@lucern/contracts 0.3.0-alpha.9 → 1.0.0

package/dist/tenant-bootstrap-seed.contract.d.ts

@@ -1,9 +1,9 @@
 /**
  * Tenant bootstrap seed contract.
  *
- * Fresh tenant deployments install the Lucern kernel and identity components
+ * Fresh tenant deployments install the Lucern kernel and control-plane components
  * from npm, then copy canonical template rows for non-secret runtime defaults.
- * This contract is intentionally exhaustive for the K/I tables: it separates
+ * This contract is intentionally exhaustive for the K/CP tables: it separates
  * rows that must be carried by the template deployments from rows that are
  * runtime data, runtime credentials, logs, queues, or derived caches.
  */
@@ -14,16 +14,20 @@ declare const TENANT_BOOTSTRAP_SEED_COMPONENTS: {
     readonly kernel: {
         readonly componentName: "lucern";
         readonly migrationModule: "adapters/migration";
+        readonly templateMigrationModule: "dist/adapters/migration";
+        readonly tenantMigrationModule: "adapters/migration";
         readonly templateService: "services/kernel-template";
         readonly templateDeployments: {
             readonly staging: "kindly-goldfish-162";
             readonly prod: "cool-badger-368";
         };
     };
-    readonly identity: {
-        readonly componentName: "identity";
+    readonly "control-plane": {
+        readonly componentName: "controlPlane";
         readonly migrationModule: "migration";
-        readonly templateService: "services/identity-template";
+        readonly templateMigrationModule: "dist/migration";
+        readonly tenantMigrationModule: "migration";
+        readonly templateService: "services/control-plane-template";
         readonly templateDeployments: {
             readonly staging: "industrious-cheetah-864";
             readonly prod: "combative-beagle-879";
@@ -177,6 +181,12 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly prepopulation: "runtime_data";
     readonly copyMode: "none";
     readonly description: "Deliberation sessions are created by tenant workflows.";
+}, {
+    readonly component: "kernel";
+    readonly table: "domainEvents";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Domain event rows are append-only runtime audit/exhaust data.";
 }, {
     readonly component: "kernel";
     readonly table: "epistemicAudit";
@@ -392,13 +402,13 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly copyMode: "none";
     readonly description: "Worktrees are tenant/runtime planning data.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "agents";
     readonly prepopulation: "runtime_bootstrap";
     readonly copyMode: "none";
     readonly description: "Service agents are provisioned per tenant or service, not copied.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "mcpWritePolicy";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_global";
@@ -406,13 +416,13 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["topicId", "role", "toolCategory"];
     readonly description: "Global write policy defaults govern service and interactive MCP writes.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "modelCallLogs";
     readonly prepopulation: "runtime_log";
     readonly copyMode: "none";
     readonly description: "Model call logs are runtime telemetry.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "modelFunctionSlots";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_global";
@@ -420,7 +430,7 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["slot"];
     readonly description: "Function-to-model slots are required by model runtime resolution.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "modelRegistry";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_global";
@@ -428,7 +438,7 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["key"];
     readonly description: "Model catalog defaults are required by model runtime clients.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "modelSlotConfigs";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_global";
@@ -436,13 +446,91 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["slot"];
     readonly description: "Slot-level defaults are required before tenant overrides exist.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
+    readonly table: "permitAccessReviewItems";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit access-review item rows are tenant review data projected from Permit.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitAccessReviews";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit access-review campaigns are tenant review data projected from Permit.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitAttributeBindings";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit ABAC attribute bindings are tenant policy projection rows.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitGroups";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit groups are tenant-defined policy subjects, not template data.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitGroupMemberships";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit group memberships are tenant-specific policy projection rows.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitPolicyBundles";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Permit policy bundles are derived from the Permit control plane.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitPolicyDecisionReceipts";
+    readonly prepopulation: "runtime_log";
+    readonly copyMode: "none";
+    readonly description: "Permit decision receipts are runtime authorization audit logs.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitPrincipalAliases";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit principal aliases are tenant-specific identity projection rows.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitPrincipals";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit principals are projected from Clerk, Permit, and tenant onboarding flows.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitProjectionOutbox";
+    readonly prepopulation: "runtime_queue";
+    readonly copyMode: "none";
+    readonly description: "Permit projection outbox rows are runtime sync queue data.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitRelationshipTuples";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit ReBAC relationship tuples are tenant policy projection rows.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitResourceInstances";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit resource instances are tenant/workspace graph and deployment projection rows.";
+}, {
+    readonly component: "control-plane";
+    readonly table: "permitRoleAssignments";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Permit role assignments are tenant-specific policy projection rows.";
+}, {
+    readonly component: "control-plane";
     readonly table: "platformAudienceGrants";
     readonly prepopulation: "runtime_data";
     readonly copyMode: "none";
     readonly description: "Audience grants are principal/group-specific access rows.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "platformAudiences";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_tenant_rewrite";
@@ -450,31 +538,31 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["tenantId", "workspaceId", "audienceKey"];
     readonly description: "Default tenant audience taxonomy rows are rewritten into each tenant.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "platformPolicyDecisionLogs";
     readonly prepopulation: "runtime_log";
     readonly copyMode: "none";
     readonly description: "Policy decisions are runtime audit logs.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "projectGrants";
     readonly prepopulation: "runtime_data";
     readonly copyMode: "none";
     readonly description: "Project/topic grants are principal or group-specific access rows.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "reasoningPermissions";
     readonly prepopulation: "runtime_data";
     readonly copyMode: "none";
     readonly description: "Reasoning permissions are principal-specific policy rows.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantApiKeys";
     readonly prepopulation: "runtime_secret";
     readonly copyMode: "none";
     readonly description: "API keys are tenant credentials and must never be copied.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantConfig";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_tenant_rewrite";
@@ -482,7 +570,7 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["tenantId"];
     readonly description: "Tenant-local config defaults are rewritten during bootstrap.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantIntegrations";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_tenant_rewrite";
@@ -490,13 +578,19 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["tenantId", "integrationKey"];
     readonly description: "Non-secret integration descriptors are rewritten into each tenant.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantModelSlotBindings";
     readonly prepopulation: "runtime_secret";
     readonly copyMode: "none";
     readonly description: "Tenant model slot bindings reference provider secrets and are runtime-only.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
+    readonly table: "tenantPermitSyncStates";
+    readonly prepopulation: "runtime_derived";
+    readonly copyMode: "none";
+    readonly description: "Tenant Permit sync state rows are runtime reconciliation state.";
+}, {
+    readonly component: "control-plane";
     readonly table: "tenantPolicies";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_tenant_rewrite";
@@ -504,37 +598,37 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["tenantId", "workspaceId", "roleName"];
     readonly description: "Default tenant policy roles are rewritten during bootstrap.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantProviderSecrets";
     readonly prepopulation: "runtime_secret";
     readonly copyMode: "none";
     readonly description: "Provider secrets are credentials and must never be copied.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantProxyGatewayUsage";
     readonly prepopulation: "runtime_log";
     readonly copyMode: "none";
     readonly description: "Proxy gateway usage rows are runtime telemetry.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantProxyTokenMints";
     readonly prepopulation: "runtime_secret";
     readonly copyMode: "none";
     readonly description: "Proxy token mints are ephemeral secret-bearing runtime rows.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantSandboxAuditEvents";
     readonly prepopulation: "runtime_log";
     readonly copyMode: "none";
     readonly description: "Sandbox audit rows are runtime security logs.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "tenantSecrets";
     readonly prepopulation: "runtime_secret";
     readonly copyMode: "none";
     readonly description: "Tenant secrets are credentials and must never be copied.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "toolAcls";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_global";
@@ -542,7 +636,7 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["role", "toolName"];
     readonly description: "Default role-to-tool grants are required for SDK/MCP tool access.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "toolRegistry";
     readonly prepopulation: "required_template";
     readonly copyMode: "template_global";
@@ -550,7 +644,7 @@ declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly uniqueKey: readonly ["toolName"];
     readonly description: "Core tool catalog rows are required before pack or tenant tools exist.";
 }, {
-    readonly component: "identity";
+    readonly component: "control-plane";
     readonly table: "users";
     readonly prepopulation: "runtime_bootstrap";
     readonly copyMode: "none";
@@ -567,16 +661,20 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly kernel: {
             readonly componentName: "lucern";
             readonly migrationModule: "adapters/migration";
+            readonly templateMigrationModule: "dist/adapters/migration";
+            readonly tenantMigrationModule: "adapters/migration";
             readonly templateService: "services/kernel-template";
             readonly templateDeployments: {
                 readonly staging: "kindly-goldfish-162";
                 readonly prod: "cool-badger-368";
             };
         };
-        readonly identity: {
-            readonly componentName: "identity";
+        readonly "control-plane": {
+            readonly componentName: "controlPlane";
             readonly migrationModule: "migration";
-            readonly templateService: "services/identity-template";
+            readonly templateMigrationModule: "dist/migration";
+            readonly tenantMigrationModule: "migration";
+            readonly templateService: "services/control-plane-template";
             readonly templateDeployments: {
                 readonly staging: "industrious-cheetah-864";
                 readonly prod: "combative-beagle-879";
@@ -711,6 +809,12 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly prepopulation: "runtime_data";
         readonly copyMode: "none";
         readonly description: "Deliberation sessions are created by tenant workflows.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "domainEvents";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Domain event rows are append-only runtime audit/exhaust data.";
     }, {
         readonly component: "kernel";
         readonly table: "epistemicAudit";
@@ -926,13 +1030,13 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly copyMode: "none";
         readonly description: "Worktrees are tenant/runtime planning data.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "agents";
         readonly prepopulation: "runtime_bootstrap";
         readonly copyMode: "none";
         readonly description: "Service agents are provisioned per tenant or service, not copied.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "mcpWritePolicy";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_global";
@@ -940,13 +1044,13 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["topicId", "role", "toolCategory"];
         readonly description: "Global write policy defaults govern service and interactive MCP writes.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "modelCallLogs";
         readonly prepopulation: "runtime_log";
         readonly copyMode: "none";
         readonly description: "Model call logs are runtime telemetry.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "modelFunctionSlots";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_global";
@@ -954,7 +1058,7 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["slot"];
         readonly description: "Function-to-model slots are required by model runtime resolution.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "modelRegistry";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_global";
@@ -962,7 +1066,7 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["key"];
         readonly description: "Model catalog defaults are required by model runtime clients.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "modelSlotConfigs";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_global";
@@ -970,13 +1074,91 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["slot"];
         readonly description: "Slot-level defaults are required before tenant overrides exist.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
+        readonly table: "permitAccessReviewItems";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit access-review item rows are tenant review data projected from Permit.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitAccessReviews";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit access-review campaigns are tenant review data projected from Permit.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitAttributeBindings";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit ABAC attribute bindings are tenant policy projection rows.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitGroups";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit groups are tenant-defined policy subjects, not template data.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitGroupMemberships";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit group memberships are tenant-specific policy projection rows.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitPolicyBundles";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Permit policy bundles are derived from the Permit control plane.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitPolicyDecisionReceipts";
+        readonly prepopulation: "runtime_log";
+        readonly copyMode: "none";
+        readonly description: "Permit decision receipts are runtime authorization audit logs.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitPrincipalAliases";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit principal aliases are tenant-specific identity projection rows.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitPrincipals";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit principals are projected from Clerk, Permit, and tenant onboarding flows.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitProjectionOutbox";
+        readonly prepopulation: "runtime_queue";
+        readonly copyMode: "none";
+        readonly description: "Permit projection outbox rows are runtime sync queue data.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitRelationshipTuples";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit ReBAC relationship tuples are tenant policy projection rows.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitResourceInstances";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit resource instances are tenant/workspace graph and deployment projection rows.";
+    }, {
+        readonly component: "control-plane";
+        readonly table: "permitRoleAssignments";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Permit role assignments are tenant-specific policy projection rows.";
+    }, {
+        readonly component: "control-plane";
         readonly table: "platformAudienceGrants";
         readonly prepopulation: "runtime_data";
         readonly copyMode: "none";
         readonly description: "Audience grants are principal/group-specific access rows.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "platformAudiences";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_tenant_rewrite";
@@ -984,31 +1166,31 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["tenantId", "workspaceId", "audienceKey"];
         readonly description: "Default tenant audience taxonomy rows are rewritten into each tenant.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "platformPolicyDecisionLogs";
         readonly prepopulation: "runtime_log";
         readonly copyMode: "none";
         readonly description: "Policy decisions are runtime audit logs.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "projectGrants";
         readonly prepopulation: "runtime_data";
         readonly copyMode: "none";
         readonly description: "Project/topic grants are principal or group-specific access rows.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "reasoningPermissions";
         readonly prepopulation: "runtime_data";
         readonly copyMode: "none";
         readonly description: "Reasoning permissions are principal-specific policy rows.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantApiKeys";
         readonly prepopulation: "runtime_secret";
         readonly copyMode: "none";
         readonly description: "API keys are tenant credentials and must never be copied.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantConfig";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_tenant_rewrite";
@@ -1016,7 +1198,7 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["tenantId"];
         readonly description: "Tenant-local config defaults are rewritten during bootstrap.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantIntegrations";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_tenant_rewrite";
@@ -1024,13 +1206,19 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["tenantId", "integrationKey"];
         readonly description: "Non-secret integration descriptors are rewritten into each tenant.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantModelSlotBindings";
         readonly prepopulation: "runtime_secret";
         readonly copyMode: "none";
         readonly description: "Tenant model slot bindings reference provider secrets and are runtime-only.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
+        readonly table: "tenantPermitSyncStates";
+        readonly prepopulation: "runtime_derived";
+        readonly copyMode: "none";
+        readonly description: "Tenant Permit sync state rows are runtime reconciliation state.";
+    }, {
+        readonly component: "control-plane";
         readonly table: "tenantPolicies";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_tenant_rewrite";
@@ -1038,37 +1226,37 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["tenantId", "workspaceId", "roleName"];
         readonly description: "Default tenant policy roles are rewritten during bootstrap.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantProviderSecrets";
         readonly prepopulation: "runtime_secret";
         readonly copyMode: "none";
         readonly description: "Provider secrets are credentials and must never be copied.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantProxyGatewayUsage";
         readonly prepopulation: "runtime_log";
         readonly copyMode: "none";
         readonly description: "Proxy gateway usage rows are runtime telemetry.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantProxyTokenMints";
         readonly prepopulation: "runtime_secret";
         readonly copyMode: "none";
         readonly description: "Proxy token mints are ephemeral secret-bearing runtime rows.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantSandboxAuditEvents";
         readonly prepopulation: "runtime_log";
         readonly copyMode: "none";
         readonly description: "Sandbox audit rows are runtime security logs.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "tenantSecrets";
         readonly prepopulation: "runtime_secret";
         readonly copyMode: "none";
         readonly description: "Tenant secrets are credentials and must never be copied.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "toolAcls";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_global";
@@ -1076,7 +1264,7 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["role", "toolName"];
         readonly description: "Default role-to-tool grants are required for SDK/MCP tool access.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "toolRegistry";
         readonly prepopulation: "required_template";
         readonly copyMode: "template_global";
@@ -1084,7 +1272,7 @@ declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly uniqueKey: readonly ["toolName"];
         readonly description: "Core tool catalog rows are required before pack or tenant tools exist.";
     }, {
-        readonly component: "identity";
+        readonly component: "control-plane";
         readonly table: "users";
         readonly prepopulation: "runtime_bootstrap";
         readonly copyMode: "none";