@lucern/sdk 0.3.0-alpha.10 → 0.3.0-alpha.11

package/dist/client.js

@@ -1048,6 +1048,574 @@ function createAdminClient(config = {}) {
   };
 }
 
+// src/boundaryClientSurface.ts
+function cleanOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function cleanRequiredString(value, label) {
+  const normalized = cleanOptionalString(value);
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function readTopicId(input) {
+  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
+}
+function requireTopicId(input) {
+  const topicId = readTopicId(input);
+  if (!topicId) {
+    throw new Error("topicId is required");
+  }
+  return topicId;
+}
+function assertKnownKeys(input, allowed, operation) {
+  const allowedSet = new Set(allowed);
+  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
+    );
+  }
+}
+function knownPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return { ...input };
+}
+function topicPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return {
+    ...input,
+    topicId: requireTopicId(input),
+    projectId: void 0
+  };
+}
+function listResultFromEnvelope(data, legacyKey) {
+  const record = isRecord3(data) ? data : {};
+  const legacyItems = record[legacyKey];
+  return createListResult(
+    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
+    legacyKey
+  );
+}
+
+// src/identityClient.ts
+function createIdentityWhoamiClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    async whoami() {
+      return gateway.request({
+        path: "/api/platform/v1/identity/whoami"
+      });
+    }
+  };
+}
+var TENANT_IDENTITY_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "integrationKey",
+  "secretRef",
+  "policySubject",
+  "policyAction",
+  "policyResource",
+  "decision",
+  "config",
+  "configKey",
+  "configValue",
+  "provider",
+  "status",
+  "metadata",
+  "limit",
+  "cursor"
+];
+function tenantIdentityQuery(input) {
+  return {
+    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
+    workspaceId: input.workspaceId,
+    principalId: input.principalId,
+    limit: input.limit,
+    cursor: input.cursor
+  };
+}
+function tenantIdentityBody(input, operation) {
+  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
+}
+function createIdentityClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  const whoamiClient = createIdentityWhoamiClient(config);
+  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
+    path: "/api/platform/v1/identity/principals",
+    method,
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
+  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
+    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
+    method: "POST",
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  return {
+    /**
+     * Resolve the current authenticated identity summary.
+     */
+    async whoami() {
+      return whoamiClient.whoami().then(
+        (response) => mapGatewayData(response, (data) => ({
+          principalId: data.principalId,
+          principalType: data.principalType,
+          tenantId: data.tenantId ?? null,
+          workspaceId: data.workspaceId ?? null,
+          scopes: Array.isArray(data.scopes) ? data.scopes : [],
+          roles: Array.isArray(data.roles) ? data.roles : [],
+          isPlatformAdmin: data.isPlatformAdmin === true,
+          isTenantAdmin: data.isTenantAdmin === true,
+          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
+          authMode: data.authMode,
+          sessionId: data.sessionId,
+          delegatedBy: data.delegatedBy,
+          expiresAt: data.expiresAt
+        }))
+      );
+    },
+    /**
+     * List principals in the current identity scope.
+     */
+    async listPrincipals(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "principals"
+          )
+        )
+      );
+    },
+    /**
+     * Create a principal.
+     */
+    async createPrincipal(input, idempotencyKey) {
+      return requestPrincipalWrite("POST", input, idempotencyKey);
+    },
+    /**
+     * Update a principal.
+     */
+    updatePrincipal,
+    /**
+     * @deprecated Use createPrincipal or updatePrincipal.
+     */
+    upsertPrincipal: updatePrincipal,
+    /**
+     * List keys in the current identity scope.
+     */
+    async listKeys(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+        )
+      );
+    },
+    /**
+     * Create an API key.
+     */
+    async createKey(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/identity/keys",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Rotate an API key.
+     */
+    async rotateKey(keyId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Delete an API key by revoking it.
+     */
+    deleteKey,
+    /**
+     * @deprecated Use deleteKey.
+     */
+    revokeKey: deleteKey,
+    /**
+     * Search Clerk users by email or display attributes.
+     */
+    async searchClerkUsers(q) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+      });
+    },
+    async getTenantConfig(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/tenant-config${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      });
+    },
+    async updateTenantConfig(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      return gateway.request({
+        path: "/api/platform/v1/identity/tenant-config",
+        method: "PATCH",
+        body: tenantIdentityBody(
+          input,
+          "identity.updateTenantConfig"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listIntegrations(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/integrations${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "integrations"
+          )
+        )
+      );
+    },
+    async upsertIntegration(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.integrationKey, "integrationKey");
+      return gateway.request({
+        path: "/api/platform/v1/identity/integrations",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.upsertIntegration"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listSecrets(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/secrets${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "secrets"
+          )
+        )
+      );
+    },
+    async putSecretReference(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.secretRef, "secretRef");
+      return gateway.request({
+        path: "/api/platform/v1/identity/secrets",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.putSecretReference"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async evaluatePolicy(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.policySubject, "policySubject");
+      cleanRequiredString(input.policyAction, "policyAction");
+      cleanRequiredString(input.policyResource, "policyResource");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/evaluate",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.evaluatePolicy"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async recordPolicyDecision(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.decision, "decision");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/decisions",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.recordPolicyDecision"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
+  };
+}
+
+// src/accessControl.ts
+var LucernAccessControlError = class extends LucernSdkAuthContextError {
+  policyDecision;
+  constructor(reason, message, policyDecision) {
+    super(reason, message);
+    this.name = "LucernAccessControlError";
+    this.policyDecision = policyDecision;
+  }
+};
+function cleanString3(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function cleanStringList2(values) {
+  if (!values) {
+    return [];
+  }
+  return [
+    ...new Set(
+      values.map((value) => value.trim()).filter((value) => value.length > 0)
+    )
+  ];
+}
+function requireString2(value, reason, label) {
+  const normalized = cleanString3(value);
+  if (!normalized) {
+    throw new LucernAccessControlError(
+      reason,
+      `Lucern SDK access control requires ${label}.`
+    );
+  }
+  return normalized;
+}
+function normalizePrincipalType(principalType) {
+  if (principalType === "agent") {
+    return "agent";
+  }
+  if (principalType === "service") {
+    return "service";
+  }
+  return "human";
+}
+function aliasKey(alias) {
+  return `${alias.provider}:${alias.providerProjectId ?? ""}:${alias.externalSubjectId}`;
+}
+function normalizeAliases(input, canonicalClerkUserId) {
+  const aliases = /* @__PURE__ */ new Map();
+  for (const alias of input ?? []) {
+    const externalSubjectId = cleanString3(alias.externalSubjectId);
+    if (!externalSubjectId) {
+      continue;
+    }
+    const normalized = {
+      provider: cleanString3(alias.provider) ?? "clerk",
+      providerProjectId: cleanString3(alias.providerProjectId),
+      externalSubjectId,
+      status: cleanString3(alias.status)
+    };
+    aliases.set(aliasKey(normalized), normalized);
+  }
+  if (canonicalClerkUserId) {
+    const canonicalAlias = {
+      provider: "clerk",
+      externalSubjectId: canonicalClerkUserId,
+      status: "active"
+    };
+    aliases.set(aliasKey(canonicalAlias), canonicalAlias);
+  }
+  return [...aliases.values()];
+}
+function isKnownClerkSubject(args) {
+  if (args.clerkId === args.canonicalClerkUserId) {
+    return true;
+  }
+  return args.aliases.some(
+    (alias) => alias.provider === "clerk" && alias.externalSubjectId === args.clerkId
+  );
+}
+function authContextToPrincipalInput(input) {
+  const normalized = normalizeCanonicalLucernAuthContext(input);
+  return {
+    principalId: normalized.principalId,
+    principalType: normalized.principalType,
+    canonicalClerkUserId: normalized.clerkId,
+    clerkId: normalized.clerkId,
+    tenantId: normalized.tenantId,
+    workspaceId: normalized.workspaceId,
+    roles: normalized.roles,
+    scopes: normalized.scopes
+  };
+}
+function isAuthContextInput(input) {
+  return "authMode" in input || "permit" in input || "delegationChain" in input;
+}
+function normalizeCanonicalPrincipalIdentity(input, options = {}) {
+  const principalInput = isAuthContextInput(input) ? authContextToPrincipalInput(input) : input;
+  const principalId = requireString2(
+    principalInput.principalId,
+    "principal_missing",
+    "principalId"
+  );
+  const principalType = normalizePrincipalType(principalInput.principalType);
+  const observedClerkId = cleanString3(options.observedClerkId);
+  const canonicalClerkUserId = cleanString3(principalInput.canonicalClerkUserId) ?? cleanString3(principalInput.clerkId);
+  if (principalType === "human" && !canonicalClerkUserId) {
+    throw new LucernAccessControlError(
+      "clerk_alias_missing",
+      "Human principals require one canonical Clerk user id."
+    );
+  }
+  const aliases = normalizeAliases(
+    principalInput.clerkIdentityAliases,
+    canonicalClerkUserId
+  );
+  if (observedClerkId && !isKnownClerkSubject({
+    clerkId: observedClerkId,
+    canonicalClerkUserId,
+    aliases
+  })) {
+    throw new LucernAccessControlError(
+      "clerk_alias_unrecognized",
+      "Observed Clerk user id is not attached to the canonical Lucern principal."
+    );
+  }
+  return {
+    principalId,
+    principalType,
+    canonicalClerkUserId,
+    clerkIdentityAliases: aliases,
+    tenantId: cleanString3(principalInput.tenantId),
+    workspaceId: cleanString3(principalInput.workspaceId),
+    roles: cleanStringList2(principalInput.roles),
+    scopes: cleanStringList2(principalInput.scopes)
+  };
+}
+function formatPermitResource(resource) {
+  if (typeof resource === "string") {
+    return requireString2(resource, "policy_denied", "policyResource");
+  }
+  const type = requireString2(resource.type, "policy_denied", "resource.type");
+  const key = requireString2(resource.key, "policy_denied", "resource.key");
+  return key.startsWith(`${type}:`) ? key : `${type}:${key}`;
+}
+function resourceRequiresWorkspace(resource) {
+  if (typeof resource === "string") {
+    return !resource.startsWith("tenant:");
+  }
+  return resource.type !== "tenant";
+}
+function buildPolicyInput(identity, input) {
+  const tenantId = requireString2(
+    input.tenantId ?? identity.tenantId,
+    "tenant_missing",
+    "tenantId"
+  );
+  const workspaceId = cleanString3(input.workspaceId ?? identity.workspaceId);
+  if (resourceRequiresWorkspace(input.resource) && !workspaceId) {
+    throw new LucernAccessControlError(
+      "workspace_missing",
+      "Workspace-scoped Permit checks require workspaceId."
+    );
+  }
+  return {
+    tenantId,
+    workspaceId,
+    principalId: identity.principalId,
+    policySubject: identity.principalId,
+    policyAction: requireString2(input.action, "policy_denied", "policyAction"),
+    policyResource: formatPermitResource(input.resource),
+    metadata: input.context
+  };
+}
+async function resolveConfiguredPrincipalInput(authContext) {
+  if (typeof authContext === "function") {
+    return await authContext();
+  }
+  return authContext;
+}
+function assertPermitAllowed(decision) {
+  if (decision.decision !== "allow") {
+    throw new LucernAccessControlError(
+      decision.decision === "deny" ? "policy_denied" : "policy_unknown",
+      `Permit denied ${decision.policyAction} on ${decision.policyResource}.`,
+      decision
+    );
+  }
+}
+function createAccessControlClient(config = {}) {
+  const identityClient = createIdentityClient(config);
+  async function resolveIdentity(input, observedClerkId) {
+    const identityInput = input ?? await resolveConfiguredPrincipalInput(config.authContext);
+    if (!identityInput) {
+      throw new LucernAccessControlError(
+        "principal_missing",
+        "Lucern SDK access control requires a canonical principal identity."
+      );
+    }
+    return normalizeCanonicalPrincipalIdentity(identityInput, {
+      observedClerkId
+    });
+  }
+  async function checkAccess(input, idempotencyKey) {
+    const identity = await resolveIdentity(input.identity, input.observedClerkId);
+    const policyInput = buildPolicyInput(identity, input);
+    try {
+      const response = await identityClient.evaluatePolicy(
+        policyInput,
+        idempotencyKey
+      );
+      return {
+        identity,
+        policyInput,
+        decision: response.data
+      };
+    } catch (error) {
+      if (error instanceof LucernSdkAuthContextError) {
+        throw error;
+      }
+      throw new LucernAccessControlError(
+        "policy_unavailable",
+        "Permit policy check failed closed before an allow decision was returned."
+      );
+    }
+  }
+  async function requireAccess(input, idempotencyKey) {
+    const result = await checkAccess(input, idempotencyKey);
+    assertPermitAllowed(result.decision);
+    return result;
+  }
+  async function canAccess(input, idempotencyKey) {
+    try {
+      await requireAccess(input, idempotencyKey);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return {
+    normalizePrincipal: normalizeCanonicalPrincipalIdentity,
+    checkAccess,
+    requireAccess,
+    canAccess
+  };
+}
+
 // src/answersClient.ts
 function createAnswersClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
@@ -1215,7 +1783,7 @@ function authBaseUrl(config) {
 async function readJson(response) {
   try {
     const payload = await response.json();
-    return isRecord3(payload) ? payload : {};
+    return isRecord4(payload) ? payload : {};
   } catch (error) {
     return unreadableJsonBodyFallback();
   }
@@ -1223,7 +1791,7 @@ async function readJson(response) {
 function unreadableJsonBodyFallback(_error) {
   return {};
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readString(value) {
@@ -1266,7 +1834,7 @@ function assertDeviceTokenResponse(payload) {
     tenant_id: tenantId,
     workspace_id: readString(payload.workspace_id),
     principal_id: principalId,
-    user: isRecord3(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
+    user: isRecord4(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
       id: payload.user.id,
       principalId: payload.user.principalId
     } : void 0
@@ -1612,61 +2180,6 @@ function createEvidenceClient(config = {}) {
   };
 }
 
-// src/boundaryClientSurface.ts
-function cleanOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function isRecord4(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function cleanRequiredString(value, label) {
-  const normalized = cleanOptionalString(value);
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
-  return normalized;
-}
-function readTopicId(input) {
-  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
-}
-function requireTopicId(input) {
-  const topicId = readTopicId(input);
-  if (!topicId) {
-    throw new Error("topicId is required");
-  }
-  return topicId;
-}
-function assertKnownKeys(input, allowed, operation) {
-  const allowedSet = new Set(allowed);
-  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
-  if (unknownKeys.length > 0) {
-    throw new Error(
-      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
-    );
-  }
-}
-function knownPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return { ...input };
-}
-function topicPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return {
-    ...input,
-    topicId: requireTopicId(input),
-    projectId: void 0
-  };
-}
-function listResultFromEnvelope(data, legacyKey) {
-  const record = isRecord4(data) ? data : {};
-  const legacyItems = record[legacyKey];
-  return createListResult(
-    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
-    legacyKey
-  );
-}
-
 // src/eventingClient.ts
 var EVENTING_FIELDS = [
   "tenantId",
@@ -2065,628 +2578,360 @@ function createOntologyClient(config = {}) {
       });
     },
     /**
-     * Bind an ontology definition to a topic.
-     */
-    async bind(input, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/ontologies/${encodeURIComponent(input.ontologyId)}/bind`,
-        method: "POST",
-        body: {
-          topicId: input.topicId
-        },
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Create an ontology definition.
-     */
-    async createDefinition(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/ontologies",
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Update an ontology definition.
-     */
-    async updateDefinition(id, input, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/ontologies/${encodeURIComponent(id)}`,
-        method: "PATCH",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Archive an ontology definition.
-     */
-    async archiveDefinition(id, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/ontologies/${encodeURIComponent(id)}`,
-        method: "DELETE",
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * List versions for an ontology definition.
-     */
-    async listVersions(ontologyId, filters = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions${toQueryString(filters)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(asListItems(data, "versions"), "versions")
-        )
-      );
-    },
-    /**
-     * Create an ontology version.
-     */
-    async createVersion(ontologyId, input, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions`,
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Publish an ontology version.
-     */
-    async publishVersion(ontologyId, versionId, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions/${encodeURIComponent(versionId)}/publish`,
-        method: "POST",
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Deprecate an ontology version.
-     */
-    async deprecateVersion(ontologyId, versionId, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions/${encodeURIComponent(versionId)}/deprecate`,
-        method: "POST",
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * List topics directly bound to a specific ontology definition.
-     * Uses the topics gateway with ontologyId filter.
-     */
-    async listTopics(ontologyId) {
-      return gateway.request({
-        path: `/api/platform/v1/topics?ontologyId=${encodeURIComponent(ontologyId)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "topics")
-        )
-      );
-    }
-  };
-  return Object.assign(client, {
-    listDefinitions: client.list,
-    getDefinition: client.get,
-    listTopicsByOntology: client.listTopics
-  });
-}
-
-// src/graphClient.ts
-function createGraphClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const client = {
-    /**
-     * List graph nodes matching the provided filters.
-     */
-    async listNodes(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/nodes${toQueryString(
-          normalizeTopicQuery(query5)
-        )}`
-      }).then(
-        (response) => mapGatewayData(response, (data) => mapAliasedList(data, "nodes"))
-      );
-    },
-    /**
-     * Retrieve a single graph node by nodeId or globalId.
-     */
-    async getNode(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/nodes${toQueryString(query5)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => withSdkAliases(data)
-        )
-      );
-    },
-    /**
-     * Create a graph node.
-     */
-    async createNode(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/nodes",
-        method: "POST",
-        body: normalizeNodeWriteInput(input),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => withSdkAliases(data)
-        )
-      );
-    },
-    /**
-     * Update a graph node.
-     */
-    async updateNode(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/nodes",
-        method: "PUT",
-        body: normalizeNodeWriteInput(input),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => withSdkAliases(data)
-        )
-      );
-    },
-    /**
-     * Batch create graph nodes through the admin route surface.
+     * Bind an ontology definition to a topic.
      */
-    async batchCreateNodes(input, idempotencyKey) {
+    async bind(input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/graph/nodes/batch",
+        path: `/api/platform/v1/ontologies/${encodeURIComponent(input.ontologyId)}/bind`,
         method: "POST",
         body: {
-          nodes: input.nodes.map((node) => normalizeNodeWriteInput(node))
+          topicId: input.topicId
         },
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Supersede an existing graph node with a new canonical version.
+     * Create an ontology definition.
      */
-    async supersedeNode(input, idempotencyKey) {
+    async createDefinition(input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/graph/nodes/supersede",
+        path: "/api/platform/v1/ontologies",
         method: "POST",
         body: input,
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Update a node's verification status.
+     * Update an ontology definition.
      */
-    async verifyNode(input, idempotencyKey) {
-      const verificationStatus = normalizeNodeVerificationStatus(input.verificationStatus) ?? input.verificationStatus;
+    async updateDefinition(id, input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/graph/nodes/verify",
-        method: "POST",
-        body: {
-          ...input,
-          verificationStatus
-        },
+        path: `/api/platform/v1/ontologies/${encodeURIComponent(id)}`,
+        method: "PATCH",
+        body: input,
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Permanently delete a node via the admin-only hard-delete route.
+     * Archive an ontology definition.
      */
-    async hardDeleteNode(input, idempotencyKey) {
+    async archiveDefinition(id, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/graph/nodes/hard-delete",
-        method: "POST",
-        body: input,
+        path: `/api/platform/v1/ontologies/${encodeURIComponent(id)}`,
+        method: "DELETE",
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * List graph edges matching the provided filters.
+     * List versions for an ontology definition.
      */
-    async listEdges(query5) {
+    async listVersions(ontologyId, filters = {}) {
       return gateway.request({
-        path: `/api/platform/v1/graph/edges${toQueryString(
-          normalizeTopicQuery(query5)
-        )}`
+        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions${toQueryString(filters)}`
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => mapAliasedList(data, "edges")
+          (data) => createListResult(asListItems(data, "versions"), "versions")
         )
       );
     },
     /**
-     * Create a graph edge.
+     * Create an ontology version.
      */
-    async createEdge(input, idempotencyKey) {
+    async createVersion(ontologyId, input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/graph/edges",
+        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions`,
         method: "POST",
-        body: normalizeTopicQuery(input),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Delete one or more edges matching the provided filter.
-     */
-    async deleteEdge(query5, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/edges${toQueryString(query5)}`,
-        method: "DELETE",
+        body: input,
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Retrieve a graph neighborhood around a root node.
-     */
-    async neighborhood(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
-      });
-    },
-    /**
-     * Traverse the graph from a starting node.
+     * Publish an ontology version.
      */
-    async traverse(query5) {
+    async publishVersion(ontologyId, versionId, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/graph/traverse",
+        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions/${encodeURIComponent(versionId)}/publish`,
         method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Analyze graph structure for a topic.
-     */
-    async analyze(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/analyze${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Detect confirmation-bias patterns for a topic graph.
-     */
-    async bias(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/bias${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Find graph gaps for beliefs that still need testing.
-     */
-    async gaps(query5) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/gaps${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
-        })}`
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Search across graph resources within a topic.
+     * Deprecate an ontology version.
      */
-    async search(query5) {
+    async deprecateVersion(ontologyId, versionId, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/search",
+        path: `/api/platform/v1/ontologies/${encodeURIComponent(ontologyId)}/versions/${encodeURIComponent(versionId)}/deprecate`,
         method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Retrieve the shortest known path between two graph nodes.
-     */
-    async getPath(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Retrieve graph analytics for the requested metric.
+     * List topics directly bound to a specific ontology definition.
+     * Uses the topics gateway with ontologyId filter.
      */
-    async getAnalytics(query5 = {}) {
+    async listTopics(ontologyId) {
       return gateway.request({
-        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
-      });
+        path: `/api/platform/v1/topics?ontologyId=${encodeURIComponent(ontologyId)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "topics")
+        )
+      );
     }
   };
   return Object.assign(client, {
-    queryNodes: client.listNodes,
-    queryEdges: client.listEdges,
-    getNeighborhood: client.neighborhood
+    listDefinitions: client.list,
+    getDefinition: client.get,
+    listTopicsByOntology: client.listTopics
   });
 }
 
-// src/identityClient.ts
-function createIdentityWhoamiClient(config = {}) {
+// src/graphClient.ts
+function createGraphClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
-  return {
-    async whoami() {
+  const client = {
+    /**
+     * List graph nodes matching the provided filters.
+     */
+    async listNodes(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/whoami"
-      });
-    }
-  };
-}
-var TENANT_IDENTITY_FIELDS = [
-  "tenantId",
-  "workspaceId",
-  "principalId",
-  "integrationKey",
-  "secretRef",
-  "policySubject",
-  "policyAction",
-  "policyResource",
-  "decision",
-  "config",
-  "configKey",
-  "configValue",
-  "provider",
-  "status",
-  "metadata",
-  "limit",
-  "cursor"
-];
-function tenantIdentityQuery(input) {
-  return {
-    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
-    workspaceId: input.workspaceId,
-    principalId: input.principalId,
-    limit: input.limit,
-    cursor: input.cursor
-  };
-}
-function tenantIdentityBody(input, operation) {
-  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
-}
-function createIdentityClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const whoamiClient = createIdentityWhoamiClient(config);
-  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
-    path: "/api/platform/v1/identity/principals",
-    method,
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
-  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
-    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
-    method: "POST",
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  return {
+        path: `/api/platform/v1/graph/nodes${toQueryString(
+          normalizeTopicQuery(query5)
+        )}`
+      }).then(
+        (response) => mapGatewayData(response, (data) => mapAliasedList(data, "nodes"))
+      );
+    },
     /**
-     * Resolve the current authenticated identity summary.
+     * Retrieve a single graph node by nodeId or globalId.
      */
-    async whoami() {
-      return whoamiClient.whoami().then(
-        (response) => mapGatewayData(response, (data) => ({
-          principalId: data.principalId,
-          principalType: data.principalType,
-          tenantId: data.tenantId ?? null,
-          workspaceId: data.workspaceId ?? null,
-          scopes: Array.isArray(data.scopes) ? data.scopes : [],
-          roles: Array.isArray(data.roles) ? data.roles : [],
-          isPlatformAdmin: data.isPlatformAdmin === true,
-          isTenantAdmin: data.isTenantAdmin === true,
-          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
-          authMode: data.authMode,
-          sessionId: data.sessionId,
-          delegatedBy: data.delegatedBy,
-          expiresAt: data.expiresAt
-        }))
+    async getNode(query5) {
+      return gateway.request({
+        path: `/api/platform/v1/graph/nodes${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => withSdkAliases(data)
+        )
       );
     },
     /**
-     * List principals in the current identity scope.
+     * Create a graph node.
      */
-    async listPrincipals(query5 = {}) {
+    async createNode(input, idempotencyKey) {
       return gateway.request({
-        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
+        path: "/api/platform/v1/graph/nodes",
+        method: "POST",
+        body: normalizeNodeWriteInput(input),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => createListResult(
-            Array.isArray(data) ? data : [],
-            "principals"
-          )
+          (data) => withSdkAliases(data)
         )
       );
     },
     /**
-     * Create a principal.
-     */
-    async createPrincipal(input, idempotencyKey) {
-      return requestPrincipalWrite("POST", input, idempotencyKey);
-    },
-    /**
-     * Update a principal.
-     */
-    updatePrincipal,
-    /**
-     * @deprecated Use createPrincipal or updatePrincipal.
-     */
-    upsertPrincipal: updatePrincipal,
-    /**
-     * List keys in the current identity scope.
+     * Update a graph node.
      */
-    async listKeys(query5 = {}) {
+    async updateNode(input, idempotencyKey) {
       return gateway.request({
-        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
+        path: "/api/platform/v1/graph/nodes",
+        method: "PUT",
+        body: normalizeNodeWriteInput(input),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+          (data) => withSdkAliases(data)
         )
       );
     },
     /**
-     * Create an API key.
+     * Batch create graph nodes through the admin route surface.
      */
-    async createKey(input, idempotencyKey) {
+    async batchCreateNodes(input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/identity/keys",
+        path: "/api/platform/v1/graph/nodes/batch",
         method: "POST",
-        body: input,
+        body: {
+          nodes: input.nodes.map((node) => normalizeNodeWriteInput(node))
+        },
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Rotate an API key.
+     * Supersede an existing graph node with a new canonical version.
      */
-    async rotateKey(keyId, input = {}, idempotencyKey) {
+    async supersedeNode(input, idempotencyKey) {
       return gateway.request({
-        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
+        path: "/api/platform/v1/graph/nodes/supersede",
         method: "POST",
         body: input,
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Delete an API key by revoking it.
-     */
-    deleteKey,
-    /**
-     * @deprecated Use deleteKey.
-     */
-    revokeKey: deleteKey,
-    /**
-     * Search Clerk users by email or display attributes.
+     * Update a node's verification status.
      */
-    async searchClerkUsers(q) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
-      });
-    },
-    async getTenantConfig(input) {
+    async verifyNode(input, idempotencyKey) {
+      const verificationStatus = normalizeNodeVerificationStatus(input.verificationStatus) ?? input.verificationStatus;
       return gateway.request({
-        path: `/api/platform/v1/identity/tenant-config${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
+        path: "/api/platform/v1/graph/nodes/verify",
+        method: "POST",
+        body: {
+          ...input,
+          verificationStatus
+        },
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
-    async updateTenantConfig(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
+    /**
+     * Permanently delete a node via the admin-only hard-delete route.
+     */
+    async hardDeleteNode(input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/identity/tenant-config",
-        method: "PATCH",
-        body: tenantIdentityBody(
-          input,
-          "identity.updateTenantConfig"
-        ),
+        path: "/api/platform/v1/graph/nodes/hard-delete",
+        method: "POST",
+        body: input,
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
-    async listIntegrations(input) {
+    /**
+     * List graph edges matching the provided filters.
+     */
+    async listEdges(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/integrations${toQueryString(
-          tenantIdentityQuery(input)
+        path: `/api/platform/v1/graph/edges${toQueryString(
+          normalizeTopicQuery(query5)
         )}`
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => listResultFromEnvelope(
-            data,
-            "integrations"
-          )
+          (data) => mapAliasedList(data, "edges")
         )
       );
     },
-    async upsertIntegration(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.integrationKey, "integrationKey");
+    /**
+     * Create a graph edge.
+     */
+    async createEdge(input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/identity/integrations",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.upsertIntegration"
-        ),
+        path: "/api/platform/v1/graph/edges",
+        method: "POST",
+        body: normalizeTopicQuery(input),
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
-    async listSecrets(input) {
+    /**
+     * Delete one or more edges matching the provided filter.
+     */
+    async deleteEdge(query5, idempotencyKey) {
       return gateway.request({
-        path: `/api/platform/v1/identity/secrets${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "secrets"
-          )
-        )
-      );
+        path: `/api/platform/v1/graph/edges${toQueryString(query5)}`,
+        method: "DELETE",
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
     },
-    async putSecretReference(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.secretRef, "secretRef");
+    /**
+     * Retrieve a graph neighborhood around a root node.
+     */
+    async neighborhood(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/secrets",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.putSecretReference"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
       });
     },
-    async evaluatePolicy(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.policySubject, "policySubject");
-      cleanRequiredString(input.policyAction, "policyAction");
-      cleanRequiredString(input.policyResource, "policyResource");
+    /**
+     * Traverse the graph from a starting node.
+     */
+    async traverse(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/evaluate",
+        path: "/api/platform/v1/graph/traverse",
         method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.evaluatePolicy"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        body: normalizeTopicQuery(query5)
       });
     },
-    async recordPolicyDecision(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.decision, "decision");
+    /**
+     * Analyze graph structure for a topic.
+     */
+    async analyze(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/decisions",
+        path: `/api/platform/v1/graph/analyze${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
+      });
+    },
+    /**
+     * Detect confirmation-bias patterns for a topic graph.
+     */
+    async bias(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
+      return gateway.request({
+        path: `/api/platform/v1/graph/bias${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
+      });
+    },
+    /**
+     * Find graph gaps for beliefs that still need testing.
+     */
+    async gaps(query5) {
+      const normalized = normalizeTopicQuery(query5);
+      return gateway.request({
+        path: `/api/platform/v1/graph/gaps${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
+        })}`
+      });
+    },
+    /**
+     * Search across graph resources within a topic.
+     */
+    async search(query5) {
+      return gateway.request({
+        path: "/api/platform/v1/search",
         method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.recordPolicyDecision"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        body: normalizeTopicQuery(query5)
+      });
+    },
+    /**
+     * Retrieve the shortest known path between two graph nodes.
+     */
+    async getPath(query5) {
+      return gateway.request({
+        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
+      });
+    },
+    /**
+     * Retrieve graph analytics for the requested metric.
+     */
+    async getAnalytics(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
       });
     }
   };
+  return Object.assign(client, {
+    queryNodes: client.listNodes,
+    queryEdges: client.listEdges,
+    getNeighborhood: client.neighborhood
+  });
 }
 
 // src/topicsClient.ts
-function cleanString3(value) {
+function cleanString4(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeTopicRecord(value) {
   const record = asRecord(value);
-  const topicId = cleanString3(record.topicId) ?? cleanString3(record.id) ?? cleanString3(record._id);
+  const topicId = cleanString4(record.topicId) ?? cleanString4(record.id) ?? cleanString4(record._id);
   return withTopicAlias({
     ...record,
     ...topicId ? { topicId } : {}
@@ -3899,7 +4144,7 @@ function createEmbeddingsClient(config = {}) {
 }
 
 // src/contextClient.ts
-function cleanString4(value) {
+function cleanString5(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function cleanNumber(value) {
@@ -3911,11 +4156,11 @@ function cleanBoolean(value) {
 function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   const effectiveInput = typeof topicIdOrInput === "string" ? input : topicIdOrInput;
   const payload = {};
-  const topicId = typeof topicIdOrInput === "string" ? cleanString4(topicIdOrInput) : cleanString4(effectiveInput.topicId);
+  const topicId = typeof topicIdOrInput === "string" ? cleanString5(topicIdOrInput) : cleanString5(effectiveInput.topicId);
   if (topicId) {
     payload.topicId = topicId;
   }
-  const query5 = cleanString4(effectiveInput.query);
+  const query5 = cleanString5(effectiveInput.query);
   if (query5) {
     payload.query = query5;
   }
@@ -3923,7 +4168,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (budget !== void 0) {
     payload.budget = budget;
   }
-  const ranking = cleanString4(effectiveInput.ranking) ?? cleanString4(effectiveInput.rankingProfile);
+  const ranking = cleanString5(effectiveInput.ranking) ?? cleanString5(effectiveInput.rankingProfile);
   if (ranking) {
     payload.ranking = ranking;
   }
@@ -3939,7 +4184,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeEntities !== void 0) {
     payload.includeEntities = includeEntities;
   }
-  const mode = cleanString4(effectiveInput.mode);
+  const mode = cleanString5(effectiveInput.mode);
   if (mode) {
     payload.mode = mode;
   }
@@ -3947,11 +4192,11 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeFailures !== void 0) {
     payload.includeFailures = includeFailures;
   }
-  const worktreeId = cleanString4(effectiveInput.worktreeId);
+  const worktreeId = cleanString5(effectiveInput.worktreeId);
   if (worktreeId) {
     payload.worktreeId = worktreeId;
   }
-  const sessionId = cleanString4(effectiveInput.sessionId);
+  const sessionId = cleanString5(effectiveInput.sessionId);
   if (sessionId) {
     payload.sessionId = sessionId;
   }
@@ -4837,7 +5082,8 @@ function createMcpClient(config = {}) {
         transportKind: input.transportKind,
         sessionId: input.sessionId,
         agentIdentity: input.agentIdentity,
-        workspaceId: input.workspaceId
+        workspaceId: input.workspaceId,
+        worktreeId: input.worktreeId
       };
       return gateway.request({
         path: `${MCP_GATEWAY_BOOTSTRAP_ENDPOINT}${toQueryString(scope)}`,
@@ -5669,7 +5915,7 @@ var ORG_GRAPH_SEARCH_FIELDS = [
   "cursor",
   "provenanceScope"
 ];
-function cleanString5(value, label) {
+function cleanString6(value, label) {
   const normalized = value?.trim();
   if (!normalized) {
     throw new Error(`${label} is required`);
@@ -5691,9 +5937,9 @@ function searchBody(input) {
     "orgGraphSearch.search"
   );
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
-    query: cleanString5(input.query, "query"),
+    tenantId: cleanString6(input.tenantId, "tenantId"),
+    workspaceId: cleanString6(input.workspaceId, "workspaceId"),
+    query: cleanString6(input.query, "query"),
     nodeTypes: input.nodeTypes,
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -5703,8 +5949,8 @@ function searchBody(input) {
 }
 function listQuery2(input) {
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+    tenantId: cleanString6(input.tenantId, "tenantId"),
+    workspaceId: cleanString6(input.workspaceId, "workspaceId"),
     nodeTypes: input.nodeTypes?.join(","),
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -5738,8 +5984,8 @@ function createOrgGraphSearchClient(config = {}) {
       return gateway.request({
         path: `/api/platform/v1/org-graph-search/nodes/${nodePath}${toQueryString(
           {
-            tenantId: cleanString5(input.tenantId, "tenantId"),
-            workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+            tenantId: cleanString6(input.tenantId, "tenantId"),
+            workspaceId: cleanString6(input.workspaceId, "workspaceId"),
             globalId: nodeId ? void 0 : globalId
           }
         )}`
@@ -6704,7 +6950,7 @@ function createToolRegistryClient(config = {}) {
 }
 
 // src/version.ts
-var LUCERN_SDK_VERSION = "0.3.0-alpha.10";
+var LUCERN_SDK_VERSION = "0.3.0-alpha.11";
 
 // src/workflowClient.ts
 function normalizeLensQuery(value) {
@@ -7161,6 +7407,7 @@ function createLucernClient(config = {}) {
   const auditClient = createAuditClient(gatewayConfig);
   const authDeviceClient = createAuthDeviceClient(gatewayConfig);
   const adminClient = createAdminClient(gatewayConfig);
+  const accessControlClient = createAccessControlClient(gatewayConfig);
   const answersClient = createAnswersClient(gatewayConfig);
   const contradictionsFacade = createContradictionsFacade(gatewayConfig);
   const edgesFacade = createEdgesFacade(gatewayConfig);
@@ -8845,6 +9092,7 @@ function createLucernClient(config = {}) {
     nodes: nodesNamespace,
     identity: {
       ...identityFacade,
+      access: accessControlClient,
       evaluatePolicy: identityClient.evaluatePolicy,
       recordPolicyDecision: identityClient.recordPolicyDecision,
       putSecretReference: identityClient.putSecretReference,