@lucern/contracts 0.3.0-alpha.2 → 0.3.0-alpha.4

package/dist/tenant-bootstrap-seed.contract.d.ts

@@ -0,0 +1,1097 @@
+/**
+ * Tenant bootstrap seed contract.
+ *
+ * Fresh tenant deployments install the Lucern kernel and identity components
+ * from npm, then copy canonical template rows for non-secret runtime defaults.
+ * This contract is intentionally exhaustive for the K/I tables: it separates
+ * rows that must be carried by the template deployments from rows that are
+ * runtime data, runtime credentials, logs, queues, or derived caches.
+ */
+declare const TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION: "2026-04-30";
+declare const TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS: readonly ["tenantId", "workspaceId", "principalId", "role", "authMode", "correlationId", "auditMetadata"];
+type TenantBootstrapSeedAuthMetadataField = (typeof TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS)[number];
+declare const TENANT_BOOTSTRAP_SEED_COMPONENTS: {
+    readonly kernel: {
+        readonly componentName: "lucern";
+        readonly templateService: "services/kernel-template";
+        readonly templateDeployments: {
+            readonly staging: "charming-okapi-787";
+            readonly prod: "brilliant-narwhal-889";
+        };
+    };
+    readonly identity: {
+        readonly componentName: "identity";
+        readonly templateService: "services/identity-template";
+        readonly templateDeployments: {
+            readonly staging: "charming-goldfinch-895";
+            readonly prod: "helpful-mule-694";
+        };
+    };
+};
+type TenantBootstrapSeedComponent = keyof typeof TENANT_BOOTSTRAP_SEED_COMPONENTS;
+type TenantBootstrapSeedScope = "global" | "tenant";
+type TenantBootstrapPrepopulation = "required_template" | "optional_template" | "runtime_bootstrap" | "runtime_data" | "runtime_log" | "runtime_secret" | "runtime_derived" | "runtime_queue";
+type TenantBootstrapCopyMode = "template_global" | "template_tenant_rewrite" | "template_reference_remap" | "none";
+type TenantBootstrapTableRequirement = {
+    component: TenantBootstrapSeedComponent;
+    table: string;
+    prepopulation: TenantBootstrapPrepopulation;
+    copyMode: TenantBootstrapCopyMode;
+    scope?: TenantBootstrapSeedScope;
+    uniqueKey?: readonly string[];
+    dependsOn?: readonly string[];
+    description: string;
+};
+type TenantBootstrapSeedTable = TenantBootstrapTableRequirement & {
+    copyMode: "template_global" | "template_tenant_rewrite" | "template_reference_remap";
+    scope: TenantBootstrapSeedScope;
+    uniqueKey: readonly string[];
+};
+declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
+    readonly component: "kernel";
+    readonly table: "agentMessages";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Agent coordination messages are session data, not template data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "agentSessions";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Agent coordination sessions are created by active clients.";
+}, {
+    readonly component: "kernel";
+    readonly table: "autofixJobs";
+    readonly prepopulation: "runtime_queue";
+    readonly copyMode: "none";
+    readonly description: "Autofix work items are runtime queue rows.";
+}, {
+    readonly component: "kernel";
+    readonly table: "backgroundJobRuns";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Background job executions are runtime logs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "backgroundJobSettings";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["jobKey"];
+    readonly description: "Default job enablement settings must come from the K template.";
+}, {
+    readonly component: "kernel";
+    readonly table: "beliefConfidence";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Belief confidence rows are created with tenant graph facts.";
+}, {
+    readonly component: "kernel";
+    readonly table: "beliefEvidenceLinks";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Belief-to-evidence links are tenant graph data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "beliefHistory";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Belief history is append-only tenant graph data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "beliefScenarios";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Scenario rows are tenant-authored reasoning data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "beliefVotes";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Decision belief votes are tenant-authored data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "calibrationScores";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Calibration scores are computed from tenant outcomes.";
+}, {
+    readonly component: "kernel";
+    readonly table: "contractEvaluations";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Contract evaluation rows are runtime computation logs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "contradictions";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Contradictions are tenant graph facts.";
+}, {
+    readonly component: "kernel";
+    readonly table: "crossProjectConnections";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Cross-topic connections are tenant graph facts.";
+}, {
+    readonly component: "kernel";
+    readonly table: "decisionComputedSummaries";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Decision summaries are derived tenant outputs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "decisionEvents";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Decision events are lifecycle data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "decisionParticipants";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Decision participants are tenant-selected actors.";
+}, {
+    readonly component: "kernel";
+    readonly table: "decisionRiskLedger";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Decision risk rows are tenant decision data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "decisionSnapshots";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Decision snapshots are derived from tenant state.";
+}, {
+    readonly component: "kernel";
+    readonly table: "deliberationContributions";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Deliberation contributions are tenant-authored data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "deliberationSessions";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Deliberation sessions are created by tenant workflows.";
+}, {
+    readonly component: "kernel";
+    readonly table: "epistemicAudit";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Epistemic audit rows are append-only runtime audit data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "epistemicContracts";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Epistemic contracts are tenant-authored governance data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "epistemicEdges";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Edges are tenant reasoning graph data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "epistemicNodeEmbeddings";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Embeddings are derived from tenant graph nodes.";
+}, {
+    readonly component: "kernel";
+    readonly table: "epistemicNodes";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Nodes are tenant reasoning graph data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "graphAnalysisCache";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Graph analysis cache rows are derived from tenant graph state.";
+}, {
+    readonly component: "kernel";
+    readonly table: "graphAnalysisResults";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Graph analysis result rows are derived tenant outputs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "graphSuggestions";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Graph suggestions are derived recommendations.";
+}, {
+    readonly component: "kernel";
+    readonly table: "harnessReplays";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Harness replay rows are runtime verification logs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "harnessRuns";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Harness run rows are runtime verification logs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "idempotencyTokens";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Idempotency tokens are request-scoped runtime guards.";
+}, {
+    readonly component: "kernel";
+    readonly table: "lenses";
+    readonly prepopulation: "optional_template";
+    readonly copyMode: "none";
+    readonly description: "Reusable lens templates may live in K templates, but workspace-specific copies are not required for core SDK boot.";
+}, {
+    readonly component: "kernel";
+    readonly table: "lensTopicBindings";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Lens bindings attach runtime topics to runtime/workspace lenses.";
+}, {
+    readonly component: "kernel";
+    readonly table: "neo4jSyncQueue";
+    readonly prepopulation: "runtime_queue";
+    readonly copyMode: "none";
+    readonly description: "Neo4j sync queue rows are runtime work items.";
+}, {
+    readonly component: "kernel";
+    readonly table: "ontologyDefinitions";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["ontologyKey"];
+    readonly description: "Platform ontology definitions power taxonomy reads and effective ontology resolution.";
+}, {
+    readonly component: "kernel";
+    readonly table: "ontologyVersions";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_reference_remap";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["ontologyKey", "version"];
+    readonly dependsOn: readonly ["ontologyDefinitions"];
+    readonly description: "Ontology versions must be copied with ontologyDefinition ID remapping.";
+}, {
+    readonly component: "kernel";
+    readonly table: "platformAgentRunPolicyDecisions";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Agent-run policy decisions are audit logs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "platformAgentRunPromptResolutions";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Agent-run prompt resolution rows are runtime logs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "platformAgentRuns";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Agent runs are runtime execution records.";
+}, {
+    readonly component: "kernel";
+    readonly table: "platformAgentRunToolCalls";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Agent-run tool calls are runtime execution records.";
+}, {
+    readonly component: "kernel";
+    readonly table: "platformHarnessShadowAudit";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Harness shadow audit rows are runtime audit records.";
+}, {
+    readonly component: "kernel";
+    readonly table: "publicationRules";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_tenant_rewrite";
+    readonly scope: "tenant";
+    readonly uniqueKey: readonly ["tenantId", "workspaceId", "name"];
+    readonly description: "Default publication policy rules are rewritten into each tenant.";
+}, {
+    readonly component: "kernel";
+    readonly table: "questionEvidenceLinks";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Question-to-evidence links are tenant graph data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "researchJobs";
+    readonly prepopulation: "runtime_queue";
+    readonly copyMode: "none";
+    readonly description: "Research job rows are runtime queue items.";
+}, {
+    readonly component: "kernel";
+    readonly table: "schemaEnumConfig";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["category", "value"];
+    readonly description: "Runtime-extensible enum defaults required by SDK graph APIs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "stakeholderGroups";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Stakeholder groups are tenant decision data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "systemLogs";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "System logs are runtime telemetry.";
+}, {
+    readonly component: "kernel";
+    readonly table: "tasks";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Tasks are tenant-authored work items.";
+}, {
+    readonly component: "kernel";
+    readonly table: "topics";
+    readonly prepopulation: "runtime_bootstrap";
+    readonly copyMode: "none";
+    readonly description: "Default topics are created by tenant provisioning, not copied from templates.";
+}, {
+    readonly component: "kernel";
+    readonly table: "workflowDefinitions";
+    readonly prepopulation: "optional_template";
+    readonly copyMode: "none";
+    readonly description: "Table-driven workflow definitions can be template data after the workflow engine leaves legacy mode.";
+}, {
+    readonly component: "kernel";
+    readonly table: "workflowPullRequests";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Workflow pull requests are tenant workflow data.";
+}, {
+    readonly component: "kernel";
+    readonly table: "workflowStages";
+    readonly prepopulation: "optional_template";
+    readonly copyMode: "none";
+    readonly dependsOn: readonly ["workflowDefinitions"];
+    readonly description: "Workflow stages can be template data after workflowDefinitions are enabled for bootstrap copying.";
+}, {
+    readonly component: "kernel";
+    readonly table: "worktreeBeliefCluster";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Worktree cluster rows link runtime worktrees to runtime beliefs.";
+}, {
+    readonly component: "kernel";
+    readonly table: "worktrees";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Worktrees are tenant/runtime planning data.";
+}, {
+    readonly component: "identity";
+    readonly table: "agents";
+    readonly prepopulation: "runtime_bootstrap";
+    readonly copyMode: "none";
+    readonly description: "Service agents are provisioned per tenant or service, not copied.";
+}, {
+    readonly component: "identity";
+    readonly table: "mcpWritePolicy";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["topicId", "role", "toolCategory"];
+    readonly description: "Global write policy defaults govern service and interactive MCP writes.";
+}, {
+    readonly component: "identity";
+    readonly table: "modelCallLogs";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Model call logs are runtime telemetry.";
+}, {
+    readonly component: "identity";
+    readonly table: "modelFunctionSlots";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["slot"];
+    readonly description: "Function-to-model slots are required by model runtime resolution.";
+}, {
+    readonly component: "identity";
+    readonly table: "modelRegistry";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["key"];
+    readonly description: "Model catalog defaults are required by model runtime clients.";
+}, {
+    readonly component: "identity";
+    readonly table: "modelSlotConfigs";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["slot"];
+    readonly description: "Slot-level defaults are required before tenant overrides exist.";
+}, {
+    readonly component: "identity";
+    readonly table: "platformAudienceGrants";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Audience grants are principal/group-specific access rows.";
+}, {
+    readonly component: "identity";
+    readonly table: "platformAudiences";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_tenant_rewrite";
+    readonly scope: "tenant";
+    readonly uniqueKey: readonly ["tenantId", "workspaceId", "audienceKey"];
+    readonly description: "Default tenant audience taxonomy rows are rewritten into each tenant.";
+}, {
+    readonly component: "identity";
+    readonly table: "platformPolicyDecisionLogs";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Policy decisions are runtime audit logs.";
+}, {
+    readonly component: "identity";
+    readonly table: "projectGrants";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Project/topic grants are principal or group-specific access rows.";
+}, {
+    readonly component: "identity";
+    readonly table: "reasoningPermissions";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Reasoning permissions are principal-specific policy rows.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantApiKeys";
+    readonly prepopulation: "runtime_secret";
+    readonly copyMode: "none";
+    readonly description: "API keys are tenant credentials and must never be copied.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantConfig";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_tenant_rewrite";
+    readonly scope: "tenant";
+    readonly uniqueKey: readonly ["tenantId"];
+    readonly description: "Tenant-local config defaults are rewritten during bootstrap.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantIntegrations";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_tenant_rewrite";
+    readonly scope: "tenant";
+    readonly uniqueKey: readonly ["tenantId", "integrationKey"];
+    readonly description: "Non-secret integration descriptors are rewritten into each tenant.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantModelSlotBindings";
+    readonly prepopulation: "runtime_secret";
+    readonly copyMode: "none";
+    readonly description: "Tenant model slot bindings reference provider secrets and are runtime-only.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantPolicies";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_tenant_rewrite";
+    readonly scope: "tenant";
+    readonly uniqueKey: readonly ["tenantId", "workspaceId", "roleName"];
+    readonly description: "Default tenant policy roles are rewritten during bootstrap.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantProviderSecrets";
+    readonly prepopulation: "runtime_secret";
+    readonly copyMode: "none";
+    readonly description: "Provider secrets are credentials and must never be copied.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantProxyGatewayUsage";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Proxy gateway usage rows are runtime telemetry.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantProxyTokenMints";
+    readonly prepopulation: "runtime_secret";
+    readonly copyMode: "none";
+    readonly description: "Proxy token mints are ephemeral secret-bearing runtime rows.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantSandboxAuditEvents";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Sandbox audit rows are runtime security logs.";
+}, {
+    readonly component: "identity";
+    readonly table: "tenantSecrets";
+    readonly prepopulation: "runtime_secret";
+    readonly copyMode: "none";
+    readonly description: "Tenant secrets are credentials and must never be copied.";
+}, {
+    readonly component: "identity";
+    readonly table: "toolAcls";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["role", "toolName"];
+    readonly description: "Default role-to-tool grants are required for SDK/MCP tool access.";
+}, {
+    readonly component: "identity";
+    readonly table: "toolRegistry";
+    readonly prepopulation: "required_template";
+    readonly copyMode: "template_global";
+    readonly scope: "global";
+    readonly uniqueKey: readonly ["toolName"];
+    readonly description: "Core tool catalog rows are required before pack or tenant tools exist.";
+}, {
+    readonly component: "identity";
+    readonly table: "users";
+    readonly prepopulation: "runtime_bootstrap";
+    readonly copyMode: "none";
+    readonly description: "Users are created from Clerk/MC principal resolution, not copied.";
+}];
+declare const TENANT_BOOTSTRAP_SEED_TABLES: readonly TenantBootstrapSeedTable[];
+type TenantBootstrapSeedTableName = (typeof TENANT_BOOTSTRAP_SEED_TABLES)[number]["table"];
+declare const TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES: readonly string[];
+type TenantBootstrapForbiddenSeedTable = (typeof TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES)[number];
+declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
+    readonly contractVersion: "2026-04-30";
+    readonly authMetadataFields: readonly ["tenantId", "workspaceId", "principalId", "role", "authMode", "correlationId", "auditMetadata"];
+    readonly components: {
+        readonly kernel: {
+            readonly componentName: "lucern";
+            readonly templateService: "services/kernel-template";
+            readonly templateDeployments: {
+                readonly staging: "charming-okapi-787";
+                readonly prod: "brilliant-narwhal-889";
+            };
+        };
+        readonly identity: {
+            readonly componentName: "identity";
+            readonly templateService: "services/identity-template";
+            readonly templateDeployments: {
+                readonly staging: "charming-goldfinch-895";
+                readonly prod: "helpful-mule-694";
+            };
+        };
+    };
+    readonly tableRequirements: readonly [{
+        readonly component: "kernel";
+        readonly table: "agentMessages";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Agent coordination messages are session data, not template data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "agentSessions";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Agent coordination sessions are created by active clients.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "autofixJobs";
+        readonly prepopulation: "runtime_queue";
+        readonly copyMode: "none";
+        readonly description: "Autofix work items are runtime queue rows.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "backgroundJobRuns";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Background job executions are runtime logs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "backgroundJobSettings";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["jobKey"];
+        readonly description: "Default job enablement settings must come from the K template.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "beliefConfidence";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Belief confidence rows are created with tenant graph facts.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "beliefEvidenceLinks";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Belief-to-evidence links are tenant graph data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "beliefHistory";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Belief history is append-only tenant graph data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "beliefScenarios";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Scenario rows are tenant-authored reasoning data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "beliefVotes";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Decision belief votes are tenant-authored data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "calibrationScores";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Calibration scores are computed from tenant outcomes.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "contractEvaluations";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Contract evaluation rows are runtime computation logs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "contradictions";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Contradictions are tenant graph facts.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "crossProjectConnections";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Cross-topic connections are tenant graph facts.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "decisionComputedSummaries";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Decision summaries are derived tenant outputs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "decisionEvents";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Decision events are lifecycle data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "decisionParticipants";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Decision participants are tenant-selected actors.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "decisionRiskLedger";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Decision risk rows are tenant decision data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "decisionSnapshots";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Decision snapshots are derived from tenant state.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "deliberationContributions";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Deliberation contributions are tenant-authored data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "deliberationSessions";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Deliberation sessions are created by tenant workflows.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "epistemicAudit";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Epistemic audit rows are append-only runtime audit data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "epistemicContracts";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Epistemic contracts are tenant-authored governance data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "epistemicEdges";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Edges are tenant reasoning graph data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "epistemicNodeEmbeddings";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Embeddings are derived from tenant graph nodes.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "epistemicNodes";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Nodes are tenant reasoning graph data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "graphAnalysisCache";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Graph analysis cache rows are derived from tenant graph state.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "graphAnalysisResults";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Graph analysis result rows are derived tenant outputs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "graphSuggestions";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Graph suggestions are derived recommendations.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "harnessReplays";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Harness replay rows are runtime verification logs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "harnessRuns";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Harness run rows are runtime verification logs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "idempotencyTokens";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Idempotency tokens are request-scoped runtime guards.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "lenses";
+        readonly prepopulation: "optional_template";
+        readonly copyMode: "none";
+        readonly description: "Reusable lens templates may live in K templates, but workspace-specific copies are not required for core SDK boot.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "lensTopicBindings";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Lens bindings attach runtime topics to runtime/workspace lenses.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "neo4jSyncQueue";
+        readonly prepopulation: "runtime_queue";
+        readonly copyMode: "none";
+        readonly description: "Neo4j sync queue rows are runtime work items.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "ontologyDefinitions";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["ontologyKey"];
+        readonly description: "Platform ontology definitions power taxonomy reads and effective ontology resolution.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "ontologyVersions";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_reference_remap";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["ontologyKey", "version"];
+        readonly dependsOn: readonly ["ontologyDefinitions"];
+        readonly description: "Ontology versions must be copied with ontologyDefinition ID remapping.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "platformAgentRunPolicyDecisions";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Agent-run policy decisions are audit logs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "platformAgentRunPromptResolutions";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Agent-run prompt resolution rows are runtime logs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "platformAgentRuns";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Agent runs are runtime execution records.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "platformAgentRunToolCalls";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Agent-run tool calls are runtime execution records.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "platformHarnessShadowAudit";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Harness shadow audit rows are runtime audit records.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "publicationRules";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_tenant_rewrite";
+        readonly scope: "tenant";
+        readonly uniqueKey: readonly ["tenantId", "workspaceId", "name"];
+        readonly description: "Default publication policy rules are rewritten into each tenant.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "questionEvidenceLinks";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Question-to-evidence links are tenant graph data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "researchJobs";
+        readonly prepopulation: "runtime_queue";
+        readonly copyMode: "none";
+        readonly description: "Research job rows are runtime queue items.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "schemaEnumConfig";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["category", "value"];
+        readonly description: "Runtime-extensible enum defaults required by SDK graph APIs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "stakeholderGroups";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Stakeholder groups are tenant decision data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "systemLogs";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "System logs are runtime telemetry.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "tasks";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Tasks are tenant-authored work items.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "topics";
+        readonly prepopulation: "runtime_bootstrap";
+        readonly copyMode: "none";
+        readonly description: "Default topics are created by tenant provisioning, not copied from templates.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "workflowDefinitions";
+        readonly prepopulation: "optional_template";
+        readonly copyMode: "none";
+        readonly description: "Table-driven workflow definitions can be template data after the workflow engine leaves legacy mode.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "workflowPullRequests";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Workflow pull requests are tenant workflow data.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "workflowStages";
+        readonly prepopulation: "optional_template";
+        readonly copyMode: "none";
+        readonly dependsOn: readonly ["workflowDefinitions"];
+        readonly description: "Workflow stages can be template data after workflowDefinitions are enabled for bootstrap copying.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "worktreeBeliefCluster";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Worktree cluster rows link runtime worktrees to runtime beliefs.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "worktrees";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Worktrees are tenant/runtime planning data.";
+    }, {
+        readonly component: "identity";
+        readonly table: "agents";
+        readonly prepopulation: "runtime_bootstrap";
+        readonly copyMode: "none";
+        readonly description: "Service agents are provisioned per tenant or service, not copied.";
+    }, {
+        readonly component: "identity";
+        readonly table: "mcpWritePolicy";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["topicId", "role", "toolCategory"];
+        readonly description: "Global write policy defaults govern service and interactive MCP writes.";
+    }, {
+        readonly component: "identity";
+        readonly table: "modelCallLogs";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Model call logs are runtime telemetry.";
+    }, {
+        readonly component: "identity";
+        readonly table: "modelFunctionSlots";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["slot"];
+        readonly description: "Function-to-model slots are required by model runtime resolution.";
+    }, {
+        readonly component: "identity";
+        readonly table: "modelRegistry";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["key"];
+        readonly description: "Model catalog defaults are required by model runtime clients.";
+    }, {
+        readonly component: "identity";
+        readonly table: "modelSlotConfigs";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["slot"];
+        readonly description: "Slot-level defaults are required before tenant overrides exist.";
+    }, {
+        readonly component: "identity";
+        readonly table: "platformAudienceGrants";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Audience grants are principal/group-specific access rows.";
+    }, {
+        readonly component: "identity";
+        readonly table: "platformAudiences";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_tenant_rewrite";
+        readonly scope: "tenant";
+        readonly uniqueKey: readonly ["tenantId", "workspaceId", "audienceKey"];
+        readonly description: "Default tenant audience taxonomy rows are rewritten into each tenant.";
+    }, {
+        readonly component: "identity";
+        readonly table: "platformPolicyDecisionLogs";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Policy decisions are runtime audit logs.";
+    }, {
+        readonly component: "identity";
+        readonly table: "projectGrants";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Project/topic grants are principal or group-specific access rows.";
+    }, {
+        readonly component: "identity";
+        readonly table: "reasoningPermissions";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Reasoning permissions are principal-specific policy rows.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantApiKeys";
+        readonly prepopulation: "runtime_secret";
+        readonly copyMode: "none";
+        readonly description: "API keys are tenant credentials and must never be copied.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantConfig";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_tenant_rewrite";
+        readonly scope: "tenant";
+        readonly uniqueKey: readonly ["tenantId"];
+        readonly description: "Tenant-local config defaults are rewritten during bootstrap.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantIntegrations";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_tenant_rewrite";
+        readonly scope: "tenant";
+        readonly uniqueKey: readonly ["tenantId", "integrationKey"];
+        readonly description: "Non-secret integration descriptors are rewritten into each tenant.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantModelSlotBindings";
+        readonly prepopulation: "runtime_secret";
+        readonly copyMode: "none";
+        readonly description: "Tenant model slot bindings reference provider secrets and are runtime-only.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantPolicies";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_tenant_rewrite";
+        readonly scope: "tenant";
+        readonly uniqueKey: readonly ["tenantId", "workspaceId", "roleName"];
+        readonly description: "Default tenant policy roles are rewritten during bootstrap.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantProviderSecrets";
+        readonly prepopulation: "runtime_secret";
+        readonly copyMode: "none";
+        readonly description: "Provider secrets are credentials and must never be copied.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantProxyGatewayUsage";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Proxy gateway usage rows are runtime telemetry.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantProxyTokenMints";
+        readonly prepopulation: "runtime_secret";
+        readonly copyMode: "none";
+        readonly description: "Proxy token mints are ephemeral secret-bearing runtime rows.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantSandboxAuditEvents";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Sandbox audit rows are runtime security logs.";
+    }, {
+        readonly component: "identity";
+        readonly table: "tenantSecrets";
+        readonly prepopulation: "runtime_secret";
+        readonly copyMode: "none";
+        readonly description: "Tenant secrets are credentials and must never be copied.";
+    }, {
+        readonly component: "identity";
+        readonly table: "toolAcls";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["role", "toolName"];
+        readonly description: "Default role-to-tool grants are required for SDK/MCP tool access.";
+    }, {
+        readonly component: "identity";
+        readonly table: "toolRegistry";
+        readonly prepopulation: "required_template";
+        readonly copyMode: "template_global";
+        readonly scope: "global";
+        readonly uniqueKey: readonly ["toolName"];
+        readonly description: "Core tool catalog rows are required before pack or tenant tools exist.";
+    }, {
+        readonly component: "identity";
+        readonly table: "users";
+        readonly prepopulation: "runtime_bootstrap";
+        readonly copyMode: "none";
+        readonly description: "Users are created from Clerk/MC principal resolution, not copied.";
+    }];
+    readonly tables: readonly TenantBootstrapSeedTable[];
+    readonly forbiddenTables: readonly string[];
+};
+declare function findTenantBootstrapTableRequirement(table: string): TenantBootstrapTableRequirement | undefined;
+declare function findTenantBootstrapSeedTable(table: string): TenantBootstrapSeedTable | undefined;
+declare function isTenantBootstrapSeedTable(table: string): boolean;
+declare function isTenantBootstrapForbiddenSeedTable(table: string): boolean;
+
+export { TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, type TenantBootstrapCopyMode, type TenantBootstrapForbiddenSeedTable, type TenantBootstrapPrepopulation, type TenantBootstrapSeedAuthMetadataField, type TenantBootstrapSeedComponent, type TenantBootstrapSeedScope, type TenantBootstrapSeedTable, type TenantBootstrapSeedTableName, type TenantBootstrapTableRequirement, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable };