@lucern/sdk 0.3.0-alpha.0 → 0.3.0-alpha.10

package/dist/gatewayFacades.js

@@ -1,3 +1,170 @@
+// src/authContext.ts
+var LucernSdkAuthContextError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "LucernSdkAuthContextError";
+    this.reason = reason;
+  }
+};
+function cleanString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function cleanStringList(values) {
+  if (!values) {
+    return [];
+  }
+  return values.map((value) => value.trim()).filter(
+    (value, index, list) => value.length > 0 && list.indexOf(value) === index
+  );
+}
+function requireString(value, reason, label) {
+  const normalized = cleanString(value);
+  if (!normalized) {
+    throw new LucernSdkAuthContextError(
+      reason,
+      `Canonical Lucern SDK auth context is missing ${label}.`
+    );
+  }
+  return normalized;
+}
+function requirePrincipalType(principalType) {
+  if (!principalType) {
+    throw new LucernSdkAuthContextError(
+      "principal_missing",
+      "Canonical Lucern SDK auth context is missing principalType."
+    );
+  }
+  return principalType;
+}
+function requireAuthMode(authMode) {
+  if (!authMode) {
+    throw new LucernSdkAuthContextError(
+      "principal_missing",
+      "Canonical Lucern SDK auth context is missing authMode."
+    );
+  }
+  return authMode;
+}
+function ensurePermitMatch(args) {
+  const actual = cleanString(args.actual);
+  if (actual && actual !== args.expected) {
+    throw new LucernSdkAuthContextError(
+      "policy_denied",
+      `Canonical Lucern SDK auth context has conflicting Permit ${args.field}.`
+    );
+  }
+}
+function normalizeCanonicalLucernAuthContext(input) {
+  if (!input) {
+    throw new LucernSdkAuthContextError(
+      "principal_missing",
+      "Canonical Lucern SDK auth context is required."
+    );
+  }
+  if (input.policyDecision === "deny") {
+    throw new LucernSdkAuthContextError(
+      "policy_denied",
+      "Canonical Lucern SDK auth context carries a denied policy decision."
+    );
+  }
+  const principalId = requireString(
+    input.principalId,
+    "principal_missing",
+    "principalId"
+  );
+  const tenantId = requireString(input.tenantId, "tenant_missing", "tenantId");
+  const workspaceId = requireString(
+    input.workspaceId,
+    "workspace_missing",
+    "workspaceId"
+  );
+  const roles = cleanStringList(input.roles);
+  const scopes = cleanStringList(input.scopes);
+  const principalType = requirePrincipalType(input.principalType);
+  const authMode = requireAuthMode(input.authMode);
+  const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
+  if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
+    throw new LucernSdkAuthContextError(
+      "membership_missing",
+      "Canonical Lucern SDK auth context requires non-empty roles and scopes."
+    );
+  }
+  const subject = cleanString(input.permit?.subject) ?? principalId;
+  const tenant = cleanString(input.permit?.tenant) ?? tenantId;
+  const workspace = cleanString(input.permit?.workspace) ?? workspaceId;
+  ensurePermitMatch({
+    field: "subject",
+    expected: principalId,
+    actual: subject
+  });
+  ensurePermitMatch({ field: "tenant", expected: tenantId, actual: tenant });
+  ensurePermitMatch({
+    field: "workspace",
+    expected: workspaceId,
+    actual: workspace
+  });
+  const context = input.permit?.context ? { ...input.permit.context } : void 0;
+  return {
+    clerkId: cleanString(input.clerkId),
+    principalId,
+    tenantId,
+    workspaceId,
+    principalType,
+    authMode,
+    roles,
+    scopes,
+    delegationChain: input.delegationChain ? [...input.delegationChain] : [],
+    policyTraceId: cleanString(input.policyTraceId),
+    correlationId: cleanString(input.correlationId),
+    membershipId: cleanString(input.membershipId),
+    permit: {
+      subject,
+      tenant,
+      workspace,
+      resource: cleanString(input.permit?.resource),
+      action: cleanString(input.permit?.action),
+      relation: cleanString(input.permit?.relation),
+      context
+    }
+  };
+}
+function createCanonicalAuthHeaders(authContext) {
+  const headers = {
+    "x-lucern-principal-id": authContext.principalId,
+    "x-lucern-principal-type": authContext.principalType,
+    "x-lucern-tenant": authContext.tenantId,
+    "x-lucern-tenant-id": authContext.tenantId,
+    "x-lucern-workspace": authContext.workspaceId,
+    "x-lucern-workspace-id": authContext.workspaceId,
+    "x-lucern-auth-mode": authContext.authMode,
+    "x-lucern-roles": authContext.roles.join(","),
+    "x-lucern-scopes": authContext.scopes.join(","),
+    "x-lucern-permit-context": JSON.stringify(authContext.permit)
+  };
+  if (authContext.clerkId) {
+    headers["x-lucern-clerk-id"] = authContext.clerkId;
+    headers["x-lucern-user-id"] = authContext.clerkId;
+  }
+  if (authContext.delegationChain.length > 0) {
+    headers["x-lucern-delegation-chain"] = JSON.stringify(
+      authContext.delegationChain
+    );
+  }
+  if (authContext.policyTraceId) {
+    headers["x-lucern-policy-trace-id"] = authContext.policyTraceId;
+  }
+  if (authContext.correlationId) {
+    headers["x-correlation-id"] = authContext.correlationId;
+    headers["x-lucern-correlation-id"] = authContext.correlationId;
+  }
+  if (authContext.membershipId) {
+    headers["x-lucern-membership-id"] = authContext.membershipId;
+  }
+  return headers;
+}
+
 // src/coreClient.ts
 var LucernApiError = class extends Error {
   code;
@@ -65,9 +232,7 @@ function generatePortableRequestId() {
     8
   ).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
 }
-function randomIdempotencyKey() {
-  return generatePortableRequestId();
-}
+var randomIdempotencyKey = generatePortableRequestId;
 function isRetryableStatus(status) {
   return status >= 500 || status === 408 || status === 429;
 }
@@ -132,8 +297,11 @@ function timeoutError(timeoutMs) {
   error.name = "AbortError";
   return error;
 }
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function readPolicySummaryFromDetails(details) {
-  if (!details || typeof details !== "object" || Array.isArray(details)) {
+  if (!isRecord(details)) {
     return null;
   }
   const directSummary = details.summary;
@@ -141,11 +309,11 @@ function readPolicySummaryFromDetails(details) {
     return directSummary.trim();
   }
   const policy = details.policy;
-  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
+  if (!isRecord(policy)) {
     return null;
   }
   const explanation = policy.explanation;
-  if (!explanation || typeof explanation !== "object" || Array.isArray(explanation)) {
+  if (!isRecord(explanation)) {
     return null;
   }
   const nestedSummary = explanation.summary;
@@ -154,16 +322,41 @@ function readPolicySummaryFromDetails(details) {
   }
   return null;
 }
+async function resolveConfiguredAuthContext(authContext) {
+  if (typeof authContext === "function") {
+    return await authContext();
+  }
+  return authContext;
+}
+function mergeHeaderRecord(base, addition) {
+  const headers = new Headers(base);
+  for (const [key, value] of Object.entries(addition)) {
+    const existing = headers.get(key);
+    if (existing !== null && existing !== value) {
+      throw new LucernSdkAuthContextError(
+        "policy_denied",
+        `Canonical Lucern SDK auth context conflicts with existing ${key} header.`
+      );
+    }
+    headers.set(key, value);
+  }
+  return Object.fromEntries(headers.entries());
+}
 function createGatewayRequestClient(config = {}) {
   const fetchImpl = config.fetchImpl ?? fetch;
   const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
   const maxRetries = config.maxRetries ?? 2;
   const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
   async function resolveAuthHeaders() {
-    if (!config.getAuthHeaders) {
-      return {};
+    const base = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const authContextInput = await resolveConfiguredAuthContext(
+      config.authContext
+    );
+    if (!authContextInput && !config.requireCanonicalAuthContext) {
+      return base;
     }
-    return await config.getAuthHeaders();
+    const authContext = normalizeCanonicalLucernAuthContext(authContextInput);
+    return mergeHeaderRecord(base, createCanonicalAuthHeaders(authContext));
   }
   async function fetchWithTimeout(url, init, timeoutMs) {
     const controller = new AbortController();
@@ -184,11 +377,11 @@ function createGatewayRequestClient(config = {}) {
     if (!text) {
       return null;
     }
-    try {
-      return JSON.parse(text);
-    } catch {
+    const parsed = tryParseGatewayEnvelopeJson(text);
+    if (!parsed.ok) {
       return null;
     }
+    return isRecord(parsed.value) ? parsed.value : null;
   }
   function resolveTimeoutMs(method, requestTimeoutMs) {
     if (typeof requestTimeoutMs === "number") {
@@ -200,16 +393,31 @@ function createGatewayRequestClient(config = {}) {
     }
     return config.timeoutMs ?? 15e3;
   }
+  function tryParseGatewayEnvelopeJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
+      return { ok: false, reason: "non-json" };
+    }
+    try {
+      return { ok: true, value: JSON.parse(trimmed) };
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        return { ok: false, reason: "invalid-json", error };
+      }
+      throw error;
+    }
+  }
   function buildApiError(args) {
     const failure = args.failure;
-    const legacyError = failure && typeof failure.error === "object" && failure.error !== null ? failure.error : failure?.legacyError;
+    const legacyError = failure && isRecord(failure.error) ? failure.error : failure?.legacyError;
     const correlationId = failure?.correlationId ?? args.response.headers.get("x-lucern-correlation-id")?.trim() ?? args.requestId;
     const policyTraceId = failure?.policyTraceId ?? args.response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null;
     const details = failure?.details ?? legacyError?.details;
     const policySummary = readPolicySummaryFromDetails(details);
+    const failureMessage = typeof failure?.error === "string" ? failure.error : legacyError?.message;
     return new LucernApiError({
       code: failure?.code ?? legacyError?.code ?? fallbackErrorCode(args.response.status),
-      message: policySummary ?? (typeof failure?.error === "string" ? failure.error : legacyError?.message ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed.")),
+      message: policySummary ?? failureMessage ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed."),
       status: args.response.status,
       invariant: failure?.invariant,
       suggestion: failure?.suggestion,
@@ -334,47 +542,18 @@ function createGatewayRequestClient(config = {}) {
   };
 }
 
-// src/opinion.ts
-function clamp01(value) {
-  if (!Number.isFinite(value)) {
-    return 0;
-  }
-  return Math.max(0, Math.min(1, value));
-}
-function vacuous(baseRate = 0.5) {
-  return { b: 0, d: 0, u: 1, a: clamp01(baseRate) };
-}
-function dogmatic(probability, baseRate = 0.5) {
-  const p = clamp01(probability);
-  return { b: p, d: 1 - p, u: 0, a: clamp01(baseRate) };
-}
-function opinionFromBaseRate(probability) {
-  return vacuous(clamp01(probability));
-}
-function opinionFromDogmatic(probability, baseRate = 0.5) {
-  return dogmatic(clamp01(probability), clamp01(baseRate));
-}
-function opinionFromProjected(probability, uncertainty, baseRate = 0.5) {
-  const p = clamp01(probability);
-  const u = clamp01(uncertainty);
-  const remainingMass = 1 - u;
-  return {
-    b: p * remainingMass,
-    d: (1 - p) * remainingMass,
-    u,
-    a: clamp01(baseRate)
-  };
-}
-
 // src/sdkSurface.ts
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 function asRecord(value) {
-  return value && typeof value === "object" ? value : {};
+  return isRecord2(value) ? value : {};
 }
-function cleanString(value) {
+function cleanString2(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeVerificationStatus(value) {
-  const status = cleanString(value);
+  const status = cleanString2(value);
   if (!status) {
     return void 0;
   }
@@ -390,20 +569,20 @@ function cloneWith(value, patch) {
   return { ...value, ...patch };
 }
 function resolveTopicId(value) {
-  return cleanString(value.topicId);
+  return cleanString2(value.topicId);
 }
 function resolveText(value) {
-  return cleanString(value.text) ?? cleanString(value.canonicalText);
+  return cleanString2(value.text) ?? cleanString2(value.canonicalText);
 }
 function withTopicAlias(value) {
-  const topicId = cleanString(value.topicId) ?? void 0;
+  const topicId = cleanString2(value.topicId) ?? void 0;
   if (!topicId) {
     return value;
   }
   return cloneWith(value, { topicId });
 }
 function withTextAlias(value) {
-  const text = cleanString(value.text) ?? cleanString(value.canonicalText) ?? void 0;
+  const text = cleanString2(value.text) ?? cleanString2(value.canonicalText) ?? void 0;
   if (!text) {
     return value;
   }
@@ -429,11 +608,9 @@ function normalizeNodeWriteInput(value) {
   }
   return next;
 }
-function normalizeNodeVerificationStatus(value) {
-  return normalizeVerificationStatus(value);
-}
+var normalizeNodeVerificationStatus = normalizeVerificationStatus;
 function normalizeTopicQuery(value) {
-  const topicId = cleanString(value.topicId);
+  const topicId = cleanString2(value.topicId);
   if (!topicId) {
     return value;
   }
@@ -458,7 +635,10 @@ function createListResult(items, legacyKey) {
     total: items.length
   };
   if (legacyKey) {
-    result[legacyKey] = items;
+    return {
+      ...result,
+      [legacyKey]: items
+    };
   }
   return result;
 }
@@ -478,7 +658,7 @@ function mapAliasedList(data, legacyKey) {
 // src/ontologyClient.ts
 function createOntologyClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
-  return {
+  const client = {
     /**
      * List ontology definitions matching optional filters.
      */
@@ -487,13 +667,14 @@ function createOntologyClient(config = {}) {
         path: `/api/platform/v1/ontologies${toQueryString(filters)}`
       }).then(
         (response) => mapGatewayData(response, (data) => {
-          const record = data && typeof data === "object" && !Array.isArray(data) ? data : {};
-          const ontologies = Array.isArray(record.ontologies) ? record.ontologies : Array.isArray(record.definitions) ? record.definitions : Array.isArray(data) ? data : [];
-          const total = typeof record.total === "number" && Number.isFinite(record.total) ? record.total : ontologies.length;
+          const record = asRecord(data);
+          const ontologies = asListItems(data, "ontologies");
+          const definitions = ontologies.length > 0 ? ontologies : asListItems(data, "definitions");
+          const total = typeof record.total === "number" && Number.isFinite(record.total) ? record.total : definitions.length;
           return {
             ...record,
-            ...createListResult(ontologies, "definitions"),
-            ontologies,
+            ...createListResult(definitions, "definitions"),
+            ontologies: definitions,
             total
           };
         })
@@ -520,18 +701,6 @@ function createOntologyClient(config = {}) {
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
-    /**
-     * List ontology definitions.
-     */
-    async listDefinitions(filters = {}) {
-      return this.list(filters);
-    },
-    /**
-     * Get an ontology definition.
-     */
-    async getDefinition(id) {
-      return this.get(id);
-    },
     /**
      * Create an ontology definition.
      */
@@ -573,7 +742,7 @@ function createOntologyClient(config = {}) {
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "versions")
+          (data) => createListResult(asListItems(data, "versions"), "versions")
         )
       );
     },
@@ -621,20 +790,19 @@ function createOntologyClient(config = {}) {
           (data) => createListResult(Array.isArray(data) ? data : [], "topics")
         )
       );
-    },
-    /**
-     * @deprecated Use listTopics.
-     */
-    async listTopicsByOntology(ontologyId) {
-      return this.listTopics(ontologyId);
     }
   };
+  return Object.assign(client, {
+    listDefinitions: client.list,
+    getDefinition: client.get,
+    listTopicsByOntology: client.listTopics
+  });
 }
 
 // src/graphClient.ts
 function createGraphClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
-  return {
+  const client = {
     /**
      * List graph nodes matching the provided filters.
      */
@@ -647,12 +815,6 @@ function createGraphClient(config = {}) {
         (response) => mapGatewayData(response, (data) => mapAliasedList(data, "nodes"))
       );
     },
-    /**
-     * @deprecated Use listNodes.
-     */
-    async queryNodes(query) {
-      return this.listNodes(query);
-    },
     /**
      * Retrieve a single graph node by nodeId or globalId.
      */
@@ -763,12 +925,6 @@ function createGraphClient(config = {}) {
         )
       );
     },
-    /**
-     * @deprecated Use listEdges.
-     */
-    async queryEdges(query) {
-      return this.listEdges(query);
-    },
     /**
      * Create a graph edge.
      */
@@ -856,12 +1012,6 @@ function createGraphClient(config = {}) {
         body: normalizeTopicQuery(query)
       });
     },
-    /**
-     * Retrieve a graph neighborhood around a root node.
-     */
-    async getNeighborhood(query) {
-      return this.neighborhood(query);
-    },
     /**
      * Retrieve the shortest known path between two graph nodes.
      */
@@ -879,6 +1029,48 @@ function createGraphClient(config = {}) {
       });
     }
   };
+  return Object.assign(client, {
+    queryNodes: client.listNodes,
+    queryEdges: client.listEdges,
+    getNeighborhood: client.neighborhood
+  });
+}
+
+// src/boundaryClientSurface.ts
+function cleanOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function cleanRequiredString(value, label) {
+  const normalized = cleanOptionalString(value);
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function assertKnownKeys(input, allowed, operation) {
+  const allowedSet = new Set(allowed);
+  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
+    );
+  }
+}
+function knownPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return { ...input };
+}
+function listResultFromEnvelope(data, legacyKey) {
+  const record = isRecord3(data) ? data : {};
+  const legacyItems = record[legacyKey];
+  return createListResult(
+    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
+    legacyKey
+  );
 }
 
 // src/identityClient.ts
@@ -892,6 +1084,37 @@ function createIdentityWhoamiClient(config = {}) {
     }
   };
 }
+var TENANT_IDENTITY_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "integrationKey",
+  "secretRef",
+  "policySubject",
+  "policyAction",
+  "policyResource",
+  "decision",
+  "config",
+  "configKey",
+  "configValue",
+  "provider",
+  "status",
+  "metadata",
+  "limit",
+  "cursor"
+];
+function tenantIdentityQuery(input) {
+  return {
+    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
+    workspaceId: input.workspaceId,
+    principalId: input.principalId,
+    limit: input.limit,
+    cursor: input.cursor
+  };
+}
+function tenantIdentityBody(input, operation) {
+  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
+}
 function createIdentityClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
   const whoamiClient = createIdentityWhoamiClient(config);
@@ -901,6 +1124,13 @@ function createIdentityClient(config = {}) {
     body: input,
     idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
   });
+  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
+  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
+    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
+    method: "POST",
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
   return {
     /**
      * Resolve the current authenticated identity summary.
@@ -949,15 +1179,11 @@ function createIdentityClient(config = {}) {
     /**
      * Update a principal.
      */
-    async updatePrincipal(input, idempotencyKey) {
-      return requestPrincipalWrite("PATCH", input, idempotencyKey);
-    },
+    updatePrincipal,
     /**
      * @deprecated Use createPrincipal or updatePrincipal.
      */
-    async upsertPrincipal(input, idempotencyKey) {
-      return requestPrincipalWrite("PATCH", input, idempotencyKey);
-    },
+    upsertPrincipal: updatePrincipal,
     /**
      * List keys in the current identity scope.
      */
@@ -996,20 +1222,11 @@ function createIdentityClient(config = {}) {
     /**
      * Delete an API key by revoking it.
      */
-    async deleteKey(keyId, input = {}, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
+    deleteKey,
     /**
      * @deprecated Use deleteKey.
      */
-    async revokeKey(keyId, input = {}, idempotencyKey) {
-      return this.deleteKey(keyId, input, idempotencyKey);
-    },
+    revokeKey: deleteKey,
     /**
      * Search Clerk users by email or display attributes.
      */
@@ -1017,20 +1234,120 @@ function createIdentityClient(config = {}) {
       return gateway.request({
         path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
       });
+    },
+    async getTenantConfig(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/tenant-config${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      });
+    },
+    async updateTenantConfig(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      return gateway.request({
+        path: "/api/platform/v1/identity/tenant-config",
+        method: "PATCH",
+        body: tenantIdentityBody(
+          input,
+          "identity.updateTenantConfig"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listIntegrations(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/integrations${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "integrations"
+          )
+        )
+      );
+    },
+    async upsertIntegration(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.integrationKey, "integrationKey");
+      return gateway.request({
+        path: "/api/platform/v1/identity/integrations",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.upsertIntegration"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listSecrets(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/secrets${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "secrets"
+          )
+        )
+      );
+    },
+    async putSecretReference(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.secretRef, "secretRef");
+      return gateway.request({
+        path: "/api/platform/v1/identity/secrets",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.putSecretReference"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async evaluatePolicy(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.policySubject, "policySubject");
+      cleanRequiredString(input.policyAction, "policyAction");
+      cleanRequiredString(input.policyResource, "policyResource");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/evaluate",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.evaluatePolicy"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async recordPolicyDecision(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.decision, "decision");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/decisions",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.recordPolicyDecision"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
     }
   };
 }
 
 // src/topicsClient.ts
-function asRecord2(value) {
-  return value && typeof value === "object" ? value : {};
-}
-function cleanString2(value) {
+function cleanString3(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeTopicRecord(value) {
-  const record = asRecord2(value);
-  const topicId = cleanString2(record.topicId) ?? cleanString2(record.id) ?? cleanString2(record._id);
+  const record = asRecord(value);
+  const topicId = cleanString3(record.topicId) ?? cleanString3(record.id) ?? cleanString3(record._id);
   return withTopicAlias({
     ...record,
     ...topicId ? { topicId } : {}
@@ -1054,7 +1371,7 @@ function createTopicsClient(config = {}) {
         })}`
       }).then(
         (response) => mapGatewayData(response, (data) => {
-          const record = asRecord2(data);
+          const record = asRecord(data);
           const items = Array.isArray(record.topics) ? record.topics.map(normalizeTopicRecord) : [];
           return {
             ...createListResult(items, "topics"),
@@ -1071,7 +1388,7 @@ function createTopicsClient(config = {}) {
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => normalizeTopicRecord(asRecord2(data).topic ?? data)
+          (data) => normalizeTopicRecord(asRecord(data).topic ?? data)
         )
       );
     },
@@ -1107,7 +1424,7 @@ function createTopicsClient(config = {}) {
         )}`
       }).then(
         (response) => mapGatewayData(response, (data) => {
-          const record = asRecord2(data);
+          const record = asRecord(data);
           return {
             tree: Array.isArray(record.tree) ? record.tree.map(normalizeTopicTreeNode) : []
           };
@@ -1142,11 +1459,7 @@ function createTopicsClient(config = {}) {
 
 // src/gatewayFacades.ts
 function normalizeBeliefConfidenceInput(input) {
-  const opinion = "opinion" in input ? input.opinion : input.interpretation === "base_rate" ? opinionFromBaseRate(input.confidence) : input.interpretation === "dogmatic" ? opinionFromDogmatic(input.confidence, input.baseRate) : opinionFromProjected(
-    input.confidence,
-    input.uncertainty,
-    input.baseRate
-  );
+  const opinion = input.opinion;
   return {
     belief: opinion.b,
     disbelief: opinion.d,
@@ -1154,6 +1467,11 @@ function normalizeBeliefConfidenceInput(input) {
     baseRate: opinion.a,
     trigger: input.trigger,
     rationale: input.rationale,
+    triggeringEvidenceId: input.triggeringEvidenceId,
+    triggeringQuestionId: input.triggeringQuestionId,
+    triggeringAnswerId: input.triggeringAnswerId,
+    triggeringContradictionId: input.triggeringContradictionId,
+    triggeringWorktreeId: input.triggeringWorktreeId,
     maxInlinePropagationTargets: input.maxInlinePropagationTargets
   };
 }
@@ -1525,7 +1843,7 @@ function createEventsFacade(config = {}) {
 function createGraphFacade(config = {}) {
   const graphClient = createGraphClient(config);
   const gateway = createGatewayRequestClient(config);
-  return {
+  const graphFacade = {
     async neighborhood(input) {
       return graphClient.neighborhood({
         globalId: input.globalId,
@@ -1533,18 +1851,6 @@ function createGraphFacade(config = {}) {
         maxDepth: input.maxDepth
       });
     },
-    async traverse(input) {
-      return graphClient.traverse(input);
-    },
-    async analyze(input = {}) {
-      return graphClient.analyze(input);
-    },
-    async bias(input = {}) {
-      return graphClient.bias(input);
-    },
-    async gaps(input) {
-      return graphClient.gaps(input);
-    },
     async falsify(input, idempotencyKey = randomIdempotencyKey()) {
       return gateway.request({
         path: "/api/platform/v1/graph/falsify",
@@ -1554,6 +1860,12 @@ function createGraphFacade(config = {}) {
       });
     }
   };
+  return Object.assign(graphFacade, {
+    traverse: graphClient.traverse,
+    analyze: graphClient.analyze,
+    bias: graphClient.bias,
+    gaps: graphClient.gaps
+  });
 }
 function createIdentityFacade(config = {}) {
   const identityClient = createIdentityClient(config);
@@ -1567,15 +1879,12 @@ function createIdentityFacade(config = {}) {
 function createOntologiesFacade(config = {}) {
   const ontologyClient = createOntologyClient(config);
   const gateway = createGatewayRequestClient(config);
-  return {
+  const ontologyFacade = {
     async get(id) {
       return gateway.request({
         path: `/api/platform/v1/ontologies/${encodeURIComponent(id)}`
       });
     },
-    async list(query = {}) {
-      return ontologyClient.list(query);
-    },
     async bind(input, idempotencyKey) {
       return gateway.request({
         path: `/api/platform/v1/ontologies/${encodeURIComponent(input.ontologyId)}/bind`,
@@ -1595,6 +1904,9 @@ function createOntologiesFacade(config = {}) {
       });
     }
   };
+  return Object.assign(ontologyFacade, {
+    list: ontologyClient.list
+  });
 }
 function createQuestionsFacade(config = {}) {
   const gateway = createGatewayRequestClient(config);
@@ -1787,15 +2099,9 @@ function createTasksFacade(config = {}) {
 function createTopicsFacade(config = {}) {
   const topicsClient = createTopicsClient(config);
   return {
-    async create(input, idempotencyKey) {
-      return topicsClient.create(input, idempotencyKey);
-    },
-    async get(id) {
-      return topicsClient.get(id);
-    },
-    async list(query = {}) {
-      return topicsClient.list(query);
-    },
+    create: topicsClient.create,
+    get: topicsClient.get,
+    list: topicsClient.list,
     async update(input, idempotencyKey) {
       const { id, ...rest } = input;
       return topicsClient.update(id, rest, idempotencyKey);
@@ -1811,12 +2117,8 @@ function createTopicsFacade(config = {}) {
         maxDepth: input.maxDepth
       });
     },
-    async remove(id, idempotencyKey = randomIdempotencyKey()) {
-      return topicsClient.remove(id, idempotencyKey);
-    },
-    async bulkCreate(input, idempotencyKey = randomIdempotencyKey()) {
-      return topicsClient.bulkCreate(input, idempotencyKey);
-    }
+    remove: topicsClient.remove,
+    bulkCreate: topicsClient.bulkCreate
   };
 }
 function createWebhooksFacade(config = {}) {
@@ -1893,6 +2195,18 @@ function createWorktreesFacade(config = {}) {
     async list(query) {
       return gateway.request({
         path: `/api/platform/v1/worktrees${toQueryString({
+          topicId: query.topicId,
+          status: query.status,
+          groupBy: query.groupBy,
+          lane: query.lane,
+          campaign: query.campaign,
+          limit: query.limit
+        })}`
+      });
+    },
+    async listCampaigns(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/worktrees/campaigns${toQueryString({
           topicId: query.topicId,
           status: query.status,
           limit: query.limit
@@ -1915,10 +2229,10 @@ function createWorktreesFacade(config = {}) {
           objective: input.objective,
           hypothesis: input.hypothesis,
           rationale: input.rationale,
-          track: input.track,
-          trackPosition: input.trackPosition,
-          executionBand: input.executionBand,
-          executionOrder: input.executionOrder,
+          campaign: input.campaign,
+          lane: input.lane,
+          laneOrderInCampaign: input.laneOrderInCampaign,
+          orderInLane: input.orderInLane,
           dependsOn: input.dependsOn,
           blocks: input.blocks,
           gate: input.gate,