@lucern/mcp 0.3.0-alpha.12 → 0.3.0-alpha.14

package/dist/gateway.js

@@ -4,6 +4,7 @@ import { basename, extname } from 'path';
 import { randomUUID } from 'crypto';
 import { anyApi } from 'convex/server';
 import { ConvexHttpClient } from 'convex/browser';
+import { Permit } from 'permitio';
 
 // ../contracts/src/types/reasoning-method.ts
 var REASONING_METHODS = [
@@ -1032,6 +1033,35 @@ defineTable({
     { kind: "index", name: "by_source", columns: ["source"] }
   ]
 });
+defineTable({
+  name: "domainEvents",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    "eventId": z.string(),
+    "type": z.string(),
+    "version": z.string(),
+    "timestamp": z.number(),
+    "tenantId": z.string().optional(),
+    "workspaceId": z.string().optional(),
+    "topicId": z.string(),
+    "resourceId": z.string(),
+    "resourceType": z.string(),
+    "actorId": z.string(),
+    "actorType": z.enum(["human", "agent", "service"]),
+    "data": z.record(z.any()),
+    "correlationId": z.string().optional(),
+    "expiresAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_eventId", columns: ["eventId"] },
+    { kind: "index", name: "by_topic_timestamp", columns: ["topicId", "timestamp"] },
+    { kind: "index", name: "by_tenant_workspace_timestamp", columns: ["tenantId", "workspaceId", "timestamp"] },
+    { kind: "index", name: "by_type_timestamp", columns: ["type", "timestamp"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId", "timestamp"] },
+    { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
+  ]
+});
 defineTable({
   name: "beliefConfidence",
   component: "kernel",
@@ -4438,7 +4468,10 @@ defineTable({
   }),
   indices: [
     { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "providerSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "providerSubjectId"] },
     { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
+    { kind: "index", name: "by_tenant_provider_project_subject", columns: ["tenantId", "provider", "providerProjectId", "providerSubjectId"] },
     {
       kind: "index",
       name: "by_tenant_provider_alias",
@@ -9411,7 +9444,7 @@ var IDENTITY_WHOAMI = {
     description: "Canonical identity summary for the current session",
     fields: {
       principalId: "string \u2014 canonical federated principal identifier",
-      principalType: "string \u2014 human, service, or agent",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
       tenantId: "string | undefined \u2014 resolved tenant scope",
       workspaceId: "string | undefined \u2014 resolved workspace scope",
       scopes: "string[] | undefined \u2014 granted scopes for this session",
@@ -9422,6 +9455,49 @@ var IDENTITY_WHOAMI = {
   ontologyPrimitive: "identity",
   tier: "workhorse"
 };
+var RESOLVE_INTERACTIVE_PRINCIPAL = {
+  name: "resolve_interactive_principal",
+  description: "Read the Permit-backed Lucern principal context for an authenticated Clerk user. Like `git config --get user.email` plus the repository ACL \u2014 resolves the identity alias into the canonical authorization subject.",
+  parameters: {
+    clerkId: {
+      type: "string",
+      description: "Authenticated Clerk subject (`sub`). Clerk proves identity only; it is not the authorization record."
+    },
+    tenantId: {
+      type: "string",
+      description: "Optional tenant scope. Omit only when the Clerk alias is globally unambiguous."
+    },
+    workspaceId: {
+      type: "string",
+      description: "Optional workspace scope. Required when the principal has access to multiple workspaces and no default can be inferred."
+    },
+    providerProjectId: {
+      type: "string",
+      description: "Optional Clerk project or provider instance id for tenants with multiple identity providers."
+    }
+  },
+  required: ["clerkId"],
+  response: {
+    description: "Permit-backed Lucern principal context for tenant SDK bootstrap",
+    fields: {
+      principalId: "string \u2014 canonical Lucern principal identifier",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
+      clerkId: "string \u2014 authenticated Clerk subject alias",
+      tenantId: "string \u2014 resolved tenant scope",
+      workspaceId: "string | null \u2014 resolved workspace scope",
+      roles: "string[] \u2014 effective Permit roles",
+      scopes: "string[] \u2014 effective scopes derived from Permit/control-plane projection",
+      groupIds: "string[] \u2014 active Permit group memberships",
+      principalStatus: "string \u2014 active, invited, suspended, disabled, revoked, or missing",
+      tenantStatus: "string \u2014 projected tenant resource status",
+      workspaceStatus: "string \u2014 projected workspace resource status",
+      permit: "object \u2014 Permit subject, tenant, and optional workspace tuple"
+    }
+  },
+  ownerModule: "control-plane",
+  ontologyPrimitive: "identity",
+  tier: "workhorse"
+};
 var COMPILE_CONTEXT = {
   name: "compile_context",
   description: "Compile a focused reasoning context. If topicId is omitted, Lucern resolves the best topic from the query. Like `git log --graph --decorate` for the reasoning substrate \u2014 returns the canonical Pillar 3 context pack through the public API shape.",
@@ -11324,6 +11400,7 @@ var MCP_TOOL_CONTRACTS = {
   update_worktree_targets: UPDATE_WORKTREE_TARGETS,
   update_worktree_metadata: UPDATE_WORKTREE_METADATA,
   identity_whoami: IDENTITY_WHOAMI,
+  resolve_interactive_principal: RESOLVE_INTERACTIVE_PRINCIPAL,
   compile_context: COMPILE_CONTEXT,
   record_scope_learning: RECORD_SCOPE_LEARNING,
   pipeline_snapshot: PIPELINE_SNAPSHOT,
@@ -11441,6 +11518,7 @@ function entries(names, surfaceClass, surfaceIntent, surfaces, rationale) {
 var MCP_CORE_OPERATION_NAMES = [
   "compile_context",
   "identity_whoami",
+  "resolve_interactive_principal",
   "check_permission",
   "filter_by_permission",
   "create_belief",
@@ -11994,7 +12072,13 @@ function surfaceContract(args) {
       scopes: args.scopes ?? [
         args.kind === "query" ? `${args.domain}.read` : `${args.domain}.write`
       ],
-      allowedPrincipalTypes: ["user", "service", "agent"]
+      allowedPrincipalTypes: [
+        "user",
+        "service",
+        "agent",
+        "group",
+        "external_viewer"
+      ]
     },
     convex: args.convex,
     gateway: args.gateway,
@@ -12136,8 +12220,6 @@ var contextContracts = [
     args: observationContextArgs
   })
 ];
-
-// ../contracts/src/function-registry/identity.ts
 var withPrincipal = (input, context) => ({
   ...input,
   tenantId: input.tenantId ?? context.tenantId,
@@ -12163,6 +12245,28 @@ var identityContracts = [
       inputProjection: withPrincipal
     }
   }),
+  surfaceContract({
+    name: "resolve_interactive_principal",
+    kind: "query",
+    domain: "controlPlane",
+    surfaceClass: "platform_public",
+    method: "POST",
+    path: "/control-plane/identity/resolve-interactive-principal",
+    sdkNamespace: "controlPlane.identity",
+    sdkMethod: "resolveInteractivePrincipal",
+    summary: "Resolve an authenticated Clerk user into a Permit-backed Lucern principal context.",
+    args: z.object({
+      clerkId: z.string().min(1),
+      tenantId: z.string().min(1).optional(),
+      workspaceId: z.string().min(1).optional(),
+      providerProjectId: z.string().min(1).optional()
+    }),
+    convex: {
+      module: "identity",
+      functionName: "resolveInteractivePrincipal",
+      kind: "query"
+    }
+  }),
   surfaceContract({
     name: "check_permission",
     kind: "query",
@@ -16255,6 +16359,13 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     copyMode: "none",
     description: "Deliberation sessions are created by tenant workflows."
   },
+  {
+    component: "kernel",
+    table: "domainEvents",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Domain event rows are append-only runtime audit/exhaust data."
+  },
   {
     component: "kernel",
     table: "epistemicAudit",
@@ -23084,23 +23195,31 @@ async function resolveTaskEventTopicId(authContext, task, operation) {
   });
 }
 async function emitTaskEventFromGatewayAuth(authContext, args) {
-  return emitDomainEvent(
-    (reference, input) => authContext.convex.mutation(reference, input),
-    {
-      tenantId: authContext.tenantId,
-      workspaceId: authContext.workspaceId,
-      topicId: args.topicId,
-      type: args.type,
-      resourceId: args.resourceId,
-      resourceType: "task",
-      actorId: authContext.principalId ?? authContext.userId,
-      actorType: inferActorType({
-        authMode: authContext.authMode,
-        principalType: authContext.principalType
-      }),
-      data: args.data
-    }
-  );
+  return authContext.convex.mutation(api.events.recordEvent, {
+    tenantId: authContext.tenantId,
+    workspaceId: authContext.workspaceId,
+    topicId: args.topicId,
+    type: args.type,
+    resourceId: args.resourceId,
+    resourceType: "task",
+    actorId: authContext.principalId ?? authContext.userId,
+    actorType: inferActorType({
+      authMode: authContext.authMode,
+      principalType: authContext.principalType
+    }),
+    data: args.data
+  });
+}
+async function emitTaskEventBestEffortFromGatewayAuth(authContext, args) {
+  try {
+    await emitTaskEventFromGatewayAuth(authContext, args);
+  } catch (error) {
+    console.warn("[tasks] Task write succeeded but event emission failed.", {
+      taskId: args.resourceId,
+      eventType: args.type,
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
 }
 function gatewayIdempotencyArgs(authContext, options) {
   {
@@ -23197,7 +23316,7 @@ async function createTaskFromGatewayAuth(authContext, input, options) {
     ...input,
     topicId: resolvedTopic.topicId
   });
-  await emitTaskEventFromGatewayAuth(authContext, {
+  await emitTaskEventBestEffortFromGatewayAuth(authContext, {
     topicId: payload.topicId ?? resolvedTopic.topicId,
     type: "task.created",
     resourceId: payload.id,
@@ -23225,7 +23344,7 @@ async function updateTaskFromGatewayAuth(authContext, input, options) {
     payload,
     "update"
   );
-  await emitTaskEventFromGatewayAuth(authContext, {
+  await emitTaskEventBestEffortFromGatewayAuth(authContext, {
     topicId,
     type: "task.updated",
     resourceId: payload.id,
@@ -23252,7 +23371,7 @@ async function completeTaskFromGatewayAuth(authContext, input, options) {
     payload,
     "complete"
   );
-  await emitTaskEventFromGatewayAuth(authContext, {
+  await emitTaskEventBestEffortFromGatewayAuth(authContext, {
     topicId,
     type: "task.completed",
     resourceId: payload.id,
@@ -25732,7 +25851,7 @@ function handleEventsError(error, fallbackMessage, correlationId, policyTraceId)
 }
 async function handleEventsList(args) {
   try {
-    const payload = await args.authContext.convex.query("events:listEvents", {
+    const payload = await args.authContext.convex.query(api.events.listEvents, {
       tenantId: args.authContext.tenantId,
       workspaceId: args.authContext.workspaceId,
       topicId: args.query.topicId,
@@ -25758,7 +25877,7 @@ async function handleEventsList(args) {
 async function handleEventsReplay(args) {
   try {
     const payload = await args.authContext.convex.mutation(
-      "events:replayEvents",
+      api.events.replayEvents,
       {
         tenantId: args.authContext.tenantId,
         workspaceId: args.authContext.workspaceId,
@@ -27077,22 +27196,69 @@ function readTenantKeyFromValue(value) {
   const record = asRecord25(value);
   return readString27(record.key) ?? readString27(record.tenant) ?? readString27(record.tenantKey) ?? readString27(record.tenant_id);
 }
+function hasTenantIdentifier(value) {
+  if (typeof value === "string" && value.trim()) {
+    return true;
+  }
+  const record = asRecord25(value);
+  return Boolean(
+    readString27(record.key) ?? readString27(record.tenant) ?? readString27(record.tenantKey) ?? readString27(record.tenant_key) ?? readString27(record.tenant_id) ?? readString27(record.id)
+  );
+}
 function extractPermitWebhookTenantKeys(body) {
   const record = asRecord25(body);
   const candidates = [
     record.tenant,
     record.tenantKey,
+    record.tenant_key,
+    asRecord25(record.data).tenant,
+    asRecord25(record.data).tenantKey,
+    asRecord25(record.data).tenant_key,
+    asRecord25(record.object).tenant,
+    asRecord25(record.object).tenantKey,
+    asRecord25(record.object).tenant_key,
+    asRecord25(record.resource_instance).tenant,
+    asRecord25(record.resource_instance).tenantKey,
+    asRecord25(record.resource_instance).tenant_key,
+    asRecord25(record.access_request_details).tenant,
+    asRecord25(record.access_request_details).tenantKey,
+    asRecord25(record.access_request_details).tenant_key,
+    asRecord25(asRecord25(record.data).access_request_details).tenant,
+    asRecord25(asRecord25(record.data).access_request_details).tenantKey,
+    asRecord25(asRecord25(record.data).access_request_details).tenant_key
+  ];
+  const tenantKeys = candidates.map(readTenantKeyFromValue).filter((entry) => Boolean(entry));
+  return [...new Set(tenantKeys)];
+}
+function hasPermitWebhookTenantScope(body) {
+  const record = asRecord25(body);
+  const candidates = [
+    record.tenant,
+    record.tenantKey,
+    record.tenant_key,
     record.tenant_id,
     asRecord25(record.data).tenant,
     asRecord25(record.data).tenantKey,
+    asRecord25(record.data).tenant_key,
     asRecord25(record.data).tenant_id,
     asRecord25(record.object).tenant,
     asRecord25(record.object).tenantKey,
+    asRecord25(record.object).tenant_key,
     asRecord25(record.object).tenant_id,
-    asRecord25(record.resource_instance).tenant
+    asRecord25(record.resource_instance).tenant,
+    asRecord25(record.resource_instance).tenantKey,
+    asRecord25(record.resource_instance).tenant_key,
+    asRecord25(record.resource_instance).tenant_id,
+    asRecord25(record.access_request_details).tenant,
+    asRecord25(record.access_request_details).tenantKey,
+    asRecord25(record.access_request_details).tenant_key,
+    asRecord25(record.access_request_details).tenant_id,
+    asRecord25(asRecord25(record.data).access_request_details).tenant,
+    asRecord25(asRecord25(record.data).access_request_details).tenantKey,
+    asRecord25(asRecord25(record.data).access_request_details).tenant_key,
+    asRecord25(asRecord25(record.data).access_request_details).tenant_id
   ];
-  const tenantKeys = candidates.map(readTenantKeyFromValue).filter((entry) => Boolean(entry));
-  return [...new Set(tenantKeys)];
+  return candidates.some(hasTenantIdentifier);
 }
 function summarizePermitWebhookEvent(body) {
   const record = asRecord25(body);
@@ -27160,7 +27326,8 @@ async function handlePermitProjectionWebhook(args) {
   try {
     const event = summarizePermitWebhookEvent(args.body);
     const tenantKeys = extractPermitWebhookTenantKeys(args.body);
-    if (tenantKeys.length === 0) {
+    const hasTenantScope = hasPermitWebhookTenantScope(args.body);
+    if (tenantKeys.length === 0 && !hasTenantScope) {
       return successResponse(
         {
           acknowledged: true,
@@ -27178,7 +27345,7 @@ async function handlePermitProjectionWebhook(args) {
     const receipt = await client.action(mcApi.permitProjectionActions.reconcile, {
       mode: "apply",
       trigger: "permit_webhook",
-      tenantKeys,
+      tenantKeys: tenantKeys.length > 0 ? tenantKeys : void 0,
       environments: ["dev", "staging", "prod"],
       componentPath: "controlPlane",
       webhookSecret: readSecret(),
@@ -27202,37 +27369,1119 @@ async function handlePermitProjectionWebhook(args) {
     );
   }
 }
+var mcApi2 = anyApi;
+var mcClientCache2 = {
+  value: null
+};
+var permitClientCache = {
+  value: null
+};
+var permitClientFactory = null;
+var SYSTEM_ACTOR_ID = "clerk:system";
+var SIGNATURE_TOLERANCE_SECONDS = 300;
+var USER_EVENTS = /* @__PURE__ */ new Set([
+  "user.created",
+  "user.updated",
+  "user.deleted"
+]);
+var MEMBERSHIP_EVENTS = /* @__PURE__ */ new Set([
+  "organizationMembership.created",
+  "organizationMembership.updated",
+  "organizationMembership.deleted"
+]);
+var INVITATION_EVENTS = /* @__PURE__ */ new Set([
+  "organizationInvitation.created",
+  "organizationInvitation.accepted",
+  "organizationInvitation.revoked"
+]);
+var ORGANIZATION_LIFECYCLE_EVENTS = /* @__PURE__ */ new Set([
+  "organization.created",
+  "organization.updated",
+  "organization.deleted"
+]);
+var PERMIT_MEMBERSHIP_ROLES = /* @__PURE__ */ new Set([
+  "tenant_admin",
+  "viewer",
+  "editor",
+  "auditor",
+  "service_agent",
+  "platform_admin",
+  "workspace_admin"
+]);
+var CLERK_WEBHOOK_SECRETS = [
+  "LUCERN_CLERK_WEBHOOK_SECRET",
+  "CLERK_WEBHOOK_SECRET",
+  "CLERK_WEBHOOK_SIGNING_SECRET"
+];
+function isRecord8(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readString28(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function readNumber18(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  if (typeof value === "string" && value.trim()) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return void 0;
+}
+var PERMIT_USER_KEY_PATTERN = /^[A-Za-z0-9|@+\-._]+$/;
+var PERMIT_USER_KEY_ESCAPE_SENTINEL = "|";
+function asRecord26(value) {
+  return isRecord8(value) ? value : {};
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function encodeBase64(bytes) {
+  const buffer = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let binary = "";
+  for (const value of buffer) {
+    binary += String.fromCharCode(value);
+  }
+  return btoa(binary);
+}
+function permitUserKeyForPrincipalId(principalId) {
+  const trimmed = principalId.trim();
+  if (PERMIT_USER_KEY_PATTERN.test(trimmed) && !trimmed.includes(PERMIT_USER_KEY_ESCAPE_SENTINEL)) {
+    return trimmed;
+  }
+  return Array.from(trimmed).map(
+    (character) => PERMIT_USER_KEY_PATTERN.test(character) && character !== PERMIT_USER_KEY_ESCAPE_SENTINEL ? character : `${PERMIT_USER_KEY_ESCAPE_SENTINEL}${character.codePointAt(0)?.toString(16) ?? "0"}${PERMIT_USER_KEY_ESCAPE_SENTINEL}`
+  ).join("");
+}
+function compactRecord5(value) {
+  return Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== void 0)
+  );
+}
+function statusCodeFromError(error) {
+  if (!error || typeof error !== "object") {
+    return void 0;
+  }
+  const record = error;
+  return numericStatus(record.status) ?? numericStatus(record.statusCode) ?? numericStatus(record.response?.status) ?? numericStatus(record.cause?.response?.status);
+}
+function numericStatus(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  if (typeof value === "string") {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return void 0;
+}
+function isNotFound(error) {
+  return statusCodeFromError(error) === 404 || String(error?.message ?? "").includes("404");
+}
+function isConflict(error) {
+  return statusCodeFromError(error) === 409 || String(error?.message ?? "").includes("409");
+}
+function readRoleAssignments(value) {
+  if (!Array.isArray(value)) {
+    const record = isRecord8(value) ? value : {};
+    if (Array.isArray(record.data)) {
+      return record.data.filter(isRecord8);
+    }
+    if (Array.isArray(record.results)) {
+      return record.results.filter(isRecord8);
+    }
+    return [];
+  }
+  return value.filter(isRecord8);
+}
+function roleAssignmentResourceInstance(assignment) {
+  return readString28(assignment.resource_instance) ?? readString28(assignment.resourceInstance) ?? readString28(assignment.resource_instance_id) ?? readString28(assignment.resourceInstanceId);
+}
+function isTenantScopedRoleAssignment(assignment) {
+  return !roleAssignmentResourceInstance(assignment);
+}
+function createPermitClient() {
+  const token = readString28(process.env.LUCERN_PERMIT_API_KEY) ?? readString28(process.env.PERMIT_API_KEY);
+  const pdpUrl = readString28(process.env.LUCERN_PERMIT_PDP_URL) ?? readString28(process.env.PERMIT_PDP_URL);
+  const apiUrl = readString28(process.env.LUCERN_PERMIT_API_URL) ?? readString28(process.env.PERMIT_API_URL);
+  if (!token || !pdpUrl) {
+    throw {
+      status: 502,
+      code: "UPSTREAM_ERROR",
+      message: "Permit projection is not configured. Set LUCERN_PERMIT_API_KEY and LUCERN_PERMIT_PDP_URL."
+    };
+  }
+  return new Permit({
+    token,
+    pdp: pdpUrl,
+    ...apiUrl ? { apiUrl } : {},
+    throwOnError: true
+  });
+}
+function getPermitClient() {
+  if (permitClientCache.value) {
+    return permitClientCache.value;
+  }
+  if (permitClientFactory) {
+    permitClientCache.value = permitClientFactory();
+    return permitClientCache.value;
+  }
+  permitClientCache.value = createPermitClient();
+  return permitClientCache.value;
+}
+var __testOnly = {
+  setPermitClientFactory(factory) {
+    permitClientFactory = factory;
+    permitClientCache.value = null;
+  }
+};
+async function upsertPermitTenant(args) {
+  const permit = getPermitClient();
+  const tenantPayload = {
+    name: args.tenantName ?? args.tenantKey,
+    attributes: compactRecord5({
+      clerkOrganizationId: args.clerkOrganizationId,
+      clerkOrganizationSlug: args.clerkOrganizationSlug,
+      mcTenantKey: args.tenantKey,
+      sourceType: "organization",
+      sourceEvent: args.eventType,
+      eventAt: args.eventAt,
+      actorId: args.actorId
+    })
+  };
+  try {
+    return await permit.api.tenants.update(args.tenantKey, tenantPayload);
+  } catch (error) {
+    if (!isNotFound(error)) {
+      throw error;
+    }
+  }
+  return await permit.api.tenants.create({
+    key: args.tenantKey,
+    ...tenantPayload
+  });
+}
+async function syncPermitUser(args) {
+  const permit = getPermitClient();
+  return await permit.api.users.sync({
+    key: permitUserKeyForPrincipalId(args.userId),
+    email: args.email,
+    attributes: compactRecord5({
+      sourceType: "clerk_webhook_user",
+      sourceEvent: args.eventType,
+      clerkStatus: args.eventType,
+      clerkDisplayName: args.displayName,
+      eventAt: args.eventAt,
+      actorId: args.actorId
+    })
+  });
+}
+async function upsertPermitTenantMembershipRole(args) {
+  const permit = getPermitClient();
+  const permitUserId = permitUserKeyForPrincipalId(args.userId);
+  const existing = readRoleAssignments(
+    await permit.api.roleAssignments.list({
+      user: permitUserId,
+      tenant: args.tenantKey,
+      perPage: 100
+    })
+  );
+  await Promise.all(
+    existing.map((assignment2) => {
+      const role = readString28(assignment2.role);
+      if (!role || !PERMIT_MEMBERSHIP_ROLES.has(role)) {
+        return Promise.resolve();
+      }
+      if (!isTenantScopedRoleAssignment(assignment2)) {
+        return Promise.resolve();
+      }
+      if (role === args.role) {
+        return Promise.resolve();
+      }
+      return unassignPermitTenantMembershipRole({
+        permit,
+        permitUserId,
+        tenant: args.tenantKey,
+        role
+      });
+    })
+  );
+  const assignment = {
+    user: permitUserId,
+    role: args.role,
+    tenant: args.tenantKey
+  };
+  try {
+    return await permit.api.roleAssignments.assign(assignment);
+  } catch (error) {
+    if (isConflict(error)) {
+      return { alreadyAssigned: true };
+    }
+    throw error;
+  }
+}
+async function unassignPermitTenantMembershipRole(args) {
+  const api2 = args.permit.api;
+  const assignment = {
+    user: args.permitUserId,
+    role: args.role,
+    tenant: args.tenant,
+    ...args.resourceInstance ? { resource_instance: args.resourceInstance } : {}
+  };
+  if (typeof api2.roleAssignments?.unassign === "function") {
+    return await api2.roleAssignments.unassign(assignment);
+  }
+  if (typeof api2.unassignRole === "function") {
+    return await api2.unassignRole(assignment);
+  }
+  if (typeof api2.users?.unassignRole === "function") {
+    return await api2.users.unassignRole({
+      user: args.permitUserId,
+      role: args.role,
+      tenant: args.tenant
+    });
+  }
+  throw new Error("Permit SDK does not expose an unassignRole method");
+}
+async function revokePermitTenantMembershipRoles(args) {
+  const permit = getPermitClient();
+  const permitUserId = permitUserKeyForPrincipalId(args.userId);
+  const assignments = readRoleAssignments(
+    await permit.api.roleAssignments.list({
+      user: permitUserId,
+      tenant: args.tenantKey,
+      perPage: 100
+    })
+  );
+  const membershipRoles = assignments.filter(
+    (assignment) => isTenantScopedRoleAssignment(assignment) && PERMIT_MEMBERSHIP_ROLES.has(readString28(assignment.role) ?? "")
+  );
+  await Promise.all(
+    membershipRoles.map((assignment) => {
+      const role = readString28(assignment.role);
+      if (!role) {
+        return Promise.resolve();
+      }
+      return unassignPermitTenantMembershipRole({
+        permit,
+        permitUserId,
+        tenant: args.tenantKey,
+        role
+      });
+    })
+  );
+}
+function normalizeBase64(value) {
+  return value.replace(/-/g, "+").replace(/_/g, "/");
+}
+function maybeBase64(value) {
+  if (!value || value.length < 16) {
+    return false;
+  }
+  if (value.length % 4 === 1) {
+    return false;
+  }
+  return /^[A-Za-z0-9+/=_-]+$/.test(value);
+}
+function decodeBase64OrRaw(value) {
+  if (!value) {
+    return new Uint8Array();
+  }
+  const trimmed = value.trim();
+  const secretMaterial = trimmed.startsWith("whsec_") ? trimmed.slice("whsec_".length) : trimmed;
+  const candidate = normalizeBase64(secretMaterial);
+  if (!maybeBase64(candidate)) {
+    return new TextEncoder().encode(secretMaterial);
+  }
+  try {
+    const binary = atob(candidate);
+    return Uint8Array.from(binary, (entry) => entry.charCodeAt(0));
+  } catch {
+    return new TextEncoder().encode(secretMaterial);
+  }
+}
+function readSigningSecret(env = process.env) {
+  for (const key of CLERK_WEBHOOK_SECRETS) {
+    const value = readString28(env[key]);
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function parseSvixSignatures(header) {
+  return header.split(",").map((entry) => entry.trim()).filter(Boolean).flatMap((entry) => {
+    if (entry.startsWith("v1=")) {
+      return [entry.slice("v1=".length)];
+    }
+    return [];
+  }).filter(Boolean);
+}
+function parseWebhookHeaders(headers) {
+  const secret = readSigningSecret();
+  const webhookId = headers.get("svix-id");
+  const timestamp = headers.get("svix-timestamp");
+  const signatureHeader = headers.get("svix-signature");
+  if (!secret || !webhookId || !timestamp || !signatureHeader) {
+    return null;
+  }
+  return {
+    webhookId,
+    timestamp,
+    signatures: parseSvixSignatures(signatureHeader),
+    secret
+  };
+}
+function safeEquals(left, right) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    diff |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return diff === 0;
+}
+async function verifyClerkSignature(args) {
+  const parsed = parseWebhookHeaders(args.headers);
+  if (!parsed) {
+    return "missing_headers_or_secret";
+  }
+  const signatureTimestamp = readNumber18(parsed.timestamp);
+  if (!signatureTimestamp) {
+    return "malformed_timestamp";
+  }
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  if (Math.abs(nowSeconds - signatureTimestamp) > SIGNATURE_TOLERANCE_SECONDS) {
+    return "signature_expired";
+  }
+  const message = `${parsed.webhookId}.${parsed.timestamp}.${args.body}`;
+  const keyBytes = decodeBase64OrRaw(parsed.secret);
+  const key = await crypto.subtle.importKey(
+    "raw",
+    keyBytes,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const computed = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
+  const computedSignature = encodeBase64(computed);
+  return parsed.signatures.some((candidate) => safeEquals(candidate, computedSignature)) || "signature_mismatch";
+}
+function extractClerkActorId(payload) {
+  const event = asRecord26(payload);
+  const data = asRecord26(event.data);
+  return readString28(event.actor_id) || readString28(asRecord26(event.actor).id) || readString28(data.actor_id) || readString28(asRecord26(data.actor).id) || readString28(data.created_by) || readString28(asRecord26(data.public_user_data).user_id) || SYSTEM_ACTOR_ID;
+}
+function extractUserData(data) {
+  const user = asRecord26(data.user);
+  if (Object.keys(user).length > 0) {
+    return user;
+  }
+  const publicUser = asRecord26(data.public_user_data);
+  if (Object.keys(publicUser).length > 0) {
+    return publicUser;
+  }
+  return data;
+}
+function extractOrganizationIds(data) {
+  const organization = asRecord26(data.organization);
+  return {
+    organizationId: readString28(data.organization_id) || readString28(data.id) || readString28(organization.id),
+    organizationSlug: readString28(data.organization_slug) || readString28(data.slug) || readString28(organization.slug)
+  };
+}
+function readPrimaryEmail(userData) {
+  const direct = readString28(userData.primary_email_address) || readString28(userData.email) || readString28(userData.emailAddress);
+  if (direct) {
+    return direct;
+  }
+  for (const entry of asArray(userData.email_addresses)) {
+    const row = asRecord26(entry);
+    const value = readString28(row.email_address) || readString28(row.emailAddress) || readString28(row.address);
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function readDisplayName(userData) {
+  const first = readString28(userData.first_name) || readString28(userData.firstName);
+  const last = readString28(userData.last_name) || readString28(userData.lastName);
+  if (first || last) {
+    return [first, last].filter(Boolean).join(" ");
+  }
+  return readString28(userData.username) || readString28(userData.name);
+}
+function normalizeRole(value) {
+  const normalized = readString28(value)?.toLowerCase() ?? "viewer";
+  if (normalized === "admin" || normalized === "owner" || normalized === "org:admin") {
+    return "tenant_admin";
+  }
+  if (normalized === "editor" || normalized === "viewer" || normalized === "auditor" || normalized === "service_agent" || normalized === "platform_admin" || normalized === "tenant_admin" || normalized === "workspace_admin") {
+    return normalized;
+  }
+  if (normalized === "basic_member" || normalized === "org:member") {
+    return "viewer";
+  }
+  return "viewer";
+}
+function buildWebhookMetadata(args) {
+  return {
+    source: "clerk_webhook",
+    eventType: args.eventType,
+    eventId: args.eventId,
+    eventAt: args.eventAt,
+    actorId: args.actorId,
+    ...args.extra
+  };
+}
+function extractOrganizationName(organization) {
+  return readString28(organization.name) || readString28(organization.slug) || readString28(organization.title);
+}
+async function getMasterControlConvexClient2() {
+  if (mcClientCache2.value) {
+    return mcClientCache2.value;
+  }
+  const convexUrl = readString28(process.env.CONVEX_MC_URL);
+  const deployKey = readString28(process.env.CONVEX_MC_DEPLOY_KEY);
+  if (!convexUrl || !deployKey) {
+    throw new Error(
+      "Master Control is not configured. Set CONVEX_MC_URL and CONVEX_MC_DEPLOY_KEY."
+    );
+  }
+  const client = new ConvexHttpClient(convexUrl);
+  client.setAdminAuth(
+    deployKey
+  );
+  mcClientCache2.value = client;
+  return client;
+}
+async function resolveTenantByOrgSlug(args) {
+  if (!args.organizationSlug) {
+    return void 0;
+  }
+  const tenant = await args.client.query(mcApi2.tenants.getBySlug, {
+    slug: args.organizationSlug
+  });
+  if (!tenant || !isRecord8(tenant)) {
+    return void 0;
+  }
+  const tenantId = readString28(tenant._id);
+  const tenantSlug = readString28(tenant.slug);
+  if (!tenantId || !tenantSlug) {
+    return void 0;
+  }
+  return { tenantId, tenantSlug };
+}
+function webhookError(code, status, message, correlationId, policyTraceId, details) {
+  return errorResponse({
+    code,
+    status,
+    message,
+    correlationId,
+    policyTraceId,
+    details
+  });
+}
+function handleClerkWebhookError(error, correlationId, policyTraceId) {
+  const resolved = resolveServerCoreError(error, "Failed to reconcile Clerk webhook.");
+  return errorResponse({
+    code: resolved.code,
+    message: resolved.message,
+    status: resolved.status,
+    correlationId,
+    policyTraceId,
+    invariant: resolved.invariant,
+    suggestion: resolved.suggestion,
+    details: resolved.details
+  });
+}
+async function handleClerkWebhook(args) {
+  try {
+    const rawBody = await args.request.clone().text();
+    const verification = await verifyClerkSignature({
+      body: rawBody,
+      headers: args.request.headers
+    });
+    if (verification !== true) {
+      let message = "Clerk webhook signature verification failed.";
+      if (verification === "signature_expired") {
+        message = "Clerk webhook signature is too old.";
+      }
+      if (verification === "malformed_timestamp") {
+        message = "Malformed Clerk webhook timestamp header.";
+      }
+      if (verification === "missing_headers_or_secret") {
+        message = "Missing Clerk webhook signature headers or secret.";
+      }
+      return webhookError(
+        "AUTH_REQUIRED",
+        401,
+        message,
+        args.correlationId,
+        args.policyTraceId
+      );
+    }
+    let payload;
+    try {
+      payload = JSON.parse(rawBody);
+    } catch {
+      return webhookError(
+        "INVALID_REQUEST",
+        400,
+        "Clerk webhook body must be valid JSON.",
+        args.correlationId,
+        args.policyTraceId
+      );
+    }
+    const eventType = readString28(payload.type);
+    if (!eventType) {
+      return webhookError(
+        "INVALID_REQUEST",
+        400,
+        "Clerk webhook payload must include event type.",
+        args.correlationId,
+        args.policyTraceId
+      );
+    }
+    const data = asRecord26(payload.data);
+    const actorId = extractClerkActorId(payload);
+    const eventId = readString28(payload.id);
+    const eventTimestamp = readString28(payload.created_at) || readString28(payload.timestamp);
+    const isOrgLifecycleEvent = ORGANIZATION_LIFECYCLE_EVENTS.has(eventType);
+    const isUserEvent = USER_EVENTS.has(eventType);
+    const isMembershipEvent = MEMBERSHIP_EVENTS.has(eventType);
+    const isInvitationEvent = INVITATION_EVENTS.has(eventType);
+    const getClient = async () => args.convexClient ?? await getMasterControlConvexClient2();
+    if (isOrgLifecycleEvent) {
+      const nestedOrganization = asRecord26(data.organization);
+      const organizationRecord = Object.keys(nestedOrganization).length > 0 ? nestedOrganization : data;
+      const organizationId = readString28(data.id) || readString28(data.organization_id) || readString28(organizationRecord.id);
+      const organizationIds = extractOrganizationIds(data);
+      if (!organizationId) {
+        return webhookError(
+          "INVALID_REQUEST",
+          400,
+          "Clerk organization webhook payload missing organization id.",
+          args.correlationId,
+          args.policyTraceId
+        );
+      }
+      const client = await getClient();
+      const tenant = await resolveTenantByOrgSlug({
+        client,
+        organizationSlug: organizationIds.organizationSlug
+      });
+      if (!tenant) {
+        return webhookError(
+          "NOT_FOUND",
+          404,
+          "Could not resolve tenant for Clerk organization webhook event.",
+          args.correlationId,
+          args.policyTraceId,
+          {
+            eventType,
+            organizationId,
+            organizationSlug: organizationIds.organizationSlug
+          }
+        );
+      }
+      await upsertPermitTenant({
+        clerkOrganizationId: organizationId,
+        clerkOrganizationSlug: organizationIds.organizationSlug,
+        tenantKey: tenant.tenantSlug,
+        tenantName: extractOrganizationName(organizationRecord),
+        eventType,
+        eventAt: eventTimestamp,
+        actorId
+      });
+      const principal = await client.mutation(mcApi2.identity.upsertPrincipal, {
+        principalId: organizationId,
+        principalType: "group",
+        clerkId: organizationId,
+        displayName: extractOrganizationName(organizationRecord),
+        status: eventType === "organization.deleted" ? "disabled" : "active",
+        actorClerkId: actorId,
+        tenantId: tenant.tenantId,
+        metadata: buildWebhookMetadata({
+          eventType,
+          eventId,
+          actorId,
+          eventAt: eventTimestamp,
+          extra: {
+            sourceType: "organization",
+            organizationId,
+            organizationSlug: organizationIds.organizationSlug,
+            organizationName: extractOrganizationName(organizationRecord),
+            organizationStatus: eventType
+          }
+        })
+      });
+      const alias = await client.mutation(mcApi2.identity.upsertPrincipalIdentityAlias, {
+        principalId: organizationId,
+        principalRefId: void 0,
+        provider: "clerk",
+        providerProjectId: void 0,
+        externalSubjectId: organizationId,
+        tenantId: tenant.tenantId,
+        email: void 0,
+        metadata: buildWebhookMetadata({
+          eventType,
+          eventId,
+          actorId,
+          eventAt: eventTimestamp,
+          extra: {
+            sourceType: "organization",
+            organizationId,
+            organizationSlug: organizationIds.organizationSlug,
+            organizationName: extractOrganizationName(organizationRecord),
+            organizationStatus: eventType
+          }
+        }),
+        actorClerkId: actorId
+      });
+      return successResponse(
+        {
+          acknowledged: true,
+          eventType,
+          tenantId: tenant.tenantId,
+          principalId: organizationId,
+          principal,
+          alias
+        },
+        {
+          correlationId: args.correlationId,
+          policyTraceId: args.policyTraceId
+        }
+      );
+    }
+    if (isUserEvent) {
+      const client = await getClient();
+      const userData = extractUserData(data);
+      const userId = readString28(userData.id) || readString28(data.id);
+      if (!userId) {
+        return webhookError(
+          "INVALID_REQUEST",
+          400,
+          "Clerk user webhook payload missing user id.",
+          args.correlationId,
+          args.policyTraceId
+        );
+      }
+      await syncPermitUser({
+        userId,
+        email: readPrimaryEmail(userData),
+        displayName: readDisplayName(userData),
+        eventType,
+        eventAt: eventTimestamp,
+        actorId
+      });
+      const principal = await client.mutation(mcApi2.identity.upsertPrincipal, {
+        principalId: userId,
+        principalType: "user",
+        clerkId: userId,
+        email: readPrimaryEmail(userData),
+        displayName: readDisplayName(userData),
+        status: eventType === "user.deleted" ? "disabled" : "active",
+        actorClerkId: actorId,
+        metadata: buildWebhookMetadata({
+          eventType,
+          eventId,
+          actorId,
+          eventAt: eventTimestamp,
+          extra: {
+            userId,
+            clerkStatus: eventType,
+            user: userData
+          }
+        })
+      });
+      const alias = await client.mutation(mcApi2.identity.upsertPrincipalIdentityAlias, {
+        principalId: userId,
+        principalRefId: void 0,
+        provider: "clerk",
+        providerProjectId: void 0,
+        externalSubjectId: userId,
+        tenantId: void 0,
+        email: readPrimaryEmail(userData),
+        metadata: buildWebhookMetadata({
+          eventType,
+          eventId,
+          actorId,
+          eventAt: eventTimestamp,
+          extra: {
+            userId,
+            sourceType: "user",
+            status: eventType,
+            email: readPrimaryEmail(userData),
+            displayName: readDisplayName(userData)
+          }
+        }),
+        actorClerkId: actorId
+      });
+      return successResponse(
+        {
+          acknowledged: true,
+          eventType,
+          principal,
+          alias,
+          source: {
+            eventType,
+            eventId
+          }
+        },
+        {
+          correlationId: args.correlationId,
+          policyTraceId: args.policyTraceId
+        }
+      );
+    }
+    if (isMembershipEvent || isInvitationEvent) {
+      const client = await getClient();
+      const org = extractOrganizationIds(data);
+      const tenant = await resolveTenantByOrgSlug({
+        client,
+        organizationSlug: org.organizationSlug
+      });
+      if (!tenant) {
+        return webhookError(
+          "NOT_FOUND",
+          404,
+          "Could not resolve tenant for Clerk organization webhook event.",
+          args.correlationId,
+          args.policyTraceId,
+          {
+            eventType,
+            organizationId: org.organizationId,
+            organizationSlug: org.organizationSlug
+          }
+        );
+      }
+      const userId = readString28(data.user_id) || readString28(asRecord26(data.public_user_data).user_id) || readString28(asRecord26(data.user).id);
+      const rawRole = readString28(data.role);
+      const role = normalizeRole(rawRole);
+      const permitTenantKey = tenant.tenantSlug;
+      if (!permitTenantKey) {
+        return webhookError(
+          "INVALID_REQUEST",
+          400,
+          "Clerk organization webhook payload missing organization tenant key.",
+          args.correlationId,
+          args.policyTraceId
+        );
+      }
+      if (INVITATION_EVENTS.has(eventType)) {
+        const invitationId = readString28(data.id);
+        const invitationAccepted = eventType === "organizationInvitation.accepted";
+        const invitationRevoked = eventType === "organizationInvitation.revoked";
+        let fallbackInvitationStatus = "created";
+        if (invitationAccepted) {
+          fallbackInvitationStatus = "accepted";
+        } else if (invitationRevoked) {
+          fallbackInvitationStatus = "revoked";
+        }
+        const invitationStatus = readString28(data.status) || fallbackInvitationStatus;
+        if (!invitationId) {
+          return webhookError(
+            "INVALID_REQUEST",
+            400,
+            "Clerk organization invitation webhook payload missing invitation id.",
+            args.correlationId,
+            args.policyTraceId
+          );
+        }
+        if (userId) {
+          const userEmail = readPrimaryEmail(asRecord26(data.public_user_data));
+          await syncPermitUser({
+            userId,
+            email: userEmail,
+            displayName: void 0,
+            eventType,
+            eventAt: eventTimestamp,
+            actorId
+          });
+          const existingPrincipal = invitationAccepted ? null : await client.query(mcApi2.identity.getPrincipalByPrincipalId, {
+            principalId: userId
+          });
+          const principalStatus = invitationAccepted ? "active" : readString28(asRecord26(existingPrincipal).status) ?? "invited";
+          await client.mutation(mcApi2.identity.upsertPrincipal, {
+            principalId: userId,
+            principalType: "user",
+            clerkId: userId,
+            actorClerkId: actorId,
+            status: principalStatus,
+            metadata: buildWebhookMetadata({
+              eventType,
+              eventId,
+              actorId,
+              eventAt: eventTimestamp,
+              extra: {
+                sourceType: "organization_invitation",
+                invitationId,
+                organizationId: org.organizationId,
+                organizationSlug: org.organizationSlug,
+                membershipId: readString28(data.membership_id),
+                role,
+                tenantId: tenant.tenantId
+              }
+            })
+          });
+          if (invitationAccepted) {
+            await upsertPermitTenantMembershipRole({
+              userId,
+              tenantKey: permitTenantKey,
+              role
+            });
+            await client.mutation(mcApi2.identity.upsertMembership, {
+              principalId: userId,
+              principalRefId: void 0,
+              tenantId: tenant.tenantId,
+              role,
+              source: "api",
+              actorClerkId: actorId
+            });
+          }
+          await client.mutation(mcApi2.identity.upsertPrincipalIdentityAlias, {
+            principalId: userId,
+            principalRefId: void 0,
+            provider: "clerk",
+            providerProjectId: void 0,
+            externalSubjectId: userId,
+            tenantId: tenant.tenantId,
+            email: readPrimaryEmail(asRecord26(data.public_user_data)),
+            metadata: buildWebhookMetadata({
+              eventType,
+              eventId,
+              actorId,
+              eventAt: eventTimestamp,
+              extra: {
+                sourceType: "organization_invitation",
+                organizationId: org.organizationId,
+                organizationSlug: org.organizationSlug,
+                invitationId,
+                invitationStatus,
+                role,
+                tenantId: tenant.tenantId,
+                membershipId: readString28(data.membership_id)
+              }
+            }),
+            actorClerkId: actorId
+          });
+          if (invitationRevoked) {
+            await revokePermitTenantMembershipRoles({
+              userId,
+              tenantKey: permitTenantKey
+            });
+            const existing = await client.query(mcApi2.identity.getMembershipForPrincipal, {
+              principalId: userId,
+              tenantId: tenant.tenantId,
+              workspaceId: void 0
+            });
+            if (existing) {
+              await client.mutation(mcApi2.identity.revokeMembership, {
+                membershipId: existing._id,
+                actorClerkId: actorId
+              });
+            }
+          }
+        }
+        return successResponse(
+          {
+            acknowledged: true,
+            eventType,
+            tenantId: tenant.tenantId,
+            principalId: userId,
+            invitationId,
+            userMatched: Boolean(userId),
+            skipped: userId ? void 0 : "no_user_reference"
+          },
+          {
+            correlationId: args.correlationId,
+            policyTraceId: args.policyTraceId
+          }
+        );
+      }
+      if (!userId) {
+        return webhookError(
+          "INVALID_REQUEST",
+          400,
+          "Clerk membership webhook payload missing user id.",
+          args.correlationId,
+          args.policyTraceId
+        );
+      }
+      await syncPermitUser({
+        userId,
+        email: readPrimaryEmail(asRecord26(data.public_user_data)),
+        displayName: void 0,
+        eventType,
+        eventAt: eventTimestamp,
+        actorId
+      });
+      await client.mutation(mcApi2.identity.upsertPrincipal, {
+        principalId: userId,
+        principalType: "user",
+        clerkId: userId,
+        actorClerkId: actorId,
+        status: "active",
+        metadata: buildWebhookMetadata({
+          eventType,
+          eventId,
+          actorId,
+          eventAt: eventTimestamp,
+          extra: {
+            sourceType: "organization_membership",
+            organizationId: org.organizationId,
+            organizationSlug: org.organizationSlug,
+            membershipId: readString28(data.id),
+            role,
+            tenantId: tenant.tenantId
+          }
+        })
+      });
+      await client.mutation(mcApi2.identity.upsertPrincipalIdentityAlias, {
+        principalId: userId,
+        principalRefId: void 0,
+        provider: "clerk",
+        providerProjectId: void 0,
+        externalSubjectId: userId,
+        tenantId: tenant.tenantId,
+        email: readPrimaryEmail(asRecord26(data.public_user_data)),
+        metadata: buildWebhookMetadata({
+          eventType,
+          eventId,
+          actorId,
+          eventAt: eventTimestamp,
+          extra: {
+            sourceType: "organization_membership",
+            organizationId: org.organizationId,
+            organizationSlug: org.organizationSlug,
+            membershipId: readString28(data.id),
+            role,
+            tenantId: tenant.tenantId,
+            organizationEventType: eventType
+          }
+        }),
+        actorClerkId: actorId
+      });
+      if (eventType === "organizationMembership.deleted") {
+        await revokePermitTenantMembershipRoles({
+          userId,
+          tenantKey: permitTenantKey
+        });
+        const existing = await client.query(mcApi2.identity.getMembershipForPrincipal, {
+          principalId: userId,
+          tenantId: tenant.tenantId,
+          workspaceId: void 0
+        });
+        if (!existing) {
+          return successResponse(
+            {
+              acknowledged: true,
+              eventType,
+              principalId: userId,
+              tenantId: tenant.tenantId,
+              skipped: "membership_not_found"
+            },
+            {
+              correlationId: args.correlationId,
+              policyTraceId: args.policyTraceId
+            }
+          );
+        }
+        const revoked = await client.mutation(mcApi2.identity.revokeMembership, {
+          membershipId: existing._id,
+          actorClerkId: actorId
+        });
+        return successResponse(
+          {
+            acknowledged: true,
+            eventType,
+            tenantId: tenant.tenantId,
+            principalId: userId,
+            revoked
+          },
+          {
+            correlationId: args.correlationId,
+            policyTraceId: args.policyTraceId
+          }
+        );
+      }
+      const membership = await client.mutation(mcApi2.identity.upsertMembership, {
+        principalId: userId,
+        principalRefId: void 0,
+        tenantId: tenant.tenantId,
+        role,
+        source: "api",
+        actorClerkId: actorId
+      });
+      await upsertPermitTenantMembershipRole({
+        userId,
+        tenantKey: permitTenantKey,
+        role
+      });
+      return successResponse(
+        {
+          acknowledged: true,
+          eventType,
+          tenantId: tenant.tenantId,
+          principalId: userId,
+          membership
+        },
+        {
+          correlationId: args.correlationId,
+          policyTraceId: args.policyTraceId
+        }
+      );
+    }
+    return successResponse(
+      {
+        acknowledged: true,
+        eventType,
+        reason: "Unsupported Clerk event type"
+      },
+      {
+        correlationId: args.correlationId,
+        policyTraceId: args.policyTraceId
+      }
+    );
+  } catch (error) {
+    return handleClerkWebhookError(error, args.correlationId, args.policyTraceId);
+  }
+}
 
 // ../../apps/gateway/src/routes/questions.ts
-function asRecord26(value) {
+function asRecord27(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString28(value) {
+function readString29(value) {
   if (typeof value !== "string") {
     return void 0;
   }
   const normalized = value.trim();
   return normalized.length > 0 ? normalized : void 0;
 }
-function readNumber18(value) {
+function readNumber19(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function readStringArray14(value) {
   if (!Array.isArray(value)) {
     return void 0;
   }
-  const items = value.map((entry) => readString28(entry)).filter((entry) => Boolean(entry));
+  const items = value.map((entry) => readString29(entry)).filter((entry) => Boolean(entry));
   return items.length > 0 ? items : void 0;
 }
 async function handleQuestionCreate(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await createQuestionFromGatewayAuth(args.authContext, {
-      topicId: readString28(body.topicId),
-      text: readString28(body.text) ?? "",
-      priority: readString28(body.priority),
-      linkedBeliefId: readString28(body.linkedBeliefId),
-      metadata: asRecord26(body.metadata)
+      topicId: readString29(body.topicId),
+      text: readString29(body.text) ?? "",
+      priority: readString29(body.priority),
+      linkedBeliefId: readString29(body.linkedBeliefId),
+      metadata: asRecord27(body.metadata)
     });
     return successResponse(payload, {
       status: 201,
@@ -27279,10 +28528,10 @@ async function handleQuestionGet(args) {
 }
 async function handleQuestionArchive(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await archiveQuestionFromGatewayAuth(args.authContext, {
       id: args.questionId,
-      rationale: readString28(body.reason) ?? readString28(body.rationale)
+      rationale: readString29(body.reason) ?? readString29(body.rationale)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27325,13 +28574,13 @@ async function handleQuestionList(args) {
 }
 async function handleQuestionAnswer(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await answerQuestionFromGatewayAuth(args.authContext, {
       id: args.questionId,
-      text: readString28(body.text) ?? "",
-      confidence: readString28(body.confidence),
+      text: readString29(body.text) ?? "",
+      confidence: readString29(body.confidence),
       evidenceIds: readStringArray14(body.evidenceIds),
-      rationale: readString28(body.rationale)
+      rationale: readString29(body.rationale)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27377,11 +28626,11 @@ async function handleQuestionGetAnswer(args) {
 }
 async function handleQuestionRefine(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await refineQuestionFromGatewayAuth(args.authContext, {
       id: args.questionId,
-      text: readString28(body.text) ?? "",
-      rationale: readString28(body.rationale)
+      text: readString29(body.text) ?? "",
+      rationale: readString29(body.rationale)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27403,11 +28652,11 @@ async function handleQuestionRefine(args) {
 }
 async function handleQuestionUpdateStatus(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await updateQuestionStatusFromGatewayAuth(args.authContext, {
       id: args.questionId,
-      status: readString28(body.status) ?? "",
-      rationale: readString28(body.rationale)
+      status: readString29(body.status) ?? "",
+      rationale: readString29(body.rationale)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27432,19 +28681,19 @@ async function handleQuestionUpdateStatus(args) {
 }
 async function handleQuestionBatchCreate(args) {
   try {
-    const body = asRecord26(args.body);
-    const questions = Array.isArray(body.questions) ? body.questions.map((entry) => asRecord26(entry)).map((entry) => ({
-      question: readString28(entry.question) ?? readString28(entry.text) ?? "",
-      category: readString28(entry.category),
-      priority: readString28(entry.priority),
-      linkedBeliefNodeId: readString28(entry.linkedBeliefNodeId) ?? readString28(entry.linkedBeliefId),
-      linkedWorktreeId: readString28(entry.linkedWorktreeId),
-      testType: readString28(entry.testType)
+    const body = asRecord27(args.body);
+    const questions = Array.isArray(body.questions) ? body.questions.map((entry) => asRecord27(entry)).map((entry) => ({
+      question: readString29(entry.question) ?? readString29(entry.text) ?? "",
+      category: readString29(entry.category),
+      priority: readString29(entry.priority),
+      linkedBeliefNodeId: readString29(entry.linkedBeliefNodeId) ?? readString29(entry.linkedBeliefId),
+      linkedWorktreeId: readString29(entry.linkedWorktreeId),
+      testType: readString29(entry.testType)
     })) : [];
     const payload = await createQuestionsBatchFromGatewayAuth(args.authContext, {
-      topicId: readString28(body.topicId),
+      topicId: readString29(body.topicId),
       questions,
-      source: readString28(body.source)
+      source: readString29(body.source)
     });
     return successResponse(payload, {
       status: 201,
@@ -27470,20 +28719,20 @@ async function handleQuestionBatchCreate(args) {
 }
 async function handleQuestionAdd(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await addQuestionFromGatewayAuth(args.authContext, {
-      topicId: readString28(body.topicId),
-      question: readString28(body.question) ?? readString28(body.text),
-      category: readString28(body.category),
-      priority: readString28(body.priority),
-      source: readString28(body.source),
-      beliefId: readString28(body.beliefId) ?? readString28(body.linkedBeliefId),
-      linkedWorktreeId: readString28(body.linkedWorktreeId),
-      chatId: readString28(body.chatId),
-      importance: readNumber18(body.importance),
-      epistemicUnlock: readString28(body.epistemicUnlock),
-      metadata: asRecord26(body.metadata),
-      questionType: readString28(body.questionType)
+      topicId: readString29(body.topicId),
+      question: readString29(body.question) ?? readString29(body.text),
+      category: readString29(body.category),
+      priority: readString29(body.priority),
+      source: readString29(body.source),
+      beliefId: readString29(body.beliefId) ?? readString29(body.linkedBeliefId),
+      linkedWorktreeId: readString29(body.linkedWorktreeId),
+      chatId: readString29(body.chatId),
+      importance: readNumber19(body.importance),
+      epistemicUnlock: readString29(body.epistemicUnlock),
+      metadata: asRecord27(body.metadata),
+      questionType: readString29(body.questionType)
     });
     return successResponse(payload, {
       status: 201,
@@ -27506,12 +28755,12 @@ async function handleQuestionAdd(args) {
 }
 async function handleQuestionUpdatePriority(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await updateQuestionPriorityFromGatewayAuth(
       args.authContext,
       {
-        id: readString28(body.id) ?? readString28(body.nodeId) ?? readString28(body.questionId),
-        priority: readString28(body.priority) ?? "medium"
+        id: readString29(body.id) ?? readString29(body.nodeId) ?? readString29(body.questionId),
+        priority: readString29(body.priority) ?? "medium"
       }
     );
     return successResponse(payload, {
@@ -27537,12 +28786,12 @@ async function handleQuestionUpdatePriority(args) {
 }
 async function handleQuestionAdvanceToConviction(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await advanceQuestionToConvictionFromGatewayAuth(
       args.authContext,
       {
-        questionId: readString28(body.questionId) ?? readString28(body.id) ?? readString28(body.nodeId),
-        worktreeId: readString28(body.worktreeId)
+        questionId: readString29(body.questionId) ?? readString29(body.id) ?? readString29(body.nodeId),
+        worktreeId: readString29(body.worktreeId)
       }
     );
     return successResponse(payload, {
@@ -27568,14 +28817,14 @@ async function handleQuestionAdvanceToConviction(args) {
 }
 async function handleQuestionUpdateConviction(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await updateQuestionConvictionFromGatewayAuth(
       args.authContext,
       {
-        questionId: readString28(body.questionId) ?? readString28(body.id) ?? readString28(body.nodeId),
-        conviction: readNumber18(body.conviction),
-        answerCompleteness: readString28(body.answerCompleteness),
-        convictionRationale: readString28(body.convictionRationale)
+        questionId: readString29(body.questionId) ?? readString29(body.id) ?? readString29(body.nodeId),
+        conviction: readNumber19(body.conviction),
+        answerCompleteness: readString29(body.answerCompleteness),
+        convictionRationale: readString29(body.convictionRationale)
       }
     );
     return successResponse(payload, {
@@ -27601,16 +28850,16 @@ async function handleQuestionUpdateConviction(args) {
 }
 async function handleQuestionFinalizeConviction(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await finalizeQuestionConvictionFromGatewayAuth(
       args.authContext,
       {
-        questionId: readString28(body.questionId) ?? readString28(body.id) ?? readString28(body.nodeId),
-        conviction: readNumber18(body.conviction) ?? Number.NaN,
-        answer: readString28(body.answer) ?? "",
-        convictionRationale: readString28(body.convictionRationale),
-        answerCompleteness: readString28(body.answerCompleteness),
-        whatWeNeed: readString28(body.whatWeNeed)
+        questionId: readString29(body.questionId) ?? readString29(body.id) ?? readString29(body.nodeId),
+        conviction: readNumber19(body.conviction) ?? Number.NaN,
+        answer: readString29(body.answer) ?? "",
+        convictionRationale: readString29(body.convictionRationale),
+        answerCompleteness: readString29(body.answerCompleteness),
+        whatWeNeed: readString29(body.whatWeNeed)
       }
     );
     return successResponse(payload, {
@@ -27636,12 +28885,12 @@ async function handleQuestionFinalizeConviction(args) {
 }
 async function handleQuestionUpdate(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await updateQuestionFromGatewayAuth(args.authContext, {
-      questionId: readString28(body.questionId) ?? readString28(body.id) ?? readString28(body.nodeId),
-      question: readString28(body.question) ?? readString28(body.text),
-      category: readString28(body.category),
-      priority: readString28(body.priority)
+      questionId: readString29(body.questionId) ?? readString29(body.id) ?? readString29(body.nodeId),
+      question: readString29(body.question) ?? readString29(body.text),
+      category: readString29(body.category),
+      priority: readString29(body.priority)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27663,9 +28912,9 @@ async function handleQuestionUpdate(args) {
 }
 async function handleQuestionDelete(args) {
   try {
-    const body = asRecord26(args.body);
+    const body = asRecord27(args.body);
     const payload = await deleteQuestionFromGatewayAuth(args.authContext, {
-      questionId: readString28(body.questionId) ?? readString28(body.id) ?? readString28(body.nodeId)
+      questionId: readString29(body.questionId) ?? readString29(body.id) ?? readString29(body.nodeId)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27687,30 +28936,30 @@ async function handleQuestionDelete(args) {
 }
 
 // ../../apps/gateway/src/routes/search.ts
-function asRecord27(value) {
+function asRecord28(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString29(value) {
+function readString30(value) {
   if (typeof value !== "string") {
     return void 0;
   }
   const normalized = value.trim();
   return normalized.length > 0 ? normalized : void 0;
 }
-function readNumber19(value) {
+function readNumber20(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function readStringArray15(value) {
   if (!Array.isArray(value)) {
     return void 0;
   }
-  const items = value.map((entry) => readString29(entry)).filter((entry) => Boolean(entry));
+  const items = value.map((entry) => readString30(entry)).filter((entry) => Boolean(entry));
   return items.length > 0 ? items : void 0;
 }
 async function handleSearchResources(args) {
-  const body = asRecord27(args.body);
-  const q = readString29(body.q) ?? readString29(body.query);
-  const topicId = readString29(body.topicId) ?? readString29(body.projectId);
+  const body = asRecord28(args.body);
+  const q = readString30(body.q) ?? readString30(body.query);
+  const topicId = readString30(body.topicId) ?? readString30(body.projectId);
   if (!q) {
     return errorResponse({
       code: "INVALID_REQUEST",
@@ -27734,10 +28983,10 @@ async function handleSearchResources(args) {
       q,
       topicId,
       types: readStringArray15(body.types),
-      status: readString29(body.status),
-      minConfidence: readNumber19(body.minConfidence),
-      limit: readNumber19(body.limit),
-      cursor: readString29(body.cursor)
+      status: readString30(body.status),
+      minConfidence: readNumber20(body.minConfidence),
+      limit: readNumber20(body.limit),
+      cursor: readString30(body.cursor)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27759,17 +29008,17 @@ async function handleSearchResources(args) {
 }
 
 // ../../apps/gateway/src/routes/sources.ts
-function asRecord28(value) {
+function asRecord29(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString30(value) {
+function readString31(value) {
   if (typeof value !== "string") {
     return void 0;
   }
   const normalized = value.trim();
   return normalized.length > 0 ? normalized : void 0;
 }
-function readNumber20(value) {
+function readNumber21(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function handleSourcesError(error, fallbackMessage, correlationId, policyTraceId) {
@@ -27787,15 +29036,15 @@ function handleSourcesError(error, fallbackMessage, correlationId, policyTraceId
 }
 async function handleSourceUpsert(args) {
   try {
-    const body = asRecord28(args.body);
+    const body = asRecord29(args.body);
     const payload = await upsertSourceFromGatewayAuth(args.authContext, {
-      url: readString30(body.url),
-      sha: readString30(body.sha),
-      kind: readString30(body.kind) ?? "",
-      title: readString30(body.title),
-      capturedAt: readNumber20(body.capturedAt),
-      topicId: readString30(body.topicId),
-      metadata: asRecord28(body.metadata)
+      url: readString31(body.url),
+      sha: readString31(body.sha),
+      kind: readString31(body.kind) ?? "",
+      title: readString31(body.title),
+      capturedAt: readNumber21(body.capturedAt),
+      topicId: readString31(body.topicId),
+      metadata: asRecord29(body.metadata)
     });
     return successResponse(payload, {
       status: 201,
@@ -27829,10 +29078,10 @@ async function handleSourceGet(args) {
 }
 
 // ../../apps/gateway/src/routes/tasks.ts
-function asRecord29(value) {
+function asRecord30(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString31(value) {
+function readString32(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -27854,18 +29103,18 @@ function handleTasksError(error, fallbackMessage, correlationId, policyTraceId)
 }
 async function handleTaskCreate(args) {
   try {
-    const body = asRecord29(args.body);
+    const body = asRecord30(args.body);
     const payload = await createTaskFromGatewayAuth(args.authContext, {
-      topicId: readString31(body.topicId),
-      title: readString31(body.title) ?? "",
-      description: readString31(body.description),
-      taskType: readString31(body.taskType),
-      priority: readString31(body.priority),
-      status: readString31(body.status),
-      linkedBeliefId: readString31(body.linkedBeliefId),
-      linkedQuestionId: readString31(body.linkedQuestionId),
-      linkedWorktreeId: readString31(body.linkedWorktreeId),
-      tags: Array.isArray(body.tags) ? body.tags.map((entry) => readString31(entry)).filter((entry) => Boolean(entry)) : void 0,
+      topicId: readString32(body.topicId),
+      title: readString32(body.title) ?? "",
+      description: readString32(body.description),
+      taskType: readString32(body.taskType),
+      priority: readString32(body.priority),
+      status: readString32(body.status),
+      linkedBeliefId: readString32(body.linkedBeliefId),
+      linkedQuestionId: readString32(body.linkedQuestionId),
+      linkedWorktreeId: readString32(body.linkedWorktreeId),
+      tags: Array.isArray(body.tags) ? body.tags.map((entry) => readString32(entry)).filter((entry) => Boolean(entry)) : void 0,
       metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata) ? body.metadata : void 0
     });
     return successResponse(payload, {
@@ -27900,16 +29149,16 @@ async function handleTaskList(args) {
 }
 async function handleTaskUpdate(args) {
   try {
-    const body = asRecord29(args.body);
+    const body = asRecord30(args.body);
     const payload = await updateTaskFromGatewayAuth(args.authContext, {
       id: args.taskId,
-      title: readString31(body.title),
-      description: readString31(body.description),
-      priority: readString31(body.priority),
-      status: readString31(body.status),
-      linkedBeliefId: readString31(body.linkedBeliefId),
-      linkedQuestionId: readString31(body.linkedQuestionId),
-      linkedWorktreeId: readString31(body.linkedWorktreeId),
+      title: readString32(body.title),
+      description: readString32(body.description),
+      priority: readString32(body.priority),
+      status: readString32(body.status),
+      linkedBeliefId: readString32(body.linkedBeliefId),
+      linkedQuestionId: readString32(body.linkedQuestionId),
+      linkedWorktreeId: readString32(body.linkedWorktreeId),
       metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata) ? body.metadata : void 0
     });
     return successResponse(payload, {
@@ -27927,10 +29176,10 @@ async function handleTaskUpdate(args) {
 }
 async function handleTaskComplete(args) {
   try {
-    const body = asRecord29(args.body);
+    const body = asRecord30(args.body);
     const payload = await completeTaskFromGatewayAuth(args.authContext, {
       id: args.taskId,
-      outputSummary: readString31(body.outputSummary)
+      outputSummary: readString32(body.outputSummary)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -27947,10 +29196,10 @@ async function handleTaskComplete(args) {
 }
 
 // ../../apps/gateway/src/routes/topics.ts
-function asRecord30(value) {
+function asRecord31(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString32(value) {
+function readString33(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -27960,14 +29209,14 @@ function readString32(value) {
 function readBoolean(value) {
   return typeof value === "boolean" ? value : void 0;
 }
-function readNumber21(value) {
+function readNumber22(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function readStringArray16(value) {
   if (!Array.isArray(value)) {
     return void 0;
   }
-  const items = value.map((entry) => readString32(entry)).filter((entry) => Boolean(entry));
+  const items = value.map((entry) => readString33(entry)).filter((entry) => Boolean(entry));
   return items.length > 0 ? items : void 0;
 }
 function handleTopicsError(error, fallbackMessage, correlationId, policyTraceId) {
@@ -27985,17 +29234,17 @@ function handleTopicsError(error, fallbackMessage, correlationId, policyTraceId)
 }
 async function handleTopicCreate(args) {
   try {
-    const body = asRecord30(args.body);
+    const body = asRecord31(args.body);
     const payload = await createTopicFromGatewayAuth(args.authContext, {
-      name: readString32(body.name) ?? "",
-      description: readString32(body.description),
-      type: readString32(body.type),
-      parentTopicId: readString32(body.parentTopicId),
-      ontologyId: readString32(body.ontologyId),
-      tenantId: readString32(body.tenantId),
-      workspaceId: readString32(body.workspaceId),
-      visibility: readString32(body.visibility),
-      createdBy: readString32(body.createdBy)
+      name: readString33(body.name) ?? "",
+      description: readString33(body.description),
+      type: readString33(body.type),
+      parentTopicId: readString33(body.parentTopicId),
+      ontologyId: readString33(body.ontologyId),
+      tenantId: readString33(body.tenantId),
+      workspaceId: readString33(body.workspaceId),
+      visibility: readString33(body.visibility),
+      createdBy: readString33(body.createdBy)
     });
     return successResponse(payload, {
       status: 201,
@@ -28013,16 +29262,16 @@ async function handleTopicCreate(args) {
 }
 async function handleTopicUpdate(args) {
   try {
-    const body = asRecord30(args.body);
+    const body = asRecord31(args.body);
     const payload = await updateTopicFromGatewayAuth(args.authContext, {
       id: args.topicId,
-      name: readString32(body.name),
-      description: readString32(body.description),
-      type: readString32(body.type),
-      ontologyId: readString32(body.ontologyId),
+      name: readString33(body.name),
+      description: readString33(body.description),
+      type: readString33(body.type),
+      ontologyId: readString33(body.ontologyId),
       clearOntologyId: readBoolean(body.clearOntologyId),
-      status: readString32(body.status),
-      visibility: readString32(body.visibility)
+      status: readString33(body.status),
+      visibility: readString33(body.visibility)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28073,7 +29322,7 @@ async function handleTopicTree(args) {
   try {
     const payload = await getTopicTreeFromGatewayAuth(args.authContext, {
       id: args.topicId,
-      maxDepth: readNumber21(args.query.maxDepth)
+      maxDepth: readNumber22(args.query.maxDepth)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28093,7 +29342,7 @@ async function handleTopicCoverage(args) {
     const payload = await getTopicCoverageFromGatewayAuth(args.authContext, {
       id: args.topicId,
       includeDescendants: typeof args.query.includeDescendants === "boolean" ? args.query.includeDescendants : void 0,
-      maxDepth: readNumber21(args.query.maxDepth)
+      maxDepth: readNumber22(args.query.maxDepth)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28110,9 +29359,9 @@ async function handleTopicCoverage(args) {
 }
 async function handleTopicRemove(args) {
   try {
-    const body = asRecord30(args.body);
+    const body = asRecord31(args.body);
     const payload = await removeTopicFromGatewayAuth(args.authContext, {
-      id: readString32(body.id) ?? readString32(body.topicId) ?? ""
+      id: readString33(body.id) ?? readString33(body.topicId) ?? ""
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28129,22 +29378,22 @@ async function handleTopicRemove(args) {
 }
 async function handleTopicBulkCreate(args) {
   try {
-    const body = asRecord30(args.body);
-    const topics2 = Array.isArray(body.topics) ? body.topics.map((entry) => asRecord30(entry)).map((entry) => ({
-      globalId: readString32(entry.globalId) ?? "",
-      name: readString32(entry.name) ?? "",
-      description: readString32(entry.description),
-      type: readString32(entry.type) ?? "theme",
-      parentTopicId: readString32(entry.parentTopicId),
-      depth: readNumber21(entry.depth) ?? 0,
+    const body = asRecord31(args.body);
+    const topics2 = Array.isArray(body.topics) ? body.topics.map((entry) => asRecord31(entry)).map((entry) => ({
+      globalId: readString33(entry.globalId) ?? "",
+      name: readString33(entry.name) ?? "",
+      description: readString33(entry.description),
+      type: readString33(entry.type) ?? "theme",
+      parentTopicId: readString33(entry.parentTopicId),
+      depth: readNumber22(entry.depth) ?? 0,
       path: readStringArray16(entry.path) ?? [],
-      tenantId: readString32(entry.tenantId),
-      workspaceId: readString32(entry.workspaceId),
-      graphScopeProjectId: readString32(entry.graphScopeProjectId),
-      status: readString32(entry.status) ?? "active",
-      visibility: readString32(entry.visibility),
-      metadata: asRecord30(entry.metadata),
-      createdBy: readString32(entry.createdBy)
+      tenantId: readString33(entry.tenantId),
+      workspaceId: readString33(entry.workspaceId),
+      graphScopeProjectId: readString33(entry.graphScopeProjectId),
+      status: readString33(entry.status) ?? "active",
+      visibility: readString33(entry.visibility),
+      metadata: asRecord31(entry.metadata),
+      createdBy: readString33(entry.createdBy)
     })) : [];
     const payload = await bulkCreateTopicsFromGatewayAuth(args.authContext, {
       topics: topics2
@@ -28165,10 +29414,10 @@ async function handleTopicBulkCreate(args) {
 }
 
 // ../../apps/gateway/src/routes/webhooks.ts
-function asRecord31(value) {
+function asRecord32(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString33(value) {
+function readString34(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -28182,7 +29431,7 @@ function readStringArray17(value) {
   if (!Array.isArray(value)) {
     return void 0;
   }
-  const normalized = value.map((entry) => readString33(entry)).filter((entry) => Boolean(entry));
+  const normalized = value.map((entry) => readString34(entry)).filter((entry) => Boolean(entry));
   return normalized.length > 0 ? normalized : void 0;
 }
 function handleWebhooksError(error, fallbackMessage, correlationId, policyTraceId) {
@@ -28200,16 +29449,16 @@ function handleWebhooksError(error, fallbackMessage, correlationId, policyTraceI
 }
 async function handleWebhookCreate(args) {
   try {
-    const body = asRecord31(args.body);
+    const body = asRecord32(args.body);
     const payload = await args.authContext.convex.mutation(
       "events:createWebhook",
       {
         tenantId: args.authContext.tenantId,
         workspaceId: args.authContext.workspaceId,
-        topicId: readString33(body.topicId),
-        url: readString33(body.url) ?? "",
+        topicId: readString34(body.topicId),
+        url: readString34(body.url) ?? "",
         events: readStringArray17(body.events) ?? [],
-        secret: readString33(body.secret) ?? "",
+        secret: readString34(body.secret) ?? "",
         active: readBoolean2(body.active),
         createdBy: args.authContext.principalId ?? args.authContext.userId
       }
@@ -28270,17 +29519,17 @@ async function handleWebhookGet(args) {
 }
 async function handleWebhookUpdate(args) {
   try {
-    const body = asRecord31(args.body);
+    const body = asRecord32(args.body);
     const payload = await args.authContext.convex.mutation(
       "events:updateWebhook",
       {
         webhookId: args.webhookId,
         tenantId: args.authContext.tenantId,
         workspaceId: args.authContext.workspaceId,
-        url: readString33(body.url),
+        url: readString34(body.url),
         events: readStringArray17(body.events),
-        secret: readString33(body.secret),
-        topicId: readString33(body.topicId),
+        secret: readString34(body.secret),
+        topicId: readString34(body.topicId),
         clearTopicId: body.topicId === null ? true : readBoolean2(body.clearTopicId),
         active: readBoolean2(body.active),
         updatedBy: args.authContext.principalId ?? args.authContext.userId
@@ -28324,12 +29573,12 @@ async function handleWebhookDelete(args) {
 }
 async function handleWebhookTest(args) {
   try {
-    const body = asRecord31(args.body);
+    const body = asRecord32(args.body);
     const payload = await args.authContext.convex.action("events:testWebhook", {
       webhookId: args.webhookId,
       tenantId: args.authContext.tenantId,
       workspaceId: args.authContext.workspaceId,
-      topicId: readString33(body.topicId),
+      topicId: readString34(body.topicId),
       actorId: args.authContext.principalId ?? args.authContext.userId,
       actorType: inferActorType({
         authMode: args.authContext.authMode,
@@ -28399,31 +29648,31 @@ async function handleWebhookHealth(args) {
 }
 
 // ../../apps/gateway/src/routes/worktrees.ts
-function asRecord32(value) {
+function asRecord33(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString34(value) {
+function readString35(value) {
   if (typeof value !== "string") {
     return void 0;
   }
   const normalized = value.trim();
   return normalized.length > 0 ? normalized : void 0;
 }
-function readNumber22(value) {
+function readNumber23(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function readStringArray18(value) {
   if (!Array.isArray(value)) {
     return void 0;
   }
-  const normalized = value.map((entry) => readString34(entry)).filter((entry) => Boolean(entry));
+  const normalized = value.map((entry) => readString35(entry)).filter((entry) => Boolean(entry));
   return normalized.length > 0 ? normalized : void 0;
 }
 function readObjectArray(value) {
   if (!Array.isArray(value)) {
     return void 0;
   }
-  const normalized = value.map((entry) => asRecord32(entry)).filter((entry) => Object.keys(entry).length > 0);
+  const normalized = value.map((entry) => asRecord33(entry)).filter((entry) => Object.keys(entry).length > 0);
   return normalized.length > 0 ? normalized : void 0;
 }
 function readConfidenceImpact(value) {
@@ -28434,18 +29683,18 @@ function normalizeMergeOutcomes2(value) {
     return [];
   }
   return value.map((entry) => {
-    const finding = readString34(entry);
+    const finding = readString35(entry);
     if (finding) {
       return finding;
     }
-    const row = asRecord32(entry);
+    const row = asRecord33(entry);
     if (!Object.keys(row).length) {
       return null;
     }
     return {
-      beliefId: readString34(row.beliefId) ?? "",
-      confidence: readNumber22(row.confidence) ?? Number.NaN,
-      rationale: readString34(row.rationale) ?? ""
+      beliefId: readString35(row.beliefId) ?? "",
+      confidence: readNumber23(row.confidence) ?? Number.NaN,
+      rationale: readString35(row.rationale) ?? ""
     };
   }).filter((entry) => entry !== null);
 }
@@ -28464,22 +29713,22 @@ function handleWorktreesError(error, fallbackMessage, correlationId, policyTrace
 }
 async function handleWorktreeCreate(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const goCriteria = readStringArray18(body.goCriteria);
     const noGoSignals = readStringArray18(body.noGoSignals);
     const payload = await createWorktreeFromGatewayAuth(args.authContext, {
-      title: readString34(body.title) ?? readString34(body.name) ?? "",
-      topicId: readString34(body.topicId ?? body.projectId) ?? "",
-      topicHint: readString34(body.topicHint),
-      objective: readString34(body.objective),
-      hypothesis: readString34(body.hypothesis),
-      rationale: readString34(body.rationale),
-      worktreeType: readString34(body.worktreeType),
-      startDate: readNumber22(body.startDate),
-      endDate: readNumber22(body.endDate),
-      durationWeeks: readNumber22(body.durationWeeks),
+      title: readString35(body.title) ?? readString35(body.name) ?? "",
+      topicId: readString35(body.topicId ?? body.projectId) ?? "",
+      topicHint: readString35(body.topicHint),
+      objective: readString35(body.objective),
+      hypothesis: readString35(body.hypothesis),
+      rationale: readString35(body.rationale),
+      worktreeType: readString35(body.worktreeType),
+      startDate: readNumber23(body.startDate),
+      endDate: readNumber23(body.endDate),
+      durationWeeks: readNumber23(body.durationWeeks),
       confidenceImpact: readConfidenceImpact(body.confidenceImpact),
-      beliefFocus: readString34(body.beliefFocus),
+      beliefFocus: readString35(body.beliefFocus),
       beliefIds: readStringArray18(body.targetBeliefIds) ?? readStringArray18(body.beliefIds) ?? readStringArray18(body.beliefs),
       targetBeliefIds: readStringArray18(body.targetBeliefIds),
       targetQuestionIds: readStringArray18(body.targetQuestionIds),
@@ -28490,23 +29739,23 @@ async function handleWorktreeCreate(args) {
         noGoSignals: noGoSignals ?? []
       } : void 0,
       autoShape: typeof body.autoShape === "boolean" ? body.autoShape : void 0,
-      domainPackId: readString34(body.domainPackId),
+      domainPackId: readString35(body.domainPackId),
       tags: readStringArray18(body.tags),
       touchedPaths: readStringArray18(body.touchedPaths),
-      sourceRef: readString34(body.sourceRef),
-      sourceKind: readString34(body.sourceKind),
-      campaign: readNumber22(body.campaign),
-      lane: readString34(body.lane),
-      laneOrderInCampaign: readNumber22(body.laneOrderInCampaign),
-      orderInLane: readNumber22(body.orderInLane),
+      sourceRef: readString35(body.sourceRef),
+      sourceKind: readString35(body.sourceKind),
+      campaign: readNumber23(body.campaign),
+      lane: readString35(body.lane),
+      laneOrderInCampaign: readNumber23(body.laneOrderInCampaign),
+      orderInLane: readNumber23(body.orderInLane),
       dependsOn: readStringArray18(body.dependsOn),
       blocks: readStringArray18(body.blocks),
-      gate: readString34(body.gate),
+      gate: readString35(body.gate),
       proofArtifacts: Array.isArray(body.proofArtifacts) ? body.proofArtifacts : void 0,
-      staffingHint: readString34(body.staffingHint),
-      lastReconciledAt: readNumber22(body.lastReconciledAt),
+      staffingHint: readString35(body.staffingHint),
+      lastReconciledAt: readNumber23(body.lastReconciledAt),
       autoFixPolicy: body.autoFixPolicy && typeof body.autoFixPolicy === "object" && !Array.isArray(body.autoFixPolicy) ? body.autoFixPolicy : void 0,
-      lensId: readString34(body.lensId)
+      lensId: readString35(body.lensId)
     });
     return successResponse(payload, {
       status: 201,
@@ -28525,12 +29774,12 @@ async function handleWorktreeCreate(args) {
 async function handleWorktreeList(args) {
   try {
     const payload = await listWorktreesFromGatewayAuth(args.authContext, {
-      topicId: readString34(args.query.topicId) ?? "",
-      status: readString34(args.query.status),
-      groupBy: readString34(args.query.groupBy),
-      lane: readString34(args.query.lane),
-      campaign: readNumber22(args.query.campaign),
-      limit: readNumber22(args.query.limit)
+      topicId: readString35(args.query.topicId) ?? "",
+      status: readString35(args.query.status),
+      groupBy: readString35(args.query.groupBy),
+      lane: readString35(args.query.lane),
+      campaign: readNumber23(args.query.campaign),
+      limit: readNumber23(args.query.limit)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28548,11 +29797,11 @@ async function handleWorktreeList(args) {
 async function handleWorktreeListAll(args) {
   try {
     const payload = await listAllWorktreesFromGatewayAuth(args.authContext, {
-      status: readString34(args.query.status),
-      lane: readString34(args.query.lane),
-      campaign: readNumber22(args.query.campaign),
-      groupBy: readString34(args.query.groupBy),
-      limit: readNumber22(args.query.limit)
+      status: readString35(args.query.status),
+      lane: readString35(args.query.lane),
+      campaign: readNumber23(args.query.campaign),
+      groupBy: readString35(args.query.groupBy),
+      limit: readNumber23(args.query.limit)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28570,9 +29819,9 @@ async function handleWorktreeListAll(args) {
 async function handleWorktreeListCampaigns(args) {
   try {
     const payload = await listCampaignsFromGatewayAuth(args.authContext, {
-      topicId: readString34(args.query.topicId),
-      status: readString34(args.query.status),
-      limit: readNumber22(args.query.limit)
+      topicId: readString35(args.query.topicId),
+      status: readString35(args.query.status),
+      limit: readNumber23(args.query.limit)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28607,27 +29856,27 @@ async function handleWorktreeActivate(args) {
 }
 async function handleWorktreeUpdate(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const payload = await updateWorktreeFromGatewayAuth(args.authContext, {
       id: args.worktreeId,
-      objective: readString34(body.objective),
-      hypothesis: readString34(body.hypothesis),
-      rationale: readString34(body.rationale),
-      campaign: readNumber22(body.campaign),
-      lane: readString34(body.lane),
-      laneOrderInCampaign: readNumber22(body.laneOrderInCampaign),
-      orderInLane: readNumber22(body.orderInLane),
+      objective: readString35(body.objective),
+      hypothesis: readString35(body.hypothesis),
+      rationale: readString35(body.rationale),
+      campaign: readNumber23(body.campaign),
+      lane: readString35(body.lane),
+      laneOrderInCampaign: readNumber23(body.laneOrderInCampaign),
+      orderInLane: readNumber23(body.orderInLane),
       dependsOn: readStringArray18(body.dependsOn),
       blocks: readStringArray18(body.blocks),
-      gate: readString34(body.gate),
-      status: readString34(body.status),
-      topicId: readString34(body.topicId),
+      gate: readString35(body.gate),
+      status: readString35(body.status),
+      topicId: readString35(body.topicId),
       additionalTopicIds: readStringArray18(body.additionalTopicIds),
       proofArtifacts: Array.isArray(body.proofArtifacts) ? body.proofArtifacts : void 0,
-      staffingHint: readString34(body.staffingHint),
-      lastReconciledAt: readNumber22(body.lastReconciledAt),
+      staffingHint: readString35(body.staffingHint),
+      lastReconciledAt: readNumber23(body.lastReconciledAt),
       autoFixPolicy: body.autoFixPolicy && typeof body.autoFixPolicy === "object" ? body.autoFixPolicy : void 0,
-      lensId: readString34(body.lensId)
+      lensId: readString35(body.lensId)
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28644,11 +29893,11 @@ async function handleWorktreeUpdate(args) {
 }
 async function handleWorktreeMerge(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const outcomes = normalizeMergeOutcomes2(body.outcomes);
     const payload = await mergeWorktreeFromGatewayAuth(args.authContext, {
       id: args.worktreeId,
-      summary: readString34(body.summary),
+      summary: readString35(body.summary),
       outcomes
     });
     return successResponse(payload, {
@@ -28666,7 +29915,7 @@ async function handleWorktreeMerge(args) {
 }
 async function handleWorktreeUpdateTargets(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const payload = await updateWorktreeTargetsFromGatewayAuth(
       args.authContext,
       {
@@ -28692,11 +29941,11 @@ async function handleWorktreeUpdateTargets(args) {
 }
 async function handleWorktreeComplete(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const payload = await completeWorktreeRecordFromGatewayAuth(
       args.authContext,
       {
-        worktreeId: readString34(body.worktreeId) ?? "",
+        worktreeId: readString35(body.worktreeId) ?? "",
         keyFindings: readStringArray18(body.keyFindings),
         decisionsReached: readStringArray18(body.decisionsReached),
         nextSteps: readStringArray18(body.nextSteps)
@@ -28717,9 +29966,9 @@ async function handleWorktreeComplete(args) {
 }
 async function handleWorktreeAdvancePhase(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const payload = await advanceWorktreePhaseFromGatewayAuth(args.authContext, {
-      worktreeId: readString34(body.worktreeId) ?? ""
+      worktreeId: readString35(body.worktreeId) ?? ""
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28736,10 +29985,10 @@ async function handleWorktreeAdvancePhase(args) {
 }
 async function handleWorktreeSetPhase(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const payload = await setWorktreePhaseFromGatewayAuth(args.authContext, {
-      worktreeId: readString34(body.worktreeId) ?? "",
-      phase: readString34(body.phase) ?? ""
+      worktreeId: readString35(body.worktreeId) ?? "",
+      phase: readString35(body.phase) ?? ""
     });
     return successResponse(payload, {
       correlationId: args.correlationId,
@@ -28756,12 +30005,12 @@ async function handleWorktreeSetPhase(args) {
 }
 async function handleWorktreePatchState(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const payload = await patchWorktreeStateFromGatewayAuth(
       args.authContext,
       {
-        worktreeId: readString34(body.worktreeId) ?? "",
-        patch: asRecord32(body.patch)
+        worktreeId: readString35(body.worktreeId) ?? "",
+        patch: asRecord33(body.patch)
       }
     );
     return successResponse(payload, {
@@ -28779,7 +30028,7 @@ async function handleWorktreePatchState(args) {
 }
 async function handleWorktreeBulkCreate(args) {
   try {
-    const body = asRecord32(args.body);
+    const body = asRecord33(args.body);
     const payload = await bulkCreateWorktreesFromGatewayAuth(args.authContext, {
       worktrees: Array.isArray(body.worktrees) ? body.worktrees : []
     });
@@ -28798,6 +30047,6 @@ async function handleWorktreeBulkCreate(args) {
   }
 }
 
-export { extractPermitWebhookTenantKeys, handleBeliefArchive, handleBeliefBatchUpdateCriticality, handleBeliefBisect, handleBeliefConfidenceHistory, handleBeliefCreate, handleBeliefCreateContract, handleBeliefFork, handleBeliefGet, handleBeliefLineage, handleBeliefLink, handleBeliefList, handleBeliefReassignTopic, handleBeliefRefine, handleBeliefRelationships, handleBeliefUnlinkEvidence, handleBeliefUpdateConfidence, handleBeliefUpdateCriticality, handleBeliefUpdateRationale, handleBeliefUpdateStatus, handleContradictionFlag, handleContradictionGet, handleContradictionList, handleEdgeBatchCreate, handleEdgeCreate, handleEdgeDelete, handleEdgeList, handleEdgeRemove, handleEdgeTraverse, handleEdgeUpdate, handleEdgesRemoveBetween, handleEventsList, handleEventsReplay, handleEvidenceClassify, handleEvidenceClassifyBatch, handleEvidenceCreate, handleEvidenceFlagIncorrect, handleEvidenceGet, handleEvidenceLink, handleEvidenceList, handleEvidenceRemove, handleEvidenceSearch, handleEvidenceUpdate, handleEvidenceUpdateStatus, handleEvidenceUpdateVerificationStatus, handleGraphAnalysisCompute, handleGraphAnalysisLatest, handleGraphAnalysisList, handleGraphAnalysisListChanges, handleGraphAnalysisListSuggestions, handleGraphAnalysisSave, handleGraphAnalysisSaveSuggestions, handleGraphAnalysisUpdateSuggestion, handleGraphAnalyze, handleGraphBias, handleGraphEdgeList, handleGraphFalsify, handleGraphGaps, handleGraphNeighborhood, handleGraphNodeList, handleGraphRecommendationGet, handleGraphRecommendationStatus, handleGraphRecommendationsList, handleGraphTraverse, handleIdentityWhoami, handleOntologyBind, handleOntologyGet, handleOntologyList, handleOntologyMatch, handleOrgGraphByProvenance, handleOrgGraphNodeGet, handleOrgGraphPublished, handleOrgGraphSearch, handlePermitProjectionWebhook, handleQuestionAdd, handleQuestionAdvanceToConviction, handleQuestionAnswer, handleQuestionArchive, handleQuestionBatchCreate, handleQuestionCreate, handleQuestionDelete, handleQuestionFinalizeConviction, handleQuestionGet, handleQuestionGetAnswer, handleQuestionList, handleQuestionRefine, handleQuestionUpdate, handleQuestionUpdateConviction, handleQuestionUpdatePriority, handleQuestionUpdateStatus, handleSearchResources, handleSourceGet, handleSourceUpsert, handleTaskComplete, handleTaskCreate, handleTaskList, handleTaskUpdate, handleTopicBulkCreate, handleTopicCoverage, handleTopicCreate, handleTopicGet, handleTopicList, handleTopicRemove, handleTopicTree, handleTopicUpdate, handleWebhookCreate, handleWebhookDelete, handleWebhookDeliveries, handleWebhookGet, handleWebhookHealth, handleWebhookList, handleWebhookTest, handleWebhookUpdate, handleWorktreeActivate, handleWorktreeAdvancePhase, handleWorktreeBulkCreate, handleWorktreeComplete, handleWorktreeCreate, handleWorktreeList, handleWorktreeListAll, handleWorktreeListCampaigns, handleWorktreeMerge, handleWorktreePatchState, handleWorktreeSetPhase, handleWorktreeUpdate, handleWorktreeUpdateTargets, isPermitWebhookAuthorized };
+export { __testOnly, extractPermitWebhookTenantKeys, handleBeliefArchive, handleBeliefBatchUpdateCriticality, handleBeliefBisect, handleBeliefConfidenceHistory, handleBeliefCreate, handleBeliefCreateContract, handleBeliefFork, handleBeliefGet, handleBeliefLineage, handleBeliefLink, handleBeliefList, handleBeliefReassignTopic, handleBeliefRefine, handleBeliefRelationships, handleBeliefUnlinkEvidence, handleBeliefUpdateConfidence, handleBeliefUpdateCriticality, handleBeliefUpdateRationale, handleBeliefUpdateStatus, handleClerkWebhook, handleContradictionFlag, handleContradictionGet, handleContradictionList, handleEdgeBatchCreate, handleEdgeCreate, handleEdgeDelete, handleEdgeList, handleEdgeRemove, handleEdgeTraverse, handleEdgeUpdate, handleEdgesRemoveBetween, handleEventsList, handleEventsReplay, handleEvidenceClassify, handleEvidenceClassifyBatch, handleEvidenceCreate, handleEvidenceFlagIncorrect, handleEvidenceGet, handleEvidenceLink, handleEvidenceList, handleEvidenceRemove, handleEvidenceSearch, handleEvidenceUpdate, handleEvidenceUpdateStatus, handleEvidenceUpdateVerificationStatus, handleGraphAnalysisCompute, handleGraphAnalysisLatest, handleGraphAnalysisList, handleGraphAnalysisListChanges, handleGraphAnalysisListSuggestions, handleGraphAnalysisSave, handleGraphAnalysisSaveSuggestions, handleGraphAnalysisUpdateSuggestion, handleGraphAnalyze, handleGraphBias, handleGraphEdgeList, handleGraphFalsify, handleGraphGaps, handleGraphNeighborhood, handleGraphNodeList, handleGraphRecommendationGet, handleGraphRecommendationStatus, handleGraphRecommendationsList, handleGraphTraverse, handleIdentityWhoami, handleOntologyBind, handleOntologyGet, handleOntologyList, handleOntologyMatch, handleOrgGraphByProvenance, handleOrgGraphNodeGet, handleOrgGraphPublished, handleOrgGraphSearch, handlePermitProjectionWebhook, handleQuestionAdd, handleQuestionAdvanceToConviction, handleQuestionAnswer, handleQuestionArchive, handleQuestionBatchCreate, handleQuestionCreate, handleQuestionDelete, handleQuestionFinalizeConviction, handleQuestionGet, handleQuestionGetAnswer, handleQuestionList, handleQuestionRefine, handleQuestionUpdate, handleQuestionUpdateConviction, handleQuestionUpdatePriority, handleQuestionUpdateStatus, handleSearchResources, handleSourceGet, handleSourceUpsert, handleTaskComplete, handleTaskCreate, handleTaskList, handleTaskUpdate, handleTopicBulkCreate, handleTopicCoverage, handleTopicCreate, handleTopicGet, handleTopicList, handleTopicRemove, handleTopicTree, handleTopicUpdate, handleWebhookCreate, handleWebhookDelete, handleWebhookDeliveries, handleWebhookGet, handleWebhookHealth, handleWebhookList, handleWebhookTest, handleWebhookUpdate, handleWorktreeActivate, handleWorktreeAdvancePhase, handleWorktreeBulkCreate, handleWorktreeComplete, handleWorktreeCreate, handleWorktreeList, handleWorktreeListAll, handleWorktreeListCampaigns, handleWorktreeMerge, handleWorktreePatchState, handleWorktreeSetPhase, handleWorktreeUpdate, handleWorktreeUpdateTargets, hasPermitWebhookTenantScope, isPermitWebhookAuthorized };
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map