@lucern/sdk 0.3.0-alpha.10 → 0.3.0-alpha.12

package/dist/index.js

@@ -5,7 +5,9 @@ import { LUCERN_OPERATION_MANIFEST } from '@lucern/contracts/function-registry/m
 import * as graphIntel_star from '@lucern/reasoning-kernel/graphIntel';
 import { listGraphIntelligenceQueries, isGraphIntelligenceQueryMode, getGraphIntelligenceQuery, fillGraphIntelligencePromptTemplate, GRAPH_INTELLIGENCE_QUICK_QUERIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_MODE_TOOL_NAMES } from '@lucern/contracts/graph-intelligence.contract';
 export { GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUICK_QUERIES, fillGraphIntelligencePromptTemplate, getGraphIntelligenceQuery, isGraphIntelligenceQueryMode, listGraphIntelligenceQueries } from '@lucern/contracts/graph-intelligence.contract';
-import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath } from '@lucern/contracts';
+import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath, GENERATED_INFISICAL_RUNTIME_ENV } from '@lucern/contracts';
+import { resolveInfisicalSecretFromBinding, SecretResolverError } from '@lucern/secrets';
+export { SecretResolverError, resolveInfisicalSecretFromBinding } from '@lucern/secrets';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -77,6 +79,7 @@ __export(src_exports, {
   LENS_STATUSES: () => LENS_STATUSES,
   LENS_TASK_TEMPLATE_PRIORITIES: () => LENS_TASK_TEMPLATE_PRIORITIES,
   LUCERN_SDK_VERSION: () => LUCERN_SDK_VERSION,
+  LucernAccessControlError: () => LucernAccessControlError,
   LucernApiError: () => LucernApiError,
   LucernSdkAuthContextError: () => LucernSdkAuthContextError,
   MAX_ENTITY_LIMIT: () => MAX_ENTITY_LIMIT,
@@ -92,6 +95,7 @@ __export(src_exports, {
   SESSION_LIFECYCLE_STATUSES: () => SESSION_LIFECYCLE_STATUSES,
   SESSION_PRINCIPAL_TYPES: () => SESSION_PRINCIPAL_TYPES,
   STRUCTURAL_EDGE_TYPES: () => STRUCTURAL_EDGE_TYPES,
+  SecretResolverError: () => SecretResolverError,
   TELEMETRY_FIELDS: () => TELEMETRY_FIELDS,
   TENANT_IDENTITY_FIELDS: () => TENANT_IDENTITY_FIELDS,
   TOOL_REGISTRY_FIELDS: () => TOOL_REGISTRY_FIELDS,
@@ -113,6 +117,7 @@ __export(src_exports, {
   applyInfisicalRuntimeEnv: () => applyInfisicalRuntimeEnv,
   asListItems: () => asListItems,
   asRecord: () => asRecord,
+  assertPermitAllowed: () => assertPermitAllowed,
   assertValidWebhookSecret: () => assertValidWebhookSecret,
   assertValidWebhookUrl: () => assertValidWebhookUrl,
   buildDeprecatedBranchMetadata: () => buildDeprecatedBranchMetadata,
@@ -123,6 +128,7 @@ __export(src_exports, {
   compareEventCursor: () => compareEventCursor,
   compileContextPackFromSnapshot: () => compileContextPackFromSnapshot,
   computeWebhookSignature: () => computeWebhookSignature,
+  createAccessControlClient: () => createAccessControlClient,
   createAdminClient: () => createAdminClient,
   createAnswersClient: () => createAnswersClient,
   createAudiencesClient: () => createAudiencesClient,
@@ -169,6 +175,7 @@ __export(src_exports, {
   encodeEventCursor: () => encodeEventCursor,
   eventPatternToRegExp: () => eventPatternToRegExp,
   fillGraphIntelligencePromptTemplate: () => fillGraphIntelligencePromptTemplate,
+  formatPermitResource: () => formatPermitResource,
   getControlObjectOwnershipCase: () => getControlObjectOwnershipCase,
   getGraphIntelligenceQuery: () => getGraphIntelligenceQuery,
   getMcpToolExposure: () => getMcpToolExposure,
@@ -200,6 +207,7 @@ __export(src_exports, {
   migrateBranchToLens: () => migrateBranchToLens,
   nextDeliveryAttemptAt: () => nextDeliveryAttemptAt,
   normalizeCanonicalLucernAuthContext: () => normalizeCanonicalLucernAuthContext,
+  normalizeCanonicalPrincipalIdentity: () => normalizeCanonicalPrincipalIdentity,
   normalizeDelegationChain: () => normalizeDelegationChain,
   normalizeNodeVerificationStatus: () => normalizeNodeVerificationStatus,
   normalizeNodeWriteInput: () => normalizeNodeWriteInput,
@@ -214,6 +222,7 @@ __export(src_exports, {
   readInfisicalRuntimeBootstrap: () => readInfisicalRuntimeBootstrap,
   registerCustomTool: () => registerCustomTool,
   resolveDeliveryFailureStatus: () => resolveDeliveryFailureStatus,
+  resolveInfisicalSecretFromBinding: () => resolveInfisicalSecretFromBinding,
   resolveText: () => resolveText,
   resolveTopicId: () => resolveTopicId,
   sanitizeWebhookRecord: () => sanitizeWebhookRecord,
@@ -1306,6 +1315,574 @@ function createAdminClient(config = {}) {
   };
 }
 
+// src/boundaryClientSurface.ts
+function cleanOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function cleanRequiredString(value, label) {
+  const normalized = cleanOptionalString(value);
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function readTopicId(input) {
+  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
+}
+function requireTopicId(input) {
+  const topicId = readTopicId(input);
+  if (!topicId) {
+    throw new Error("topicId is required");
+  }
+  return topicId;
+}
+function assertKnownKeys(input, allowed, operation) {
+  const allowedSet = new Set(allowed);
+  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
+    );
+  }
+}
+function knownPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return { ...input };
+}
+function topicPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return {
+    ...input,
+    topicId: requireTopicId(input),
+    projectId: void 0
+  };
+}
+function listResultFromEnvelope(data, legacyKey) {
+  const record = isRecord3(data) ? data : {};
+  const legacyItems = record[legacyKey];
+  return createListResult(
+    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
+    legacyKey
+  );
+}
+
+// src/identityClient.ts
+function createIdentityWhoamiClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    async whoami() {
+      return gateway.request({
+        path: "/api/platform/v1/identity/whoami"
+      });
+    }
+  };
+}
+var TENANT_IDENTITY_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "integrationKey",
+  "secretRef",
+  "policySubject",
+  "policyAction",
+  "policyResource",
+  "decision",
+  "config",
+  "configKey",
+  "configValue",
+  "provider",
+  "status",
+  "metadata",
+  "limit",
+  "cursor"
+];
+function tenantIdentityQuery(input) {
+  return {
+    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
+    workspaceId: input.workspaceId,
+    principalId: input.principalId,
+    limit: input.limit,
+    cursor: input.cursor
+  };
+}
+function tenantIdentityBody(input, operation) {
+  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
+}
+function createIdentityClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  const whoamiClient = createIdentityWhoamiClient(config);
+  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
+    path: "/api/platform/v1/identity/principals",
+    method,
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
+  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
+    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
+    method: "POST",
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  return {
+    /**
+     * Resolve the current authenticated identity summary.
+     */
+    async whoami() {
+      return whoamiClient.whoami().then(
+        (response) => mapGatewayData(response, (data) => ({
+          principalId: data.principalId,
+          principalType: data.principalType,
+          tenantId: data.tenantId ?? null,
+          workspaceId: data.workspaceId ?? null,
+          scopes: Array.isArray(data.scopes) ? data.scopes : [],
+          roles: Array.isArray(data.roles) ? data.roles : [],
+          isPlatformAdmin: data.isPlatformAdmin === true,
+          isTenantAdmin: data.isTenantAdmin === true,
+          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
+          authMode: data.authMode,
+          sessionId: data.sessionId,
+          delegatedBy: data.delegatedBy,
+          expiresAt: data.expiresAt
+        }))
+      );
+    },
+    /**
+     * List principals in the current identity scope.
+     */
+    async listPrincipals(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "principals"
+          )
+        )
+      );
+    },
+    /**
+     * Create a principal.
+     */
+    async createPrincipal(input, idempotencyKey) {
+      return requestPrincipalWrite("POST", input, idempotencyKey);
+    },
+    /**
+     * Update a principal.
+     */
+    updatePrincipal,
+    /**
+     * @deprecated Use createPrincipal or updatePrincipal.
+     */
+    upsertPrincipal: updatePrincipal,
+    /**
+     * List keys in the current identity scope.
+     */
+    async listKeys(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+        )
+      );
+    },
+    /**
+     * Create an API key.
+     */
+    async createKey(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/identity/keys",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Rotate an API key.
+     */
+    async rotateKey(keyId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Delete an API key by revoking it.
+     */
+    deleteKey,
+    /**
+     * @deprecated Use deleteKey.
+     */
+    revokeKey: deleteKey,
+    /**
+     * Search Clerk users by email or display attributes.
+     */
+    async searchClerkUsers(q) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+      });
+    },
+    async getTenantConfig(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/tenant-config${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      });
+    },
+    async updateTenantConfig(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      return gateway.request({
+        path: "/api/platform/v1/identity/tenant-config",
+        method: "PATCH",
+        body: tenantIdentityBody(
+          input,
+          "identity.updateTenantConfig"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listIntegrations(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/integrations${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "integrations"
+          )
+        )
+      );
+    },
+    async upsertIntegration(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.integrationKey, "integrationKey");
+      return gateway.request({
+        path: "/api/platform/v1/identity/integrations",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.upsertIntegration"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listSecrets(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/secrets${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "secrets"
+          )
+        )
+      );
+    },
+    async putSecretReference(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.secretRef, "secretRef");
+      return gateway.request({
+        path: "/api/platform/v1/identity/secrets",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.putSecretReference"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async evaluatePolicy(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.policySubject, "policySubject");
+      cleanRequiredString(input.policyAction, "policyAction");
+      cleanRequiredString(input.policyResource, "policyResource");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/evaluate",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.evaluatePolicy"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async recordPolicyDecision(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.decision, "decision");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/decisions",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.recordPolicyDecision"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
+  };
+}
+
+// src/accessControl.ts
+var LucernAccessControlError = class extends LucernSdkAuthContextError {
+  policyDecision;
+  constructor(reason, message, policyDecision) {
+    super(reason, message);
+    this.name = "LucernAccessControlError";
+    this.policyDecision = policyDecision;
+  }
+};
+function cleanString3(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function cleanStringList2(values) {
+  if (!values) {
+    return [];
+  }
+  return [
+    ...new Set(
+      values.map((value) => value.trim()).filter((value) => value.length > 0)
+    )
+  ];
+}
+function requireString2(value, reason, label) {
+  const normalized = cleanString3(value);
+  if (!normalized) {
+    throw new LucernAccessControlError(
+      reason,
+      `Lucern SDK access control requires ${label}.`
+    );
+  }
+  return normalized;
+}
+function normalizePrincipalType(principalType) {
+  if (principalType === "agent") {
+    return "agent";
+  }
+  if (principalType === "service") {
+    return "service";
+  }
+  return "human";
+}
+function aliasKey(alias) {
+  return `${alias.provider}:${alias.providerProjectId ?? ""}:${alias.externalSubjectId}`;
+}
+function normalizeAliases(input, canonicalClerkUserId) {
+  const aliases = /* @__PURE__ */ new Map();
+  for (const alias of input ?? []) {
+    const externalSubjectId = cleanString3(alias.externalSubjectId);
+    if (!externalSubjectId) {
+      continue;
+    }
+    const normalized = {
+      provider: cleanString3(alias.provider) ?? "clerk",
+      providerProjectId: cleanString3(alias.providerProjectId),
+      externalSubjectId,
+      status: cleanString3(alias.status)
+    };
+    aliases.set(aliasKey(normalized), normalized);
+  }
+  if (canonicalClerkUserId) {
+    const canonicalAlias = {
+      provider: "clerk",
+      externalSubjectId: canonicalClerkUserId,
+      status: "active"
+    };
+    aliases.set(aliasKey(canonicalAlias), canonicalAlias);
+  }
+  return [...aliases.values()];
+}
+function isKnownClerkSubject(args) {
+  if (args.clerkId === args.canonicalClerkUserId) {
+    return true;
+  }
+  return args.aliases.some(
+    (alias) => alias.provider === "clerk" && alias.externalSubjectId === args.clerkId
+  );
+}
+function authContextToPrincipalInput(input) {
+  const normalized = normalizeCanonicalLucernAuthContext(input);
+  return {
+    principalId: normalized.principalId,
+    principalType: normalized.principalType,
+    canonicalClerkUserId: normalized.clerkId,
+    clerkId: normalized.clerkId,
+    tenantId: normalized.tenantId,
+    workspaceId: normalized.workspaceId,
+    roles: normalized.roles,
+    scopes: normalized.scopes
+  };
+}
+function isAuthContextInput(input) {
+  return "authMode" in input || "permit" in input || "delegationChain" in input;
+}
+function normalizeCanonicalPrincipalIdentity(input, options = {}) {
+  const principalInput = isAuthContextInput(input) ? authContextToPrincipalInput(input) : input;
+  const principalId = requireString2(
+    principalInput.principalId,
+    "principal_missing",
+    "principalId"
+  );
+  const principalType = normalizePrincipalType(principalInput.principalType);
+  const observedClerkId = cleanString3(options.observedClerkId);
+  const canonicalClerkUserId = cleanString3(principalInput.canonicalClerkUserId) ?? cleanString3(principalInput.clerkId);
+  if (principalType === "human" && !canonicalClerkUserId) {
+    throw new LucernAccessControlError(
+      "clerk_alias_missing",
+      "Human principals require one canonical Clerk user id."
+    );
+  }
+  const aliases = normalizeAliases(
+    principalInput.clerkIdentityAliases,
+    canonicalClerkUserId
+  );
+  if (observedClerkId && !isKnownClerkSubject({
+    clerkId: observedClerkId,
+    canonicalClerkUserId,
+    aliases
+  })) {
+    throw new LucernAccessControlError(
+      "clerk_alias_unrecognized",
+      "Observed Clerk user id is not attached to the canonical Lucern principal."
+    );
+  }
+  return {
+    principalId,
+    principalType,
+    canonicalClerkUserId,
+    clerkIdentityAliases: aliases,
+    tenantId: cleanString3(principalInput.tenantId),
+    workspaceId: cleanString3(principalInput.workspaceId),
+    roles: cleanStringList2(principalInput.roles),
+    scopes: cleanStringList2(principalInput.scopes)
+  };
+}
+function formatPermitResource(resource) {
+  if (typeof resource === "string") {
+    return requireString2(resource, "policy_denied", "policyResource");
+  }
+  const type = requireString2(resource.type, "policy_denied", "resource.type");
+  const key = requireString2(resource.key, "policy_denied", "resource.key");
+  return key.startsWith(`${type}:`) ? key : `${type}:${key}`;
+}
+function resourceRequiresWorkspace(resource) {
+  if (typeof resource === "string") {
+    return !resource.startsWith("tenant:");
+  }
+  return resource.type !== "tenant";
+}
+function buildPolicyInput(identity, input) {
+  const tenantId = requireString2(
+    input.tenantId ?? identity.tenantId,
+    "tenant_missing",
+    "tenantId"
+  );
+  const workspaceId = cleanString3(input.workspaceId ?? identity.workspaceId);
+  if (resourceRequiresWorkspace(input.resource) && !workspaceId) {
+    throw new LucernAccessControlError(
+      "workspace_missing",
+      "Workspace-scoped Permit checks require workspaceId."
+    );
+  }
+  return {
+    tenantId,
+    workspaceId,
+    principalId: identity.principalId,
+    policySubject: identity.principalId,
+    policyAction: requireString2(input.action, "policy_denied", "policyAction"),
+    policyResource: formatPermitResource(input.resource),
+    metadata: input.context
+  };
+}
+async function resolveConfiguredPrincipalInput(authContext) {
+  if (typeof authContext === "function") {
+    return await authContext();
+  }
+  return authContext;
+}
+function assertPermitAllowed(decision) {
+  if (decision.decision !== "allow") {
+    throw new LucernAccessControlError(
+      decision.decision === "deny" ? "policy_denied" : "policy_unknown",
+      `Permit denied ${decision.policyAction} on ${decision.policyResource}.`,
+      decision
+    );
+  }
+}
+function createAccessControlClient(config = {}) {
+  const identityClient = createIdentityClient(config);
+  async function resolveIdentity(input, observedClerkId) {
+    const identityInput = input ?? await resolveConfiguredPrincipalInput(config.authContext);
+    if (!identityInput) {
+      throw new LucernAccessControlError(
+        "principal_missing",
+        "Lucern SDK access control requires a canonical principal identity."
+      );
+    }
+    return normalizeCanonicalPrincipalIdentity(identityInput, {
+      observedClerkId
+    });
+  }
+  async function checkAccess(input, idempotencyKey) {
+    const identity = await resolveIdentity(input.identity, input.observedClerkId);
+    const policyInput = buildPolicyInput(identity, input);
+    try {
+      const response = await identityClient.evaluatePolicy(
+        policyInput,
+        idempotencyKey
+      );
+      return {
+        identity,
+        policyInput,
+        decision: response.data
+      };
+    } catch (error) {
+      if (error instanceof LucernSdkAuthContextError) {
+        throw error;
+      }
+      throw new LucernAccessControlError(
+        "policy_unavailable",
+        "Permit policy check failed closed before an allow decision was returned."
+      );
+    }
+  }
+  async function requireAccess(input, idempotencyKey) {
+    const result = await checkAccess(input, idempotencyKey);
+    assertPermitAllowed(result.decision);
+    return result;
+  }
+  async function canAccess(input, idempotencyKey) {
+    try {
+      await requireAccess(input, idempotencyKey);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return {
+    normalizePrincipal: normalizeCanonicalPrincipalIdentity,
+    checkAccess,
+    requireAccess,
+    canAccess
+  };
+}
+
 // src/answersClient.ts
 function createAnswersClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
@@ -1473,7 +2050,7 @@ function authBaseUrl(config) {
 async function readJson(response) {
   try {
     const payload = await response.json();
-    return isRecord3(payload) ? payload : {};
+    return isRecord4(payload) ? payload : {};
   } catch (error) {
     return unreadableJsonBodyFallback();
   }
@@ -1481,7 +2058,7 @@ async function readJson(response) {
 function unreadableJsonBodyFallback(_error) {
   return {};
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readString(value) {
@@ -1524,7 +2101,7 @@ function assertDeviceTokenResponse(payload) {
     tenant_id: tenantId,
     workspace_id: readString(payload.workspace_id),
     principal_id: principalId,
-    user: isRecord3(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
+    user: isRecord4(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
       id: payload.user.id,
       principalId: payload.user.principalId
     } : void 0
@@ -1864,65 +2441,10 @@ function createEvidenceClient(config = {}) {
           evidence,
           config: classificationConfig
         },
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    }
-  };
-}
-
-// src/boundaryClientSurface.ts
-function cleanOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function isRecord4(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function cleanRequiredString(value, label) {
-  const normalized = cleanOptionalString(value);
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
-  return normalized;
-}
-function readTopicId(input) {
-  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
-}
-function requireTopicId(input) {
-  const topicId = readTopicId(input);
-  if (!topicId) {
-    throw new Error("topicId is required");
-  }
-  return topicId;
-}
-function assertKnownKeys(input, allowed, operation) {
-  const allowedSet = new Set(allowed);
-  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
-  if (unknownKeys.length > 0) {
-    throw new Error(
-      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
-    );
-  }
-}
-function knownPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return { ...input };
-}
-function topicPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return {
-    ...input,
-    topicId: requireTopicId(input),
-    projectId: void 0
-  };
-}
-function listResultFromEnvelope(data, legacyKey) {
-  const record = isRecord4(data) ? data : {};
-  const legacyItems = record[legacyKey];
-  return createListResult(
-    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
-    legacyKey
-  );
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
+  };
 }
 
 // src/eventingClient.ts
@@ -2514,437 +3036,169 @@ function createGraphClient(config = {}) {
       return gateway.request({
         path: "/api/platform/v1/graph/nodes/supersede",
         method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Update a node's verification status.
-     */
-    async verifyNode(input, idempotencyKey) {
-      const verificationStatus = normalizeNodeVerificationStatus(input.verificationStatus) ?? input.verificationStatus;
-      return gateway.request({
-        path: "/api/platform/v1/graph/nodes/verify",
-        method: "POST",
-        body: {
-          ...input,
-          verificationStatus
-        },
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Permanently delete a node via the admin-only hard-delete route.
-     */
-    async hardDeleteNode(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/nodes/hard-delete",
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * List graph edges matching the provided filters.
-     */
-    async listEdges(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/edges${toQueryString(
-          normalizeTopicQuery(query5)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => mapAliasedList(data, "edges")
-        )
-      );
-    },
-    /**
-     * Create a graph edge.
-     */
-    async createEdge(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/edges",
-        method: "POST",
-        body: normalizeTopicQuery(input),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Delete one or more edges matching the provided filter.
-     */
-    async deleteEdge(query5, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/edges${toQueryString(query5)}`,
-        method: "DELETE",
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Retrieve a graph neighborhood around a root node.
-     */
-    async neighborhood(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
-      });
-    },
-    /**
-     * Traverse the graph from a starting node.
-     */
-    async traverse(query5) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/traverse",
-        method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Analyze graph structure for a topic.
-     */
-    async analyze(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/analyze${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Detect confirmation-bias patterns for a topic graph.
-     */
-    async bias(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/bias${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Find graph gaps for beliefs that still need testing.
-     */
-    async gaps(query5) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/gaps${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
-        })}`
-      });
-    },
-    /**
-     * Search across graph resources within a topic.
-     */
-    async search(query5) {
-      return gateway.request({
-        path: "/api/platform/v1/search",
-        method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Retrieve the shortest known path between two graph nodes.
-     */
-    async getPath(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
-      });
-    },
-    /**
-     * Retrieve graph analytics for the requested metric.
-     */
-    async getAnalytics(query5 = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
-      });
-    }
-  };
-  return Object.assign(client, {
-    queryNodes: client.listNodes,
-    queryEdges: client.listEdges,
-    getNeighborhood: client.neighborhood
-  });
-}
-
-// src/identityClient.ts
-function createIdentityWhoamiClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  return {
-    async whoami() {
-      return gateway.request({
-        path: "/api/platform/v1/identity/whoami"
-      });
-    }
-  };
-}
-var TENANT_IDENTITY_FIELDS = [
-  "tenantId",
-  "workspaceId",
-  "principalId",
-  "integrationKey",
-  "secretRef",
-  "policySubject",
-  "policyAction",
-  "policyResource",
-  "decision",
-  "config",
-  "configKey",
-  "configValue",
-  "provider",
-  "status",
-  "metadata",
-  "limit",
-  "cursor"
-];
-function tenantIdentityQuery(input) {
-  return {
-    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
-    workspaceId: input.workspaceId,
-    principalId: input.principalId,
-    limit: input.limit,
-    cursor: input.cursor
-  };
-}
-function tenantIdentityBody(input, operation) {
-  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
-}
-function createIdentityClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const whoamiClient = createIdentityWhoamiClient(config);
-  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
-    path: "/api/platform/v1/identity/principals",
-    method,
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
-  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
-    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
-    method: "POST",
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  return {
-    /**
-     * Resolve the current authenticated identity summary.
-     */
-    async whoami() {
-      return whoamiClient.whoami().then(
-        (response) => mapGatewayData(response, (data) => ({
-          principalId: data.principalId,
-          principalType: data.principalType,
-          tenantId: data.tenantId ?? null,
-          workspaceId: data.workspaceId ?? null,
-          scopes: Array.isArray(data.scopes) ? data.scopes : [],
-          roles: Array.isArray(data.roles) ? data.roles : [],
-          isPlatformAdmin: data.isPlatformAdmin === true,
-          isTenantAdmin: data.isTenantAdmin === true,
-          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
-          authMode: data.authMode,
-          sessionId: data.sessionId,
-          delegatedBy: data.delegatedBy,
-          expiresAt: data.expiresAt
-        }))
-      );
-    },
-    /**
-     * List principals in the current identity scope.
-     */
-    async listPrincipals(query5 = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(
-            Array.isArray(data) ? data : [],
-            "principals"
-          )
-        )
-      );
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
     },
     /**
-     * Create a principal.
+     * Update a node's verification status.
      */
-    async createPrincipal(input, idempotencyKey) {
-      return requestPrincipalWrite("POST", input, idempotencyKey);
+    async verifyNode(input, idempotencyKey) {
+      const verificationStatus = normalizeNodeVerificationStatus(input.verificationStatus) ?? input.verificationStatus;
+      return gateway.request({
+        path: "/api/platform/v1/graph/nodes/verify",
+        method: "POST",
+        body: {
+          ...input,
+          verificationStatus
+        },
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
     },
     /**
-     * Update a principal.
-     */
-    updatePrincipal,
-    /**
-     * @deprecated Use createPrincipal or updatePrincipal.
+     * Permanently delete a node via the admin-only hard-delete route.
      */
-    upsertPrincipal: updatePrincipal,
+    async hardDeleteNode(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/graph/nodes/hard-delete",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
     /**
-     * List keys in the current identity scope.
+     * List graph edges matching the provided filters.
      */
-    async listKeys(query5 = {}) {
+    async listEdges(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
+        path: `/api/platform/v1/graph/edges${toQueryString(
+          normalizeTopicQuery(query5)
+        )}`
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+          (data) => mapAliasedList(data, "edges")
         )
       );
     },
     /**
-     * Create an API key.
+     * Create a graph edge.
      */
-    async createKey(input, idempotencyKey) {
+    async createEdge(input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/identity/keys",
+        path: "/api/platform/v1/graph/edges",
         method: "POST",
-        body: input,
+        body: normalizeTopicQuery(input),
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Rotate an API key.
+     * Delete one or more edges matching the provided filter.
      */
-    async rotateKey(keyId, input = {}, idempotencyKey) {
+    async deleteEdge(query5, idempotencyKey) {
       return gateway.request({
-        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
-        method: "POST",
-        body: input,
+        path: `/api/platform/v1/graph/edges${toQueryString(query5)}`,
+        method: "DELETE",
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Delete an API key by revoking it.
-     */
-    deleteKey,
-    /**
-     * @deprecated Use deleteKey.
-     */
-    revokeKey: deleteKey,
-    /**
-     * Search Clerk users by email or display attributes.
+     * Retrieve a graph neighborhood around a root node.
      */
-    async searchClerkUsers(q) {
+    async neighborhood(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
       });
     },
-    async getTenantConfig(input) {
+    /**
+     * Traverse the graph from a starting node.
+     */
+    async traverse(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/tenant-config${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
+        path: "/api/platform/v1/graph/traverse",
+        method: "POST",
+        body: normalizeTopicQuery(query5)
       });
     },
-    async updateTenantConfig(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
+    /**
+     * Analyze graph structure for a topic.
+     */
+    async analyze(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: "/api/platform/v1/identity/tenant-config",
-        method: "PATCH",
-        body: tenantIdentityBody(
-          input,
-          "identity.updateTenantConfig"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/analyze${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
       });
     },
-    async listIntegrations(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/integrations${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "integrations"
-          )
-        )
-      );
-    },
-    async upsertIntegration(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.integrationKey, "integrationKey");
+    /**
+     * Detect confirmation-bias patterns for a topic graph.
+     */
+    async bias(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: "/api/platform/v1/identity/integrations",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.upsertIntegration"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/bias${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
       });
     },
-    async listSecrets(input) {
+    /**
+     * Find graph gaps for beliefs that still need testing.
+     */
+    async gaps(query5) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: `/api/platform/v1/identity/secrets${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "secrets"
-          )
-        )
-      );
+        path: `/api/platform/v1/graph/gaps${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
+        })}`
+      });
     },
-    async putSecretReference(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.secretRef, "secretRef");
+    /**
+     * Search across graph resources within a topic.
+     */
+    async search(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/secrets",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.putSecretReference"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: "/api/platform/v1/search",
+        method: "POST",
+        body: normalizeTopicQuery(query5)
       });
     },
-    async evaluatePolicy(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.policySubject, "policySubject");
-      cleanRequiredString(input.policyAction, "policyAction");
-      cleanRequiredString(input.policyResource, "policyResource");
+    /**
+     * Retrieve the shortest known path between two graph nodes.
+     */
+    async getPath(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/evaluate",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.evaluatePolicy"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
       });
     },
-    async recordPolicyDecision(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.decision, "decision");
+    /**
+     * Retrieve graph analytics for the requested metric.
+     */
+    async getAnalytics(query5 = {}) {
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/decisions",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.recordPolicyDecision"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
       });
     }
   };
+  return Object.assign(client, {
+    queryNodes: client.listNodes,
+    queryEdges: client.listEdges,
+    getNeighborhood: client.neighborhood
+  });
 }
 
 // src/topicsClient.ts
-function cleanString3(value) {
+function cleanString4(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeTopicRecord(value) {
   const record = asRecord(value);
-  const topicId = cleanString3(record.topicId) ?? cleanString3(record.id) ?? cleanString3(record._id);
+  const topicId = cleanString4(record.topicId) ?? cleanString4(record.id) ?? cleanString4(record._id);
   return withTopicAlias({
     ...record,
     ...topicId ? { topicId } : {}
@@ -4157,7 +4411,7 @@ function createEmbeddingsClient(config = {}) {
 }
 
 // src/contextClient.ts
-function cleanString4(value) {
+function cleanString5(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function cleanNumber(value) {
@@ -4169,11 +4423,11 @@ function cleanBoolean(value) {
 function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   const effectiveInput = typeof topicIdOrInput === "string" ? input : topicIdOrInput;
   const payload = {};
-  const topicId = typeof topicIdOrInput === "string" ? cleanString4(topicIdOrInput) : cleanString4(effectiveInput.topicId);
+  const topicId = typeof topicIdOrInput === "string" ? cleanString5(topicIdOrInput) : cleanString5(effectiveInput.topicId);
   if (topicId) {
     payload.topicId = topicId;
   }
-  const query5 = cleanString4(effectiveInput.query);
+  const query5 = cleanString5(effectiveInput.query);
   if (query5) {
     payload.query = query5;
   }
@@ -4181,7 +4435,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (budget !== void 0) {
     payload.budget = budget;
   }
-  const ranking = cleanString4(effectiveInput.ranking) ?? cleanString4(effectiveInput.rankingProfile);
+  const ranking = cleanString5(effectiveInput.ranking) ?? cleanString5(effectiveInput.rankingProfile);
   if (ranking) {
     payload.ranking = ranking;
   }
@@ -4197,7 +4451,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeEntities !== void 0) {
     payload.includeEntities = includeEntities;
   }
-  const mode = cleanString4(effectiveInput.mode);
+  const mode = cleanString5(effectiveInput.mode);
   if (mode) {
     payload.mode = mode;
   }
@@ -4205,11 +4459,11 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeFailures !== void 0) {
     payload.includeFailures = includeFailures;
   }
-  const worktreeId = cleanString4(effectiveInput.worktreeId);
+  const worktreeId = cleanString5(effectiveInput.worktreeId);
   if (worktreeId) {
     payload.worktreeId = worktreeId;
   }
-  const sessionId = cleanString4(effectiveInput.sessionId);
+  const sessionId = cleanString5(effectiveInput.sessionId);
   if (sessionId) {
     payload.sessionId = sessionId;
   }
@@ -5095,7 +5349,8 @@ function createMcpClient(config = {}) {
         transportKind: input.transportKind,
         sessionId: input.sessionId,
         agentIdentity: input.agentIdentity,
-        workspaceId: input.workspaceId
+        workspaceId: input.workspaceId,
+        worktreeId: input.worktreeId
       };
       return gateway.request({
         path: `${MCP_GATEWAY_BOOTSTRAP_ENDPOINT}${toQueryString(scope)}`,
@@ -6055,7 +6310,7 @@ var ORG_GRAPH_SEARCH_FIELDS = [
   "cursor",
   "provenanceScope"
 ];
-function cleanString5(value, label) {
+function cleanString6(value, label) {
   const normalized = value?.trim();
   if (!normalized) {
     throw new Error(`${label} is required`);
@@ -6077,9 +6332,9 @@ function searchBody(input) {
     "orgGraphSearch.search"
   );
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
-    query: cleanString5(input.query, "query"),
+    tenantId: cleanString6(input.tenantId, "tenantId"),
+    workspaceId: cleanString6(input.workspaceId, "workspaceId"),
+    query: cleanString6(input.query, "query"),
     nodeTypes: input.nodeTypes,
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -6089,8 +6344,8 @@ function searchBody(input) {
 }
 function listQuery2(input) {
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+    tenantId: cleanString6(input.tenantId, "tenantId"),
+    workspaceId: cleanString6(input.workspaceId, "workspaceId"),
     nodeTypes: input.nodeTypes?.join(","),
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -6124,8 +6379,8 @@ function createOrgGraphSearchClient(config = {}) {
       return gateway.request({
         path: `/api/platform/v1/org-graph-search/nodes/${nodePath}${toQueryString(
           {
-            tenantId: cleanString5(input.tenantId, "tenantId"),
-            workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+            tenantId: cleanString6(input.tenantId, "tenantId"),
+            workspaceId: cleanString6(input.workspaceId, "workspaceId"),
             globalId: nodeId ? void 0 : globalId
           }
         )}`
@@ -7090,7 +7345,7 @@ function createToolRegistryClient(config = {}) {
 }
 
 // src/version.ts
-var LUCERN_SDK_VERSION = "0.3.0-alpha.10";
+var LUCERN_SDK_VERSION = "0.3.0-alpha.12";
 
 // src/workflowClient.ts
 function normalizeLensQuery(value) {
@@ -7547,6 +7802,7 @@ function createLucernClient(config = {}) {
   const auditClient = createAuditClient(gatewayConfig);
   const authDeviceClient = createAuthDeviceClient(gatewayConfig);
   const adminClient = createAdminClient(gatewayConfig);
+  const accessControlClient = createAccessControlClient(gatewayConfig);
   const answersClient = createAnswersClient(gatewayConfig);
   const contradictionsFacade = createContradictionsFacade(gatewayConfig);
   const edgesFacade = createEdgesFacade(gatewayConfig);
@@ -9231,6 +9487,7 @@ function createLucernClient(config = {}) {
     nodes: nodesNamespace,
     identity: {
       ...identityFacade,
+      access: accessControlClient,
       evaluatePolicy: identityClient.evaluatePolicy,
       recordPolicyDecision: identityClient.recordPolicyDecision,
       putSecretReference: identityClient.putSecretReference,
@@ -9292,7 +9549,7 @@ function createLucernClient(config = {}) {
 }
 
 // src/facade/context.ts
-function cleanString6(value) {
+function cleanString7(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function cleanNumber2(value) {
@@ -9304,11 +9561,11 @@ function cleanBoolean2(value) {
 function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   const effectiveInput = typeof topicIdOrInput === "string" ? input : topicIdOrInput;
   const payload = {};
-  const topicId = typeof topicIdOrInput === "string" ? cleanString6(topicIdOrInput) : cleanString6(effectiveInput.topicId);
+  const topicId = typeof topicIdOrInput === "string" ? cleanString7(topicIdOrInput) : cleanString7(effectiveInput.topicId);
   if (topicId) {
     payload.topicId = topicId;
   }
-  const query5 = cleanString6(effectiveInput.query);
+  const query5 = cleanString7(effectiveInput.query);
   if (query5) {
     payload.query = query5;
   }
@@ -9316,7 +9573,7 @@ function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   if (budget !== void 0) {
     payload.budget = budget;
   }
-  const ranking = cleanString6(effectiveInput.ranking) ?? cleanString6(effectiveInput.rankingProfile);
+  const ranking = cleanString7(effectiveInput.ranking) ?? cleanString7(effectiveInput.rankingProfile);
   if (ranking) {
     payload.ranking = ranking;
   }
@@ -9332,7 +9589,7 @@ function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   if (includeEntities !== void 0) {
     payload.includeEntities = includeEntities;
   }
-  const mode = cleanString6(effectiveInput.mode);
+  const mode = cleanString7(effectiveInput.mode);
   if (mode) {
     payload.mode = mode;
   }
@@ -9340,11 +9597,11 @@ function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   if (includeFailures !== void 0) {
     payload.includeFailures = includeFailures;
   }
-  const worktreeId = cleanString6(effectiveInput.worktreeId);
+  const worktreeId = cleanString7(effectiveInput.worktreeId);
   if (worktreeId) {
     payload.worktreeId = worktreeId;
   }
-  const sessionId = cleanString6(effectiveInput.sessionId);
+  const sessionId = cleanString7(effectiveInput.sessionId);
   if (sessionId) {
     payload.sessionId = sessionId;
   }
@@ -10710,7 +10967,12 @@ var REASONING_METHODS = [
   "inductive",
   "abductive",
   "analogical",
-  "empirical"
+  "causal",
+  "correlational",
+  "testimonial",
+  "statistical",
+  "implicit",
+  "pattern_match"
 ];
 var DEFEAT_TYPES = [
   "rebuts",
@@ -11007,6 +11269,12 @@ function isMcpToolAllowed(toolName, options = {}) {
   if (options.permittedTools !== void 0 && options.permittedTools !== null) {
     return options.permittedTools.some((tool) => tool.toolName === toolName);
   }
+  if (options.sessionType === "agent") {
+    if (options.allowedTools === null || options.allowedTools === void 0) {
+      return false;
+    }
+    return options.allowedTools.includes(toolName);
+  }
   if (options.allowedTools === null || options.allowedTools === void 0) {
     return true;
   }
@@ -11719,10 +11987,11 @@ async function hydrateInfisicalRuntimeEnv(options) {
       message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`
     });
   }
-  if (surface.delivery !== "runtime_fetch") {
+  const fallbackDelivery = surface.fallback;
+  if (surface.delivery !== "runtime_fetch" && fallbackDelivery !== "runtime_fetch") {
     throw new InfisicalRuntimeError({
       code: "INFISICAL_UNSUPPORTED_SURFACE_DELIVERY",
-      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces.`
+      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces or surfaces with a runtime_fetch fallback.`
     });
   }
   const fetchImpl = options.fetchImpl ?? globalThis.fetch;
@@ -11735,35 +12004,26 @@ async function hydrateInfisicalRuntimeEnv(options) {
   const token = await loginWithUniversalAuth(bootstrap, fetchImpl);
   const values = {};
   const missingRequired = [];
-  const sourcePaths = [];
-  for (const pathId of surface.sourcePathIds) {
-    const path = findInfisicalRuntimePath(pathId);
-    if (!path) {
-      throw new InfisicalRuntimeError({
-        code: "INFISICAL_UNKNOWN_PATH",
-        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
-      });
-    }
-    sourcePaths.push(path.secretPath);
-    for (const variable of path.variables) {
-      const runtimeVariable = variable;
-      const secretValue = await readVariableSecret({
-        bootstrap,
-        fetchImpl,
-        token,
-        secretPath: path.secretPath,
-        variable: runtimeVariable
-      });
-      if (!secretValue) {
-        if (runtimeVariable.required) {
-          missingRequired.push(runtimeVariable.name);
-        }
-        continue;
-      }
-      values[runtimeVariable.name] = secretValue.value;
-      for (const alias of runtimeVariable.aliases ?? []) {
-        values[alias] = secretValue.value;
+  const sourcePaths = /* @__PURE__ */ new Set();
+  const variables = options.includeGeneratedSurfaceVariables ? generatedSurfaceVariables(options.surfaceId) : contractSurfaceVariables(surface.sourcePathIds);
+  for (const runtimeVariable of variables) {
+    sourcePaths.add(runtimeVariable.secretPath);
+    const secretValue = await readVariableSecret({
+      bootstrap,
+      fetchImpl,
+      token,
+      secretPath: runtimeVariable.secretPath,
+      variable: runtimeVariable
+    });
+    if (!secretValue) {
+      if (runtimeVariable.required) {
+        missingRequired.push(runtimeVariable.name);
       }
+      continue;
+    }
+    values[runtimeVariable.name] = secretValue.value;
+    for (const alias of runtimeVariable.aliases ?? []) {
+      values[alias] = secretValue.value;
     }
   }
   if (missingRequired.length > 0) {
@@ -11777,7 +12037,7 @@ async function hydrateInfisicalRuntimeEnv(options) {
     surfaceId: options.surfaceId,
     environment: bootstrap.environment,
     values,
-    sourcePaths
+    sourcePaths: [...sourcePaths]
   };
 }
 function applyInfisicalRuntimeEnv(result, targetEnv, options = {}) {
@@ -11848,6 +12108,46 @@ async function readVariableSecret(args) {
   }
   return null;
 }
+function contractSurfaceVariables(sourcePathIds) {
+  return sourcePathIds.flatMap((pathId) => {
+    const path = findInfisicalRuntimePath(pathId);
+    if (!path) {
+      throw new InfisicalRuntimeError({
+        code: "INFISICAL_UNKNOWN_PATH",
+        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
+      });
+    }
+    return path.variables.map((variable) => ({
+      ...variable,
+      secretPath: path.secretPath
+    }));
+  });
+}
+function generatedSurfaceVariables(surfaceId) {
+  const surface = GENERATED_INFISICAL_RUNTIME_ENV.surfaces[surfaceId];
+  if (!surface) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNKNOWN_SURFACE",
+      message: `Unknown generated Lucern Infisical runtime surface: ${surfaceId}.`
+    });
+  }
+  return surface.variables.map(generatedVariableToRuntimeVariable);
+}
+function generatedVariableToRuntimeVariable(variable) {
+  const aliases = /* @__PURE__ */ new Set([
+    ...variable.envNames.filter((name) => name !== variable.canonicalName),
+    ...variable.aliases
+  ]);
+  return {
+    name: variable.canonicalName,
+    required: variable.required,
+    secret: variable.secret,
+    public: variable.public,
+    aliases: [...aliases],
+    description: variable.description,
+    secretPath: variable.sourcePath
+  };
+}
 async function readSecretValue(args) {
   const params = new URLSearchParams({
     projectId: args.bootstrap.projectId,
@@ -11955,6 +12255,6 @@ function formatInfisicalRuntimeError(error) {
   return "Unknown Infisical runtime error shape";
 }
 
-export { BELIEF_STATUSES, BRANCH_DEPRECATION_MESSAGE, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, CONTROL_OBJECT_BLAST_RADII, CONTROL_OBJECT_EDIT_SURFACES, CONTROL_OBJECT_INHERITANCE_RULES, CONTROL_OBJECT_KINDS, CONTROL_OBJECT_OWNERSHIP_CONTRACT, CONTROL_OBJECT_OWNERSHIP_MATRIX, CONTROL_OBJECT_OWNERSHIP_ROWS, CONTROL_OBJECT_OWNER_SCOPES, CustomToolRegistryError, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, DeviceAuthorizationError, EDGE_TYPES, EMBEDDINGS_FIELDS, EPISTEMIC_EDGE_TYPES, EPISTEMIC_LAYERS, EVENTING_FIELDS, EVENT_RETENTION_DEFAULT_DAYS, FORK_REASONS, FUNCTION_SURFACE_METHOD_PATHS, GRAPH_ANALYSIS_ANALYSIS_FIELDS, GRAPH_ANALYSIS_COMPUTE_FIELDS, GRAPH_ANALYSIS_SUGGESTION_FIELDS, GRAPH_RECOMMENDATION_FIELDS, GRAPH_STATE_CLASSIFIER_FIELDS, InfisicalRuntimeError, JOBS_FIELDS, JUDGMENT_TYPES, LENS_PERSPECTIVE_TYPES, LENS_STATUSES, LENS_TASK_TEMPLATE_PRIORITIES, LUCERN_SDK_VERSION, LucernApiError, LucernSdkAuthContextError, MAX_ENTITY_LIMIT, MCP_ALWAYS_ALLOWED_TOOL_NAMES, MERGE_OUTCOMES, MODEL_RUNTIME_FIELDS, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, ONTOLOGY_LINK_FIELDS, ORG_GRAPH_SEARCH_FIELDS, REASONING_METHODS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, STRUCTURAL_EDGE_TYPES, TELEMETRY_FIELDS, TENANT_IDENTITY_FIELDS, TOOL_REGISTRY_FIELDS, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, applyInfisicalRuntimeEnv, asListItems, asRecord, assertValidWebhookSecret, assertValidWebhookUrl, buildDeprecatedBranchMetadata, buildDomainEvent, buildMcpToolContracts, buildMcpToolManifest, clearRegisteredCustomTools, compareEventCursor, compileContextPackFromSnapshot, computeWebhookSignature, createAdminClient, createAnswersClient, createAudiencesClient, createAuditClient, createAuthDeviceClient, createBeliefsClient, createCanonicalAuthHeaders, createContextClient, createContextFacade, createDecisionsClient, createEmbeddingsClient, createEventId, createEventingClient, createEventsClientCore, createEvidenceClient, createFunctionSurfaceClient, createGatewayRequestClient, createGraphAnalysisClient, createGraphClient, createGraphRecommendationsClient, createGraphStateClassifierClient, createHarnessClient, createIdentityClient, createJobsClient, createLearningClient, createListResult, createLucernClient, createModelRuntimeClient, createOntologyClient, createOntologyLinksClient, createOrgGraphSearchClient, createPacksClient, createPolicyClient, createReportsClient, createSchemaClient, createSourcesClient, createTelemetryClient, createToolRegistryClient, createTopicsClient, createWebhooksClientCore, createWorkflowClient, decodeEventCursor, emitDomainEvent, encodeEventCursor, eventPatternToRegExp, getControlObjectOwnershipCase, getMcpToolExposure, getRegisteredCustomTool, hydrateInfisicalRuntimeEnv, inferActorType, inferLensPerspectiveTypeFromBranchSchema, inferSessionPrincipalType, invokeRegisteredCustomTool, isAfterCursor, isInfisicalRuntimeDisabled, isLensFilterCriteria, isLucernPrompt, isMcpToolAllowed, isRecord2 as isRecord, isTaxonomyFilterCriteriaV1, lastDelegator, listControlObjectOwnershipCases, listRegisteredCustomTools, mapAliasedList, mapGatewayData, mapOpinionHistoryEntriesFromGatewayData, matchesAnyEventPattern, matchesEventPattern, mcpContractToInputSchema, mcpContractToManifestEntry, migrateBranchToLens, nextDeliveryAttemptAt, normalizeCanonicalLucernAuthContext, normalizeDelegationChain, normalizeNodeVerificationStatus, normalizeNodeWriteInput, normalizeRetentionDays, normalizeTopicQuery, normalizeWebhookPatterns, opinionFromBaseRate, opinionFromDogmatic, opinionFromProjected, planContextPackCompilation, randomIdempotencyKey, readInfisicalRuntimeBootstrap, registerCustomTool, resolveDeliveryFailureStatus, resolveText, resolveTopicId, sanitizeWebhookRecord, sortEventsByCursor, toQueryString, truncateWebhookResponseBody, unregisterCustomTool, validateFilterCriteria, withSdkAliases, withTextAlias, withTopicAlias };
+export { BELIEF_STATUSES, BRANCH_DEPRECATION_MESSAGE, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, CONTROL_OBJECT_BLAST_RADII, CONTROL_OBJECT_EDIT_SURFACES, CONTROL_OBJECT_INHERITANCE_RULES, CONTROL_OBJECT_KINDS, CONTROL_OBJECT_OWNERSHIP_CONTRACT, CONTROL_OBJECT_OWNERSHIP_MATRIX, CONTROL_OBJECT_OWNERSHIP_ROWS, CONTROL_OBJECT_OWNER_SCOPES, CustomToolRegistryError, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, DeviceAuthorizationError, EDGE_TYPES, EMBEDDINGS_FIELDS, EPISTEMIC_EDGE_TYPES, EPISTEMIC_LAYERS, EVENTING_FIELDS, EVENT_RETENTION_DEFAULT_DAYS, FORK_REASONS, FUNCTION_SURFACE_METHOD_PATHS, GRAPH_ANALYSIS_ANALYSIS_FIELDS, GRAPH_ANALYSIS_COMPUTE_FIELDS, GRAPH_ANALYSIS_SUGGESTION_FIELDS, GRAPH_RECOMMENDATION_FIELDS, GRAPH_STATE_CLASSIFIER_FIELDS, InfisicalRuntimeError, JOBS_FIELDS, JUDGMENT_TYPES, LENS_PERSPECTIVE_TYPES, LENS_STATUSES, LENS_TASK_TEMPLATE_PRIORITIES, LUCERN_SDK_VERSION, LucernAccessControlError, LucernApiError, LucernSdkAuthContextError, MAX_ENTITY_LIMIT, MCP_ALWAYS_ALLOWED_TOOL_NAMES, MERGE_OUTCOMES, MODEL_RUNTIME_FIELDS, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, ONTOLOGY_LINK_FIELDS, ORG_GRAPH_SEARCH_FIELDS, REASONING_METHODS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, STRUCTURAL_EDGE_TYPES, TELEMETRY_FIELDS, TENANT_IDENTITY_FIELDS, TOOL_REGISTRY_FIELDS, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, applyInfisicalRuntimeEnv, asListItems, asRecord, assertPermitAllowed, assertValidWebhookSecret, assertValidWebhookUrl, buildDeprecatedBranchMetadata, buildDomainEvent, buildMcpToolContracts, buildMcpToolManifest, clearRegisteredCustomTools, compareEventCursor, compileContextPackFromSnapshot, computeWebhookSignature, createAccessControlClient, createAdminClient, createAnswersClient, createAudiencesClient, createAuditClient, createAuthDeviceClient, createBeliefsClient, createCanonicalAuthHeaders, createContextClient, createContextFacade, createDecisionsClient, createEmbeddingsClient, createEventId, createEventingClient, createEventsClientCore, createEvidenceClient, createFunctionSurfaceClient, createGatewayRequestClient, createGraphAnalysisClient, createGraphClient, createGraphRecommendationsClient, createGraphStateClassifierClient, createHarnessClient, createIdentityClient, createJobsClient, createLearningClient, createListResult, createLucernClient, createModelRuntimeClient, createOntologyClient, createOntologyLinksClient, createOrgGraphSearchClient, createPacksClient, createPolicyClient, createReportsClient, createSchemaClient, createSourcesClient, createTelemetryClient, createToolRegistryClient, createTopicsClient, createWebhooksClientCore, createWorkflowClient, decodeEventCursor, emitDomainEvent, encodeEventCursor, eventPatternToRegExp, formatPermitResource, getControlObjectOwnershipCase, getMcpToolExposure, getRegisteredCustomTool, hydrateInfisicalRuntimeEnv, inferActorType, inferLensPerspectiveTypeFromBranchSchema, inferSessionPrincipalType, invokeRegisteredCustomTool, isAfterCursor, isInfisicalRuntimeDisabled, isLensFilterCriteria, isLucernPrompt, isMcpToolAllowed, isRecord2 as isRecord, isTaxonomyFilterCriteriaV1, lastDelegator, listControlObjectOwnershipCases, listRegisteredCustomTools, mapAliasedList, mapGatewayData, mapOpinionHistoryEntriesFromGatewayData, matchesAnyEventPattern, matchesEventPattern, mcpContractToInputSchema, mcpContractToManifestEntry, migrateBranchToLens, nextDeliveryAttemptAt, normalizeCanonicalLucernAuthContext, normalizeCanonicalPrincipalIdentity, normalizeDelegationChain, normalizeNodeVerificationStatus, normalizeNodeWriteInput, normalizeRetentionDays, normalizeTopicQuery, normalizeWebhookPatterns, opinionFromBaseRate, opinionFromDogmatic, opinionFromProjected, planContextPackCompilation, randomIdempotencyKey, readInfisicalRuntimeBootstrap, registerCustomTool, resolveDeliveryFailureStatus, resolveText, resolveTopicId, sanitizeWebhookRecord, sortEventsByCursor, toQueryString, truncateWebhookResponseBody, unregisterCustomTool, validateFilterCriteria, withSdkAliases, withTextAlias, withTopicAlias };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map