCodeHash": z.string(),
-    "userCode": z.string(),
-    "clientId": z.string(),
-    "scope": z.string(),
-    "status": z.enum(["pending", "approved", "denied", "expired", "consumed"]),
-    "expiresAt": z.number(),
-    "intervalSeconds": z.number(),
-    "lastPolledAt": z.number().optional(),
-    "slowDownCount": z.number().optional(),
-    "clerkUserId": z.string().optional(),
-    "tenantId": idOf("tenants").optional(),
-    "workspaceId": z.string().optional(),
-    "principalId": z.string().optional(),
-    "role": z.string().optional(),
-    "scopes": z.array(z.string()).optional(),
-    "sessionId": z.string().optional(),
-    "approvedAt": z.number().optional(),
-    "deniedAt": z.number().optional(),
-    "consumedAt": z.number().optional(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_deviceCodeHash", columns: ["deviceCodeHash"] },
-    { kind: "index", name: "by_userCode", columns: ["userCode"] },
-    { kind: "index", name: "by_status_expiresAt", columns: ["status", "expiresAt"] },
-    { kind: "index", name: "by_sessionId", columns: ["sessionId"] }
-  ]
-});
 var servicePrincipalKeys = defineTable({
   name: "servicePrincipalKeys",
   component: "mc",
@@ -2707,7 +2381,7 @@ var lensTopicBindings = defineTable({
 });
 var mcpWritePolicy = defineTable({
   name: "mcpWritePolicy",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "topicId": z.string().optional(),
@@ -2730,7 +2404,7 @@ var mcpWritePolicy = defineTable({
 });
 var platformAudienceGrants = defineTable({
   name: "platformAudienceGrants",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2756,7 +2430,7 @@ var platformAudienceGrants = defineTable({
 });
 var platformAudiences = defineTable({
   name: "platformAudiences",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2781,7 +2455,7 @@ var platformAudiences = defineTable({
 });
 var platformPolicyDecisionLogs = defineTable({
   name: "platformPolicyDecisionLogs",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "principalId": z.string(),
@@ -2817,7 +2491,7 @@ var platformPolicyDecisionLogs = defineTable({
 });
 var tenantApiKeys = defineTable({
   name: "tenantApiKeys",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2844,7 +2518,7 @@ var tenantApiKeys = defineTable({
 });
 var tenantConfig = defineTable({
   name: "tenantConfig",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2863,7 +2537,7 @@ var tenantConfig = defineTable({
 });
 var tenantIntegrations = defineTable({
   name: "tenantIntegrations",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2918,7 +2592,7 @@ var tenantIntegrations = defineTable({
 });
 var tenantModelSlotBindings = defineTable({
   name: "tenantModelSlotBindings",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "bindingId": z.string(),
@@ -2946,7 +2620,7 @@ var tenantModelSlotBindings = defineTable({
 });
 var tenantPolicies = defineTable({
   name: "tenantPolicies",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2971,7 +2645,7 @@ var tenantPolicies = defineTable({
 });
 var tenantProviderSecrets = defineTable({
   name: "tenantProviderSecrets",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "secretRef": z.string(),
@@ -3002,7 +2676,7 @@ var tenantProviderSecrets = defineTable({
 });
 var tenantProxyGatewayUsage = defineTable({
   name: "tenantProxyGatewayUsage",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "usageId": z.string(),
@@ -3037,7 +2711,7 @@ var tenantProxyGatewayUsage = defineTable({
 });
 var tenantProxyTokenMints = defineTable({
   name: "tenantProxyTokenMints",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "proxyTokenId": z.string(),
@@ -3060,7 +2734,7 @@ var tenantProxyTokenMints = defineTable({
 });
 var tenantSandboxAuditEvents = defineTable({
   name: "tenantSandboxAuditEvents",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "eventId": z.string(),
@@ -3094,7 +2768,7 @@ var tenantSandboxAuditEvents = defineTable({
 });
 var tenantSecrets = defineTable({
   name: "tenantSecrets",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3116,7 +2790,7 @@ var tenantSecrets = defineTable({
 });
 var toolAcls = defineTable({
   name: "toolAcls",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "role": z.enum(["platform_admin", "tenant_admin", "workspace_admin", "editor", "viewer", "auditor", "service_agent"]),
@@ -3131,7 +2805,7 @@ var toolAcls = defineTable({
 });
 var toolRegistry = defineTable({
   name: "toolRegistry",
-  component: "control-plane",
+  component: "identity",
   category: "platform",
   shape: z.object({
     "toolName": z.string(),
@@ -3212,7 +2886,7 @@ var tenantMethodologyAssignments = defineTable({
 });
 var modelCallLogs = defineTable({
   name: "modelCallLogs",
-  component: "control-plane",
+  component: "identity",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3238,7 +2912,7 @@ var modelCallLogs = defineTable({
 });
 var modelFunctionSlots = defineTable({
   name: "modelFunctionSlots",
-  component: "control-plane",
+  component: "identity",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3263,7 +2937,7 @@ var modelFunctionSlots = defineTable({
 });
 var modelRegistry = defineTable({
   name: "modelRegistry",
-  component: "control-plane",
+  component: "identity",
   category: "model",
   shape: z.object({
     "key": z.string(),
@@ -3290,7 +2964,7 @@ var modelRegistry = defineTable({
 });
 var modelSlotConfigs = defineTable({
   name: "modelSlotConfigs",
-  component: "control-plane",
+  component: "identity",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3677,7 +3351,7 @@ var policyDecisionLogs = defineTable({
     "workspaceId": idOf("workspaces").optional(),
     "resourceType": z.string(),
     "resourceId": z.string(),
-    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote", "route", "invoke", "manage", "deploy", "promote", "rollback", "audit", "read_ref", "fetch_value", "rotate", "administer", "mint", "delegate", "revoke"]),
+    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote"]),
     "decision": z.enum(["allow", "deny"]),
     "reasonCode": z.string(),
     "policyVersion": z.string(),
@@ -3739,7 +3413,7 @@ var controlPlaneToolAcls = defineTable({
 });
 var projectGrants = defineTable({
   name: "projectGrants",
-  component: "control-plane",
+  component: "identity",
   category: "project",
   shape: z.object({
     "projectId": z.string().optional(),
@@ -3771,653 +3445,9 @@ var projectGrants = defineTable({
     { kind: "index", name: "by_topic_cluster_status", columns: ["topicId", "beliefClusterId", "status"] }
   ]
 });
-var permitActorType = z.enum([
-  "human",
-  "agent",
-  "service_principal",
-  "external_stakeholder",
-  "system"
-]);
-var permitMembershipStatus = z.enum([
-  "active",
-  "invited",
-  "revoked",
-  "suspended",
-  "disabled"
-]);
-var permitDecision = z.enum(["allow", "deny"]);
-var permitAccessReviewStatus = z.enum([
-  "open",
-  "in_progress",
-  "approved",
-  "denied",
-  "expired",
-  "cancelled"
-]);
-var permitReviewScope = z.enum([
-  "tenant",
-  "workspace",
-  "resource_instance",
-  "group",
-  "principal",
-  "api_key",
-  "admin_action"
-]);
-var permitRecordStatus = z.enum([
-  "queued",
-  "inflight",
-  "completed",
-  "failed",
-  "skipped",
-  "stale"
-]);
-var permitObjectType = z.enum([
-  "resource",
-  "role",
-  "resource_role",
-  "resource_relation",
-  "tenant",
-  "workspace",
-  "principal",
-  "membership",
-  "group",
-  "resource_instance",
-  "relationship_tuple",
-  "role_assignment",
-  "attribute_binding",
-  "policy_bundle"
-]);
-var permitOutboxOperation = z.enum([
-  "upsert",
-  "delete",
-  "sync",
-  "resync",
-  "delete_sync",
-  "noop"
-]);
-var permitPolicyBundleStatus = z.enum([
-  "draft",
-  "validated",
-  "enforced",
-  "archived"
-]);
-var permitSyncStatus = z.enum([
-  "pending",
-  "synced",
-  "error",
-  "skipped"
-]);
-var permitAccessReviewSubjectType = z.enum([
-  "principal",
-  "group",
-  "role_assignment",
-  "resource_instance"
-]);
-var permitAttributeType = z.enum([
-  "string",
-  "number",
-  "bool",
-  "json",
-  "time"
-]);
-var permitAttributeOperator = z.enum([
-  "eq",
-  "neq",
-  "in",
-  "not_in",
-  "gt",
-  "gte",
-  "lt",
-  "lte",
-  "contains",
-  "not_contains",
-  "matches"
-]);
-var permitRoleBindingTarget = z.enum([
-  "principal",
-  "group"
-]);
-var permitPrincipals = defineTable({
-  name: "permitPrincipals",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    principalId: z.string(),
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    principalType: permitActorType,
-    status: permitMembershipStatus,
-    displayName: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    updatedBy: z.string().optional(),
-    lastSeenAt: z.number().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    { kind: "index", name: "by_tenant_principalId", columns: ["tenantId", "principalId"] },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
-    {
-      kind: "index",
-      name: "by_tenant_principalType_status",
-      columns: ["tenantId", "principalType", "status"]
-    }
-  ]
-});
-var permitPrincipalAliases = defineTable({
-  name: "permitPrincipalAliases",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    principalId: z.string(),
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    provider: z.string(),
-    providerSubjectId: z.string(),
-    providerProjectId: z.string().optional(),
-    alias: z.string(),
-    aliasKind: z.string(),
-    status: permitMembershipStatus,
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    revokedBy: z.string().optional(),
-    revokedAt: z.number().optional(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_principalId", columns: ["principalId"] },
-    { kind: "index", name: "by_provider_subject", columns: ["provider", "providerSubjectId"] },
-    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "providerSubjectId"] },
-    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
-    { kind: "index", name: "by_tenant_provider_project_subject", columns: ["tenantId", "provider", "providerProjectId", "providerSubjectId"] },
-    {
-      kind: "index",
-      name: "by_tenant_provider_alias",
-      columns: ["tenantId", "provider", "alias"]
-    },
-    { kind: "index", name: "by_tenant_alias", columns: ["tenantId", "alias"] },
-    {
-      kind: "index",
-      name: "by_tenant_provider_status",
-      columns: ["tenantId", "provider", "status"]
-    }
-  ]
-});
-var permitGroups = defineTable({
-  name: "permitGroups",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    groupId: z.string(),
-    groupKey: z.string(),
-    groupName: z.string(),
-    groupType: z.enum(["tenant", "workspace", "external", "system", "dynamic"]),
-    status: permitMembershipStatus,
-    description: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    { kind: "index", name: "by_tenant_groupId", columns: ["tenantId", "groupId"] },
-    { kind: "index", name: "by_tenant_groupKey", columns: ["tenantId", "groupKey"] },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
-  ]
-});
-var permitGroupMemberships = defineTable({
-  name: "permitGroupMemberships",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    groupId: z.string(),
-    memberType: z.enum(["principal", "group"]),
-    memberId: z.string(),
-    principalId: z.string().optional(),
-    childGroupId: z.string().optional(),
-    status: permitMembershipStatus,
-    addedBy: z.string().optional(),
-    revokedBy: z.string().optional(),
-    expiresAt: z.number().optional(),
-    revocationReason: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenant_principal", columns: ["tenantId", "principalId"] },
-    { kind: "index", name: "by_tenant_member", columns: ["tenantId", "memberType", "memberId"] },
-    {
-      kind: "index",
-      name: "by_tenant_member_group",
-      columns: ["tenantId", "memberType", "memberId", "groupId"]
-    },
-    { kind: "index", name: "by_tenant_group", columns: ["tenantId", "groupId"] },
-    { kind: "index", name: "by_member_group", columns: ["memberType", "memberId", "groupId"] },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
-    {
-      kind: "index",
-      name: "by_workspace_principal",
-      columns: ["workspaceId", "principalId"]
-    }
-  ]
-});
-var permitResourceInstances = defineTable({
-  name: "permitResourceInstances",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    resourceType: z.string(),
-    resourceKey: z.string(),
-    resourceId: z.string(),
-    status: z.enum(["active", "deleted", "archived"]),
-    attributes: z.record(z.any()).optional(),
-    ownerPrincipalId: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    updatedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    {
-      kind: "index",
-      name: "by_tenant_resource_type",
-      columns: ["tenantId", "resourceType"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_resource_key",
-      columns: ["tenantId", "resourceType", "resourceKey"]
-    },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_ownerPrincipalId",
-      columns: ["ownerPrincipalId"]
-    }
-  ]
-});
-var permitRoleAssignments = defineTable({
-  name: "permitRoleAssignments",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    role: z.string(),
-    targetType: permitRoleBindingTarget,
-    targetId: z.string(),
-    resourceType: z.string(),
-    resourceKey: z.string(),
-    resourceInstanceId: z.string().optional(),
-    status: permitMembershipStatus,
-    expiresAt: z.number().optional(),
-    attributes: z.record(z.any()).optional(),
-    grantedBy: z.string().optional(),
-    updatedBy: z.string().optional(),
-    revokedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    {
-      kind: "index",
-      name: "by_tenant_target",
-      columns: ["tenantId", "targetType", "targetId"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_resource",
-      columns: ["tenantId", "resourceType", "resourceKey"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_role",
-      columns: ["tenantId", "role", "status"]
-    },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_workspace_resource",
-      columns: ["workspaceId", "resourceType", "resourceKey"]
-    }
-  ]
-});
-var permitRelationshipTuples = defineTable({
-  name: "permitRelationshipTuples",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    relation: z.string(),
-    subject: z.string(),
-    object: z.string(),
-    resourceType: z.string().optional(),
-    resourceKey: z.string().optional(),
-    status: permitRecordStatus,
-    attributes: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    lastSeenAt: z.number().optional(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenant_subject", columns: ["tenantId", "subject"] },
-    { kind: "index", name: "by_tenant_object", columns: ["tenantId", "object"] },
-    { kind: "index", name: "by_tenant_relation", columns: ["tenantId", "relation"] },
-    {
-      kind: "index",
-      name: "by_tenant_relation_subject",
-      columns: ["tenantId", "relation", "subject"]
-    },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
-  ]
-});
-var permitAttributeBindings = defineTable({
-  name: "permitAttributeBindings",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    targetType: permitRoleBindingTarget,
-    targetId: z.string(),
-    attributeName: z.string(),
-    attributeType: permitAttributeType,
-    attributeOperator: permitAttributeOperator,
-    attributeValue: z.any(),
-    status: permitRecordStatus,
-    source: z.string().optional(),
-    sourceRef: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    createdBy: z.string(),
-    updatedBy: z.string().optional(),
-    expiresAt: z.number().optional()
-  }),
-  indices: [
-    {
-      kind: "index",
-      name: "by_tenant_target",
-      columns: ["tenantId", "targetType", "targetId"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_target_attribute",
-      columns: ["tenantId", "targetType", "targetId", "attributeName"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_name",
-      columns: ["tenantId", "attributeName"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    }
-  ]
-});
-var permitPolicyBundles = defineTable({
-  name: "permitPolicyBundles",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    bundleKey: z.string(),
-    version: z.number(),
-    status: permitPolicyBundleStatus,
-    policyHash: z.string().optional(),
-    policyPayload: z.record(z.any()),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    reviewedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    retiredAt: z.number().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    {
-      kind: "index",
-      name: "by_tenant_bundleKey",
-      columns: ["tenantId", "bundleKey"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_bundle_version",
-      columns: ["tenantId", "bundleKey", "version"]
-    },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
-  ]
-});
-var permitProjectionOutbox = defineTable({
-  name: "permitProjectionOutbox",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    syncKey: z.string(),
-    objectType: permitObjectType,
-    objectId: z.string(),
-    operation: permitOutboxOperation,
-    payload: z.record(z.any()),
-    status: permitRecordStatus,
-    attemptCount: z.number(),
-    nextAttemptAt: z.number().optional(),
-    lastError: z.string().optional(),
-    tenantId: z.string().optional(),
-    workspaceId: z.optional(z.string()),
-    principalId: z.string().optional(),
-    permitTenantKey: z.string().optional(),
-    permitResourceType: z.string().optional(),
-    permitResourceKey: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    lastHandledAt: z.number().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_objectType",
-      columns: ["objectType", "status"]
-    }
-  ]
-});
-var tenantPermitSyncStates = defineTable({
-  name: "tenantPermitSyncStates",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    syncKey: z.string(),
-    objectType: permitObjectType,
-    objectId: z.string(),
-    tenantId: z.string().optional(),
-    workspaceId: z.string().optional(),
-    principalId: z.string().optional(),
-    permitTenantKey: z.string().optional(),
-    permitResourceType: z.string().optional(),
-    permitResourceKey: z.string().optional(),
-    desiredPayload: z.record(z.any()),
-    lastAppliedPayloadHash: z.string().optional(),
-    status: permitSyncStatus,
-    attemptCount: z.number(),
-    lastError: z.string().optional(),
-    nextAttemptAt: z.number().optional(),
-    lastSyncedAt: z.number().optional(),
-    createdBy: z.string(),
-    updatedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_workspace_status",
-      columns: ["workspaceId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_principal_status",
-      columns: ["principalId", "status"]
-    }
-  ]
-});
-var permitPolicyDecisionReceipts = defineTable({
-  name: "permitPolicyDecisionReceipts",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string().optional(),
-    workspaceId: z.string().optional(),
-    principalId: z.string(),
-    subjectType: permitAccessReviewSubjectType.optional(),
-    subjectId: z.string().optional(),
-    resourceType: z.string(),
-    resourceId: z.string(),
-    action: z.string(),
-    decision: permitDecision,
-    reasonCode: z.string(),
-    policyBundleId: z.string().optional(),
-    policyVersion: z.string(),
-    traceId: z.string().optional(),
-    requestId: z.string().optional(),
-    audienceMode: z.string().optional(),
-    audienceKey: z.string().optional(),
-    audienceClass: z.enum(["internal", "restricted_external", "public"]).optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    expiresAt: z.number().optional(),
-    createdBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_principal_createdAt", columns: ["principalId", "createdAt"] },
-    { kind: "index", name: "by_tenant_createdAt", columns: ["tenantId", "createdAt"] },
-    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId"] },
-    { kind: "index", name: "by_decision_createdAt", columns: ["decision", "createdAt"] },
-    { kind: "index", name: "by_traceId", columns: ["traceId"] },
-    { kind: "index", name: "by_action", columns: ["action"] }
-  ]
-});
-var permitAccessReviews = defineTable({
-  name: "permitAccessReviews",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    reviewKey: z.string(),
-    scope: permitReviewScope,
-    status: permitAccessReviewStatus,
-    subjectType: permitAccessReviewSubjectType,
-    subjectId: z.string(),
-    resourceType: z.string().optional(),
-    resourceKey: z.string().optional(),
-    outcome: z.enum(["allow", "deny"]).optional(),
-    requestedBy: z.string(),
-    reviewedBy: z.string().optional(),
-    requestedAt: z.number(),
-    reviewedAt: z.number().optional(),
-    dueAt: z.number().optional(),
-    justification: z.string().optional(),
-    rationale: z.string().optional(),
-    policyBundleId: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
-    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
-    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
-    {
-      kind: "index",
-      name: "by_tenant_subject",
-      columns: ["tenantId", "subjectType", "subjectId"]
-    },
-    { kind: "index", name: "by_outcome", columns: ["outcome"] },
-    {
-      kind: "index",
-      name: "by_workspace_status",
-      columns: ["workspaceId", "status"]
-    }
-  ]
-});
-var permitAccessReviewItems = defineTable({
-  name: "permitAccessReviewItems",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    reviewKey: z.string(),
-    itemKey: z.string(),
-    tenantId: z.string(),
-    workspaceId: z.string().optional(),
-    subjectType: permitAccessReviewSubjectType,
-    subjectId: z.string(),
-    resourceType: z.string().optional(),
-    resourceKey: z.string().optional(),
-    role: z.string().optional(),
-    relation: z.string().optional(),
-    status: z.enum(["open", "approved", "revoked", "changed", "deferred"]),
-    reviewerId: z.string().optional(),
-    decisionAt: z.number().optional(),
-    rationale: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_reviewKey", columns: ["reviewKey"] },
-    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
-    { kind: "index", name: "by_tenant_itemKey", columns: ["tenantId", "itemKey"] },
-    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
-    { kind: "index", name: "by_status", columns: ["status"] }
-  ]
-});
 var reasoningPermissions = defineTable({
   name: "reasoningPermissions",
-  component: "control-plane",
+  component: "identity",
   category: "epistemic",
   shape: z.object({
     "topicId": z.string().optional(),
@@ -4652,7 +3682,6 @@ var topics = defineTable({
     "updatedAt": z.number()
   }),
   indices: [
-    { kind: "index", name: "by_globalId", columns: ["globalId"] },
     { kind: "index", name: "by_parent", columns: ["parentTopicId"] },
     { kind: "index", name: "by_type", columns: ["type"] },
     { kind: "index", name: "by_graph_scope_project", columns: ["graphScopeProjectId"] },
@@ -4664,7 +3693,7 @@ var topics = defineTable({
 });
 var users = defineTable({
   name: "users",
-  component: "control-plane",
+  component: "identity",
   category: "user",
   shape: z.object({
     "clerkId": z.string(),
@@ -4777,8 +3806,7 @@ var workspaces = defineTable({
     "defaultProjectVisibility": z.enum(["private", "team", "firm", "external", "public"]).optional(),
     "deployments": z.record(z.object({
       "url": z.string(),
-      "target": z.enum(["kernelDeployment", "appDeployment"]).optional(),
-      "credentialRef": z.string().optional()
+      "encryptedDeployKey": z.string()
     })).optional(),
     "metadata": z.record(z.any()).optional(),
     "createdBy": z.string().optional(),
@@ -4792,39 +3820,6 @@ var workspaces = defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
-var deploymentHosts = defineTable({
-  name: "deploymentHosts",
-  component: "mc",
-  category: "workspace",
-  shape: z.object({
-    "host": z.string(),
-    "tenantId": idOf("tenants"),
-    "workspaceId": idOf("workspaces"),
-    "environment": z.enum(["dev", "staging", "prod"]),
-    "target": z.enum(["kernelDeployment", "appDeployment"]),
-    "deploymentUrl": z.string().optional(),
-    "deploymentName": z.string().optional(),
-    "vercelProjectName": z.string().optional(),
-    "vercelProjectId": z.string().optional(),
-    "vercelEnvironment": z.enum(["development", "preview", "staging", "production"]).optional(),
-    "source": z.enum(["vercel_preview", "vercel_production", "vercel_custom_environment", "custom_domain", "manual"]),
-    "status": z.enum(["active", "revoked"]),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_host", columns: ["host"] },
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    { kind: "index", name: "by_tenant_workspace_environment", columns: ["tenantId", "workspaceId", "environment"] },
-    { kind: "index", name: "by_workspace_status", columns: ["workspaceId", "status"] },
-    { kind: "index", name: "by_status", columns: ["status"] }
-  ]
-});
 var worktreeBeliefCluster = defineTable({
   name: "worktreeBeliefCluster",
   component: "kernel",
@@ -5143,7 +4138,6 @@ var KERNEL_TABLE_CONTRACTS = [
   decisionParticipants,
   decisionRiskLedger,
   decisionSnapshots,
-  domainEvents,
   deliberationContributions,
   deliberationSessions,
   stakeholderGroups,
@@ -5190,23 +4184,9 @@ var KERNEL_TABLE_CONTRACTS = [
   worktreeBeliefCluster,
   worktrees
 ];
-var CONTROL_PLANE_TABLE_CONTRACTS = [
+var IDENTITY_TABLE_CONTRACTS = [
   agents,
   reasoningPermissions,
-  permitAccessReviewItems,
-  permitAccessReviews,
-  permitAttributeBindings,
-  permitGroups,
-  permitGroupMemberships,
-  permitPolicyBundles,
-  permitPolicyDecisionReceipts,
-  permitPrincipalAliases,
-  permitPrincipals,
-  permitProjectionOutbox,
-  permitRelationshipTuples,
-  permitResourceInstances,
-  permitRoleAssignments,
-  tenantPermitSyncStates,
   modelCallLogs,
   modelFunctionSlots,
   modelRegistry,
@@ -5234,9 +4214,7 @@ var MC_TABLE_CONTRACTS = [
   groupMemberships,
   groups,
   memberships,
-  oauthDeviceCodes,
   principals,
-  principalIdentityAliases,
   rateLimitWindows,
   servicePrincipalKeys,
   userSessions,
@@ -5252,33 +4230,29 @@ var MC_TABLE_CONTRACTS = [
   policyDecisionLogs,
   policySimulations,
   controlPlaneToolAcls,
-  permitSyncStates,
   agentRegistryEntries,
   toolCatalog,
   toolRegistryEntries,
   compatibilityShims,
   cutoverFlags,
   tenantDeploymentCredentials,
-  secretSyncDriftReports,
   controlPlaneTenantModelSlotBindings,
   controlPlaneTenantProviderSecrets,
   controlPlaneTenantProxyGatewayUsage,
-  controlPlaneTenantProxyTokenLeases,
   apiKeys,
   auditLog,
   tenants,
-  workspaces,
-  deploymentHosts
+  workspaces
 ];
 var TABLE_CONTRACTS_BY_COMPONENT = {
   kernel: KERNEL_TABLE_CONTRACTS,
-  "control-plane": CONTROL_PLANE_TABLE_CONTRACTS,
+  identity: IDENTITY_TABLE_CONTRACTS,
   mc: MC_TABLE_CONTRACTS,
   "developer-pack": []
 };
 var ALL_TABLE_CONTRACTS = [
   ...KERNEL_TABLE_CONTRACTS,
-  ...CONTROL_PLANE_TABLE_CONTRACTS,
+  ...IDENTITY_TABLE_CONTRACTS,
   ...MC_TABLE_CONTRACTS
 ];
 function listTableContractsByName(name) {
@@ -5290,6 +4264,6 @@ function getTableContract(name, component) {
   );
 }
 
-export { ALL_TABLE_CONTRACTS, CONTROL_PLANE_TABLE_CONTRACTS, KERNEL_TABLE_CONTRACTS, MC_TABLE_CONTRACTS, TABLE_CONTRACTS_BY_COMPONENT, getTableContract, listTableContractsByName };
+export { ALL_TABLE_CONTRACTS, IDENTITY_TABLE_CONTRACTS, KERNEL_TABLE_CONTRACTS, MC_TABLE_CONTRACTS, TABLE_CONTRACTS_BY_COMPONENT, getTableContract, listTableContractsByName };
 //# sourceMappingURL=manifest.js.map
 //# sourceMappingURL=manifest.js.map