@lucern/mcp 0.3.0-alpha.15 → 0.3.0-alpha.17

package/dist/gateway.js

@@ -782,6 +782,7 @@ defineTable({
   shape: z.object({
     "tenantId": idOf("tenants"),
     "workspaceId": idOf("workspaces").optional(),
+    "environment": z.enum(["dev", "staging", "prod"]).optional(),
     "keyPrefix": z.enum(["luc", "stk"]),
     "keyHash": z.string(),
     "keyHint": z.string(),
@@ -809,7 +810,7 @@ defineTable({
   shape: z.object({
     "tenantId": idOf("tenants").optional(),
     "apiKeyId": idOf("apiKeys").optional(),
-    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_token_lease_issued", "proxy_token_lease_renewed", "proxy_token_lease_revoked", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "principal_created", "principal_updated", "principal_suspended", "principal_identity_alias_upserted", "principal_identity_alias_revoked", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "deployment_host_registered", "deployment_host_revoked", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "permit_sync_enqueued", "permit_sync_succeeded", "permit_sync_failed", "permit_sync_skipped", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
+    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_token_lease_issued", "proxy_token_lease_renewed", "proxy_token_lease_revoked", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "tenant_clerk_organization_linked", "principal_created", "principal_updated", "principal_suspended", "principal_identity_alias_upserted", "principal_identity_alias_revoked", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "deployment_host_registered", "deployment_host_revoked", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "permit_sync_enqueued", "permit_sync_succeeded", "permit_sync_failed", "permit_sync_skipped", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
     "actorClerkId": z.string(),
     "details": z.any().optional(),
     "createdAt": z.number()
@@ -6938,7 +6939,7 @@ function compactRecord2(input) {
     Object.entries(input).filter(([, value]) => value !== void 0)
   );
 }
-var listBeliefsProjection = defineProjection({
+defineProjection({
   contractName: "list_beliefs",
   inputSchema: listBeliefsInputSchema,
   project: (input) => compactRecord2({
@@ -9447,7 +9448,7 @@ var IDENTITY_WHOAMI = {
   response: {
     description: "Canonical identity summary for the current session",
     fields: {
-      principalId: "string \u2014 canonical federated principal identifier",
+      principalId: "string \u2014 canonical principal identifier; for humans this is the Clerk user_... ID",
       principalType: "string \u2014 human, service, agent, group, or external_viewer",
       tenantId: "string | undefined \u2014 resolved tenant scope",
       workspaceId: "string | undefined \u2014 resolved workspace scope",
@@ -9461,7 +9462,7 @@ var IDENTITY_WHOAMI = {
 };
 var RESOLVE_INTERACTIVE_PRINCIPAL = {
   name: "resolve_interactive_principal",
-  description: "Read the Permit-backed Lucern principal context for an authenticated Clerk user. Like `git config --get user.email` plus the repository ACL \u2014 resolves the identity alias into the canonical authorization subject.",
+  description: "Read the Permit-backed Lucern principal context for an authenticated Clerk user. Like `git config --get user.email` plus the repository ACL \u2014 resolves the Clerk subject into tenant/workspace authorization context.",
   parameters: {
     clerkId: {
       type: "string",
@@ -9484,7 +9485,7 @@ var RESOLVE_INTERACTIVE_PRINCIPAL = {
   response: {
     description: "Permit-backed Lucern principal context for tenant SDK bootstrap",
     fields: {
-      principalId: "string \u2014 canonical Lucern principal identifier",
+      principalId: "string \u2014 canonical Clerk user_... ID for human sessions",
       principalType: "string \u2014 human, service, agent, group, or external_viewer",
       clerkId: "string \u2014 authenticated Clerk subject alias",
       tenantId: "string \u2014 resolved tenant scope",
@@ -10312,7 +10313,7 @@ var MANAGE_WRITE_POLICY = {
     },
     role: {
       type: "string",
-      description: "Role to set policy for (required for 'set'). E.g. 'agent:internal', 'user:analyst'."
+      description: "Role to set policy for (required for 'set'). E.g. 'agent:internal' or a Permit role key such as 'workspace_admin'."
     },
     permission: {
       type: "string",
@@ -12242,11 +12243,8 @@ var identityContracts = [
     sdkNamespace: "identity",
     sdkMethod: "whoami",
     summary: "Describe the current gateway principal.",
-    convex: {
-      module: "identity",
-      functionName: "whoami",
-      kind: "query",
-      inputProjection: withPrincipal
+    gateway: {
+      handler: "identity.whoami"
     }
   }),
   surfaceContract({
@@ -12266,7 +12264,7 @@ var identityContracts = [
       providerProjectId: z.string().min(1).optional()
     }),
     convex: {
-      module: "identity",
+      module: "platform",
       functionName: "resolveInteractivePrincipal",
       kind: "query"
     }
@@ -12350,15 +12348,6 @@ var beliefLookupInput = (input) => compactRecord4({
 var beliefNodeInput = (input) => compactRecord4({
   nodeId: input.nodeId ?? input.id ?? input.beliefId
 });
-var beliefTopicInput = (input) => {
-  const parsed = listBeliefsProjection.inputSchema.safeParse(input);
-  if (!parsed.success) {
-    throw new Error(
-      `list_beliefs projection input rejected: ${parsed.error.message}`
-    );
-  }
-  return compactRecord4(listBeliefsProjection.project(parsed.data));
-};
 var createBeliefInput = (input, context) => {
   return withUserId(
     compactRecord4({
@@ -12447,11 +12436,8 @@ var beliefsContracts = [
     sdkNamespace: "beliefs",
     sdkMethod: "listBeliefs",
     summary: "List beliefs for a topic.",
-    convex: {
-      module: "beliefs",
-      functionName: "getByTopic",
-      kind: "query",
-      inputProjection: beliefTopicInput
+    gateway: {
+      handler: "beliefs.list"
     },
     args: listBeliefsInputSchema
   }),
@@ -12636,12 +12622,6 @@ var evidenceIdInput = (input) => compactRecord4({
   insightId: input.insightId,
   nodeId: input.nodeId ?? input.id ?? input.evidenceId
 });
-var evidenceTopicInput = (input) => compactRecord4({
-  topicId: input.topicId,
-  status: input.status,
-  userId: input.userId,
-  limit: input.limit
-});
 var createEvidenceInput = (input, context) => {
   const parsed = createEvidenceProjection.inputSchema.safeParse(input);
   if (!parsed.success) {
@@ -12772,11 +12752,8 @@ var evidenceContracts = [
     sdkNamespace: "evidence",
     sdkMethod: "listEvidence",
     summary: "List evidence for a topic.",
-    convex: {
-      module: "evidence",
-      functionName: "getByTopic",
-      kind: "query",
-      inputProjection: evidenceTopicInput
+    gateway: {
+      handler: "evidence.list"
     }
   }),
   surfaceContract({
@@ -13011,11 +12988,8 @@ var questionsContracts = [
     sdkNamespace: "questions",
     sdkMethod: "listQuestions",
     summary: "List questions for a topic.",
-    convex: {
-      module: "questions",
-      functionName: "getByTopic",
-      kind: "query",
-      inputProjection: questionTopicInput
+    gateway: {
+      handler: "questions.list"
     }
   }),
   surfaceContract({
@@ -14120,6 +14094,19 @@ var worktreeEvidenceSignalInputSchema = z.object({
   progress: z.string().optional().describe("Collection progress note for the signal."),
   notes: z.string().optional().describe("Additional evidence collection notes.")
 }).passthrough().describe("Evidence signal embedded in the worktree plan.");
+var worktreeDocCompanionTargetSchema = z.object({
+  docPath: z.string().describe(
+    "Repo-relative path to a documentation file the worktree promises to update."
+  ),
+  sectionAnchor: z.string().optional().describe(
+    "Markdown heading anchor (e.g. '## Function-surface manifest') that scopes the promised update."
+  ),
+  reason: z.string().describe(
+    "Why this doc section must be updated for the worktree to be complete."
+  )
+}).passthrough().describe(
+  "Intent-driven docs companion target. pr-gate-reviewer verifies that the PR actually touches each declared (docPath, sectionAnchor). Distinct from the touch-driven docs-loop. See docs/development/docs-sync-discipline.md Lock 3."
+);
 var worktreeDecisionGateInputSchema = z.object({
   goCriteria: z.array(z.string()).describe("Criteria that must hold for the worktree to proceed."),
   noGoSignals: z.array(z.string()).describe("Signals that stop or redirect the worktree."),
@@ -14152,6 +14139,9 @@ var addWorktreeArgs = z.object({
   keyQuestions: z.array(worktreeKeyQuestionInputSchema).optional().describe("Inline key questions captured as part of the worktree plan."),
   evidenceSignals: z.array(worktreeEvidenceSignalInputSchema).optional().describe("Evidence signals the worktree needs to collect or validate."),
   decisionGate: worktreeDecisionGateInputSchema.optional(),
+  docCompanionTargets: z.array(worktreeDocCompanionTargetSchema).optional().describe(
+    "Doc sections the worktree promises to update at PR time. Enforced by pr-gate-reviewer (Lock 3)."
+  ),
   goCriteria: z.array(z.string()).optional().describe("Shorthand go criteria used to build decisionGate."),
   noGoSignals: z.array(z.string()).optional().describe("Shorthand no-go signals used to build decisionGate."),
   proofArtifacts: z.array(z.unknown()).optional().describe("Expected proof artifacts required to close the worktree."),
@@ -18486,7 +18476,7 @@ async function resolveBeliefTopicId(ctx, beliefId) {
   if (!normalizedBeliefId) {
     return void 0;
   }
-  return fetchRecordTopicId(ctx, api.epistemicBeliefs.getById, {
+  return fetchRecordTopicId(ctx, api.beliefs.getById, {
     beliefId: normalizedBeliefId,
     nodeId: normalizedBeliefId
   });
@@ -18496,7 +18486,7 @@ async function resolveQuestionTopicId(ctx, questionId) {
   if (!normalizedQuestionId) {
     return void 0;
   }
-  return fetchRecordTopicId(ctx, api.epistemicQuestions.getById, {
+  return fetchRecordTopicId(ctx, api.questions.getById, {
     questionId: normalizedQuestionId,
     nodeId: normalizedQuestionId
   });
@@ -18901,7 +18891,7 @@ function readStringArray3(value) {
 async function resolveBeliefTopicIdWithGatewayAuth(authContext, beliefId) {
   const normalizedBeliefId = resolveExternalId(beliefId) ?? beliefId;
   const belief = await authContext.convex.query(
-    api.epistemicBeliefs.getById,
+    api.beliefs.getById,
     {
       beliefId: normalizedBeliefId,
       nodeId: normalizedBeliefId
@@ -18931,13 +18921,13 @@ async function emitBeliefEventFromGatewayAuth(authContext, args) {
 function createGatewayBeliefPort(authContext) {
   return {
     fetchBelief(rawId) {
-      return authContext.convex.query(api.epistemicBeliefs.getById, {
+      return authContext.convex.query(api.beliefs.getById, {
         beliefId: rawId,
         nodeId: rawId
       });
     },
     listBeliefsByTopic(args) {
-      return authContext.convex.query(api.epistemicBeliefs.getByTopic, {
+      return authContext.convex.query(api.beliefs.getByTopic, {
         topicId: args.topicId,
         userId: authContext.userId,
         status: args.status,
@@ -18948,7 +18938,7 @@ function createGatewayBeliefPort(authContext) {
       });
     },
     createBelief(input) {
-      return authContext.convex.mutation(api.epistemicBeliefs.create, {
+      return authContext.convex.mutation(api.beliefs.create, {
         topicId: input.topicId,
         formulation: input.text,
         rationale: input.rationale,
@@ -18965,7 +18955,7 @@ function createGatewayBeliefPort(authContext) {
       });
     },
     refineBelief(input) {
-      return authContext.convex.mutation(api.epistemicBeliefs.refineBelief, {
+      return authContext.convex.mutation(api.beliefs.refineBelief, {
         nodeId: input.beliefRawId,
         canonicalText: input.text,
         rationale: input.rationale,
@@ -18973,7 +18963,7 @@ function createGatewayBeliefPort(authContext) {
       });
     },
     forkBelief(input) {
-      return authContext.convex.mutation(api.epistemicBeliefs.forkBelief, {
+      return authContext.convex.mutation(api.beliefs.forkBelief, {
         parentNodeId: input.beliefRawId,
         newFormulation: input.text,
         forkReason: input.forkReason,
@@ -18982,7 +18972,7 @@ function createGatewayBeliefPort(authContext) {
       });
     },
     modulateConfidence(input) {
-      return authContext.convex.mutation(api.epistemicBeliefs.modulateConfidence, {
+      return authContext.convex.mutation(api.beliefs.modulateConfidence, {
         nodeId: input.beliefRawId,
         trigger: input.trigger,
         rationale: input.rationale,
@@ -18999,25 +18989,25 @@ function createGatewayBeliefPort(authContext) {
       });
     },
     archiveBelief(input) {
-      return authContext.convex.mutation(api.epistemicBeliefs.archive, {
+      return authContext.convex.mutation(api.beliefs.archive, {
         nodeId: input.beliefRawId,
         reason: input.reason,
         userId: authContext.userId
       });
     },
     getLineage(rawId) {
-      return authContext.convex.query(api.epistemicBeliefs.getLineage, {
+      return authContext.convex.query(api.beliefs.getLineage, {
         nodeId: rawId
       });
     },
     getConfidenceHistory(rawId) {
-      return authContext.convex.query(api.epistemicBeliefs.getConfidenceHistory, {
+      return authContext.convex.query(api.beliefs.getConfidenceHistory, {
         nodeId: rawId
       });
     },
     createContract(args) {
       return authContext.convex.mutation(
-        api.epistemicContracts.createEpistemicContract,
+        api.contracts.createEpistemicContract,
         {
           beliefNodeId: args.beliefRawId,
           title: args.input.title,
@@ -19036,7 +19026,7 @@ function createGatewayBeliefPort(authContext) {
       );
     },
     getRelationships(rawId) {
-      return authContext.convex.query(api.epistemicBeliefs.getRelationships, {
+      return authContext.convex.query(api.beliefs.getRelationships, {
         nodeId: rawId,
         direction: "both"
       });
@@ -19184,7 +19174,7 @@ async function getBeliefRelationshipsFromGatewayAuth(authContext, id, direction)
 }
 function updateBeliefStatusFromGatewayAuth(authContext, input) {
   const externalNodeId = input.id ?? input.nodeId ?? input.beliefId;
-  return authContext.convex.mutation(api.epistemicBeliefs.updateStatus, {
+  return authContext.convex.mutation(api.beliefs.updateStatus, {
     nodeId: resolveBeliefNodeId(input),
     status: input.status,
     reason: input.reason,
@@ -19196,7 +19186,7 @@ function updateBeliefStatusFromGatewayAuth(authContext, input) {
 }
 function updateBeliefRationaleFromGatewayAuth(authContext, input) {
   const externalNodeId = input.id ?? input.nodeId ?? input.beliefId;
-  return authContext.convex.mutation(api.epistemicBeliefs.updateRationale, {
+  return authContext.convex.mutation(api.beliefs.updateRationale, {
     nodeId: resolveBeliefNodeId(input),
     rationale: input.rationale,
     userId: authContext.userId
@@ -19206,7 +19196,7 @@ function updateBeliefRationaleFromGatewayAuth(authContext, input) {
   }));
 }
 function linkBeliefsFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicBeliefs.linkBeliefs, {
+  return authContext.convex.mutation(api.beliefs.linkBeliefs, {
     fromNodeId: resolveExternalId(input.fromNodeId) ?? "",
     toNodeId: resolveExternalId(input.toNodeId) ?? "",
     edgeType: input.edgeType,
@@ -19216,7 +19206,7 @@ function linkBeliefsFromGatewayAuth(authContext, input) {
   });
 }
 function unlinkBeliefEvidenceFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicBeliefs.unlinkEvidence, {
+  return authContext.convex.mutation(api.beliefs.unlinkEvidence, {
     beliefNodeId: input.beliefNodeId ?? resolveExternalId(input.beliefId) ?? resolveExternalId(input.nodeId) ?? "",
     insightId: resolveExternalId(input.insightId ?? input.evidenceId) ?? "",
     userId: authContext.userId
@@ -19224,7 +19214,7 @@ function unlinkBeliefEvidenceFromGatewayAuth(authContext, input) {
 }
 function updateBeliefCriticalityFromGatewayAuth(authContext, input) {
   const externalNodeId = input.id ?? input.nodeId ?? input.beliefId;
-  return authContext.convex.mutation(api.epistemicBeliefs.updateCriticality, {
+  return authContext.convex.mutation(api.beliefs.updateCriticality, {
     nodeId: resolveBeliefNodeId(input),
     criticality: input.criticality,
     userId: authContext.userId
@@ -19234,7 +19224,7 @@ function updateBeliefCriticalityFromGatewayAuth(authContext, input) {
   }));
 }
 function batchUpdateBeliefCriticalityFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicBeliefs.batchUpdateCriticality, {
+  return authContext.convex.mutation(api.beliefs.batchUpdateCriticality, {
     updates: input.updates.map((update) => ({
       ...update,
       beliefId: resolveExternalId(update.beliefId) ?? update.beliefId,
@@ -19249,7 +19239,7 @@ function batchUpdateBeliefCriticalityFromGatewayAuth(authContext, input) {
   });
 }
 function reassignBeliefsTopicFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicBeliefs.reassignBeliefsTopic, {
+  return authContext.convex.mutation(api.beliefs.reassignBeliefsTopic, {
     beliefNodeIds: (input.beliefNodeIds ?? input.beliefIds ?? []).map(
       (id) => resolveExternalId(id) ?? id
     ),
@@ -19545,7 +19535,7 @@ async function emitContradictionEventFromGatewayAuth(authContext, args) {
 function createGatewayContradictionsPort(authContext) {
   return {
     fetchBelief(rawId) {
-      return authContext.convex.query(api.epistemicBeliefs.getById, {
+      return authContext.convex.query(api.beliefs.getById, {
         beliefId: rawId
       });
     },
@@ -19867,7 +19857,7 @@ async function fetchNodeWithQuery(runQuery, id) {
   const rawId = resolveNodeId(id);
   const byNodeId = await queryWithFallback(
     `fetchNodeWithQuery local id lookup for ${id}`,
-    () => runQuery(api.epistemicNodes.get, {
+    () => runQuery(api.nodes.get, {
       nodeId: rawId
     }),
     null
@@ -19877,7 +19867,7 @@ async function fetchNodeWithQuery(runQuery, id) {
   }
   return await queryWithFallback(
     `fetchNodeWithQuery global id lookup for ${id}`,
-    () => runQuery(api.epistemicNodes.getByGlobalId, {
+    () => runQuery(api.nodes.getByGlobalId, {
       globalId: id
     }),
     null
@@ -19965,7 +19955,7 @@ function createGatewayEdgesPort(authContext) {
         input.targetRawId
       );
       const inferredTopicId = input.topicId ?? resolveTopicIdFromNode(sourceNode) ?? resolveTopicIdFromNode(targetNode);
-      return authContext.convex.mutation(api.epistemicEdges.create, {
+      return authContext.convex.mutation(api.edges.create, {
         fromNodeId: input.sourceRawId,
         toNodeId: input.targetRawId,
         edgeType: input.edgeType,
@@ -19990,7 +19980,7 @@ function createGatewayEdgesPort(authContext) {
         "list"
       );
       const rows = await authContext.convex.query(
-        api.epistemicEdges.getBySourceNode,
+        api.edges.getBySourceNode,
         {
           sourceNodeId: args.sourceRawId,
           edgeType: args.edgeType
@@ -20032,7 +20022,7 @@ function traverseEdgesFromGatewayAuth(authContext, input) {
   return traverseEdges(createGatewayEdgesPort(authContext), input);
 }
 function updateEdgeFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicEdges.update, {
+  return authContext.convex.mutation(api.edges.update, {
     edgeId: resolveExternalId2(input.edgeId) ?? input.edgeId,
     weight: input.weight,
     confidence: input.confidence,
@@ -20042,13 +20032,13 @@ function updateEdgeFromGatewayAuth(authContext, input) {
   });
 }
 function removeEdgeFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicEdges.remove, {
+  return authContext.convex.mutation(api.edges.remove, {
     edgeId: resolveExternalId2(input.edgeId) ?? input.edgeId,
     userId: authContext.userId
   });
 }
 function removeEdgesBetweenFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicEdges.removeBetween, {
+  return authContext.convex.mutation(api.edges.removeBetween, {
     fromNodeId: resolveExternalId2(input.fromNodeId) ?? input.fromNodeId,
     toNodeId: resolveExternalId2(input.toNodeId) ?? input.toNodeId,
     edgeType: input.edgeType,
@@ -20056,7 +20046,7 @@ function removeEdgesBetweenFromGatewayAuth(authContext, input) {
   });
 }
 function batchCreateEdgesFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicEdges.batchCreate, {
+  return authContext.convex.mutation(api.edges.batchCreate, {
     edges: input.edges.map((edge) => ({
       globalId: edge.globalId ?? randomUUID(),
       fromNodeId: resolveExternalId2(edge.fromNodeId ?? edge.sourceId) ?? edge.fromNodeId ?? edge.sourceId ?? "",
@@ -20075,7 +20065,7 @@ function batchCreateEdgesFromGatewayAuth(authContext, input) {
   });
 }
 function deleteEdgesFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicEdges.deleteEdges, {
+  return authContext.convex.mutation(api.edges.deleteEdges, {
     edgeIds: input.edgeIds.map((edgeId) => resolveExternalId2(edgeId) ?? edgeId),
     userId: authContext.userId
   });
@@ -20403,14 +20393,14 @@ function resolveExternalId3(value) {
   }
 }
 async function resolveEvidenceTopicIdWithGatewayAuth(authContext, evidenceId) {
-  const evidence = await authContext.convex.query(api.epistemicEvidence.getById, {
+  const evidence = await authContext.convex.query(api.evidence.getById, {
     evidenceId,
     nodeId: evidenceId
   });
   return readString8(evidence?.topicId);
 }
 async function resolveEvidenceNodeIdWithGatewayAuth(authContext, evidenceId) {
-  const evidence = await authContext.convex.query(api.epistemicEvidence.getById, {
+  const evidence = await authContext.convex.query(api.evidence.getById, {
     evidenceId,
     nodeId: evidenceId
   });
@@ -20438,20 +20428,20 @@ async function emitEvidenceEventFromGatewayAuth(authContext, args) {
 function createGatewayEvidencePort(authContext) {
   return {
     fetchEvidence(rawId) {
-      return authContext.convex.query(api.epistemicEvidence.getById, {
+      return authContext.convex.query(api.evidence.getById, {
         evidenceId: rawId,
         nodeId: rawId
       });
     },
     listEvidenceByTopic(args) {
-      return authContext.convex.query(api.epistemicEvidence.getByTopic, {
+      return authContext.convex.query(api.evidence.getByTopic, {
         topicId: args.topicId,
         userId: authContext.userId,
         limit: args.limit
       });
     },
     listEvidenceForBelief(rawBeliefId) {
-      return authContext.convex.query(api.epistemicEvidence.getForBelief, {
+      return authContext.convex.query(api.evidence.getForBelief, {
         beliefNodeId: rawBeliefId
       });
     },
@@ -20464,7 +20454,7 @@ function createGatewayEvidencePort(authContext) {
       );
     },
     async createEvidence(input) {
-      const created = await authContext.convex.mutation(api.epistemicEvidence.create, {
+      const created = await authContext.convex.mutation(api.evidence.create, {
         topicId: input.topicId,
         text: input.text,
         title: input.title,
@@ -20497,7 +20487,7 @@ function createGatewayEvidencePort(authContext) {
           ...linkArgs
         });
       } else {
-        await authContext.convex.mutation(api.epistemicBeliefs.linkEvidence, {
+        await authContext.convex.mutation(api.beliefs.linkEvidence, {
           beliefNodeId: input.target.rawId,
           insightId: rawId,
           type: input.weight < 0 ? "contradicting" : "supporting",
@@ -20508,7 +20498,7 @@ function createGatewayEvidencePort(authContext) {
       return created;
     },
     linkEvidenceToBelief(input) {
-      return authContext.convex.mutation(api.epistemicBeliefs.linkEvidence, {
+      return authContext.convex.mutation(api.beliefs.linkEvidence, {
         beliefNodeId: input.targetRawId,
         insightId: input.evidenceRawId,
         type: input.weight < 0 ? "contradicting" : "supporting",
@@ -20640,7 +20630,7 @@ async function updateEvidenceStatusFromGatewayAuth(authContext, input) {
       input.id ?? input.nodeId ?? input.evidenceId ?? input.insightId ?? ""
     ) ?? ""
   );
-  return authContext.convex.mutation(api.epistemicEvidence.updateStatus, {
+  return authContext.convex.mutation(api.evidence.updateStatus, {
     nodeId: resolvedNodeId ?? input.nodeId ?? input.id,
     status: input.status,
     userId: authContext.userId
@@ -20650,7 +20640,7 @@ function updateEvidenceFromGatewayAuth(authContext, input) {
   const evidenceId = resolveExternalId3(
     input.id ?? input.evidenceId ?? input.insightId ?? input.nodeId ?? ""
   ) ?? "";
-  return authContext.convex.mutation(api.epistemicEvidence.update, {
+  return authContext.convex.mutation(api.evidence.update, {
     insightId: evidenceId,
     text: input.text,
     kind: input.kind,
@@ -20664,7 +20654,7 @@ function flagEvidenceAsIncorrectFromGatewayAuth(authContext, input) {
   const evidenceId = resolveExternalId3(
     input.id ?? input.evidenceId ?? input.insightId ?? input.nodeId ?? ""
   ) ?? "";
-  return authContext.convex.mutation(api.epistemicEvidence.flagAsIncorrect, {
+  return authContext.convex.mutation(api.evidence.flagAsIncorrect, {
     insightId: evidenceId,
     reason: input.reason,
     suggestedCorrection: input.suggestedCorrection,
@@ -20675,7 +20665,7 @@ function removeEvidenceFromGatewayAuth(authContext, input) {
   const evidenceId = resolveExternalId3(
     input.id ?? input.evidenceId ?? input.insightId ?? input.nodeId ?? ""
   ) ?? "";
-  return authContext.convex.mutation(api.epistemicEvidence.remove, {
+  return authContext.convex.mutation(api.evidence.remove, {
     insightId: evidenceId,
     userId: authContext.userId
   });
@@ -20687,7 +20677,7 @@ async function updateEvidenceVerificationStatusFromGatewayAuth(authContext, inpu
       input.id ?? input.nodeId ?? input.evidenceId ?? input.insightId ?? ""
     ) ?? ""
   );
-  return authContext.convex.mutation(api.epistemicEvidence.updateVerificationStatus, {
+  return authContext.convex.mutation(api.evidence.updateVerificationStatus, {
     nodeId: resolvedNodeId ?? input.nodeId ?? input.id,
     verificationHash: input.verificationHash,
     verificationStatus: input.verificationStatus,
@@ -21271,7 +21261,7 @@ function isRecord5(value) {
 }
 async function resolveQuestionTopicIdWithGatewayAuth(authContext, questionId) {
   const question = await authContext.convex.query(
-    api.epistemicQuestions.getById,
+    api.questions.getById,
     {
       questionId,
       nodeId: questionId
@@ -21327,20 +21317,20 @@ function normalizeLatestAnswerRecord(questionId, answer) {
 function createGatewayQuestionsPort(authContext) {
   return {
     fetchQuestion(rawId) {
-      return authContext.convex.query(api.epistemicQuestions.getById, {
+      return authContext.convex.query(api.questions.getById, {
         questionId: rawId,
         nodeId: rawId
       });
     },
     listQuestionsByTopic(args) {
-      return authContext.convex.query(api.epistemicQuestions.getByTopic, {
+      return authContext.convex.query(api.questions.getByTopic, {
         topicId: args.topicId,
         userId: authContext.userId,
         limit: args.limit
       });
     },
     createQuestion(input) {
-      return authContext.convex.mutation(api.epistemicQuestions.create, {
+      return authContext.convex.mutation(api.questions.create, {
         topicId: input.topicId,
         question: input.text,
         priority: input.priority,
@@ -21350,7 +21340,7 @@ function createGatewayQuestionsPort(authContext) {
     },
     refineQuestion(input) {
       return authContext.convex.mutation(
-        api.epistemicQuestions.updateQuestion,
+        api.questions.updateQuestion,
         {
           questionId: input.questionRawId,
           question: input.text
@@ -21358,14 +21348,14 @@ function createGatewayQuestionsPort(authContext) {
       );
     },
     updateQuestionStatus(input) {
-      return authContext.convex.mutation(api.epistemicQuestions.updateStatus, {
+      return authContext.convex.mutation(api.questions.updateStatus, {
         questionId: input.questionRawId,
         status: input.status,
         userId: authContext.userId
       });
     },
     createAnswer(input) {
-      return authContext.convex.mutation(api.epistemicAnswers.create, {
+      return authContext.convex.mutation(api.answers.create, {
         questionNodeId: input.questionRawId,
         topicId: input.topicId,
         answerText: input.text,
@@ -21450,7 +21440,7 @@ async function answerQuestionFromGatewayAuth(authContext, input) {
 }
 async function getQuestionAnswerFromGatewayAuth(authContext, questionId) {
   const answer = await authContext.convex.query(
-    api.epistemicAnswers.getLatestForQuestion,
+    api.answers.getLatestForQuestion,
     {
       questionNodeId: questionId
     }
@@ -21543,7 +21533,7 @@ function createQuestionsBatchFromGatewayAuth(authContext, input) {
       sourceKind: "question_batch",
       autoCreate: input.topicId ? false : true
     })).topicId;
-    return authContext.convex.mutation(api.epistemicQuestions.createBatch, {
+    return authContext.convex.mutation(api.questions.createBatch, {
       topicId: resolvedTopicId,
       questions: input.questions.map((question) => ({
         ...question,
@@ -21580,7 +21570,7 @@ async function addQuestionFromGatewayAuth(authContext, input) {
     autoCreate: input.topicId ? false : true
   })).topicId;
   const questionId = await authContext.convex.mutation(
-    api.epistemicQuestions.addQuestion,
+    api.questions.addQuestion,
     {
       topicId: resolvedTopicId,
       question: input.question ?? input.text ?? "",
@@ -21603,7 +21593,7 @@ async function addQuestionFromGatewayAuth(authContext, input) {
   return getQuestionFromGatewayAuth(authContext, String(questionId));
 }
 async function updateQuestionPriorityFromGatewayAuth(authContext, input) {
-  await authContext.convex.mutation(api.epistemicQuestions.updatePriority, {
+  await authContext.convex.mutation(api.questions.updatePriority, {
     nodeId: normalizePrefixedId(
       input.id ?? input.nodeId ?? input.questionId,
       "que"
@@ -21618,7 +21608,7 @@ async function updateQuestionPriorityFromGatewayAuth(authContext, input) {
 }
 function advanceQuestionToConvictionFromGatewayAuth(authContext, input) {
   return authContext.convex.mutation(
-    api.epistemicQuestions.advanceToConviction,
+    api.questions.advanceToConviction,
     {
       questionId: normalizePrefixedId(
         input.questionId ?? input.id ?? input.nodeId,
@@ -21630,7 +21620,7 @@ function advanceQuestionToConvictionFromGatewayAuth(authContext, input) {
   );
 }
 function updateQuestionConvictionFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicQuestions.updateConviction, {
+  return authContext.convex.mutation(api.questions.updateConviction, {
     questionId: normalizePrefixedId(
       input.questionId ?? input.id ?? input.nodeId,
       "que"
@@ -21643,7 +21633,7 @@ function updateQuestionConvictionFromGatewayAuth(authContext, input) {
 }
 function finalizeQuestionConvictionFromGatewayAuth(authContext, input) {
   return authContext.convex.mutation(
-    api.epistemicQuestions.finalizeConviction,
+    api.questions.finalizeConviction,
     {
       questionId: normalizePrefixedId(
         input.questionId ?? input.id ?? input.nodeId,
@@ -21660,7 +21650,7 @@ function finalizeQuestionConvictionFromGatewayAuth(authContext, input) {
 }
 async function updateQuestionFromGatewayAuth(authContext, input) {
   const questionId = normalizePrefixedId(input.questionId ?? input.id ?? input.nodeId, "que") ?? "";
-  await authContext.convex.mutation(api.epistemicQuestions.updateQuestion, {
+  await authContext.convex.mutation(api.questions.updateQuestion, {
     questionId,
     question: input.question ?? input.text,
     category: input.category,
@@ -21669,7 +21659,7 @@ async function updateQuestionFromGatewayAuth(authContext, input) {
   return getQuestionFromGatewayAuth(authContext, questionId);
 }
 function deleteQuestionFromGatewayAuth(authContext, input) {
-  return authContext.convex.mutation(api.epistemicQuestions.deleteQuestion, {
+  return authContext.convex.mutation(api.questions.deleteQuestion, {
     questionId: normalizePrefixedId(
       input.questionId ?? input.id ?? input.nodeId,
       "que"
@@ -21738,13 +21728,13 @@ function normalizeGraphEdge(row) {
 }
 async function fetchGraphNodeByIdentifier(authContext, input) {
   if (input.nodeId) {
-    const node = await authContext.convex.query(api.epistemicNodes.get, {
+    const node = await authContext.convex.query(api.nodes.get, {
       nodeId: input.nodeId
     });
     return node ? normalizeGraphNode(node) : null;
   }
   if (input.globalId) {
-    const node = await authContext.convex.query(api.epistemicNodes.getByGlobalId, {
+    const node = await authContext.convex.query(api.nodes.getByGlobalId, {
       globalId: input.globalId
     });
     return node ? normalizeGraphNode(node) : null;
@@ -21922,7 +21912,7 @@ function createGatewayGraphPort(authContext) {
       return page.beliefs;
     },
     async fetchBelief(input) {
-      const belief = await authContext.convex.query(api.epistemicBeliefs.getById, {
+      const belief = await authContext.convex.query(api.beliefs.getById, {
         beliefId: input.beliefId,
         nodeId: input.beliefId
       });
@@ -21936,7 +21926,7 @@ function createGatewayGraphPort(authContext) {
       return page.questions;
     },
     async listTestingEdges(input) {
-      const rows = await authContext.convex.query(api.epistemicEdges.getByTopicAndType, {
+      const rows = await authContext.convex.query(api.edges.getByTopicAndType, {
         topicId: input.topicId,
         edgeType: "tests"
       });
@@ -21980,7 +21970,7 @@ async function listGraphNodesFromGatewayAuth(authContext, input) {
   if (!topicId) {
     throw new Error("[graph] topicId is required to list graph nodes.");
   }
-  const rows = await authContext.convex.query(api.epistemicNodes.getByTopic, {
+  const rows = await authContext.convex.query(api.nodes.getByTopic, {
     topicId,
     userId: authContext.userId,
     limit: normalizeLimit(input.limit, 250, 1e3)
@@ -21993,7 +21983,7 @@ async function listGraphEdgesFromGatewayAuth(authContext, input) {
   if (!topicId) {
     throw new Error("[graph] topicId is required to list graph edges.");
   }
-  const rows = await authContext.convex.query(api.epistemicEdges.getByTopic, {
+  const rows = await authContext.convex.query(api.edges.getByTopic, {
     topicId,
     userId: authContext.userId,
     limit: normalizeLimit(input.limit, 500, 2e3)
@@ -23825,21 +23815,21 @@ function createGatewayTopicsPort(authContext) {
       });
     },
     listBeliefsByTopic(args) {
-      return authContext.convex.query(api.epistemicBeliefs.getByTopic, {
+      return authContext.convex.query(api.beliefs.getByTopic, {
         topicId: args.topicId,
         userId: authContext.userId,
         limit: args.limit
       });
     },
     listQuestionsByTopic(args) {
-      return authContext.convex.query(api.epistemicQuestions.getByTopic, {
+      return authContext.convex.query(api.questions.getByTopic, {
         topicId: args.topicId,
         userId: authContext.userId,
         limit: args.limit
       });
     },
     listEvidenceByTopic(args) {
-      return authContext.convex.query(api.epistemicEvidence.getByTopic, {
+      return authContext.convex.query(api.evidence.getByTopic, {
         topicId: args.topicId,
         userId: authContext.userId,
         limit: args.limit
@@ -24757,7 +24747,7 @@ function createGatewayWorktreesPort(authContext) {
     scoreBeliefOutcome(args) {
       const opinion = toSubjectiveLogicOpinion(args.confidence);
       return authContext.convex.mutation(
-        api.epistemicBeliefs.modulateConfidence,
+        api.beliefs.modulateConfidence,
         {
           nodeId: args.beliefRawId,
           trigger: "worktree_outcome",
@@ -27432,6 +27422,16 @@ var PERMIT_MEMBERSHIP_ROLES = /* @__PURE__ */ new Set([
   "platform_admin",
   "workspace_admin"
 ]);
+var PERMIT_WORKSPACE_ROLES = /* @__PURE__ */ new Set([
+  "workspace_owner",
+  "workspace_admin",
+  "workspace_member",
+  "workspace_viewer"
+]);
+var PERMIT_DEPLOYMENT_ROLES = /* @__PURE__ */ new Set([
+  "deployment_admin",
+  "deployment_operator"
+]);
 var CLERK_WEBHOOK_SECRETS = [
   "LUCERN_CLERK_WEBHOOK_SECRET",
   "CLERK_WEBHOOK_SECRET",
@@ -27453,8 +27453,7 @@ function readNumber18(value) {
   }
   return void 0;
 }
-var PERMIT_USER_KEY_PATTERN = /^[A-Za-z0-9|@+\-._]+$/;
-var PERMIT_USER_KEY_ESCAPE_SENTINEL = "|";
+var CLERK_USER_ID_PATTERN = /^user_[A-Za-z0-9]+$/;
 function asRecord26(value) {
   return isRecord8(value) ? value : {};
 }
@@ -27469,14 +27468,14 @@ function encodeBase64(bytes) {
   }
   return btoa(binary);
 }
-function permitUserKeyForPrincipalId(principalId) {
-  const trimmed = principalId.trim();
-  if (PERMIT_USER_KEY_PATTERN.test(trimmed) && !trimmed.includes(PERMIT_USER_KEY_ESCAPE_SENTINEL)) {
-    return trimmed;
+function permitUserKeyForClerkUserId(userId) {
+  const trimmed = userId.trim();
+  if (!CLERK_USER_ID_PATTERN.test(trimmed)) {
+    throw new Error(
+      `Clerk webhook user id must be a canonical Clerk user ID. Received "${userId}".`
+    );
   }
-  return Array.from(trimmed).map(
-    (character) => PERMIT_USER_KEY_PATTERN.test(character) && character !== PERMIT_USER_KEY_ESCAPE_SENTINEL ? character : `${PERMIT_USER_KEY_ESCAPE_SENTINEL}${character.codePointAt(0)?.toString(16) ?? "0"}${PERMIT_USER_KEY_ESCAPE_SENTINEL}`
-  ).join("");
+  return trimmed;
 }
 function compactRecord5(value) {
   return Object.fromEntries(
@@ -27565,9 +27564,12 @@ async function upsertPermitTenant(args) {
   const tenantPayload = {
     name: args.tenantName ?? args.tenantKey,
     attributes: compactRecord5({
+      canonicalTenantId: args.clerkOrganizationId,
+      canonicalTenantProvider: "clerk",
       clerkOrganizationId: args.clerkOrganizationId,
       clerkOrganizationSlug: args.clerkOrganizationSlug,
-      mcTenantKey: args.tenantKey,
+      mcTenantId: args.mcTenantId,
+      mcTenantSlug: args.mcTenantSlug,
       sourceType: "organization",
       sourceEvent: args.eventType,
       eventAt: args.eventAt,
@@ -27586,16 +27588,192 @@ async function upsertPermitTenant(args) {
     ...tenantPayload
   });
 }
+async function upsertPermitResourceInstance(args) {
+  const permit = getPermitClient();
+  const resourceInstance = `${args.resource}:${args.key}`;
+  const payload = {
+    attributes: compactRecord5(args.attributes)
+  };
+  try {
+    return await permit.api.resourceInstances.update(resourceInstance, payload);
+  } catch (error) {
+    if (!isNotFound(error)) {
+      throw error;
+    }
+  }
+  try {
+    return await permit.api.resourceInstances.create({
+      key: args.key,
+      tenant: args.tenantKey,
+      resource: args.resource,
+      attributes: payload.attributes
+    });
+  } catch (error) {
+    if (!isConflict(error)) {
+      throw error;
+    }
+  }
+  return await permit.api.resourceInstances.update(resourceInstance, payload);
+}
+async function createPermitRelationshipTuple(args) {
+  const permit = getPermitClient();
+  const relationshipTuples = permit.api.relationshipTuples;
+  if (!relationshipTuples || typeof relationshipTuples.create !== "function") {
+    throw new Error("Permit SDK does not expose relationship tuple creation");
+  }
+  try {
+    return await relationshipTuples.create({
+      subject: args.subject,
+      relation: args.relation,
+      object: args.object,
+      tenant: args.tenant
+    });
+  } catch (error) {
+    if (isConflict(error)) {
+      return { alreadyCreated: true };
+    }
+    throw error;
+  }
+}
+async function upsertPermitWorkspaceProjection(args) {
+  const workspaceKey = workspacePermitKey({
+    tenantKey: args.tenantKey,
+    workspace: args.workspace
+  });
+  if (!workspaceKey) {
+    return void 0;
+  }
+  return await upsertPermitResourceInstance({
+    resource: "workspace",
+    key: workspaceKey,
+    tenantKey: args.tenantKey,
+    attributes: {
+      canonicalTenantId: args.tenantKey,
+      canonicalTenantProvider: "clerk",
+      clerkOrganizationId: args.tenantKey,
+      mcTenantId: args.mcTenantId,
+      mcTenantSlug: args.mcTenantSlug,
+      mcWorkspaceId: readString28(args.workspace._id),
+      workspaceSlug: readString28(args.workspace.slug),
+      workspaceKey: readString28(args.workspace.key),
+      name: readString28(args.workspace.name),
+      status: readString28(args.workspace.status),
+      sourceType: "clerk_webhook_workspace_projection",
+      sourceEvent: args.eventType,
+      eventAt: args.eventAt,
+      actorId: args.actorId
+    }
+  });
+}
+async function upsertPermitWorkspaceRelationship(args) {
+  return await createPermitRelationshipTuple({
+    subject: `workspace:${args.workspaceKey}`,
+    relation: "belongs_to",
+    object: `tenant:${args.tenantKey}`,
+    tenant: args.tenantKey
+  });
+}
+function deploymentPermitKey(args) {
+  const workspaceKey = workspacePermitKey({
+    tenantKey: args.tenantKey,
+    workspace: args.workspace
+  });
+  const environment = slugForPermitKey(args.environment);
+  if (!workspaceKey || !environment) {
+    return void 0;
+  }
+  return `${workspaceKey}--${environment}`;
+}
+async function upsertPermitDeploymentProjection(args) {
+  const deploymentKey = deploymentPermitKey({
+    tenantKey: args.tenantKey,
+    workspace: args.workspace,
+    environment: args.environment
+  });
+  if (!deploymentKey) {
+    return void 0;
+  }
+  await upsertPermitResourceInstance({
+    resource: "deployment",
+    key: deploymentKey,
+    tenantKey: args.tenantKey,
+    attributes: {
+      canonicalTenantId: args.tenantKey,
+      canonicalTenantProvider: "clerk",
+      clerkOrganizationId: args.tenantKey,
+      mcTenantId: args.mcTenantId,
+      mcTenantSlug: args.mcTenantSlug,
+      mcWorkspaceId: readString28(args.workspace._id),
+      workspaceKey: args.workspaceKey,
+      workspaceSlug: readString28(args.workspace.slug),
+      environment: args.environment,
+      target: readString28(args.deployment.target) ?? "appDeployment",
+      url: readString28(args.deployment.url),
+      credentialRef: readString28(args.deployment.credentialRef),
+      hasCredentialRef: Boolean(readString28(args.deployment.credentialRef)),
+      sourceType: "clerk_webhook_deployment_projection",
+      sourceEvent: args.eventType,
+      eventAt: args.eventAt,
+      actorId: args.actorId
+    }
+  });
+  await createPermitRelationshipTuple({
+    subject: `deployment:${deploymentKey}`,
+    relation: "belongs_to",
+    object: `workspace:${args.workspaceKey}`,
+    tenant: args.tenantKey
+  });
+  return { deploymentKey };
+}
+async function upsertPermitDeploymentProjectionsForWorkspace(args) {
+  const deployments = asRecord26(args.workspace.deployments);
+  const deploymentKeys = [];
+  for (const [environment, deployment] of Object.entries(deployments)) {
+    if (!isRecord8(deployment)) {
+      continue;
+    }
+    const projected = await upsertPermitDeploymentProjection({
+      tenantKey: args.tenantKey,
+      mcTenantId: args.mcTenantId,
+      mcTenantSlug: args.mcTenantSlug,
+      workspace: args.workspace,
+      workspaceKey: args.workspaceKey,
+      environment,
+      deployment,
+      eventType: args.eventType,
+      eventAt: args.eventAt,
+      actorId: args.actorId
+    });
+    if (projected?.deploymentKey) {
+      deploymentKeys.push(projected.deploymentKey);
+    }
+  }
+  return deploymentKeys;
+}
 async function syncPermitUser(args) {
   const permit = getPermitClient();
   return await permit.api.users.sync({
-    key: permitUserKeyForPrincipalId(args.userId),
+    key: permitUserKeyForClerkUserId(args.userId),
     email: args.email,
     attributes: compactRecord5({
       sourceType: "clerk_webhook_user",
       sourceEvent: args.eventType,
       clerkStatus: args.eventType,
       clerkDisplayName: args.displayName,
+      clerkAliases: [
+        compactRecord5({
+          provider: "clerk",
+          externalSubjectId: args.userId,
+          email: args.email
+        })
+      ],
+      aliases: [
+        compactRecord5({
+          provider: "clerk",
+          externalSubjectId: args.userId,
+          email: args.email
+        })
+      ],
       eventAt: args.eventAt,
       actorId: args.actorId
     })
@@ -27603,7 +27781,7 @@ async function syncPermitUser(args) {
 }
 async function upsertPermitTenantMembershipRole(args) {
   const permit = getPermitClient();
-  const permitUserId = permitUserKeyForPrincipalId(args.userId);
+  const permitUserId = permitUserKeyForClerkUserId(args.userId);
   const existing = readRoleAssignments(
     await permit.api.roleAssignments.list({
       user: permitUserId,
@@ -27645,6 +27823,127 @@ async function upsertPermitTenantMembershipRole(args) {
     throw error;
   }
 }
+function workspaceRoleForTenantMembership(role) {
+  if (role === "platform_admin" || role === "tenant_admin") {
+    return "workspace_owner";
+  }
+  if (role === "workspace_admin") {
+    return "workspace_admin";
+  }
+  if (role === "editor" || role === "service_agent") {
+    return "workspace_member";
+  }
+  return "workspace_viewer";
+}
+function deploymentRoleForTenantMembership(role) {
+  const workspaceRole = workspaceRoleForTenantMembership(role);
+  if (workspaceRole === "workspace_owner") {
+    return "deployment_admin";
+  }
+  if (workspaceRole === "workspace_admin") {
+    return "deployment_operator";
+  }
+  return null;
+}
+async function upsertPermitWorkspaceMembershipRole(args) {
+  const permit = getPermitClient();
+  const permitUserId = permitUserKeyForClerkUserId(args.userId);
+  const workspaceRole = workspaceRoleForTenantMembership(args.role);
+  const existing = readRoleAssignments(
+    await permit.api.roleAssignments.list({
+      user: permitUserId,
+      tenant: args.tenantKey,
+      resourceInstance: args.resourceInstance,
+      perPage: 100
+    })
+  );
+  await Promise.all(
+    existing.map((assignment2) => {
+      const role = readString28(assignment2.role);
+      if (!role || !PERMIT_WORKSPACE_ROLES.has(role)) {
+        return Promise.resolve();
+      }
+      if (roleAssignmentResourceInstance(assignment2) !== args.resourceInstance) {
+        return Promise.resolve();
+      }
+      if (role === workspaceRole) {
+        return Promise.resolve();
+      }
+      return unassignPermitTenantMembershipRole({
+        permit,
+        permitUserId,
+        tenant: args.tenantKey,
+        role,
+        resourceInstance: args.resourceInstance
+      });
+    })
+  );
+  const assignment = {
+    user: permitUserId,
+    role: workspaceRole,
+    tenant: args.tenantKey,
+    resource_instance: args.resourceInstance
+  };
+  try {
+    return await permit.api.roleAssignments.assign(assignment);
+  } catch (error) {
+    if (isConflict(error)) {
+      return { alreadyAssigned: true };
+    }
+    throw error;
+  }
+}
+async function upsertPermitDeploymentMembershipRole(args) {
+  const permit = getPermitClient();
+  const permitUserId = permitUserKeyForClerkUserId(args.userId);
+  const deploymentRole = deploymentRoleForTenantMembership(args.role);
+  const existing = readRoleAssignments(
+    await permit.api.roleAssignments.list({
+      user: permitUserId,
+      tenant: args.tenantKey,
+      resourceInstance: args.resourceInstance,
+      perPage: 100
+    })
+  );
+  await Promise.all(
+    existing.map((assignment2) => {
+      const role = readString28(assignment2.role);
+      if (!role || !PERMIT_DEPLOYMENT_ROLES.has(role)) {
+        return Promise.resolve();
+      }
+      if (roleAssignmentResourceInstance(assignment2) !== args.resourceInstance) {
+        return Promise.resolve();
+      }
+      if (role === deploymentRole) {
+        return Promise.resolve();
+      }
+      return unassignPermitTenantMembershipRole({
+        permit,
+        permitUserId,
+        tenant: args.tenantKey,
+        role,
+        resourceInstance: args.resourceInstance
+      });
+    })
+  );
+  if (!deploymentRole) {
+    return { skipped: "membership_role_has_no_deployment_role" };
+  }
+  const assignment = {
+    user: permitUserId,
+    role: deploymentRole,
+    tenant: args.tenantKey,
+    resource_instance: args.resourceInstance
+  };
+  try {
+    return await permit.api.roleAssignments.assign(assignment);
+  } catch (error) {
+    if (isConflict(error)) {
+      return { alreadyAssigned: true };
+    }
+    throw error;
+  }
+}
 async function unassignPermitTenantMembershipRole(args) {
   const api2 = args.permit.api;
   const assignment = {
@@ -27670,7 +27969,7 @@ async function unassignPermitTenantMembershipRole(args) {
 }
 async function revokePermitTenantMembershipRoles(args) {
   const permit = getPermitClient();
-  const permitUserId = permitUserKeyForPrincipalId(args.userId);
+  const permitUserId = permitUserKeyForClerkUserId(args.userId);
   const assignments = readRoleAssignments(
     await permit.api.roleAssignments.list({
       user: permitUserId,
@@ -27696,6 +27995,88 @@ async function revokePermitTenantMembershipRoles(args) {
     })
   );
 }
+async function revokePermitWorkspaceMembershipRoles(args) {
+  const permit = getPermitClient();
+  const permitUserId = permitUserKeyForClerkUserId(args.userId);
+  const assignments = readRoleAssignments(
+    await permit.api.roleAssignments.list({
+      user: permitUserId,
+      tenant: args.tenantKey,
+      resourceInstance: args.resourceInstance,
+      perPage: 100
+    })
+  );
+  const workspaceRoles = assignments.filter(
+    (assignment) => roleAssignmentResourceInstance(assignment) === args.resourceInstance && PERMIT_WORKSPACE_ROLES.has(readString28(assignment.role) ?? "")
+  );
+  await Promise.all(
+    workspaceRoles.map((assignment) => {
+      const role = readString28(assignment.role);
+      if (!role) {
+        return Promise.resolve();
+      }
+      return unassignPermitTenantMembershipRole({
+        permit,
+        permitUserId,
+        tenant: args.tenantKey,
+        role,
+        resourceInstance: args.resourceInstance
+      });
+    })
+  );
+}
+async function revokePermitDeploymentMembershipRoles(args) {
+  const permit = getPermitClient();
+  const permitUserId = permitUserKeyForClerkUserId(args.userId);
+  const assignments = readRoleAssignments(
+    await permit.api.roleAssignments.list({
+      user: permitUserId,
+      tenant: args.tenantKey,
+      resourceInstance: args.resourceInstance,
+      perPage: 100
+    })
+  );
+  const deploymentRoles = assignments.filter(
+    (assignment) => roleAssignmentResourceInstance(assignment) === args.resourceInstance && PERMIT_DEPLOYMENT_ROLES.has(readString28(assignment.role) ?? "")
+  );
+  await Promise.all(
+    deploymentRoles.map((assignment) => {
+      const role = readString28(assignment.role);
+      if (!role) {
+        return Promise.resolve();
+      }
+      return unassignPermitTenantMembershipRole({
+        permit,
+        permitUserId,
+        tenant: args.tenantKey,
+        role,
+        resourceInstance: args.resourceInstance
+      });
+    })
+  );
+}
+function tenantPermitKey(args) {
+  return readString28(args.organizationId);
+}
+function workspacePermitKey(args) {
+  const tenantKey = readString28(args.tenantKey);
+  const workspaceKey = slugForPermitKey(
+    readString28(args.workspace.slug) ?? readString28(args.workspace.key),
+    readString28(args.workspace._id)
+  );
+  if (!tenantKey || !workspaceKey) {
+    return void 0;
+  }
+  return `${tenantKey}--${workspaceKey}`;
+}
+function slugForPermitKey(value, fallback) {
+  const raw = readString28(value) ?? readString28(fallback);
+  if (!raw) {
+    return void 0;
+  }
+  const slug = raw.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || void 0;
+}
 function normalizeBase64(value) {
   return value.replace(/-/g, "+").replace(/_/g, "/");
 }
@@ -27882,12 +28263,12 @@ async function getMasterControlConvexClient2() {
   mcClientCache2.value = client;
   return client;
 }
-async function resolveTenantByOrgSlug(args) {
-  if (!args.organizationSlug) {
+async function resolveTenantByClerkOrganization(args) {
+  if (!args.organizationId) {
     return void 0;
   }
-  const tenant = await args.client.query(mcApi2.tenants.getBySlug, {
-    slug: args.organizationSlug
+  const tenant = await args.client.query(mcApi2.tenants.getByCanonicalOrgId, {
+    clerkOrganizationId: args.organizationId
   });
   if (!tenant || !isRecord8(tenant)) {
     return void 0;
@@ -27899,6 +28280,90 @@ async function resolveTenantByOrgSlug(args) {
   }
   return { tenantId, tenantSlug };
 }
+async function resolveOrProvisionTenantByClerkOrganization(args) {
+  const existing = await resolveTenantByClerkOrganization({
+    client: args.client,
+    organizationId: args.organizationId
+  });
+  if (existing) {
+    return { ...existing, provisioned: false };
+  }
+  if (args.eventType !== "organization.created") {
+    return void 0;
+  }
+  const result = await args.client.mutation(
+    mcApi2.tenants.provisionFromClerkOrganization,
+    {
+      clerkOrganizationId: args.organizationId,
+      organizationName: args.organizationName,
+      organizationSlug: args.organizationSlug,
+      ownerClerkId: CLERK_USER_ID_PATTERN.test(args.actorId) ? args.actorId : void 0,
+      actorClerkId: args.actorId
+    }
+  );
+  const record = asRecord26(result);
+  const tenantId = readString28(record.tenantId);
+  const tenantSlug = readString28(record.slug) ?? args.organizationId;
+  if (!tenantId) {
+    return void 0;
+  }
+  return {
+    tenantId,
+    tenantSlug,
+    provisioned: Boolean(record.created)
+  };
+}
+async function listActiveTenantWorkspaces(args) {
+  const workspaces2 = await args.client.query(mcApi2.workspaces.listByTenant, {
+    tenantId: args.tenantId,
+    status: "active"
+  });
+  return asArray(workspaces2).filter(isRecord8);
+}
+async function upsertPermitWorkspaceProjectionsForTenant(args) {
+  const workspaces2 = await listActiveTenantWorkspaces({
+    client: args.client,
+    tenantId: args.tenant.tenantId
+  });
+  const projected = [];
+  for (const workspace of workspaces2) {
+    await upsertPermitWorkspaceProjection({
+      tenantKey: args.tenantKey,
+      mcTenantId: args.tenant.tenantId,
+      mcTenantSlug: args.tenant.tenantSlug,
+      workspace,
+      eventType: args.eventType,
+      eventAt: args.eventAt,
+      actorId: args.actorId
+    });
+    const workspaceKey = workspacePermitKey({
+      tenantKey: args.tenantKey,
+      workspace
+    });
+    const deploymentKeys = workspaceKey ? await upsertPermitDeploymentProjectionsForWorkspace({
+      tenantKey: args.tenantKey,
+      mcTenantId: args.tenant.tenantId,
+      mcTenantSlug: args.tenant.tenantSlug,
+      workspace,
+      workspaceKey,
+      eventType: args.eventType,
+      eventAt: args.eventAt,
+      actorId: args.actorId
+    }) : [];
+    if (workspaceKey) {
+      await upsertPermitWorkspaceRelationship({
+        tenantKey: args.tenantKey,
+        workspaceKey
+      });
+    }
+    projected.push({
+      workspaceId: readString28(workspace._id),
+      workspaceKey,
+      deploymentKeys
+    });
+  }
+  return projected;
+}
 function webhookError(code, status, message, correlationId, policyTraceId, details) {
   return errorResponse({
     code,
@@ -27994,9 +28459,13 @@ async function handleClerkWebhook(args) {
         );
       }
       const client = await getClient();
-      const tenant = await resolveTenantByOrgSlug({
+      const tenant = await resolveOrProvisionTenantByClerkOrganization({
         client,
-        organizationSlug: organizationIds.organizationSlug
+        organizationId,
+        organizationSlug: organizationIds.organizationSlug,
+        organizationName: extractOrganizationName(organizationRecord),
+        eventType,
+        actorId
       });
       if (!tenant) {
         return webhookError(
@@ -28015,12 +28484,58 @@ async function handleClerkWebhook(args) {
       await upsertPermitTenant({
         clerkOrganizationId: organizationId,
         clerkOrganizationSlug: organizationIds.organizationSlug,
-        tenantKey: tenant.tenantSlug,
+        mcTenantId: tenant.tenantId,
+        mcTenantSlug: tenant.tenantSlug,
+        tenantKey: organizationId,
         tenantName: extractOrganizationName(organizationRecord),
         eventType,
         eventAt: eventTimestamp,
         actorId
       });
+      const workspaces2 = await upsertPermitWorkspaceProjectionsForTenant({
+        client,
+        tenant,
+        tenantKey: organizationId,
+        eventType,
+        eventAt: eventTimestamp,
+        actorId
+      });
+      if (eventType === "organization.created" && CLERK_USER_ID_PATTERN.test(actorId)) {
+        await syncPermitUser({
+          userId: actorId,
+          email: void 0,
+          displayName: void 0,
+          eventType,
+          eventAt: eventTimestamp,
+          actorId
+        });
+        await Promise.all(
+          workspaces2.flatMap((workspace) => {
+            const assignments = [];
+            if (workspace.workspaceKey) {
+              assignments.push(
+                upsertPermitWorkspaceMembershipRole({
+                  userId: actorId,
+                  tenantKey: organizationId,
+                  role: "tenant_admin",
+                  resourceInstance: `workspace:${workspace.workspaceKey}`
+                })
+              );
+            }
+            assignments.push(
+              ...workspace.deploymentKeys.map(
+                (deploymentKey) => upsertPermitDeploymentMembershipRole({
+                  userId: actorId,
+                  tenantKey: organizationId,
+                  role: "tenant_admin",
+                  resourceInstance: `deployment:${deploymentKey}`
+                })
+              )
+            );
+            return assignments;
+          })
+        );
+      }
       const principal = await client.mutation(mcApi2.identity.upsertPrincipal, {
         principalId: organizationId,
         principalType: "group",
@@ -28071,6 +28586,8 @@ async function handleClerkWebhook(args) {
           acknowledged: true,
           eventType,
           tenantId: tenant.tenantId,
+          provisioned: tenant.provisioned,
+          workspaceCount: workspaces2.length,
           principalId: organizationId,
           principal,
           alias
@@ -28165,9 +28682,9 @@ async function handleClerkWebhook(args) {
     if (isMembershipEvent || isInvitationEvent) {
       const client = await getClient();
       const org = extractOrganizationIds(data);
-      const tenant = await resolveTenantByOrgSlug({
+      const tenant = await resolveTenantByClerkOrganization({
         client,
-        organizationSlug: org.organizationSlug
+        organizationId: org.organizationId
       });
       if (!tenant) {
         return webhookError(
@@ -28186,16 +28703,26 @@ async function handleClerkWebhook(args) {
       const userId = readString28(data.user_id) || readString28(asRecord26(data.public_user_data).user_id) || readString28(asRecord26(data.user).id);
       const rawRole = readString28(data.role);
       const role = normalizeRole(rawRole);
-      const permitTenantKey = tenant.tenantSlug;
+      const permitTenantKey = tenantPermitKey({
+        organizationId: org.organizationId
+      });
       if (!permitTenantKey) {
         return webhookError(
           "INVALID_REQUEST",
           400,
-          "Clerk organization webhook payload missing organization tenant key.",
+          "Clerk organization webhook payload missing canonical organization id.",
           args.correlationId,
           args.policyTraceId
         );
       }
+      const workspaceProjections = await upsertPermitWorkspaceProjectionsForTenant({
+        client,
+        tenant,
+        tenantKey: permitTenantKey,
+        eventType,
+        eventAt: eventTimestamp,
+        actorId
+      });
       if (INVITATION_EVENTS.has(eventType)) {
         const invitationId = readString28(data.id);
         const invitationAccepted = eventType === "organizationInvitation.accepted";
@@ -28258,6 +28785,32 @@ async function handleClerkWebhook(args) {
               tenantKey: permitTenantKey,
               role
             });
+            await Promise.all(
+              workspaceProjections.flatMap((workspace) => {
+                const assignments = [];
+                if (workspace.workspaceKey) {
+                  assignments.push(
+                    upsertPermitWorkspaceMembershipRole({
+                      userId,
+                      tenantKey: permitTenantKey,
+                      role,
+                      resourceInstance: `workspace:${workspace.workspaceKey}`
+                    })
+                  );
+                }
+                assignments.push(
+                  ...workspace.deploymentKeys.map(
+                    (deploymentKey) => upsertPermitDeploymentMembershipRole({
+                      userId,
+                      tenantKey: permitTenantKey,
+                      role,
+                      resourceInstance: `deployment:${deploymentKey}`
+                    })
+                  )
+                );
+                return assignments;
+              })
+            );
             await client.mutation(mcApi2.identity.upsertMembership, {
               principalId: userId,
               principalRefId: void 0,
@@ -28298,6 +28851,30 @@ async function handleClerkWebhook(args) {
               userId,
               tenantKey: permitTenantKey
             });
+            await Promise.all(
+              workspaceProjections.flatMap((workspace) => {
+                const revocations = [];
+                if (workspace.workspaceKey) {
+                  revocations.push(
+                    revokePermitWorkspaceMembershipRoles({
+                      userId,
+                      tenantKey: permitTenantKey,
+                      resourceInstance: `workspace:${workspace.workspaceKey}`
+                    })
+                  );
+                }
+                revocations.push(
+                  ...workspace.deploymentKeys.map(
+                    (deploymentKey) => revokePermitDeploymentMembershipRoles({
+                      userId,
+                      tenantKey: permitTenantKey,
+                      resourceInstance: `deployment:${deploymentKey}`
+                    })
+                  )
+                );
+                return revocations;
+              })
+            );
             const existing = await client.query(mcApi2.identity.getMembershipForPrincipal, {
               principalId: userId,
               tenantId: tenant.tenantId,
@@ -28395,6 +28972,30 @@ async function handleClerkWebhook(args) {
           userId,
           tenantKey: permitTenantKey
         });
+        await Promise.all(
+          workspaceProjections.flatMap((workspace) => {
+            const revocations = [];
+            if (workspace.workspaceKey) {
+              revocations.push(
+                revokePermitWorkspaceMembershipRoles({
+                  userId,
+                  tenantKey: permitTenantKey,
+                  resourceInstance: `workspace:${workspace.workspaceKey}`
+                })
+              );
+            }
+            revocations.push(
+              ...workspace.deploymentKeys.map(
+                (deploymentKey) => revokePermitDeploymentMembershipRoles({
+                  userId,
+                  tenantKey: permitTenantKey,
+                  resourceInstance: `deployment:${deploymentKey}`
+                })
+              )
+            );
+            return revocations;
+          })
+        );
         const existing = await client.query(mcApi2.identity.getMembershipForPrincipal, {
           principalId: userId,
           tenantId: tenant.tenantId,
@@ -28446,6 +29047,32 @@ async function handleClerkWebhook(args) {
         tenantKey: permitTenantKey,
         role
       });
+      await Promise.all(
+        workspaceProjections.flatMap((workspace) => {
+          const assignments = [];
+          if (workspace.workspaceKey) {
+            assignments.push(
+              upsertPermitWorkspaceMembershipRole({
+                userId,
+                tenantKey: permitTenantKey,
+                role,
+                resourceInstance: `workspace:${workspace.workspaceKey}`
+              })
+            );
+          }
+          assignments.push(
+            ...workspace.deploymentKeys.map(
+              (deploymentKey) => upsertPermitDeploymentMembershipRole({
+                userId,
+                tenantKey: permitTenantKey,
+                role,
+                resourceInstance: `deployment:${deploymentKey}`
+              })
+            )
+          );
+          return assignments;
+        })
+      );
       return successResponse(
         {
           acknowledged: true,