@lucern/contracts 0.3.0-alpha.2 → 0.3.0-alpha.4

package/dist/index.js

@@ -1,5 +1,6 @@
 import { z, ZodFirstPartyTypeKind } from 'zod';
 import { v } from 'convex/values';
+import { ALL_FUNCTION_CONTRACTS } from './function-registry/index.js';
 export * from './function-registry/index.js';
 
 var __defProp = Object.defineProperty;
@@ -224,6 +225,209 @@ function lastDelegator(delegationChain) {
   return delegationChain[delegationChain.length - 1]?.principalId;
 }
 
+// src/generated/tableOwnership.ts
+var TABLE_OWNERSHIP = {
+  "agentMessages": "K",
+  "agentRegistryEntries": "L",
+  "agents": "I",
+  "agentSessions": "K",
+  "apiKeys": "L",
+  "auditLog": "L",
+  "autofixJobs": "K",
+  "backgroundJobRuns": "K",
+  "backgroundJobSettings": "K",
+  "beliefConfidence": "K",
+  "beliefEvidenceLinks": "K",
+  "beliefHistory": "K",
+  "beliefScenarios": "K",
+  "beliefVotes": "K",
+  "calibrationScores": "K",
+  "compatibilityShims": "L",
+  "contractEvaluations": "K",
+  "contradictions": "K",
+  "controlPlaneTenantModelSlotBindings": "L",
+  "controlPlaneTenantProviderSecrets": "L",
+  "controlPlaneTenantProxyGatewayUsage": "L",
+  "controlPlaneToolAcls": "L",
+  "crossProjectConnections": "K",
+  "cutoverFlags": "L",
+  "decisionComputedSummaries": "K",
+  "decisionEvents": "K",
+  "decisionParticipants": "K",
+  "decisionRiskLedger": "K",
+  "decisionSnapshots": "K",
+  "deliberationContributions": "K",
+  "deliberationSessions": "K",
+  "epistemicAudit": "K",
+  "epistemicContracts": "K",
+  "epistemicEdges": "K",
+  "epistemicNodeEmbeddings": "K",
+  "epistemicNodes": "K",
+  "graphAnalysisCache": "K",
+  "graphAnalysisResults": "K",
+  "graphSuggestions": "K",
+  "groupMemberships": "L",
+  "groups": "L",
+  "harnessReplays": "K",
+  "harnessRuns": "K",
+  "idempotencyTokens": "K",
+  "lenses": "K",
+  "lensTopicBindings": "K",
+  "mcpWritePolicy": "I",
+  "memberships": "L",
+  "methodologyPacks": "L",
+  "modelCallLogs": "I",
+  "modelFunctionSlots": "I",
+  "modelRegistry": "I",
+  "modelSlotConfigs": "I",
+  "neo4jSyncQueue": "K",
+  "oauthDeviceCodes": "L",
+  "ontologyDefinitions": "K",
+  "ontologyVersions": "K",
+  "packAssignments": "L",
+  "packDefinitions": "L",
+  "packEntitlements": "L",
+  "packGroupAssignments": "L",
+  "packInstallations": "L",
+  "packVersions": "L",
+  "platformAgentRunPolicyDecisions": "K",
+  "platformAgentRunPromptResolutions": "K",
+  "platformAgentRuns": "K",
+  "platformAgentRunToolCalls": "K",
+  "platformAudienceGrants": "I",
+  "platformAudiences": "I",
+  "platformHarnessShadowAudit": "K",
+  "platformPolicyDecisionLogs": "I",
+  "policyBundles": "L",
+  "policyDecisionLogs": "L",
+  "policySimulations": "L",
+  "principals": "L",
+  "projectGrants": "I",
+  "publicationRules": "K",
+  "questionEvidenceLinks": "K",
+  "rateLimitWindows": "L",
+  "reasoningPermissions": "I",
+  "researchJobs": "K",
+  "schemaEnumConfig": "K",
+  "servicePrincipalKeys": "L",
+  "stakeholderGroups": "K",
+  "systemLogs": "K",
+  "tasks": "K",
+  "tenantApiKeys": "I",
+  "tenantConfig": "I",
+  "tenantDeploymentCredentials": "L",
+  "tenantIntegrations": "I",
+  "tenantMethodologyAssignments": "L",
+  "tenantModelSlotBindings": "I",
+  "tenantPolicies": "I",
+  "tenantProviderSecrets": "I",
+  "tenantProxyGatewayUsage": "I",
+  "tenantProxyTokenMints": "I",
+  "tenants": "L",
+  "tenantSandboxAuditEvents": "I",
+  "tenantSecrets": "I",
+  "toolAcls": "I",
+  "toolCatalog": "L",
+  "toolRegistry": "I",
+  "toolRegistryEntries": "L",
+  "topics": "K",
+  "users": "I",
+  "userSessions": "L",
+  "workflowDefinitions": "K",
+  "workflowPullRequests": "K",
+  "workflowStages": "K",
+  "workspaces": "L",
+  "worktreeBeliefCluster": "K",
+  "worktrees": "K"
+};
+
+// src/component-boundary.contract.ts
+var COMPONENT_BOUNDARY_CONTRACT_VERSION = "2026-04-27";
+var COMPONENT_BOUNDARY_COMPONENT_LAYERS = [
+  "I",
+  "K"
+];
+var COMPONENT_BOUNDARY_DIRECT_DB_METHODS = [
+  "insert",
+  "patch",
+  "replace",
+  "delete",
+  "query"
+];
+var COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS = [
+  "services",
+  "apps",
+  "convex"
+];
+var COMPONENT_BOUNDARY_HIGH_RISK_TABLES = [
+  "backgroundJobRuns",
+  "backgroundJobSettings",
+  "systemLogs",
+  "epistemicAudit",
+  "platformPolicyDecisionLogs",
+  "tenantApiKeys",
+  "projectGrants",
+  "userSessions"
+];
+function getComponentBoundaryTableLayer(tableName) {
+  return TABLE_OWNERSHIP[tableName];
+}
+function isComponentBoundaryComponentOwnedTable(tableName) {
+  const layer = getComponentBoundaryTableLayer(tableName);
+  return layer === "I" || layer === "K";
+}
+
+// src/component-host-boundary.contract.ts
+var COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION = "2026-04-28";
+var COMPONENT_HOST_PROTECTED_TABLES = [
+  "backgroundJobRuns",
+  "backgroundJobSettings",
+  "systemLogs",
+  "epistemicAudit",
+  "platformPolicyDecisionLogs",
+  "tenantApiKeys",
+  "projectGrants",
+  "userSessions"
+];
+var COMPONENT_HOST_PROTECTED_TABLE_OWNERS = {
+  backgroundJobRuns: "kernel_component",
+  backgroundJobSettings: "kernel_component",
+  systemLogs: "kernel_component",
+  epistemicAudit: "reasoning_kernel_component",
+  platformPolicyDecisionLogs: "identity_component",
+  tenantApiKeys: "identity_component",
+  projectGrants: "identity_component",
+  userSessions: "tenant_or_control_plane_schema"
+};
+var COMPONENT_HOST_DB_WRITE_OPERATIONS = [
+  "insert",
+  "patch",
+  "replace",
+  "delete"
+];
+var COMPONENT_HOST_DB_READ_OPERATIONS = ["query"];
+var COMPONENT_HOST_WRITE_AUDIT_ROOTS = [
+  "apps/web/convex",
+  "packages/server-core/src",
+  "services/kernel-template/convex",
+  "services/identity-template/convex",
+  "services/master-control/convex"
+];
+var COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS = [
+  {
+    file: "services/master-control/convex/userSessions.ts",
+    table: "userSessions",
+    operation: "insert",
+    reason: "Master Control declares and owns its own userSessions table for gateway session validation."
+  },
+  {
+    file: "services/master-control/convex/userSessions.ts",
+    table: "userSessions",
+    operation: "query",
+    reason: "Master Control declares and owns its own userSessions table for gateway session validation."
+  }
+];
+
 // src/gateway.contract.ts
 function requireActorPrincipalId(authContext) {
   const principalId = typeof authContext.principalId === "string" ? authContext.principalId.trim() : "";
@@ -3023,6 +3227,40 @@ var rateLimitWindows = defineTable({
     { kind: "index", name: "by_tier_window_end", columns: ["tier", "windowEndMs"] }
   ]
 });
+var oauthDeviceCodes = defineTable({
+  name: "oauthDeviceCodes",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "deviceCodeHash": z.string(),
+    "userCode": z.string(),
+    "clientId": z.string(),
+    "scope": z.string(),
+    "status": z.enum(["pending", "approved", "denied", "expired", "consumed"]),
+    "expiresAt": z.number(),
+    "intervalSeconds": z.number(),
+    "lastPolledAt": z.number().optional(),
+    "slowDownCount": z.number().optional(),
+    "clerkUserId": z.string().optional(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": z.string().optional(),
+    "principalId": z.string().optional(),
+    "role": z.string().optional(),
+    "scopes": z.array(z.string()).optional(),
+    "sessionId": z.string().optional(),
+    "approvedAt": z.number().optional(),
+    "deniedAt": z.number().optional(),
+    "consumedAt": z.number().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_deviceCodeHash", columns: ["deviceCodeHash"] },
+    { kind: "index", name: "by_userCode", columns: ["userCode"] },
+    { kind: "index", name: "by_status_expiresAt", columns: ["status", "expiresAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId"] }
+  ]
+});
 var servicePrincipalKeys = defineTable({
   name: "servicePrincipalKeys",
   component: "mc",
@@ -4979,7 +5217,9 @@ var workspaces = defineTable({
     "defaultProjectVisibility": z.enum(["private", "team", "firm", "external", "public"]).optional(),
     "deployments": z.record(z.object({
       "url": z.string(),
-      "encryptedDeployKey": z.string()
+      "target": z.enum(["kernelDeployment", "appDeployment"]).optional(),
+      "encryptedDeployKey": z.string().optional(),
+      "credentialRef": z.string().optional()
     })).optional(),
     "metadata": z.record(z.any()).optional(),
     "createdBy": z.string().optional(),
@@ -5387,6 +5627,7 @@ var MC_TABLE_CONTRACTS = [
   groupMemberships,
   groups,
   memberships,
+  oauthDeviceCodes,
   principals,
   rateLimitWindows,
   servicePrincipalKeys,
@@ -5554,6 +5795,608 @@ var edgePolicyManifest = {
     }
   ]
 };
+
+// src/tenant-client.contract.ts
+var TENANT_CLIENT_CONTRACT_VERSION = "2026-04-27";
+var TENANT_CLIENT_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
+];
+var TENANT_CLIENT_PRINCIPAL_TYPES = [
+  "human",
+  "service",
+  "agent"
+];
+var TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "authMode",
+  "scopes"
+];
+var TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [
+  "principalType",
+  "roles",
+  "sessionId",
+  "delegationChain"
+];
+var TENANT_CLIENT_INSTALL_TOKEN_ENV = "INSTALL_LUCERN_NPM";
+var TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH = "tenants/shared";
+var TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [
+  "/platform/publish"
+];
+var TENANT_CLIENT_FORBIDDEN_SECRET_ENV = ["NPM_TOKEN"];
+var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
+  {
+    packageName: "@lucern/access-control",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/agent",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/auth",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/cli",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/client-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/confidence",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/config",
+    role: "configuration",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/contracts",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/control-plane",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/developer-kit",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/identity",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+var TENANT_CLIENT_PUBLIC_IMPORTS = [
+  {
+    packageName: "@lucern/sdk",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "TypeScript SDK runtime and generated operation namespaces."
+  },
+  {
+    packageName: "@lucern/react",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "React bindings for tenant-owned UI applications."
+  },
+  {
+    packageName: "@lucern/mcp",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "MCP client/server entry points and hosted route helpers."
+  },
+  {
+    packageName: "@lucern/contracts",
+    surface: "contract",
+    subpaths: "published_exports",
+    description: "Published type and manifest contracts."
+  },
+  {
+    packageName: "@lucern/types",
+    surface: "contract",
+    subpaths: "published_exports",
+    description: "Published type-only helpers for tenant integration code."
+  }
+];
+var TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [
+  {
+    packageName: "@lucern/identity",
+    importPath: "@lucern/identity/convex.config",
+    surface: "component_config",
+    description: "Convex component binding config for tenant deployments that install Lucern identity."
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    importPath: "@lucern/reasoning-kernel/convex.config",
+    surface: "component_config",
+    description: "Convex component binding config for tenant deployments that install the Lucern reasoning kernel."
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    importPath: "@lucern/reasoning-kernel/runtime.config",
+    surface: "component_config",
+    description: "Runtime config alias for tenant deployments that install the Lucern reasoning kernel."
+  }
+];
+function findTenantClientInstallablePackage(packageName) {
+  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(
+    (entry) => entry.packageName === packageName
+  );
+}
+function isTenantClientInstallablePackage(packageName) {
+  return Boolean(findTenantClientInstallablePackage(packageName));
+}
+var TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [
+  "bootstrap",
+  "context",
+  "beliefs",
+  "evidence",
+  "questions",
+  "graph",
+  "worktrees",
+  "topics",
+  "edges",
+  "contradictions",
+  "contracts",
+  "graphAnalysis",
+  "graphRecommendations",
+  "orgGraphSearch",
+  "embeddings",
+  "ontologyLinks",
+  "graphStateClassifier",
+  "tools",
+  "identity",
+  "modelRuntime",
+  "events",
+  "jobs",
+  "telemetry"
+];
+var TENANT_CLIENT_CAPABILITIES = [
+  {
+    id: "identity.bootstrap_session",
+    description: "Start a scoped Lucern session for a tenant principal.",
+    surfaces: ["@lucern/sdk", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.context.compile",
+    description: "Compile tenant and workspace scoped reasoning context.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph.read",
+    description: "Read beliefs, evidence, questions, topics, and lineage.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph.write",
+    description: "Create and update graph objects through authorized APIs.",
+    surfaces: ["@lucern/sdk", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "workflow.worktree_lifecycle",
+    description: "Create, review, merge, and close scoped worktrees.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  }
+];
+var TENANT_CLIENT_ISOLATION_RULES = [
+  {
+    id: "tenant_workspace_scope_required",
+    description: "Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state."
+  },
+  {
+    id: "principal_audit_required",
+    description: "Runtime operations must carry principalId, authMode, and scopes for audit attribution."
+  },
+  {
+    id: "no_private_lucern_imports",
+    description: "Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals."
+  }
+];
+var TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [
+  {
+    id: "deep_src_import",
+    pattern: "^@lucern/[^/]+/src(?:/|$)",
+    description: "Published packages must not be bypassed through src paths."
+  },
+  {
+    id: "deep_dist_import",
+    pattern: "^@lucern/[^/]+/dist(?:/|$)",
+    description: "Published package exports must be used instead of dist file paths."
+  },
+  {
+    id: "generated_adapter_import",
+    pattern: "^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)",
+    description: "Generated Lucern adapters are internal deployment artifacts."
+  },
+  {
+    id: "private_runtime_import",
+    pattern: "^@lucern/[^/]+/(?:internal|private)(?:/|$)",
+    description: "Internal and private package subpaths are not public SDK API."
+  },
+  {
+    id: "workspace_source_import",
+    pattern: "^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)",
+    description: "Tenant clients must not import source files from the Lucern monorepo."
+  },
+  {
+    id: "root_alias_lucern_import",
+    pattern: "^@/(?:lucern|packages|modules|services|apps)(?:/|$)",
+    description: "Tenant clients must not depend on Lucern repo-local path aliases."
+  },
+  {
+    id: "relative_lucern_source_import",
+    pattern: "^\\.\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)",
+    description: "Tenant clients must not reach back into Lucern source through relative paths."
+  },
+  {
+    id: "monorepo_path_import",
+    pattern: "lucern-repo",
+    description: "Absolute imports that name the Lucern repository are not portable tenant code."
+  }
+];
+function matchesPublicImport(importPath) {
+  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(
+    (entry) => importPath === entry.importPath
+  );
+  if (componentConfig) {
+    return componentConfig;
+  }
+  return TENANT_CLIENT_PUBLIC_IMPORTS.find(
+    (entry) => importPath === entry.packageName || importPath.startsWith(`${entry.packageName}/`)
+  );
+}
+function matchesForbiddenPattern(importPath) {
+  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find(
+    (entry) => new RegExp(entry.pattern, "u").test(importPath)
+  );
+}
+function classifyTenantClientImport(importPath) {
+  const normalizedImportPath = importPath.trim();
+  const pattern = matchesForbiddenPattern(normalizedImportPath);
+  if (pattern) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "forbidden",
+      pattern,
+      reason: pattern.description
+    };
+  }
+  const publicImport = matchesPublicImport(normalizedImportPath);
+  if (publicImport) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "public",
+      publicImport,
+      reason: publicImport.description
+    };
+  }
+  if (normalizedImportPath.startsWith("@lucern/")) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "forbidden",
+      reason: "This @lucern package is not part of the tenant client public surface."
+    };
+  }
+  if (normalizedImportPath.startsWith("./") || normalizedImportPath.startsWith("../")) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "local",
+      reason: "Local tenant-owned import."
+    };
+  }
+  return {
+    importPath: normalizedImportPath,
+    decision: "external",
+    reason: "External dependency outside the Lucern package namespace."
+  };
+}
+function isTenantClientPublicImport(importPath) {
+  return classifyTenantClientImport(importPath).decision === "public";
+}
+function isTenantClientComponentConfigImport(importPath) {
+  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(
+    (entry) => importPath === entry.importPath
+  );
+}
+function isTenantClientAllowedImport(importPath) {
+  return classifyTenantClientImport(importPath).decision === "public";
+}
+function assertTenantClientImportAllowed(importPath) {
+  const classification = classifyTenantClientImport(importPath);
+  if (classification.decision !== "forbidden") {
+    return;
+  }
+  throw new Error(formatTenantClientImportViolation(classification));
+}
+function formatTenantClientImportViolation(classification) {
+  const patternId = classification.pattern ? ` [${classification.pattern.id}]` : "";
+  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;
+}
+
+// src/infisical-runtime.contract.ts
+var INFISICAL_RUNTIME_CONTRACT_VERSION = "2026-04-28";
+var INFISICAL_RUNTIME_DEFAULT_API_URL = "https://app.infisical.com";
+var INFISICAL_RUNTIME_DEFAULT_PROJECT_ID = "344b0526-90df-4606-ba50-22c647a36c65";
+var INFISICAL_RUNTIME_ENVIRONMENTS = [
+  "dev",
+  "staging",
+  "prod"
+];
+var INFISICAL_RUNTIME_DELIVERY_MODES = [
+  "vercel_sync",
+  "runtime_fetch",
+  "device_auth"
+];
+var INFISICAL_RUNTIME_SURFACE_IDS = [
+  "lucern-web",
+  "lucern-gateway",
+  "lucern-sdk",
+  "lucern-cli",
+  "lucern-mcp",
+  "tenant-client"
+];
+var INFISICAL_RUNTIME_BOOTSTRAP_ENV = {
+  apiUrl: ["INFISICAL_API_URL", "INFISICAL_URL"],
+  projectId: ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"],
+  clientId: [
+    "INFISICAL_CLIENT_ID",
+    "INFISICAL_MACHINE_CLIENT_ID",
+    "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"
+  ],
+  clientSecret: [
+    "INFISICAL_CLIENT_SECRET",
+    "INFISICAL_MACHINE_CLIENT_SECRET",
+    "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"
+  ],
+  environment: ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"],
+  organizationSlug: ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"],
+  disabled: ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"]
+};
+var INFISICAL_RUNTIME_PATHS = [
+  {
+    id: "platform-auth",
+    secretPath: "/platform/auth",
+    description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.",
+    variables: [
+      {
+        name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+        required: true,
+        secret: false,
+        public: true,
+        description: "Clerk publishable key for the Lucern web origin."
+      },
+      {
+        name: "CLERK_SECRET_KEY",
+        required: true,
+        secret: true,
+        public: false,
+        description: "Clerk backend secret key for Lucern server runtimes."
+      },
+      {
+        name: "CLERK_JWT_ISSUER_DOMAIN",
+        required: false,
+        secret: false,
+        public: false,
+        description: "Expected Clerk issuer/JWKS domain for JWT verification."
+      },
+      {
+        name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
+        required: false,
+        secret: false,
+        public: true,
+        description: "Public sign-in URL for Lucern-owned web flows."
+      },
+      {
+        name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
+        required: false,
+        secret: false,
+        public: true,
+        description: "Public sign-up URL for Lucern-owned web flows."
+      }
+    ]
+  },
+  {
+    id: "platform-runtime",
+    secretPath: "/platform/runtime",
+    description: "Runtime defaults shared by server-side Lucern clients and operator tooling.",
+    variables: [
+      {
+        name: "LUCERN_API_URL",
+        required: true,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"],
+        description: "Canonical Lucern API gateway URL."
+      },
+      {
+        name: "LUCERN_LOGIN_BASE_URL",
+        required: false,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_AUTH_BASE_URL"],
+        description: "Browser login origin used when it differs from the API."
+      },
+      {
+        name: "LUCERN_ENVIRONMENT",
+        required: false,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_ENV"],
+        description: "Lucern environment label consumed by CLI profiles."
+      }
+    ]
+  },
+  {
+    id: "tenant-shared-install",
+    secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
+    description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.",
+    variables: [
+      {
+        name: "INSTALL_LUCERN_NPM",
+        required: true,
+        secret: true,
+        public: false,
+        description: "Read-only install token for the published @lucern/* suite."
+      }
+    ]
+  }
+];
+var INFISICAL_RUNTIME_SURFACES = [
+  {
+    id: "lucern-web",
+    delivery: "vercel_sync",
+    sourcePathIds: ["platform-auth", "platform-runtime"],
+    consumer: "apps/web on Vercel project lucern",
+    description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs."
+  },
+  {
+    id: "lucern-gateway",
+    delivery: "vercel_sync",
+    sourcePathIds: ["platform-auth", "platform-runtime"],
+    consumer: "apps/gateway on Vercel project lucern-gateway",
+    description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs."
+  },
+  {
+    id: "lucern-sdk",
+    packageName: "@lucern/sdk",
+    delivery: "runtime_fetch",
+    sourcePathIds: ["platform-runtime"],
+    consumer: "server-side SDK operator contexts with a scoped Infisical identity",
+    description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials."
+  },
+  {
+    id: "lucern-cli",
+    packageName: "@lucern/cli",
+    delivery: "runtime_fetch",
+    fallback: "device_auth",
+    sourcePathIds: ["platform-runtime"],
+    consumer: "developer/operator CLI processes",
+    description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login."
+  },
+  {
+    id: "lucern-mcp",
+    packageName: "@lucern/mcp",
+    delivery: "runtime_fetch",
+    fallback: "device_auth",
+    sourcePathIds: ["platform-runtime"],
+    consumer: "MCP server/client processes",
+    description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner."
+  },
+  {
+    id: "tenant-client",
+    delivery: "device_auth",
+    sourcePathIds: ["tenant-shared-install"],
+    consumer: "tenant-owned apps and coding agents",
+    description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces."
+  }
+];
+function findInfisicalRuntimePath(pathId) {
+  return INFISICAL_RUNTIME_PATHS.find((path) => path.id === pathId);
+}
+function findInfisicalRuntimeSurface(surfaceId) {
+  return INFISICAL_RUNTIME_SURFACES.find(
+    (surface) => surface.id === surfaceId
+  );
+}
+
+// src/manifests/infisical-runtime-manifest.ts
+var INFISICAL_RUNTIME_MANIFEST = {
+  manifestVersion: "1.0.0",
+  contractVersion: INFISICAL_RUNTIME_CONTRACT_VERSION,
+  project: {
+    id: INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,
+    apiUrl: INFISICAL_RUNTIME_DEFAULT_API_URL
+  },
+  environments: INFISICAL_RUNTIME_ENVIRONMENTS,
+  deliveryModes: INFISICAL_RUNTIME_DELIVERY_MODES,
+  bootstrapEnv: INFISICAL_RUNTIME_BOOTSTRAP_ENV,
+  paths: INFISICAL_RUNTIME_PATHS,
+  surfaces: INFISICAL_RUNTIME_SURFACES
+};
 var InvariantManifestSchema = z.object({
   manifestVersion: z.literal("1.0.0"),
   rules: z.array(
@@ -5566,6 +6409,35 @@ var InvariantManifestSchema = z.object({
   )
 });
 
+// src/manifests/tenant-client-manifest.ts
+var TENANT_CLIENT_MANIFEST = {
+  manifestVersion: "1.0.0",
+  contractVersion: TENANT_CLIENT_CONTRACT_VERSION,
+  auth: {
+    modes: TENANT_CLIENT_AUTH_MODES,
+    principalTypes: TENANT_CLIENT_PRINCIPAL_TYPES,
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,
+    optionalContextFields: TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS
+  },
+  installToken: {
+    env: TENANT_CLIENT_INSTALL_TOKEN_ENV,
+    infisicalPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
+    forbiddenInfisicalPaths: TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS,
+    forbiddenSecretEnv: TENANT_CLIENT_FORBIDDEN_SECRET_ENV
+  },
+  packages: {
+    installable: TENANT_CLIENT_INSTALLABLE_PACKAGES,
+    directImports: TENANT_CLIENT_PUBLIC_IMPORTS,
+    componentConfigImports: TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS
+  },
+  sdk: {
+    requiredNamespaces: TENANT_CLIENT_REQUIRED_SDK_NAMESPACES
+  },
+  capabilities: TENANT_CLIENT_CAPABILITIES,
+  isolationRules: TENANT_CLIENT_ISOLATION_RULES,
+  forbiddenImportPatterns: TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS
+};
+
 // src/projections/projection-dsl.ts
 function defineProjection(def) {
   return def;
@@ -5917,6 +6789,7 @@ __export(tool_contracts_exports, {
   ARCHIVE_BELIEF: () => ARCHIVE_BELIEF,
   ARCHIVE_ONTOLOGY: () => ARCHIVE_ONTOLOGY,
   ARCHIVE_QUESTION: () => ARCHIVE_QUESTION,
+  BEGIN_BUILD_SESSION: () => BEGIN_BUILD_SESSION,
   BISECT_CONFIDENCE: () => BISECT_CONFIDENCE,
   BROADCAST_MESSAGE: () => BROADCAST_MESSAGE,
   CHECK_PERMISSION: () => CHECK_PERMISSION,
@@ -6440,6 +7313,14 @@ var ADD_WORKTREE = {
   description: "Check out a branch into an active worktree for investigation. Like `git worktree add <branch>` \u2014 creates independent working state on a thematic branch. Beliefs committed within the worktree can be freely amended (draft code on a feature branch). When investigation is complete, `merge` integrates findings into main.",
   parameters: {
     title: { type: "string", description: "Worktree name/objective" },
+    name: {
+      type: "string",
+      description: "Optional storage-name alias for callers that already use backend naming"
+    },
+    projectId: {
+      type: "string",
+      description: "Legacy topicId alias"
+    },
     topicId: { type: "string", description: "Optional topic scope hint" },
     branchId: {
       type: "string",
@@ -6453,24 +7334,97 @@ var ADD_WORKTREE = {
       type: "string",
       description: "The testable claim this worktree investigates"
     },
-    beliefIds: {
-      type: "array",
-      description: "Beliefs to test in this worktree"
+    rationale: {
+      type: "string",
+      description: "Why this worktree exists and why it belongs in the campaign"
     },
-    autoShape: {
-      type: "boolean",
-      description: "Whether to invoke inquiry auto-shaping during worktree creation"
+    worktreeType: {
+      type: "string",
+      description: "Schema-enum worktree type used by the kernel lifecycle and retrieval layers"
     },
-    domainPackId: {
+    gate: {
       type: "string",
-      description: "Optional domain pack whose shaping hooks should influence generated questions and tasks"
+      description: "Exit gate name for this worktree"
     },
-    campaign: {
+    startDate: {
       type: "number",
-      description: "Top-level pipeline campaign number. Campaigns define the outer execution slice."
+      description: "Planned start timestamp in milliseconds since epoch"
     },
-    lane: {
-      type: "string",
+    endDate: {
+      type: "number",
+      description: "Planned end timestamp in milliseconds since epoch"
+    },
+    durationWeeks: {
+      type: "number",
+      description: "Planned duration in weeks"
+    },
+    confidenceImpact: {
+      type: "string",
+      description: "Expected confidence impact if the worktree succeeds",
+      enum: ["high", "medium", "low"]
+    },
+    beliefFocus: {
+      type: "string",
+      description: "Natural-language focus spanning the target belief neighborhood"
+    },
+    beliefIds: {
+      type: "array",
+      description: "Legacy alias for targetBeliefIds"
+    },
+    beliefs: {
+      type: "array",
+      description: "Legacy alias for targetBeliefIds"
+    },
+    targetBeliefIds: {
+      type: "array",
+      description: "Belief node IDs this worktree is expected to test or update"
+    },
+    targetQuestionIds: {
+      type: "array",
+      description: "Question node IDs this worktree is expected to answer"
+    },
+    keyQuestions: {
+      type: "array",
+      description: "Inline key question objects with question, optional status, answer, answerConfidence, and linkedQuestionId"
+    },
+    evidenceSignals: {
+      type: "array",
+      description: "Evidence signal objects with signal, optional collected state, progress, and notes"
+    },
+    decisionGate: {
+      type: "object",
+      description: "Decision gate object with goCriteria, noGoSignals, optional verdict, rationale, decidedAt, and decidedBy"
+    },
+    goCriteria: {
+      type: "array",
+      description: "Shorthand go criteria used to build decisionGate"
+    },
+    noGoSignals: {
+      type: "array",
+      description: "Shorthand no-go signals used to build decisionGate"
+    },
+    proofArtifacts: {
+      type: "array",
+      description: "Expected proof artifacts required to close the worktree"
+    },
+    autoShape: {
+      type: "boolean",
+      description: "Whether to invoke inquiry auto-shaping during worktree creation"
+    },
+    autoFixPolicy: {
+      type: "object",
+      description: "Policy for permitted automatic remediation inside the worktree"
+    },
+    domainPackId: {
+      type: "string",
+      description: "Optional domain pack whose shaping hooks should influence generated questions and tasks"
+    },
+    campaign: {
+      type: "number",
+      description: "Top-level pipeline campaign number. Campaigns define the outer execution slice."
+    },
+    lane: {
+      type: "string",
       description: "GitButler-aligned workstream lane name inside the campaign."
     },
     laneOrderInCampaign: {
@@ -6489,9 +7443,17 @@ var ADD_WORKTREE = {
       type: "array",
       description: "Worktree IDs blocked by this worktree"
     },
-    gate: {
+    staffingHint: {
       type: "string",
-      description: "Exit gate name for this worktree"
+      description: "Suggested staffing or agent allocation note"
+    },
+    lensId: {
+      type: "string",
+      description: "Lens that scopes this worktree when applicable"
+    },
+    lastReconciledAt: {
+      type: "number",
+      description: "Timestamp when worktree metadata was last reconciled"
     }
   },
   required: ["title", "topicId"],
@@ -6521,7 +7483,7 @@ var MERGE = {
     worktreeId: { type: "string", description: "The worktree to merge" },
     outcomes: {
       type: "array",
-      description: "Scoring outcomes for each belief: { beliefId, confidence, rationale }"
+      description: "Merge outcomes as key-finding strings, or scoring outcomes for beliefs: { beliefId, confidence, rationale }"
     },
     summary: { type: "string", description: "Overall findings summary" }
   },
@@ -9540,6 +10502,69 @@ var GENERATE_SESSION_HANDOFF = {
   tier: "showcase",
   internal: true
 };
+var BEGIN_BUILD_SESSION = {
+  name: "begin_build_session",
+  description: "Bootstrap a coding build session for a Lucern worktree. Like `git worktree add` plus `git status` \u2014 returns the compact context packet an agent needs before editing.",
+  parameters: {
+    worktreeId: {
+      type: "string",
+      description: "The Lucern worktree ID to bootstrap."
+    },
+    branch: {
+      type: "string",
+      description: "Optional git branch name. Auto-generated from the worktree name when omitted."
+    },
+    branchBase: {
+      type: "string",
+      description: 'Base branch for the feature branch. Default: "staging".'
+    },
+    prBase: {
+      type: "string",
+      description: 'Target branch for the PR. Default: "staging".'
+    },
+    sessionMode: {
+      type: "string",
+      description: 'Session mode: "async" for Codex/headless or "interactive" for live sessions.',
+      enum: ["async", "interactive"]
+    },
+    activateIfPlanning: {
+      type: "boolean",
+      description: "When true, automatically activate a planning worktree during bootstrap."
+    }
+  },
+  required: ["worktreeId"],
+  response: {
+    description: "A compact build-session packet with worktree metadata, graph anchors, questions, dependencies, and git defaults.",
+    fields: {
+      topicId: "string \u2014 canonical topic scope",
+      topicName: "string \u2014 human-readable topic name",
+      worktreeId: "string \u2014 worktree ID",
+      worktreeName: "string \u2014 human-readable worktree name",
+      branch: "string \u2014 git branch name",
+      branchBase: "string \u2014 base branch",
+      prBase: "string \u2014 PR target branch",
+      campaign: "number | null \u2014 top-level pipeline campaign",
+      lane: "string \u2014 campaign lane",
+      gate: "string \u2014 exit gate",
+      hypothesis: "string \u2014 worktree hypothesis",
+      focus: "string \u2014 session focus",
+      status: "string \u2014 worktree status after optional activation",
+      sessionMode: "string \u2014 async | interactive",
+      targetBeliefIds: "array \u2014 scoped belief IDs",
+      targetQuestionIds: "array \u2014 scoped question IDs",
+      topBeliefs: "array \u2014 highest-confidence scoped beliefs",
+      openQuestions: "array \u2014 open scoped questions",
+      resolvedDecisions: "array \u2014 answered questions summarized for the session",
+      dependencies: "array \u2014 upstream worktrees",
+      unblocks: "array \u2014 downstream worktrees",
+      mergeOrderNotes: "string \u2014 merge ordering advisory"
+    }
+  },
+  ownerModule: "bootstrap",
+  ontologyPrimitive: "worktree",
+  tier: "showcase",
+  internal: true
+};
 var MCP_TOOL_CONTRACTS = {
   // Belief lifecycle (commit, amend, fork, archive)
   create_belief: CREATE_BELIEF,
@@ -9633,6 +10658,7 @@ var MCP_TOOL_CONTRACTS = {
   get_agent_inbox: GET_AGENT_INBOX,
   claim_files: CLAIM_FILES,
   generate_session_handoff: GENERATE_SESSION_HANDOFF,
+  begin_build_session: BEGIN_BUILD_SESSION,
   // Policy / ACL (workhorse)
   check_permission: CHECK_PERMISSION,
   filter_by_permission: FILTER_BY_PERMISSION,
@@ -11300,6 +12326,950 @@ function validateSdkGitSemantics(tool) {
   return { valid: true };
 }
 
+// src/tenant-bootstrap-seed.contract.ts
+var TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION = "2026-04-30";
+var TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "role",
+  "authMode",
+  "correlationId",
+  "auditMetadata"
+];
+var TENANT_BOOTSTRAP_SEED_COMPONENTS = {
+  kernel: {
+    componentName: "lucern",
+    templateService: "services/kernel-template",
+    templateDeployments: {
+      staging: "charming-okapi-787",
+      prod: "brilliant-narwhal-889"
+    }
+  },
+  identity: {
+    componentName: "identity",
+    templateService: "services/identity-template",
+    templateDeployments: {
+      staging: "charming-goldfinch-895",
+      prod: "helpful-mule-694"
+    }
+  }
+};
+function isCopyableSeedRequirement(entry) {
+  return (entry.copyMode === "template_global" || entry.copyMode === "template_tenant_rewrite" || entry.copyMode === "template_reference_remap") && Boolean(entry.scope) && Array.isArray(entry.uniqueKey) && entry.uniqueKey.length > 0;
+}
+var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
+  {
+    component: "kernel",
+    table: "agentMessages",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Agent coordination messages are session data, not template data."
+  },
+  {
+    component: "kernel",
+    table: "agentSessions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Agent coordination sessions are created by active clients."
+  },
+  {
+    component: "kernel",
+    table: "autofixJobs",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Autofix work items are runtime queue rows."
+  },
+  {
+    component: "kernel",
+    table: "backgroundJobRuns",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Background job executions are runtime logs."
+  },
+  {
+    component: "kernel",
+    table: "backgroundJobSettings",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["jobKey"],
+    description: "Default job enablement settings must come from the K template."
+  },
+  {
+    component: "kernel",
+    table: "beliefConfidence",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Belief confidence rows are created with tenant graph facts."
+  },
+  {
+    component: "kernel",
+    table: "beliefEvidenceLinks",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Belief-to-evidence links are tenant graph data."
+  },
+  {
+    component: "kernel",
+    table: "beliefHistory",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Belief history is append-only tenant graph data."
+  },
+  {
+    component: "kernel",
+    table: "beliefScenarios",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Scenario rows are tenant-authored reasoning data."
+  },
+  {
+    component: "kernel",
+    table: "beliefVotes",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision belief votes are tenant-authored data."
+  },
+  {
+    component: "kernel",
+    table: "calibrationScores",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Calibration scores are computed from tenant outcomes."
+  },
+  {
+    component: "kernel",
+    table: "contractEvaluations",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Contract evaluation rows are runtime computation logs."
+  },
+  {
+    component: "kernel",
+    table: "contradictions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Contradictions are tenant graph facts."
+  },
+  {
+    component: "kernel",
+    table: "crossProjectConnections",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Cross-topic connections are tenant graph facts."
+  },
+  {
+    component: "kernel",
+    table: "decisionComputedSummaries",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Decision summaries are derived tenant outputs."
+  },
+  {
+    component: "kernel",
+    table: "decisionEvents",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision events are lifecycle data."
+  },
+  {
+    component: "kernel",
+    table: "decisionParticipants",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision participants are tenant-selected actors."
+  },
+  {
+    component: "kernel",
+    table: "decisionRiskLedger",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision risk rows are tenant decision data."
+  },
+  {
+    component: "kernel",
+    table: "decisionSnapshots",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Decision snapshots are derived from tenant state."
+  },
+  {
+    component: "kernel",
+    table: "deliberationContributions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Deliberation contributions are tenant-authored data."
+  },
+  {
+    component: "kernel",
+    table: "deliberationSessions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Deliberation sessions are created by tenant workflows."
+  },
+  {
+    component: "kernel",
+    table: "epistemicAudit",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Epistemic audit rows are append-only runtime audit data."
+  },
+  {
+    component: "kernel",
+    table: "epistemicContracts",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Epistemic contracts are tenant-authored governance data."
+  },
+  {
+    component: "kernel",
+    table: "epistemicEdges",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Edges are tenant reasoning graph data."
+  },
+  {
+    component: "kernel",
+    table: "epistemicNodeEmbeddings",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Embeddings are derived from tenant graph nodes."
+  },
+  {
+    component: "kernel",
+    table: "epistemicNodes",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Nodes are tenant reasoning graph data."
+  },
+  {
+    component: "kernel",
+    table: "graphAnalysisCache",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Graph analysis cache rows are derived from tenant graph state."
+  },
+  {
+    component: "kernel",
+    table: "graphAnalysisResults",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Graph analysis result rows are derived tenant outputs."
+  },
+  {
+    component: "kernel",
+    table: "graphSuggestions",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Graph suggestions are derived recommendations."
+  },
+  {
+    component: "kernel",
+    table: "harnessReplays",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Harness replay rows are runtime verification logs."
+  },
+  {
+    component: "kernel",
+    table: "harnessRuns",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Harness run rows are runtime verification logs."
+  },
+  {
+    component: "kernel",
+    table: "idempotencyTokens",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Idempotency tokens are request-scoped runtime guards."
+  },
+  {
+    component: "kernel",
+    table: "lenses",
+    prepopulation: "optional_template",
+    copyMode: "none",
+    description: "Reusable lens templates may live in K templates, but workspace-specific copies are not required for core SDK boot."
+  },
+  {
+    component: "kernel",
+    table: "lensTopicBindings",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Lens bindings attach runtime topics to runtime/workspace lenses."
+  },
+  {
+    component: "kernel",
+    table: "neo4jSyncQueue",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Neo4j sync queue rows are runtime work items."
+  },
+  {
+    component: "kernel",
+    table: "ontologyDefinitions",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["ontologyKey"],
+    description: "Platform ontology definitions power taxonomy reads and effective ontology resolution."
+  },
+  {
+    component: "kernel",
+    table: "ontologyVersions",
+    prepopulation: "required_template",
+    copyMode: "template_reference_remap",
+    scope: "global",
+    uniqueKey: ["ontologyKey", "version"],
+    dependsOn: ["ontologyDefinitions"],
+    description: "Ontology versions must be copied with ontologyDefinition ID remapping."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRunPolicyDecisions",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent-run policy decisions are audit logs."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRunPromptResolutions",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent-run prompt resolution rows are runtime logs."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRuns",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent runs are runtime execution records."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRunToolCalls",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent-run tool calls are runtime execution records."
+  },
+  {
+    component: "kernel",
+    table: "platformHarnessShadowAudit",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Harness shadow audit rows are runtime audit records."
+  },
+  {
+    component: "kernel",
+    table: "publicationRules",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "workspaceId", "name"],
+    description: "Default publication policy rules are rewritten into each tenant."
+  },
+  {
+    component: "kernel",
+    table: "questionEvidenceLinks",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Question-to-evidence links are tenant graph data."
+  },
+  {
+    component: "kernel",
+    table: "researchJobs",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Research job rows are runtime queue items."
+  },
+  {
+    component: "kernel",
+    table: "schemaEnumConfig",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["category", "value"],
+    description: "Runtime-extensible enum defaults required by SDK graph APIs."
+  },
+  {
+    component: "kernel",
+    table: "stakeholderGroups",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Stakeholder groups are tenant decision data."
+  },
+  {
+    component: "kernel",
+    table: "systemLogs",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "System logs are runtime telemetry."
+  },
+  {
+    component: "kernel",
+    table: "tasks",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Tasks are tenant-authored work items."
+  },
+  {
+    component: "kernel",
+    table: "topics",
+    prepopulation: "runtime_bootstrap",
+    copyMode: "none",
+    description: "Default topics are created by tenant provisioning, not copied from templates."
+  },
+  {
+    component: "kernel",
+    table: "workflowDefinitions",
+    prepopulation: "optional_template",
+    copyMode: "none",
+    description: "Table-driven workflow definitions can be template data after the workflow engine leaves legacy mode."
+  },
+  {
+    component: "kernel",
+    table: "workflowPullRequests",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Workflow pull requests are tenant workflow data."
+  },
+  {
+    component: "kernel",
+    table: "workflowStages",
+    prepopulation: "optional_template",
+    copyMode: "none",
+    dependsOn: ["workflowDefinitions"],
+    description: "Workflow stages can be template data after workflowDefinitions are enabled for bootstrap copying."
+  },
+  {
+    component: "kernel",
+    table: "worktreeBeliefCluster",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Worktree cluster rows link runtime worktrees to runtime beliefs."
+  },
+  {
+    component: "kernel",
+    table: "worktrees",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Worktrees are tenant/runtime planning data."
+  },
+  {
+    component: "identity",
+    table: "agents",
+    prepopulation: "runtime_bootstrap",
+    copyMode: "none",
+    description: "Service agents are provisioned per tenant or service, not copied."
+  },
+  {
+    component: "identity",
+    table: "mcpWritePolicy",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["topicId", "role", "toolCategory"],
+    description: "Global write policy defaults govern service and interactive MCP writes."
+  },
+  {
+    component: "identity",
+    table: "modelCallLogs",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Model call logs are runtime telemetry."
+  },
+  {
+    component: "identity",
+    table: "modelFunctionSlots",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["slot"],
+    description: "Function-to-model slots are required by model runtime resolution."
+  },
+  {
+    component: "identity",
+    table: "modelRegistry",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["key"],
+    description: "Model catalog defaults are required by model runtime clients."
+  },
+  {
+    component: "identity",
+    table: "modelSlotConfigs",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["slot"],
+    description: "Slot-level defaults are required before tenant overrides exist."
+  },
+  {
+    component: "identity",
+    table: "platformAudienceGrants",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Audience grants are principal/group-specific access rows."
+  },
+  {
+    component: "identity",
+    table: "platformAudiences",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "workspaceId", "audienceKey"],
+    description: "Default tenant audience taxonomy rows are rewritten into each tenant."
+  },
+  {
+    component: "identity",
+    table: "platformPolicyDecisionLogs",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Policy decisions are runtime audit logs."
+  },
+  {
+    component: "identity",
+    table: "projectGrants",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Project/topic grants are principal or group-specific access rows."
+  },
+  {
+    component: "identity",
+    table: "reasoningPermissions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Reasoning permissions are principal-specific policy rows."
+  },
+  {
+    component: "identity",
+    table: "tenantApiKeys",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "API keys are tenant credentials and must never be copied."
+  },
+  {
+    component: "identity",
+    table: "tenantConfig",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId"],
+    description: "Tenant-local config defaults are rewritten during bootstrap."
+  },
+  {
+    component: "identity",
+    table: "tenantIntegrations",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "integrationKey"],
+    description: "Non-secret integration descriptors are rewritten into each tenant."
+  },
+  {
+    component: "identity",
+    table: "tenantModelSlotBindings",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Tenant model slot bindings reference provider secrets and are runtime-only."
+  },
+  {
+    component: "identity",
+    table: "tenantPolicies",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "workspaceId", "roleName"],
+    description: "Default tenant policy roles are rewritten during bootstrap."
+  },
+  {
+    component: "identity",
+    table: "tenantProviderSecrets",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Provider secrets are credentials and must never be copied."
+  },
+  {
+    component: "identity",
+    table: "tenantProxyGatewayUsage",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Proxy gateway usage rows are runtime telemetry."
+  },
+  {
+    component: "identity",
+    table: "tenantProxyTokenMints",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Proxy token mints are ephemeral secret-bearing runtime rows."
+  },
+  {
+    component: "identity",
+    table: "tenantSandboxAuditEvents",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Sandbox audit rows are runtime security logs."
+  },
+  {
+    component: "identity",
+    table: "tenantSecrets",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Tenant secrets are credentials and must never be copied."
+  },
+  {
+    component: "identity",
+    table: "toolAcls",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["role", "toolName"],
+    description: "Default role-to-tool grants are required for SDK/MCP tool access."
+  },
+  {
+    component: "identity",
+    table: "toolRegistry",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["toolName"],
+    description: "Core tool catalog rows are required before pack or tenant tools exist."
+  },
+  {
+    component: "identity",
+    table: "users",
+    prepopulation: "runtime_bootstrap",
+    copyMode: "none",
+    description: "Users are created from Clerk/MC principal resolution, not copied."
+  }
+];
+var TENANT_BOOTSTRAP_SEED_TABLES = TENANT_BOOTSTRAP_TABLE_REQUIREMENTS.filter(
+  isCopyableSeedRequirement
+);
+var TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES = TENANT_BOOTSTRAP_TABLE_REQUIREMENTS.filter(
+  (entry) => !isCopyableSeedRequirement(entry)
+).map((entry) => entry.table);
+var TENANT_BOOTSTRAP_SEED_MANIFEST = {
+  contractVersion: TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION,
+  authMetadataFields: TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS,
+  components: TENANT_BOOTSTRAP_SEED_COMPONENTS,
+  tableRequirements: TENANT_BOOTSTRAP_TABLE_REQUIREMENTS,
+  tables: TENANT_BOOTSTRAP_SEED_TABLES,
+  forbiddenTables: TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES
+};
+function findTenantBootstrapTableRequirement(table) {
+  return TENANT_BOOTSTRAP_TABLE_REQUIREMENTS.find(
+    (entry) => entry.table === table
+  );
+}
+function findTenantBootstrapSeedTable(table) {
+  return TENANT_BOOTSTRAP_SEED_TABLES.find((entry) => entry.table === table);
+}
+function isTenantBootstrapSeedTable(table) {
+  return Boolean(findTenantBootstrapSeedTable(table));
+}
+function isTenantBootstrapForbiddenSeedTable(table) {
+  return TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES.some((entry) => entry === table);
+}
+var TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION = "2026-04-30.1";
+var TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID = "tenant_template";
+var TENANT_BOOTSTRAP_TEMPLATE_ACTOR = "system:lucern-template-seed";
+var DEFAULT_SEED_TIME = Date.UTC(2026, 3, 30);
+var ROLE_GRANTS = {
+  viewer: ["viewer", "auditor", "editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
+  auditor: ["auditor", "tenant_admin", "platform_admin", "service_agent"],
+  editor: ["editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
+  workspace_admin: ["workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
+  tenant_admin: ["tenant_admin", "platform_admin", "service_agent"],
+  platform_admin: ["platform_admin", "service_agent"],
+  service_agent: ["service_agent"]
+};
+var ENUM_VALUES = {
+  topic_type: ["domain", "theme", "deal", "strategy", "constitution", "project", "portfolio", "architecture", "capability", "runtime", "interface", "governance", "operations", "security", "data"],
+  branch_schema: ["pillar", "track", "dimension", "axis", "phase"],
+  belief_type: ["belief", "hypothesis", "principle", "invariant", "assumption", "tenet", "prior", "preference", "goal", "forecast", "decision", "constraint", "tradeoff", "policy", "implementation_choice", "implementation_decision", "interface_contract", "migration_state", "code_pattern", "deprecation_notice"],
+  edge_type: ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme"],
+  worktree_type: ["belief_test", "lens", "existential", "contradiction", "refinement", "coverage", "discovery", "clarification", "confirmation"],
+  worktree_phase: ["cluster_mapping", "hypothesis_formation", "question_generation", "evidence_collection", "synthesis", "decision", "retrospective"],
+  activity_type: ["create", "update", "review", "merge", "archive", "comment", "status_change", "evidence_added", "question_added"],
+  lens_perspective_type: ["investigation", "monitoring", "analysis", "comparison", "taxonomy"],
+  node_type: ["belief", "question", "theme", "deal", "evidence", "claim", "synthesis", "source", "excerpt", "atomic_fact", "person", "company", "investor", "value_chain", "function", "decision"]
+};
+var MODEL_REGISTRY = [
+  ["claude-sonnet-4", "Claude Sonnet 4", "claude-sonnet-4-20250514", "anthropic", 2e5, 64e3, 1, 3, 15],
+  ["claude-sonnet-4.5", "Claude Sonnet 4.5", "claude-sonnet-4-5-20250929", "anthropic", 2e5, 64e3, 1, 3, 15],
+  ["claude-opus-4", "Claude Opus 4", "claude-opus-4-20250514", "anthropic", 2e5, 32e3, 1, 15, 75],
+  ["gpt-4o", "GPT-4o", "gpt-4o", "openai", 128e3, 16e3, 0.7, 5, 15],
+  ["gpt-4o-mini", "GPT-4o Mini", "gpt-4o-mini", "openai", 128e3, 16e3, 0.7, 0.15, 0.6],
+  ["gemini-2.5-pro", "Gemini 2.5 Pro", "gemini-2.5-pro", "google", 1e6, 32e3, 0.7, 1.25, 10],
+  ["sonar-pro", "Sonar Pro", "sonar-pro", "perplexity", 128e3, 8e3, 0.3, 3, 15]
+];
+var MODEL_SLOTS = [
+  ["primer_default", "primers", "Default primer generation for general topics", "claude-sonnet-4", "agents/primer/system", 1, 4e3, ["text_generation", "reasoning"]],
+  ["primer_technical", "primers", "Technical and engineering focused primers", "claude-sonnet-4", "agents/primer/system", 0.8, 4e3, ["text_generation", "reasoning", "code"]],
+  ["primer_intelligence", "document_intelligence", "Extract evidence, beliefs, and questions from documents", "claude-sonnet-4", "agents/primer-intelligence", 0.3, 8e3, ["text_generation", "structured_output", "reasoning"]],
+  ["fact_checker", "research", "Verify claims without web search", "claude-sonnet-4", "agents/internet-fact-checker", 0.3, 4e3, ["text_generation", "reasoning"]],
+  ["fact_checker_web", "research", "Verify claims with web search", "sonar-pro", "agents/internet-fact-checker", 0.3, 4e3, ["web_search"]],
+  ["deep_research", "research", "Deep research with extended analysis", "claude-opus-4", void 0, 0.7, 8e3, ["text_generation", "reasoning", "long_context"]],
+  ["belief_classifier", "classification", "Classify beliefs by epistemic type", "claude-sonnet-4", "classification/belief-category", 0.2, 1e3, ["text_generation", "reasoning"]],
+  ["evidence_classifier", "classification", "Classify evidence methodology and quality", "claude-sonnet-4", "classification/evidence-rules", 0.3, 1e3, ["text_generation", "reasoning"]],
+  ["edge_classifier", "classification", "Classify edge reasoning method and temporal class", "claude-sonnet-4", "classification/epistemic-guidance", 0.3, 1e3, ["text_generation", "reasoning"]],
+  ["entity_extractor", "extraction", "Extract entities from text", "claude-sonnet-4", void 0, 0.2, 2e3, ["text_generation", "structured_output"]],
+  ["graph_intelligence_query", "graph_intelligence", "Analyze graph health, gaps, and structural risks", "claude-sonnet-4", "graph-intelligence/query", 0.5, 8e3, ["text_generation", "reasoning", "tool_use"]],
+  ["graph_intelligence_suggestions", "graph_intelligence", "Extract actionable graph suggestions", "claude-sonnet-4", "graph-intelligence/suggestions-extraction", 0.2, 4e3, ["text_generation", "structured_output"]],
+  ["text_to_cypher", "graph_intelligence", "Generate read-only Cypher from graph questions", "claude-sonnet-4", "graph-intelligence/text-to-cypher", 0.2, 2e3, ["text_generation", "code", "reasoning"]],
+  ["contradiction_verifier", "epistemic", "Verify semantic contradiction candidates", "claude-sonnet-4", "lucern/verify-contradiction", 0.2, 500, ["text_generation", "reasoning"]],
+  ["task_execution", "tasks", "Execute research tasks with structured analysis", "claude-sonnet-4", void 0, 0.3, 4e3, ["text_generation", "reasoning", "structured_output"]],
+  ["sprint_unified", "sprints", "Unified worktree chat across all phases", "claude-opus-4", "worktrees/unified-system-prompt", 0.7, 8e3, ["text_generation", "reasoning", "tool_use"]],
+  ["evidence_assessor", "sprints", "Assess evidence for belief valence and certainty", "claude-sonnet-4", "worktrees/scoring/evidence-assessor", 0.3, 4e3, ["text_generation", "reasoning", "structured_output"]],
+  ["title_generator", "utility", "Generate concise titles", "gpt-4o-mini", void 0, 0.7, 100, ["text_generation", "fast", "cheap"]],
+  ["help_desk_agent", "utility", "Help desk support agent for workflow guidance", "claude-sonnet-4", "agents/help-desk-agent", 0.4, 2e3, ["text_generation", "reasoning"]],
+  ["bug_detective_agent", "utility", "Bug triage assistant for structured diagnosis", "claude-sonnet-4", "agents/bug-detective-agent", 0.3, 2e3, ["text_generation", "reasoning"]]
+];
+function labelFor(value) {
+  return value.split(/[_-]/).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function seedContext(options) {
+  return {
+    now: options.now ?? DEFAULT_SEED_TIME,
+    templateTenantId: options.templateTenantId ?? TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID,
+    actor: options.actorPrincipalId ?? TENANT_BOOTSTRAP_TEMPLATE_ACTOR,
+    version: options.version ?? TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION
+  };
+}
+function toolCategory(contract) {
+  if (contract.surfaceIntent === "system") return "system";
+  if (contract.effects.includes("admin")) return "admin";
+  if (contract.effects.includes("write") || contract.kind !== "query") return "write";
+  return "read";
+}
+function requiredRole(category) {
+  if (category === "system") return "service_agent";
+  if (category === "admin") return "tenant_admin";
+  if (category === "write") return "editor";
+  return "viewer";
+}
+function requiredAction(category) {
+  if (category === "admin" || category === "system") return "admin";
+  if (category === "write") return "mutate";
+  return "read";
+}
+function enabledSurfaces(contract) {
+  return [
+    contract.surfaces.mcp !== "none" ? "mcp" : void 0,
+    contract.surfaces.sdk !== "none" ? "sdk" : void 0,
+    contract.surfaces.cli !== "none" ? "cli" : void 0,
+    contract.surfaces.rest !== "none" ? "api" : void 0
+  ].filter((value) => Boolean(value));
+}
+function buildToolRegistry(now, actor, version) {
+  const rows = /* @__PURE__ */ new Map();
+  for (const contract of ALL_FUNCTION_CONTRACTS) {
+    const surfaces = enabledSurfaces(contract);
+    if (surfaces.length === 0) continue;
+    const category = toolCategory(contract);
+    const readOnly = category === "read";
+    const toolName = contract.mcp.toolName || contract.name;
+    rows.set(toolName, {
+      toolName,
+      description: contract.openapi.summary,
+      version,
+      status: "active",
+      requiredRole: requiredRole(category),
+      requiredAction: requiredAction(category),
+      surfaces,
+      category,
+      parameterSchema: { contract: contract.name, sdk: contract.sdk },
+      handlerRef: contract.convex ? `${contract.convex.module}.${contract.convex.functionName}` : contract.name,
+      executionAdapter: contract.convex?.kind === "action" ? "convex_action" : contract.convex?.kind === "mutation" ? "convex_mutation" : "mcp_tool",
+      safetyMetadata: {
+        readOnly,
+        idempotent: readOnly || contract.idempotent === true || contract.idempotent === "required",
+        sideEffectLevel: readOnly ? "none" : category === "admin" ? "high" : "low"
+      },
+      isCore: true,
+      mcVersion: version,
+      registeredBy: actor,
+      registeredAt: now
+    });
+  }
+  return [...rows.values()].sort(
+    (a, b) => String(a.toolName).localeCompare(String(b.toolName))
+  );
+}
+function buildToolAcls(tools, now, actor) {
+  return tools.flatMap(
+    (tool) => (ROLE_GRANTS[tool.requiredRole] ?? [tool.requiredRole]).map(
+      (role) => ({ role, toolName: tool.toolName, createdBy: actor, createdAt: now })
+    )
+  );
+}
+function buildMcpWritePolicy(now, actor) {
+  return [
+    ...["viewer", "auditor"].map((role) => ({
+      role,
+      toolCategory: "write",
+      permission: "deny",
+      enabled: true,
+      rationale: "Read-only roles cannot mutate the reasoning graph.",
+      createdAt: now,
+      updatedAt: now,
+      createdBy: actor
+    })),
+    ...["editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"].map((role) => ({
+      role,
+      toolCategory: "write",
+      permission: "allow",
+      maxWritesPerSession: role === "editor" ? 200 : void 0,
+      enabled: true,
+      rationale: "Default global write policy for trusted graph mutation roles.",
+      createdAt: now,
+      updatedAt: now,
+      createdBy: actor
+    }))
+  ];
+}
+function buildTenantPolicies(tenantId, now, actor) {
+  const rows = [
+    ["viewer", "Read graph and runtime metadata.", [{ resource: "graph", actions: ["read"] }]],
+    ["auditor", "Read graph, audit, and policy decisions.", [{ resource: "audit", actions: ["read", "export"] }]],
+    ["editor", "Read and mutate tenant reasoning state.", [{ resource: "graph", actions: ["read", "create", "update", "mutate"] }]],
+    ["workspace_admin", "Manage workspace-scoped reasoning operations.", [{ resource: "workspace", actions: ["read", "update", "admin"] }]],
+    ["tenant_admin", "Manage tenant policy, tools, users, and publication.", [{ resource: "tenant", actions: ["read", "update", "admin"] }, { resource: "policy", actions: ["read", "create", "update", "admin"] }]],
+    ["service_agent", "Service principal execution role for automation.", [{ resource: "runtime", actions: ["read", "create", "update"] }, { resource: "graph", actions: ["read", "create", "update", "mutate"] }]]
+  ];
+  return rows.map(([roleName, description, permissions]) => ({
+    tenantId,
+    roleName,
+    description,
+    permissions,
+    groupBindings: [],
+    createdAt: now,
+    updatedAt: now,
+    createdBy: actor,
+    updatedBy: actor
+  }));
+}
+function modelRegistryRows(now) {
+  return MODEL_REGISTRY.map(([key, name, modelId, provider, contextWindow, maxOutputTokens, defaultTemperature, inputCostPer1M, outputCostPer1M]) => ({
+    key,
+    name,
+    modelId,
+    provider,
+    capabilities: ["text_generation", "reasoning"],
+    contextWindow,
+    maxOutputTokens,
+    defaultTemperature,
+    inputCostPer1M,
+    outputCostPer1M,
+    recommended: true,
+    enabled: true,
+    createdAt: now,
+    updatedAt: now
+  }));
+}
+function modelFunctionSlotRows(now) {
+  return MODEL_SLOTS.map(([slot, category, description, modelKey, promptName, temperature, maxTokens, requiredCapabilities]) => ({
+    slot,
+    category,
+    description,
+    modelKey,
+    promptName,
+    temperature,
+    maxTokens,
+    requiredCapabilities,
+    enabled: true,
+    isDefault: true,
+    notes: `Seeded by ${TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION}.`,
+    createdAt: now,
+    updatedAt: now
+  }));
+}
+function modelSlotConfigRows(now) {
+  return MODEL_SLOTS.map(([slot, , , modelKey, , temperature, maxTokens]) => ({
+    slot,
+    modelKey,
+    temperature,
+    maxTokens,
+    enabled: true,
+    notes: `Default routing for ${slot}.`,
+    createdAt: now,
+    updatedAt: now
+  }));
+}
+function schemaEnumRows(now) {
+  return Object.entries(ENUM_VALUES).flatMap(
+    ([category, values]) => values.map((value, index) => ({
+      category,
+      value,
+      label: labelFor(value),
+      description: `${labelFor(value)} ${category} value.`,
+      tier: "platform",
+      metadata: { seedVersion: TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION },
+      isDefault: index === 0,
+      sortOrder: index + 1,
+      status: "active",
+      createdAt: now,
+      updatedAt: now
+    }))
+  );
+}
+function buildTenantBootstrapTemplateSeedRows(options = {}) {
+  const ctx = seedContext(options);
+  const toolRegistry2 = buildToolRegistry(ctx.now, ctx.actor, ctx.version);
+  return {
+    kernel: {
+      backgroundJobSettings: [
+        { jobKey: "neo4j_sync", enabled: false, notes: "Disabled until graph-sync credentials are configured.", updatedAt: ctx.now, updatedBy: ctx.actor },
+        { jobKey: "calibration_rollups", enabled: true, notes: "Compute calibration rollups when calibration data exists.", updatedAt: ctx.now, updatedBy: ctx.actor }
+      ],
+      ontologyDefinitions: [
+        { ontologyKey: "lucern-core", name: "Lucern Core", description: "Core Lucern reasoning taxonomy.", tier: "platform", status: "active", createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now }
+      ],
+      ontologyVersions: [
+        {
+          ontologyId: "lucern-core",
+          ontologyKey: "lucern-core",
+          version: ctx.version,
+          status: "published",
+          entityTypes: ["belief", "question", "evidence", "answer", "decision", "task", "worktree", "topic", "source"].map((value) => ({ value, label: labelFor(value) })),
+          edgeTypes: ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to"].map((value) => ({ value, label: labelFor(value) })),
+          releaseNotes: "Initial platform ontology seed.",
+          publishedBy: ctx.actor,
+          publishedAt: ctx.now,
+          createdAt: ctx.now
+        }
+      ],
+      publicationRules: [
+        { tenantId: ctx.templateTenantId, name: "publish-high-confidence-beliefs", description: "Publish high-confidence beliefs to tenant-level consumers.", conditionType: "confidence_threshold", conditions: { minConfidence: 0.85 }, enabled: true, priority: 100, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now }
+      ],
+      schemaEnumConfig: schemaEnumRows(ctx.now)
+    },
+    identity: {
+      mcpWritePolicy: buildMcpWritePolicy(ctx.now, ctx.actor),
+      modelFunctionSlots: modelFunctionSlotRows(ctx.now),
+      modelRegistry: modelRegistryRows(ctx.now),
+      modelSlotConfigs: modelSlotConfigRows(ctx.now),
+      platformAudiences: [
+        ["internal", "Internal", "internal"],
+        ["lp", "Limited Partners", "restricted_external"],
+        ["public", "Public", "public"]
+      ].map(([audienceKey, audienceLabel, audienceClass]) => ({ tenantId: ctx.templateTenantId, audienceKey, audienceLabel, audienceClass, status: "active", metadata: { seedVersion: ctx.version }, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now })),
+      tenantConfig: [
+        { tenantId: ctx.templateTenantId, authPolicyMode: "open", defaultSessionTTL: 28800, defaultTopicVisibility: "tenant", featureFlags: { sdkBootstrapSeeds: true, interactiveRoleAuth: true }, maxWorkspaceCount: 25, defaultModelSlotOverrides: {}, updatedAt: ctx.now, updatedBy: ctx.actor }
+      ],
+      tenantIntegrations: [
+        { tenantId: ctx.templateTenantId, integrationKey: "web-search", displayName: "Web Search", description: "Tenant-configurable search integration placeholder.", category: "search", capabilities: ["search", "deep_research", "summarize"], config: { apiBaseUrl: "https://example.invalid/lucern/search", authType: "none", timeout: 3e4 }, endpoints: { search: { path: "/search", method: "POST", queryParamName: "query", resultPath: "results" } }, status: "disabled", usageCount: 0, createdAt: ctx.now, updatedAt: ctx.now, createdBy: ctx.actor }
+      ],
+      tenantPolicies: buildTenantPolicies(ctx.templateTenantId, ctx.now, ctx.actor),
+      toolAcls: buildToolAcls(toolRegistry2, ctx.now, ctx.actor),
+      toolRegistry: toolRegistry2
+    }
+  };
+}
+
 // src/v1/topics/v1.ts
 var ROOT_TOPIC_ID = "n17tm38rwet7wqgzrmwahyt1z582590y";
 function collectTopicNeighborhood(topics2, rootTopicId, maxDescendantDepth = 2) {
@@ -11593,6 +13563,6 @@ var CANONICAL_WORKFLOW_DEFINITIONS = [
   }
 ];
 
-export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GraphRefSchema, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, bigramTokenize, buildDomainEvent, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, findEdgePolicy, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, isAfterCursor, isLucernPrompt, jaccardSimilarity, lastDelegator, listBeliefsProjection, listTasksProjection, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tokenOverlapScore, tokenizeSearchText, wordOverlapScore, wordTokenize };
+export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GraphRefSchema, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION, TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, assertTenantClientImportAllowed, bigramTokenize, buildDomainEvent, buildTenantBootstrapTemplateSeedRows, classifyTenantClientImport, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, findEdgePolicy, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, findTenantClientInstallablePackage, formatTenantClientImportViolation, getComponentBoundaryTableLayer, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, isAfterCursor, isComponentBoundaryComponentOwnedTable, isLucernPrompt, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport, jaccardSimilarity, lastDelegator, listBeliefsProjection, listTasksProjection, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tokenOverlapScore, tokenizeSearchText, wordOverlapScore, wordTokenize };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map