@lucern/contracts 0.3.0-alpha.9 → 1.0.0

package/dist/schemas/manifest.js

@@ -203,7 +203,7 @@ var toolRegistryEntries = defineTable({
 });
 var agents = defineTable({
   name: "agents",
-  component: "identity",
+  component: "control-plane",
   category: "agent",
   shape: z.object({
     "slug": z.string(),
@@ -234,6 +234,8 @@ var apiKeys = defineTable({
   category: "tenant",
   shape: z.object({
     "tenantId": idOf("tenants"),
+    "workspaceId": idOf("workspaces").optional(),
+    "environment": z.enum(["dev", "staging", "prod"]).optional(),
     "keyPrefix": z.enum(["luc", "stk"]),
     "keyHash": z.string(),
     "keyHint": z.string(),
@@ -261,7 +263,7 @@ var auditLog = defineTable({
   shape: z.object({
     "tenantId": idOf("tenants").optional(),
     "apiKeyId": idOf("apiKeys").optional(),
-    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "principal_created", "principal_updated", "principal_suspended", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
+    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_token_lease_issued", "proxy_token_lease_renewed", "proxy_token_lease_revoked", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "tenant_clerk_organization_linked", "tenant_canonical_identity_repaired", "principal_created", "principal_updated", "principal_suspended", "principal_identity_alias_upserted", "principal_identity_alias_revoked", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "deployment_host_registered", "deployment_host_revoked", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "permit_sync_enqueued", "permit_sync_succeeded", "permit_sync_failed", "permit_sync_skipped", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
     "actorClerkId": z.string(),
     "details": z.any().optional(),
     "createdAt": z.number()
@@ -485,6 +487,35 @@ var systemLogs = defineTable({
     { kind: "index", name: "by_source", columns: ["source"] }
   ]
 });
+var domainEvents = defineTable({
+  name: "domainEvents",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    "eventId": z.string(),
+    "type": z.string(),
+    "version": z.string(),
+    "timestamp": z.number(),
+    "tenantId": z.string().optional(),
+    "workspaceId": z.string().optional(),
+    "topicId": z.string(),
+    "resourceId": z.string(),
+    "resourceType": z.string(),
+    "actorId": z.string(),
+    "actorType": z.enum(["human", "agent", "service"]),
+    "data": z.record(z.any()),
+    "correlationId": z.string().optional(),
+    "expiresAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_eventId", columns: ["eventId"] },
+    { kind: "index", name: "by_topic_timestamp", columns: ["topicId", "timestamp"] },
+    { kind: "index", name: "by_tenant_workspace_timestamp", columns: ["tenantId", "workspaceId", "timestamp"] },
+    { kind: "index", name: "by_type_timestamp", columns: ["type", "timestamp"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId", "timestamp"] },
+    { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
+  ]
+});
 var beliefConfidence = defineTable({
   name: "beliefConfidence",
   component: "kernel",
@@ -1140,29 +1171,37 @@ var compatibilityShims = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "shimId": z.string(),
-    "gateId": z.string(),
-    "removalDate": z.string(),
-    "removalPriority": z.enum(["P1", "P2", "P3"]),
-    "description": z.string(),
-    "owner": z.string(),
-    "createdAt": z.string(),
-    "status": z.enum(["active", "overdue", "removed"]),
-    "bridgeType": z.enum(["tool", "agent"]),
-    "bridgeTarget": z.object({
-      "type": z.enum(["tool", "agent"]),
-      "legacyPath": z.string(),
-      "harnessPath": z.string()
+    shimId: z.string(),
+    gateId: z.string(),
+    removalDate: z.string(),
+    removalPriority: z.enum(["P1", "P2", "P3"]),
+    description: z.string(),
+    owner: z.string(),
+    createdAt: z.string(),
+    status: z.enum(["active", "overdue", "removed"]),
+    bridgeType: z.enum(["tool", "agent"]),
+    bridgeTarget: z.object({
+      type: z.enum(["tool", "agent"]),
+      legacyPath: z.string(),
+      harnessPath: z.string()
     }),
-    "shimBehavior": z.enum(["passthrough_with_logging", "adapter", "feature_flag_gate"]),
-    "producesLedgerEntries": z.boolean(),
-    "lastAuditedAt": z.number(),
-    "metadata": z.record(z.any()).optional()
+    shimBehavior: z.enum([
+      "passthrough_with_logging",
+      "adapter",
+      "feature_flag_gate"
+    ]),
+    producesLedgerEntries: z.boolean(),
+    lastAuditedAt: z.number(),
+    metadata: z.record(z.any()).optional()
   }),
   indices: [
     { kind: "index", name: "by_shimId", columns: ["shimId"] },
     { kind: "index", name: "by_status", columns: ["status"] },
-    { kind: "index", name: "by_bridgeType_status", columns: ["bridgeType", "status"] }
+    {
+      kind: "index",
+      name: "by_bridgeType_status",
+      columns: ["bridgeType", "status"]
+    }
   ]
 });
 var cutoverFlags = defineTable({
@@ -1170,12 +1209,23 @@ var cutoverFlags = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "domain": z.enum(["graph", "schema", "identity", "policy", "audit", "admin", "agent", "tool", "prompt", "intelligence"]),
-    "state": z.enum(["legacy", "cutover", "disabled"]),
-    "metadata": z.record(z.any()).optional(),
-    "updatedBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    domain: z.enum([
+      "graph",
+      "schema",
+      "identity",
+      "policy",
+      "audit",
+      "admin",
+      "agent",
+      "tool",
+      "prompt",
+      "intelligence"
+    ]),
+    state: z.enum(["legacy", "cutover", "disabled"]),
+    metadata: z.record(z.any()).optional(),
+    updatedBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_domain", columns: ["domain"] },
@@ -1187,57 +1237,193 @@ var tenantDeploymentCredentials = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "credentialRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "target": z.enum(["kernelDeployment", "appDeployment"]),
-    "environment": z.enum(["dev", "staging", "prod"]),
-    "encryptedDeployKey": z.string(),
-    "encryptionVersion": z.string(),
-    "keyFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromCredentialRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    credentialRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    target: z.enum(["kernelDeployment", "appDeployment"]),
+    environment: z.enum(["dev", "staging", "prod"]),
+    encryptedDeployKey: z.string(),
+    encryptionVersion: z.string(),
+    keyFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromCredentialRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_credentialRef", columns: ["credentialRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_target", columns: ["tenantId", "target"] },
-    { kind: "index", name: "by_tenant_target_environment", columns: ["tenantId", "target", "environment"] },
-    { kind: "index", name: "by_tenant_target_environment_status", columns: ["tenantId", "target", "environment", "status"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "target"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment",
+      columns: ["tenantId", "target", "environment"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment_status",
+      columns: ["tenantId", "target", "environment", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_workspace_target_environment_status",
+      columns: ["tenantId", "workspaceId", "target", "environment", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+var permitSyncStates = defineTable({
+  name: "permitSyncStates",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: z.enum([
+      "resource",
+      "role",
+      "resource_role",
+      "resource_relation",
+      "tenant",
+      "workspace",
+      "principal",
+      "membership",
+      "group",
+      "resource_instance",
+      "relationship_tuple",
+      "role_assignment"
+    ]),
+    objectId: z.string(),
+    tenantId: idOf("tenants").optional(),
+    workspaceId: idOf("workspaces").optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: z.enum(["pending", "synced", "error", "skipped"]),
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+var secretSyncDriftReports = defineTable({
+  name: "secretSyncDriftReports",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    reportId: z.string(),
+    source: z.enum(["infisical_manifest", "manual", "ci"]),
+    generatedAt: z.number(),
+    recordedAt: z.number(),
+    recordedBy: z.string(),
+    status: z.enum([
+      "in_sync",
+      "drift",
+      "exception",
+      "blocked",
+      "not_observed"
+    ]),
+    reportHash: z.string(),
+    manifestHash: z.string().optional(),
+    dryRunReceiptId: z.string().optional(),
+    appliedReceiptId: z.string().optional(),
+    summary: z.object({
+      totalPipelines: z.number(),
+      inSync: z.number(),
+      drift: z.number(),
+      exception: z.number(),
+      blocked: z.number(),
+      notObserved: z.number(),
+      missingKeys: z.number(),
+      valueDriftKeys: z.number(),
+      extraKeys: z.number(),
+      deniedConvexLeakage: z.number(),
+      approvedExceptions: z.number()
+    }),
+    redactedReport: z.record(z.any()),
+    metadata: z.record(z.any()).optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_reportId", columns: ["reportId"] },
+    { kind: "index", name: "by_reportHash", columns: ["reportHash"] },
+    { kind: "index", name: "by_generatedAt", columns: ["generatedAt"] },
+    {
+      kind: "index",
+      name: "by_status_generatedAt",
+      columns: ["status", "generatedAt"]
+    }
+  ]
+});
 var controlPlaneTenantModelSlotBindings = defineTable({
   name: "controlPlaneTenantModelSlotBindings",
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "bindingId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "passThroughOnly": z.boolean(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    bindingId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    status: z.enum(["active", "revoked"]),
+    passThroughOnly: z.boolean(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_bindingId", columns: ["bindingId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_slot", columns: ["tenantId", "modelSlotId"] },
-    { kind: "index", name: "by_tenant_provider_slot", columns: ["tenantId", "providerId", "modelSlotId"] },
+    {
+      kind: "index",
+      name: "by_tenant_slot",
+      columns: ["tenantId", "modelSlotId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_slot",
+      columns: ["tenantId", "providerId", "modelSlotId"]
+    },
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
@@ -1247,29 +1433,42 @@ var controlPlaneTenantProviderSecrets = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "secretRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "label": z.string().optional(),
-    "encryptedSecret": z.string(),
-    "encryptionVersion": z.string(),
-    "secretFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromSecretRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    secretRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    label: z.string().optional(),
+    encryptedSecret: z.string().optional(),
+    infisicalPath: z.string().optional(),
+    infisicalSecretKey: z.string().optional(),
+    infisicalProjectId: z.string().optional(),
+    encryptionVersion: z.string(),
+    secretFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromSecretRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId"] },
-    { kind: "index", name: "by_tenant_provider_status", columns: ["tenantId", "providerId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "providerId", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
@@ -1278,35 +1477,93 @@ var controlPlaneTenantProxyGatewayUsage = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "usageId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "proxyTokenId": z.string(),
-    "sessionId": z.string(),
-    "principalId": z.string(),
-    "workspaceId": z.string().optional(),
-    "modelId": z.string().optional(),
-    "requestPath": z.string(),
-    "status": z.enum(["success", "error"]),
-    "responseStatus": z.number().optional(),
-    "inputTokens": z.number().optional(),
-    "outputTokens": z.number().optional(),
-    "tokenCount": z.number().optional(),
-    "latencyMs": z.number(),
-    "estimatedCostUsd": z.number().optional(),
-    "failureCode": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    usageId: z.string(),
+    tenantId: idOf("tenants"),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    proxyTokenId: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    workspaceId: z.string().optional(),
+    modelId: z.string().optional(),
+    requestPath: z.string(),
+    status: z.enum(["success", "error"]),
+    responseStatus: z.number().optional(),
+    inputTokens: z.number().optional(),
+    outputTokens: z.number().optional(),
+    tokenCount: z.number().optional(),
+    latencyMs: z.number(),
+    estimatedCostUsd: z.number().optional(),
+    failureCode: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_usageId", columns: ["usageId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId", "createdAt"] },
-    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId", "createdAt"] },
-    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] }
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_proxyTokenId",
+      columns: ["proxyTokenId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_sessionId",
+      columns: ["sessionId", "createdAt"]
+    }
+  ]
+});
+var controlPlaneTenantProxyTokenLeases = defineTable({
+  name: "controlPlaneTenantProxyTokenLeases",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    leaseId: z.string(),
+    proxyTokenId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    bindingId: z.string(),
+    secretRef: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    agentSessionId: z.string().optional(),
+    status: z.enum(["active", "revoked"]),
+    expiresAt: z.number(),
+    renewedAt: z.number().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    revokeReason: z.string().optional(),
+    permitDecisionLogId: idOf("policyDecisionLogs").optional(),
+    permitTraceId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_leaseId", columns: ["leaseId"] },
+    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] },
+    {
+      kind: "index",
+      name: "by_principalId",
+      columns: ["principalId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_status_expiresAt",
+      columns: ["status", "expiresAt"]
+    }
   ]
 });
 var crossProjectConnections = defineTable({
@@ -1648,6 +1905,7 @@ var epistemicNodes = defineTable({
     "questionType": z.enum(["validation", "falsification", "assumption_probe", "prediction_test", "counterfactual", "discovery", "clarification", "comparison", "causal", "mechanism", "general"]).optional(),
     "questionPriority": z.enum(["critical", "high", "medium", "low"]).optional(),
     "answerQuality": z.enum(["definitive", "strong", "moderate", "weak", "speculative", "unanswered"]).optional(),
+    "themeStatus": z.enum(["emerging", "active", "mature", "declining", "archived"]).optional(),
     "themeConviction": z.enum(["high", "medium", "low", "negative"]).optional(),
     "decisionType": z.enum(["invest", "pass", "follow_on", "exit", "deep_dive", "monitor", "deprioritize", "thesis_adopt", "thesis_revise", "thesis_abandon"]).optional(),
     "decisionOutcome": z.enum(["pending", "successful", "unsuccessful", "mixed", "unknown"]).optional(),
@@ -1798,6 +2056,7 @@ var memberships = defineTable({
   indices: [
     { kind: "index", name: "by_principalId", columns: ["principalId"] },
     { kind: "index", name: "by_principal_tenant", columns: ["principalId", "tenantId"] },
+    { kind: "index", name: "by_principal_tenant_workspace", columns: ["principalId", "tenantId", "workspaceId"] },
     { kind: "index", name: "by_workspace_principal", columns: ["workspaceId", "principalId"] },
     { kind: "index", name: "by_tenant_role", columns: ["tenantId", "role"] },
     { kind: "index", name: "by_status", columns: ["status"] }
@@ -1829,6 +2088,36 @@ var principals = defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+var principalIdentityAliases = defineTable({
+  name: "principalIdentityAliases",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "principalId": z.string(),
+    "principalRefId": idOf("principals").optional(),
+    "provider": z.string(),
+    "providerProjectId": z.string().optional(),
+    "externalSubjectId": z.string(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": idOf("workspaces").optional(),
+    "email": z.string().optional(),
+    "status": z.enum(["active", "revoked"]),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "externalSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "externalSubjectId"] },
+    { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_principal_status", columns: ["principalId", "status"] },
+    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "externalSubjectId"] },
+    { kind: "index", name: "by_workspace_provider_subject", columns: ["workspaceId", "provider", "externalSubjectId"] }
+  ]
+});
 var rateLimitWindows = defineTable({
   name: "rateLimitWindows",
   component: "mc",
@@ -2418,7 +2707,7 @@ var lensTopicBindings = defineTable({
 });
 var mcpWritePolicy = defineTable({
   name: "mcpWritePolicy",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "topicId": z.string().optional(),
@@ -2441,7 +2730,7 @@ var mcpWritePolicy = defineTable({
 });
 var platformAudienceGrants = defineTable({
   name: "platformAudienceGrants",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2467,7 +2756,7 @@ var platformAudienceGrants = defineTable({
 });
 var platformAudiences = defineTable({
   name: "platformAudiences",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2492,7 +2781,7 @@ var platformAudiences = defineTable({
 });
 var platformPolicyDecisionLogs = defineTable({
   name: "platformPolicyDecisionLogs",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "principalId": z.string(),
@@ -2528,7 +2817,7 @@ var platformPolicyDecisionLogs = defineTable({
 });
 var tenantApiKeys = defineTable({
   name: "tenantApiKeys",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2555,7 +2844,7 @@ var tenantApiKeys = defineTable({
 });
 var tenantConfig = defineTable({
   name: "tenantConfig",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2574,7 +2863,7 @@ var tenantConfig = defineTable({
 });
 var tenantIntegrations = defineTable({
   name: "tenantIntegrations",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2629,7 +2918,7 @@ var tenantIntegrations = defineTable({
 });
 var tenantModelSlotBindings = defineTable({
   name: "tenantModelSlotBindings",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "bindingId": z.string(),
@@ -2657,7 +2946,7 @@ var tenantModelSlotBindings = defineTable({
 });
 var tenantPolicies = defineTable({
   name: "tenantPolicies",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2682,7 +2971,7 @@ var tenantPolicies = defineTable({
 });
 var tenantProviderSecrets = defineTable({
   name: "tenantProviderSecrets",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "secretRef": z.string(),
@@ -2713,7 +3002,7 @@ var tenantProviderSecrets = defineTable({
 });
 var tenantProxyGatewayUsage = defineTable({
   name: "tenantProxyGatewayUsage",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "usageId": z.string(),
@@ -2748,7 +3037,7 @@ var tenantProxyGatewayUsage = defineTable({
 });
 var tenantProxyTokenMints = defineTable({
   name: "tenantProxyTokenMints",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "proxyTokenId": z.string(),
@@ -2771,7 +3060,7 @@ var tenantProxyTokenMints = defineTable({
 });
 var tenantSandboxAuditEvents = defineTable({
   name: "tenantSandboxAuditEvents",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "eventId": z.string(),
@@ -2805,7 +3094,7 @@ var tenantSandboxAuditEvents = defineTable({
 });
 var tenantSecrets = defineTable({
   name: "tenantSecrets",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2827,7 +3116,7 @@ var tenantSecrets = defineTable({
 });
 var toolAcls = defineTable({
   name: "toolAcls",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "role": z.enum(["platform_admin", "tenant_admin", "workspace_admin", "editor", "viewer", "auditor", "service_agent"]),
@@ -2842,7 +3131,7 @@ var toolAcls = defineTable({
 });
 var toolRegistry = defineTable({
   name: "toolRegistry",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "toolName": z.string(),
@@ -2923,7 +3212,7 @@ var tenantMethodologyAssignments = defineTable({
 });
 var modelCallLogs = defineTable({
   name: "modelCallLogs",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -2949,7 +3238,7 @@ var modelCallLogs = defineTable({
 });
 var modelFunctionSlots = defineTable({
   name: "modelFunctionSlots",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -2974,7 +3263,7 @@ var modelFunctionSlots = defineTable({
 });
 var modelRegistry = defineTable({
   name: "modelRegistry",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "key": z.string(),
@@ -3001,7 +3290,7 @@ var modelRegistry = defineTable({
 });
 var modelSlotConfigs = defineTable({
   name: "modelSlotConfigs",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3388,7 +3677,7 @@ var policyDecisionLogs = defineTable({
     "workspaceId": idOf("workspaces").optional(),
     "resourceType": z.string(),
     "resourceId": z.string(),
-    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote"]),
+    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote", "route", "invoke", "manage", "deploy", "promote", "rollback", "audit", "read_ref", "fetch_value", "rotate", "administer", "mint", "delegate", "revoke"]),
     "decision": z.enum(["allow", "deny"]),
     "reasonCode": z.string(),
     "policyVersion": z.string(),
@@ -3450,7 +3739,7 @@ var controlPlaneToolAcls = defineTable({
 });
 var projectGrants = defineTable({
   name: "projectGrants",
-  component: "identity",
+  component: "control-plane",
   category: "project",
   shape: z.object({
     "projectId": z.string().optional(),
@@ -3482,9 +3771,653 @@ var projectGrants = defineTable({
     { kind: "index", name: "by_topic_cluster_status", columns: ["topicId", "beliefClusterId", "status"] }
   ]
 });
+var permitActorType = z.enum([
+  "human",
+  "agent",
+  "service_principal",
+  "external_stakeholder",
+  "system"
+]);
+var permitMembershipStatus = z.enum([
+  "active",
+  "invited",
+  "revoked",
+  "suspended",
+  "disabled"
+]);
+var permitDecision = z.enum(["allow", "deny"]);
+var permitAccessReviewStatus = z.enum([
+  "open",
+  "in_progress",
+  "approved",
+  "denied",
+  "expired",
+  "cancelled"
+]);
+var permitReviewScope = z.enum([
+  "tenant",
+  "workspace",
+  "resource_instance",
+  "group",
+  "principal",
+  "api_key",
+  "admin_action"
+]);
+var permitRecordStatus = z.enum([
+  "queued",
+  "inflight",
+  "completed",
+  "failed",
+  "skipped",
+  "stale"
+]);
+var permitObjectType = z.enum([
+  "resource",
+  "role",
+  "resource_role",
+  "resource_relation",
+  "tenant",
+  "workspace",
+  "principal",
+  "membership",
+  "group",
+  "resource_instance",
+  "relationship_tuple",
+  "role_assignment",
+  "attribute_binding",
+  "policy_bundle"
+]);
+var permitOutboxOperation = z.enum([
+  "upsert",
+  "delete",
+  "sync",
+  "resync",
+  "delete_sync",
+  "noop"
+]);
+var permitPolicyBundleStatus = z.enum([
+  "draft",
+  "validated",
+  "enforced",
+  "archived"
+]);
+var permitSyncStatus = z.enum([
+  "pending",
+  "synced",
+  "error",
+  "skipped"
+]);
+var permitAccessReviewSubjectType = z.enum([
+  "principal",
+  "group",
+  "role_assignment",
+  "resource_instance"
+]);
+var permitAttributeType = z.enum([
+  "string",
+  "number",
+  "bool",
+  "json",
+  "time"
+]);
+var permitAttributeOperator = z.enum([
+  "eq",
+  "neq",
+  "in",
+  "not_in",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "not_contains",
+  "matches"
+]);
+var permitRoleBindingTarget = z.enum([
+  "principal",
+  "group"
+]);
+var permitPrincipals = defineTable({
+  name: "permitPrincipals",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    principalType: permitActorType,
+    status: permitMembershipStatus,
+    displayName: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional(),
+    lastSeenAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_principalId", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_principalType_status",
+      columns: ["tenantId", "principalType", "status"]
+    }
+  ]
+});
+var permitPrincipalAliases = defineTable({
+  name: "permitPrincipalAliases",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    provider: z.string(),
+    providerSubjectId: z.string(),
+    providerProjectId: z.string().optional(),
+    alias: z.string(),
+    aliasKind: z.string(),
+    status: permitMembershipStatus,
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    revokedBy: z.string().optional(),
+    revokedAt: z.number().optional(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "providerSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "providerSubjectId"] },
+    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
+    { kind: "index", name: "by_tenant_provider_project_subject", columns: ["tenantId", "provider", "providerProjectId", "providerSubjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_alias",
+      columns: ["tenantId", "provider", "alias"]
+    },
+    { kind: "index", name: "by_tenant_alias", columns: ["tenantId", "alias"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "provider", "status"]
+    }
+  ]
+});
+var permitGroups = defineTable({
+  name: "permitGroups",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    groupKey: z.string(),
+    groupName: z.string(),
+    groupType: z.enum(["tenant", "workspace", "external", "system", "dynamic"]),
+    status: permitMembershipStatus,
+    description: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_groupId", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_tenant_groupKey", columns: ["tenantId", "groupKey"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+var permitGroupMemberships = defineTable({
+  name: "permitGroupMemberships",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    memberType: z.enum(["principal", "group"]),
+    memberId: z.string(),
+    principalId: z.string().optional(),
+    childGroupId: z.string().optional(),
+    status: permitMembershipStatus,
+    addedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    expiresAt: z.number().optional(),
+    revocationReason: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_principal", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_member", columns: ["tenantId", "memberType", "memberId"] },
+    {
+      kind: "index",
+      name: "by_tenant_member_group",
+      columns: ["tenantId", "memberType", "memberId", "groupId"]
+    },
+    { kind: "index", name: "by_tenant_group", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_member_group", columns: ["memberType", "memberId", "groupId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_workspace_principal",
+      columns: ["workspaceId", "principalId"]
+    }
+  ]
+});
+var permitResourceInstances = defineTable({
+  name: "permitResourceInstances",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceId: z.string(),
+    status: z.enum(["active", "deleted", "archived"]),
+    attributes: z.record(z.any()).optional(),
+    ownerPrincipalId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_resource_type",
+      columns: ["tenantId", "resourceType"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource_key",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_ownerPrincipalId",
+      columns: ["ownerPrincipalId"]
+    }
+  ]
+});
+var permitRoleAssignments = defineTable({
+  name: "permitRoleAssignments",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    role: z.string(),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceInstanceId: z.string().optional(),
+    status: permitMembershipStatus,
+    expiresAt: z.number().optional(),
+    attributes: z.record(z.any()).optional(),
+    grantedBy: z.string().optional(),
+    updatedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_role",
+      columns: ["tenantId", "role", "status"]
+    },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_workspace_resource",
+      columns: ["workspaceId", "resourceType", "resourceKey"]
+    }
+  ]
+});
+var permitRelationshipTuples = defineTable({
+  name: "permitRelationshipTuples",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    relation: z.string(),
+    subject: z.string(),
+    object: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    status: permitRecordStatus,
+    attributes: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastSeenAt: z.number().optional(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_subject", columns: ["tenantId", "subject"] },
+    { kind: "index", name: "by_tenant_object", columns: ["tenantId", "object"] },
+    { kind: "index", name: "by_tenant_relation", columns: ["tenantId", "relation"] },
+    {
+      kind: "index",
+      name: "by_tenant_relation_subject",
+      columns: ["tenantId", "relation", "subject"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+var permitAttributeBindings = defineTable({
+  name: "permitAttributeBindings",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    attributeName: z.string(),
+    attributeType: permitAttributeType,
+    attributeOperator: permitAttributeOperator,
+    attributeValue: z.any(),
+    status: permitRecordStatus,
+    source: z.string().optional(),
+    sourceRef: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    expiresAt: z.number().optional()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_attribute",
+      columns: ["tenantId", "targetType", "targetId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_name",
+      columns: ["tenantId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    }
+  ]
+});
+var permitPolicyBundles = defineTable({
+  name: "permitPolicyBundles",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    bundleKey: z.string(),
+    version: z.number(),
+    status: permitPolicyBundleStatus,
+    policyHash: z.string().optional(),
+    policyPayload: z.record(z.any()),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    reviewedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    retiredAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_bundleKey",
+      columns: ["tenantId", "bundleKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_bundle_version",
+      columns: ["tenantId", "bundleKey", "version"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+var permitProjectionOutbox = defineTable({
+  name: "permitProjectionOutbox",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    operation: permitOutboxOperation,
+    payload: z.record(z.any()),
+    status: permitRecordStatus,
+    attemptCount: z.number(),
+    nextAttemptAt: z.number().optional(),
+    lastError: z.string().optional(),
+    tenantId: z.string().optional(),
+    workspaceId: z.optional(z.string()),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastHandledAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_objectType",
+      columns: ["objectType", "status"]
+    }
+  ]
+});
+var tenantPermitSyncStates = defineTable({
+  name: "tenantPermitSyncStates",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: permitSyncStatus,
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+var permitPolicyDecisionReceipts = defineTable({
+  name: "permitPolicyDecisionReceipts",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string(),
+    subjectType: permitAccessReviewSubjectType.optional(),
+    subjectId: z.string().optional(),
+    resourceType: z.string(),
+    resourceId: z.string(),
+    action: z.string(),
+    decision: permitDecision,
+    reasonCode: z.string(),
+    policyBundleId: z.string().optional(),
+    policyVersion: z.string(),
+    traceId: z.string().optional(),
+    requestId: z.string().optional(),
+    audienceMode: z.string().optional(),
+    audienceKey: z.string().optional(),
+    audienceClass: z.enum(["internal", "restricted_external", "public"]).optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    expiresAt: z.number().optional(),
+    createdBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_principal_createdAt", columns: ["principalId", "createdAt"] },
+    { kind: "index", name: "by_tenant_createdAt", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId"] },
+    { kind: "index", name: "by_decision_createdAt", columns: ["decision", "createdAt"] },
+    { kind: "index", name: "by_traceId", columns: ["traceId"] },
+    { kind: "index", name: "by_action", columns: ["action"] }
+  ]
+});
+var permitAccessReviews = defineTable({
+  name: "permitAccessReviews",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    reviewKey: z.string(),
+    scope: permitReviewScope,
+    status: permitAccessReviewStatus,
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    outcome: z.enum(["allow", "deny"]).optional(),
+    requestedBy: z.string(),
+    reviewedBy: z.string().optional(),
+    requestedAt: z.number(),
+    reviewedAt: z.number().optional(),
+    dueAt: z.number().optional(),
+    justification: z.string().optional(),
+    rationale: z.string().optional(),
+    policyBundleId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_subject",
+      columns: ["tenantId", "subjectType", "subjectId"]
+    },
+    { kind: "index", name: "by_outcome", columns: ["outcome"] },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    }
+  ]
+});
+var permitAccessReviewItems = defineTable({
+  name: "permitAccessReviewItems",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    reviewKey: z.string(),
+    itemKey: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.string().optional(),
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    role: z.string().optional(),
+    relation: z.string().optional(),
+    status: z.enum(["open", "approved", "revoked", "changed", "deferred"]),
+    reviewerId: z.string().optional(),
+    decisionAt: z.number().optional(),
+    rationale: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_reviewKey", columns: ["reviewKey"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_tenant_itemKey", columns: ["tenantId", "itemKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    { kind: "index", name: "by_status", columns: ["status"] }
+  ]
+});
 var reasoningPermissions = defineTable({
   name: "reasoningPermissions",
-  component: "identity",
+  component: "control-plane",
   category: "epistemic",
   shape: z.object({
     "topicId": z.string().optional(),
@@ -3719,6 +4652,7 @@ var topics = defineTable({
     "updatedAt": z.number()
   }),
   indices: [
+    { kind: "index", name: "by_globalId", columns: ["globalId"] },
     { kind: "index", name: "by_parent", columns: ["parentTopicId"] },
     { kind: "index", name: "by_type", columns: ["type"] },
     { kind: "index", name: "by_graph_scope_project", columns: ["graphScopeProjectId"] },
@@ -3730,7 +4664,7 @@ var topics = defineTable({
 });
 var users = defineTable({
   name: "users",
-  component: "identity",
+  component: "control-plane",
   category: "user",
   shape: z.object({
     "clerkId": z.string(),
@@ -3844,7 +4778,6 @@ var workspaces = defineTable({
     "deployments": z.record(z.object({
       "url": z.string(),
       "target": z.enum(["kernelDeployment", "appDeployment"]).optional(),
-      "encryptedDeployKey": z.string().optional(),
       "credentialRef": z.string().optional()
     })).optional(),
     "metadata": z.record(z.any()).optional(),
@@ -3859,6 +4792,39 @@ var workspaces = defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+var deploymentHosts = defineTable({
+  name: "deploymentHosts",
+  component: "mc",
+  category: "workspace",
+  shape: z.object({
+    "host": z.string(),
+    "tenantId": idOf("tenants"),
+    "workspaceId": idOf("workspaces"),
+    "environment": z.enum(["dev", "staging", "prod"]),
+    "target": z.enum(["kernelDeployment", "appDeployment"]),
+    "deploymentUrl": z.string().optional(),
+    "deploymentName": z.string().optional(),
+    "vercelProjectName": z.string().optional(),
+    "vercelProjectId": z.string().optional(),
+    "vercelEnvironment": z.enum(["development", "preview", "staging", "production"]).optional(),
+    "source": z.enum(["vercel_preview", "vercel_production", "vercel_custom_environment", "custom_domain", "manual"]),
+    "status": z.enum(["active", "revoked"]),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "createdAt": z.number(),
+    "updatedAt": z.number(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_host", columns: ["host"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_workspace_environment", columns: ["tenantId", "workspaceId", "environment"] },
+    { kind: "index", name: "by_workspace_status", columns: ["workspaceId", "status"] },
+    { kind: "index", name: "by_status", columns: ["status"] }
+  ]
+});
 var worktreeBeliefCluster = defineTable({
   name: "worktreeBeliefCluster",
   component: "kernel",
@@ -4177,6 +5143,7 @@ var KERNEL_TABLE_CONTRACTS = [
   decisionParticipants,
   decisionRiskLedger,
   decisionSnapshots,
+  domainEvents,
   deliberationContributions,
   deliberationSessions,
   stakeholderGroups,
@@ -4223,9 +5190,23 @@ var KERNEL_TABLE_CONTRACTS = [
   worktreeBeliefCluster,
   worktrees
 ];
-var IDENTITY_TABLE_CONTRACTS = [
+var CONTROL_PLANE_TABLE_CONTRACTS = [
   agents,
   reasoningPermissions,
+  permitAccessReviewItems,
+  permitAccessReviews,
+  permitAttributeBindings,
+  permitGroups,
+  permitGroupMemberships,
+  permitPolicyBundles,
+  permitPolicyDecisionReceipts,
+  permitPrincipalAliases,
+  permitPrincipals,
+  permitProjectionOutbox,
+  permitRelationshipTuples,
+  permitResourceInstances,
+  permitRoleAssignments,
+  tenantPermitSyncStates,
   modelCallLogs,
   modelFunctionSlots,
   modelRegistry,
@@ -4255,6 +5236,7 @@ var MC_TABLE_CONTRACTS = [
   memberships,
   oauthDeviceCodes,
   principals,
+  principalIdentityAliases,
   rateLimitWindows,
   servicePrincipalKeys,
   userSessions,
@@ -4270,29 +5252,33 @@ var MC_TABLE_CONTRACTS = [
   policyDecisionLogs,
   policySimulations,
   controlPlaneToolAcls,
+  permitSyncStates,
   agentRegistryEntries,
   toolCatalog,
   toolRegistryEntries,
   compatibilityShims,
   cutoverFlags,
   tenantDeploymentCredentials,
+  secretSyncDriftReports,
   controlPlaneTenantModelSlotBindings,
   controlPlaneTenantProviderSecrets,
   controlPlaneTenantProxyGatewayUsage,
+  controlPlaneTenantProxyTokenLeases,
   apiKeys,
   auditLog,
   tenants,
-  workspaces
+  workspaces,
+  deploymentHosts
 ];
 var TABLE_CONTRACTS_BY_COMPONENT = {
   kernel: KERNEL_TABLE_CONTRACTS,
-  identity: IDENTITY_TABLE_CONTRACTS,
+  "control-plane": CONTROL_PLANE_TABLE_CONTRACTS,
   mc: MC_TABLE_CONTRACTS,
   "developer-pack": []
 };
 var ALL_TABLE_CONTRACTS = [
   ...KERNEL_TABLE_CONTRACTS,
-  ...IDENTITY_TABLE_CONTRACTS,
+  ...CONTROL_PLANE_TABLE_CONTRACTS,
   ...MC_TABLE_CONTRACTS
 ];
 function listTableContractsByName(name) {
@@ -4304,6 +5290,6 @@ function getTableContract(name, component) {
   );
 }
 
-export { ALL_TABLE_CONTRACTS, IDENTITY_TABLE_CONTRACTS, KERNEL_TABLE_CONTRACTS, MC_TABLE_CONTRACTS, TABLE_CONTRACTS_BY_COMPONENT, getTableContract, listTableContractsByName };
+export { ALL_TABLE_CONTRACTS, CONTROL_PLANE_TABLE_CONTRACTS, KERNEL_TABLE_CONTRACTS, MC_TABLE_CONTRACTS, TABLE_CONTRACTS_BY_COMPONENT, getTableContract, listTableContractsByName };
 //# sourceMappingURL=manifest.js.map
 //# sourceMappingURL=manifest.js.map