@lucern/sdk 0.3.0-alpha.16 → 0.3.0-alpha.2

package/dist/gatewayFacades.js

@@ -1,170 +1,3 @@
-// src/authContext.ts
-var LucernSdkAuthContextError = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.name = "LucernSdkAuthContextError";
-    this.reason = reason;
-  }
-};
-function cleanString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function cleanStringList(values) {
-  if (!values) {
-    return [];
-  }
-  return values.map((value) => value.trim()).filter(
-    (value, index, list) => value.length > 0 && list.indexOf(value) === index
-  );
-}
-function requireString(value, reason, label) {
-  const normalized = cleanString(value);
-  if (!normalized) {
-    throw new LucernSdkAuthContextError(
-      reason,
-      `Canonical Lucern SDK auth context is missing ${label}.`
-    );
-  }
-  return normalized;
-}
-function requirePrincipalType(principalType2) {
-  if (!principalType2) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is missing principalType."
-    );
-  }
-  return principalType2;
-}
-function requireAuthMode(authMode) {
-  if (!authMode) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is missing authMode."
-    );
-  }
-  return authMode;
-}
-function ensurePermitMatch(args) {
-  const actual = cleanString(args.actual);
-  if (actual && actual !== args.expected) {
-    throw new LucernSdkAuthContextError(
-      "policy_denied",
-      `Canonical Lucern SDK auth context has conflicting Permit ${args.field}.`
-    );
-  }
-}
-function normalizeCanonicalLucernAuthContext(input) {
-  if (!input) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is required."
-    );
-  }
-  if (input.policyDecision === "deny") {
-    throw new LucernSdkAuthContextError(
-      "policy_denied",
-      "Canonical Lucern SDK auth context carries a denied policy decision."
-    );
-  }
-  const principalId = requireString(
-    input.principalId,
-    "principal_missing",
-    "principalId"
-  );
-  const tenantId = requireString(input.tenantId, "tenant_missing", "tenantId");
-  const workspaceId = requireString(
-    input.workspaceId,
-    "workspace_missing",
-    "workspaceId"
-  );
-  const roles = cleanStringList(input.roles);
-  const scopes = cleanStringList(input.scopes);
-  const principalType2 = requirePrincipalType(input.principalType);
-  const authMode = requireAuthMode(input.authMode);
-  const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
-  if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
-    throw new LucernSdkAuthContextError(
-      "membership_missing",
-      "Canonical Lucern SDK auth context requires non-empty roles and scopes."
-    );
-  }
-  const subject = cleanString(input.permit?.subject) ?? principalId;
-  const tenant = cleanString(input.permit?.tenant) ?? tenantId;
-  const workspace = cleanString(input.permit?.workspace) ?? workspaceId;
-  ensurePermitMatch({
-    field: "subject",
-    expected: principalId,
-    actual: subject
-  });
-  ensurePermitMatch({ field: "tenant", expected: tenantId, actual: tenant });
-  ensurePermitMatch({
-    field: "workspace",
-    expected: workspaceId,
-    actual: workspace
-  });
-  const context = input.permit?.context ? { ...input.permit.context } : void 0;
-  return {
-    clerkId: cleanString(input.clerkId),
-    principalId,
-    tenantId,
-    workspaceId,
-    principalType: principalType2,
-    authMode,
-    roles,
-    scopes,
-    delegationChain: input.delegationChain ? [...input.delegationChain] : [],
-    policyTraceId: cleanString(input.policyTraceId),
-    correlationId: cleanString(input.correlationId),
-    membershipId: cleanString(input.membershipId),
-    permit: {
-      subject,
-      tenant,
-      workspace,
-      resource: cleanString(input.permit?.resource),
-      action: cleanString(input.permit?.action),
-      relation: cleanString(input.permit?.relation),
-      context
-    }
-  };
-}
-function createCanonicalAuthHeaders(authContext) {
-  const headers = {
-    "x-lucern-principal-id": authContext.principalId,
-    "x-lucern-principal-type": authContext.principalType,
-    "x-lucern-tenant": authContext.tenantId,
-    "x-lucern-tenant-id": authContext.tenantId,
-    "x-lucern-workspace": authContext.workspaceId,
-    "x-lucern-workspace-id": authContext.workspaceId,
-    "x-lucern-auth-mode": authContext.authMode,
-    "x-lucern-roles": authContext.roles.join(","),
-    "x-lucern-scopes": authContext.scopes.join(","),
-    "x-lucern-permit-context": JSON.stringify(authContext.permit)
-  };
-  if (authContext.clerkId) {
-    headers["x-lucern-clerk-id"] = authContext.clerkId;
-    headers["x-lucern-user-id"] = authContext.clerkId;
-  }
-  if (authContext.delegationChain.length > 0) {
-    headers["x-lucern-delegation-chain"] = JSON.stringify(
-      authContext.delegationChain
-    );
-  }
-  if (authContext.policyTraceId) {
-    headers["x-lucern-policy-trace-id"] = authContext.policyTraceId;
-  }
-  if (authContext.correlationId) {
-    headers["x-correlation-id"] = authContext.correlationId;
-    headers["x-lucern-correlation-id"] = authContext.correlationId;
-  }
-  if (authContext.membershipId) {
-    headers["x-lucern-membership-id"] = authContext.membershipId;
-  }
-  return headers;
-}
-
 // src/coreClient.ts
 var LucernApiError = class extends Error {
   code;
@@ -232,7 +65,9 @@ function generatePortableRequestId() {
     8
   ).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
 }
-var randomIdempotencyKey = generatePortableRequestId;
+function randomIdempotencyKey() {
+  return generatePortableRequestId();
+}
 function isRetryableStatus(status) {
   return status >= 500 || status === 408 || status === 429;
 }
@@ -297,11 +132,8 @@ function timeoutError(timeoutMs) {
   error.name = "AbortError";
   return error;
 }
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function readPolicySummaryFromDetails(details) {
-  if (!isRecord(details)) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
     return null;
   }
   const directSummary = details.summary;
@@ -309,11 +141,11 @@ function readPolicySummaryFromDetails(details) {
     return directSummary.trim();
   }
   const policy = details.policy;
-  if (!isRecord(policy)) {
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
     return null;
   }
   const explanation = policy.explanation;
-  if (!isRecord(explanation)) {
+  if (!explanation || typeof explanation !== "object" || Array.isArray(explanation)) {
     return null;
   }
   const nestedSummary = explanation.summary;
@@ -322,59 +154,16 @@ function readPolicySummaryFromDetails(details) {
   }
   return null;
 }
-async function resolveConfiguredAuthContext(authContext) {
-  if (typeof authContext === "function") {
-    return await authContext();
-  }
-  return authContext;
-}
-function mergeHeaderRecord(base, addition) {
-  const headers = new Headers(base);
-  for (const [key, value] of Object.entries(addition)) {
-    const existing = headers.get(key);
-    if (existing !== null && existing !== value) {
-      throw new LucernSdkAuthContextError(
-        "policy_denied",
-        `Canonical Lucern SDK auth context conflicts with existing ${key} header.`
-      );
-    }
-    headers.set(key, value);
-  }
-  return Object.fromEntries(headers.entries());
-}
-function cleanHeaderValue(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
 function createGatewayRequestClient(config = {}) {
   const fetchImpl = config.fetchImpl ?? fetch;
   const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
   const maxRetries = config.maxRetries ?? 2;
   const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
   async function resolveAuthHeaders() {
-    const provided = config.getAuthHeaders ? await config.getAuthHeaders() : {};
-    const headers = new Headers(provided);
-    const setIfAbsent = (name, value) => {
-      const normalized = cleanHeaderValue(value);
-      if (normalized && !headers.has(name)) {
-        headers.set(name, normalized);
-      }
-    };
-    setIfAbsent("x-lucern-key", config.apiKey);
-    setIfAbsent("x-lucern-session-token", config.userToken);
-    setIfAbsent("x-lucern-environment", config.environment);
-    setIfAbsent("x-lucern-clerk-id", config.clerkId);
-    setIfAbsent("x-lucern-user-id", config.userId ?? config.clerkId);
-    setIfAbsent("x-lucern-deployment-host", config.deploymentHost);
-    const base = Object.fromEntries(headers.entries());
-    const authContextInput = await resolveConfiguredAuthContext(
-      config.authContext
-    );
-    if (!authContextInput && !config.requireCanonicalAuthContext) {
-      return base;
+    if (!config.getAuthHeaders) {
+      return {};
     }
-    const authContext = normalizeCanonicalLucernAuthContext(authContextInput);
-    return mergeHeaderRecord(base, createCanonicalAuthHeaders(authContext));
+    return await config.getAuthHeaders();
   }
   async function fetchWithTimeout(url, init, timeoutMs) {
     const controller = new AbortController();
@@ -395,11 +184,11 @@ function createGatewayRequestClient(config = {}) {
     if (!text) {
       return null;
     }
-    const parsed = tryParseGatewayEnvelopeJson(text);
-    if (!parsed.ok) {
+    try {
+      return JSON.parse(text);
+    } catch {
       return null;
     }
-    return isRecord(parsed.value) ? parsed.value : null;
   }
   function resolveTimeoutMs(method, requestTimeoutMs) {
     if (typeof requestTimeoutMs === "number") {
@@ -411,31 +200,16 @@ function createGatewayRequestClient(config = {}) {
     }
     return config.timeoutMs ?? 15e3;
   }
-  function tryParseGatewayEnvelopeJson(text) {
-    const trimmed = text.trim();
-    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
-      return { ok: false, reason: "non-json" };
-    }
-    try {
-      return { ok: true, value: JSON.parse(trimmed) };
-    } catch (error) {
-      if (error instanceof SyntaxError) {
-        return { ok: false, reason: "invalid-json", error };
-      }
-      throw error;
-    }
-  }
   function buildApiError(args) {
     const failure = args.failure;
-    const legacyError = failure && isRecord(failure.error) ? failure.error : failure?.legacyError;
+    const legacyError = failure && typeof failure.error === "object" && failure.error !== null ? failure.error : failure?.legacyError;
     const correlationId = failure?.correlationId ?? args.response.headers.get("x-lucern-correlation-id")?.trim() ?? args.requestId;
     const policyTraceId = failure?.policyTraceId ?? args.response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null;
     const details = failure?.details ?? legacyError?.details;
     const policySummary = readPolicySummaryFromDetails(details);
-    const failureMessage = typeof failure?.error === "string" ? failure.error : legacyError?.message;
     return new LucernApiError({
       code: failure?.code ?? legacyError?.code ?? fallbackErrorCode(args.response.status),
-      message: policySummary ?? failureMessage ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed."),
+      message: policySummary ?? (typeof failure?.error === "string" ? failure.error : legacyError?.message ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed.")),
       status: args.response.status,
       invariant: failure?.invariant,
       suggestion: failure?.suggestion,
@@ -561,17 +335,14 @@ function createGatewayRequestClient(config = {}) {
 }
 
 // src/sdkSurface.ts
-function isRecord2(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
 function asRecord(value) {
-  return isRecord2(value) ? value : {};
+  return value && typeof value === "object" ? value : {};
 }
-function cleanString2(value) {
+function cleanString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeVerificationStatus(value) {
-  const status = cleanString2(value);
+  const status = cleanString(value);
   if (!status) {
     return void 0;
   }
@@ -587,20 +358,20 @@ function cloneWith(value, patch) {
   return { ...value, ...patch };
 }
 function resolveTopicId(value) {
-  return cleanString2(value.topicId);
+  return cleanString(value.topicId);
 }
 function resolveText(value) {
-  return cleanString2(value.text) ?? cleanString2(value.canonicalText);
+  return cleanString(value.text) ?? cleanString(value.canonicalText);
 }
 function withTopicAlias(value) {
-  const topicId = cleanString2(value.topicId) ?? void 0;
+  const topicId = cleanString(value.topicId) ?? void 0;
   if (!topicId) {
     return value;
   }
   return cloneWith(value, { topicId });
 }
 function withTextAlias(value) {
-  const text = cleanString2(value.text) ?? cleanString2(value.canonicalText) ?? void 0;
+  const text = cleanString(value.text) ?? cleanString(value.canonicalText) ?? void 0;
   if (!text) {
     return value;
   }
@@ -626,9 +397,11 @@ function normalizeNodeWriteInput(value) {
   }
   return next;
 }
-var normalizeNodeVerificationStatus = normalizeVerificationStatus;
+function normalizeNodeVerificationStatus(value) {
+  return normalizeVerificationStatus(value);
+}
 function normalizeTopicQuery(value) {
-  const topicId = cleanString2(value.topicId);
+  const topicId = cleanString(value.topicId);
   if (!topicId) {
     return value;
   }
@@ -653,10 +426,7 @@ function createListResult(items, legacyKey) {
     total: items.length
   };
   if (legacyKey) {
-    return {
-      ...result,
-      [legacyKey]: items
-    };
+    result[legacyKey] = items;
   }
   return result;
 }
@@ -676,7 +446,7 @@ function mapAliasedList(data, legacyKey) {
 // src/ontologyClient.ts
 function createOntologyClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
-  const client = {
+  return {
     /**
      * List ontology definitions matching optional filters.
      */
@@ -685,14 +455,13 @@ function createOntologyClient(config = {}) {
         path: `/api/platform/v1/ontologies${toQueryString(filters)}`
       }).then(
         (response) => mapGatewayData(response, (data) => {
-          const record = asRecord(data);
-          const ontologies = asListItems(data, "ontologies");
-          const definitions = ontologies.length > 0 ? ontologies : asListItems(data, "definitions");
-          const total = typeof record.total === "number" && Number.isFinite(record.total) ? record.total : definitions.length;
+          const record = data && typeof data === "object" && !Array.isArray(data) ? data : {};
+          const ontologies = Array.isArray(record.ontologies) ? record.ontologies : Array.isArray(record.definitions) ? record.definitions : Array.isArray(data) ? data : [];
+          const total = typeof record.total === "number" && Number.isFinite(record.total) ? record.total : ontologies.length;
           return {
             ...record,
-            ...createListResult(definitions, "definitions"),
-            ontologies: definitions,
+            ...createListResult(ontologies, "definitions"),
+            ontologies,
             total
           };
         })
@@ -719,6 +488,18 @@ function createOntologyClient(config = {}) {
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
+    /**
+     * List ontology definitions.
+     */
+    async listDefinitions(filters = {}) {
+      return this.list(filters);
+    },
+    /**
+     * Get an ontology definition.
+     */
+    async getDefinition(id) {
+      return this.get(id);
+    },
     /**
      * Create an ontology definition.
      */
@@ -760,7 +541,7 @@ function createOntologyClient(config = {}) {
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => createListResult(asListItems(data, "versions"), "versions")
+          (data) => createListResult(Array.isArray(data) ? data : [], "versions")
         )
       );
     },
@@ -808,19 +589,20 @@ function createOntologyClient(config = {}) {
           (data) => createListResult(Array.isArray(data) ? data : [], "topics")
         )
       );
+    },
+    /**
+     * @deprecated Use listTopics.
+     */
+    async listTopicsByOntology(ontologyId) {
+      return this.listTopics(ontologyId);
     }
   };
-  return Object.assign(client, {
-    listDefinitions: client.list,
-    getDefinition: client.get,
-    listTopicsByOntology: client.listTopics
-  });
 }
 
 // src/graphClient.ts
 function createGraphClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
-  const client = {
+  return {
     /**
      * List graph nodes matching the provided filters.
      */
@@ -833,6 +615,12 @@ function createGraphClient(config = {}) {
         (response) => mapGatewayData(response, (data) => mapAliasedList(data, "nodes"))
       );
     },
+    /**
+     * @deprecated Use listNodes.
+     */
+    async queryNodes(query) {
+      return this.listNodes(query);
+    },
     /**
      * Retrieve a single graph node by nodeId or globalId.
      */
@@ -943,6 +731,12 @@ function createGraphClient(config = {}) {
         )
       );
     },
+    /**
+     * @deprecated Use listEdges.
+     */
+    async queryEdges(query) {
+      return this.listEdges(query);
+    },
     /**
      * Create a graph edge.
      */
@@ -1030,6 +824,12 @@ function createGraphClient(config = {}) {
         body: normalizeTopicQuery(query)
       });
     },
+    /**
+     * Retrieve a graph neighborhood around a root node.
+     */
+    async getNeighborhood(query) {
+      return this.neighborhood(query);
+    },
     /**
      * Retrieve the shortest known path between two graph nodes.
      */
@@ -1047,151 +847,6 @@ function createGraphClient(config = {}) {
       });
     }
   };
-  return Object.assign(client, {
-    queryNodes: client.listNodes,
-    queryEdges: client.listEdges,
-    getNeighborhood: client.neighborhood
-  });
-}
-
-// src/boundaryClientSurface.ts
-function cleanOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function isRecord3(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function cleanRequiredString(value, label) {
-  const normalized = cleanOptionalString(value);
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
-  return normalized;
-}
-function assertKnownKeys(input, allowed, operation) {
-  const allowedSet = new Set(allowed);
-  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
-  if (unknownKeys.length > 0) {
-    throw new Error(
-      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
-    );
-  }
-}
-function knownPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return { ...input };
-}
-function listResultFromEnvelope(data, legacyKey) {
-  const record = isRecord3(data) ? data : {};
-  const legacyItems = record[legacyKey];
-  return createListResult(
-    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
-    legacyKey
-  );
-}
-
-// src/control-plane.ts
-var LucernControlPlaneIdentityError = class extends Error {
-  reason;
-  principalStatus;
-  tenantStatus;
-  workspaceStatus;
-  details;
-  constructor(failure) {
-    super(failure.message);
-    this.name = "LucernControlPlaneIdentityError";
-    this.reason = failure.reason;
-    this.principalStatus = failure.principalStatus;
-    this.tenantStatus = failure.tenantStatus;
-    this.workspaceStatus = failure.workspaceStatus;
-    this.details = failure.details;
-  }
-};
-function cleanString3(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
-function stringList(value) {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-  return [
-    ...new Set(
-      value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean)
-    )
-  ];
-}
-function principalType(value) {
-  switch (value) {
-    case "service":
-    case "service_principal":
-      return "service";
-    case "agent":
-      return "agent";
-    case "group":
-      return "group";
-    case "external_viewer":
-    case "external_stakeholder":
-      return "external_viewer";
-    default:
-      return "human";
-  }
-}
-function adminFlags(roles) {
-  const normalized = roles.map((role) => role.toLowerCase());
-  const isPlatformAdmin = normalized.includes("platform_admin");
-  const isTenantAdmin = isPlatformAdmin || normalized.includes("tenant_admin");
-  const isWorkspaceAdmin = isTenantAdmin || normalized.includes("workspace_admin") || normalized.includes("workspace_owner");
-  return { isPlatformAdmin, isTenantAdmin, isWorkspaceAdmin };
-}
-function normalizeResolvedInteractivePrincipal(payload) {
-  if ("ok" in payload && payload.ok === false) {
-    throw new LucernControlPlaneIdentityError(payload);
-  }
-  const principalId = cleanString3(payload.principalId);
-  const clerkId = cleanString3(payload.clerkId);
-  const tenantId = cleanString3(payload.tenantId);
-  if (!principalId || !clerkId || !tenantId) {
-    throw new LucernControlPlaneIdentityError({
-      ok: false,
-      reason: "resolver_unavailable",
-      message: "Control-plane principal resolver returned an incomplete principal context.",
-      principalStatus: payload.principalStatus ?? "missing",
-      tenantStatus: payload.tenantStatus,
-      workspaceStatus: payload.workspaceStatus
-    });
-  }
-  const roles = stringList(payload.roles);
-  const scopes = stringList(payload.scopes);
-  const workspaceId = cleanString3(payload.workspaceId) ?? null;
-  const flags = adminFlags(roles);
-  return {
-    principalId,
-    principalType: principalType(payload.principalType),
-    clerkId,
-    tenantId,
-    workspaceId,
-    roles,
-    scopes,
-    groupIds: stringList(payload.groupIds),
-    permittedToolNames: stringList(payload.permittedToolNames),
-    permittedPackKeys: stringList(payload.permittedPackKeys),
-    principalStatus: cleanString3(payload.principalStatus) ?? "active",
-    tenantStatus: cleanString3(payload.tenantStatus) ?? "active",
-    workspaceStatus: cleanString3(payload.workspaceStatus) ?? (workspaceId ? "active" : "none"),
-    isPlatformAdmin: typeof payload.isPlatformAdmin === "boolean" ? payload.isPlatformAdmin : flags.isPlatformAdmin,
-    isTenantAdmin: typeof payload.isTenantAdmin === "boolean" ? payload.isTenantAdmin : flags.isTenantAdmin,
-    isWorkspaceAdmin: typeof payload.isWorkspaceAdmin === "boolean" ? payload.isWorkspaceAdmin : flags.isWorkspaceAdmin,
-    permit: {
-      subject: cleanString3(payload.permit?.subject) ?? principalId,
-      tenant: cleanString3(payload.permit?.tenant) ?? tenantId,
-      ...workspaceId ? { workspace: cleanString3(payload.permit?.workspace) ?? workspaceId } : {}
-    },
-    authMode: "interactive_user",
-    sessionId: payload.sessionId,
-    delegatedBy: payload.delegatedBy,
-    expiresAt: payload.expiresAt
-  };
 }
 
 // src/identityClient.ts
@@ -1205,37 +860,6 @@ function createIdentityWhoamiClient(config = {}) {
     }
   };
 }
-var TENANT_IDENTITY_FIELDS = [
-  "tenantId",
-  "workspaceId",
-  "principalId",
-  "integrationKey",
-  "secretRef",
-  "policySubject",
-  "policyAction",
-  "policyResource",
-  "decision",
-  "config",
-  "configKey",
-  "configValue",
-  "provider",
-  "status",
-  "metadata",
-  "limit",
-  "cursor"
-];
-function tenantIdentityQuery(input) {
-  return {
-    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
-    workspaceId: input.workspaceId,
-    principalId: input.principalId,
-    limit: input.limit,
-    cursor: input.cursor
-  };
-}
-function tenantIdentityBody(input, operation) {
-  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
-}
 function createIdentityClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
   const whoamiClient = createIdentityWhoamiClient(config);
@@ -1245,13 +869,6 @@ function createIdentityClient(config = {}) {
     body: input,
     idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
   });
-  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
-  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
-    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
-    method: "POST",
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
   return {
     /**
      * Resolve the current authenticated identity summary.
@@ -1261,25 +878,13 @@ function createIdentityClient(config = {}) {
         (response) => mapGatewayData(response, (data) => ({
           principalId: data.principalId,
           principalType: data.principalType,
-          clerkId: data.clerkId,
           tenantId: data.tenantId ?? null,
           workspaceId: data.workspaceId ?? null,
           scopes: Array.isArray(data.scopes) ? data.scopes : [],
           roles: Array.isArray(data.roles) ? data.roles : [],
-          groupIds: Array.isArray(data.groupIds) ? data.groupIds : [],
-          permittedToolNames: Array.isArray(data.permittedToolNames) ? data.permittedToolNames : [],
-          permittedPackKeys: Array.isArray(data.permittedPackKeys) ? data.permittedPackKeys : [],
-          principalStatus: data.principalStatus,
-          tenantStatus: data.tenantStatus,
-          workspaceStatus: data.workspaceStatus,
           isPlatformAdmin: data.isPlatformAdmin === true,
           isTenantAdmin: data.isTenantAdmin === true,
           isWorkspaceAdmin: data.isWorkspaceAdmin === true,
-          permit: data.permit ?? (data.tenantId ? {
-            subject: data.principalId,
-            tenant: data.tenantId,
-            ...data.workspaceId ? { workspace: data.workspaceId } : {}
-          } : void 0),
           authMode: data.authMode,
           sessionId: data.sessionId,
           delegatedBy: data.delegatedBy,
@@ -1287,19 +892,6 @@ function createIdentityClient(config = {}) {
         }))
       );
     },
-    /**
-     * Resolve a Clerk subject through the tenant control-plane Permit projection.
-     * @deprecated Prefer lucern.controlPlane.identity.resolveInteractivePrincipal().
-     */
-    async resolveInteractivePrincipal(input) {
-      return gateway.request({
-        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
-        method: "POST",
-        body: input
-      }).then(
-        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
-      );
-    },
     /**
      * List principals in the current identity scope.
      */
@@ -1325,11 +917,15 @@ function createIdentityClient(config = {}) {
     /**
      * Update a principal.
      */
-    updatePrincipal,
+    async updatePrincipal(input, idempotencyKey) {
+      return requestPrincipalWrite("PATCH", input, idempotencyKey);
+    },
     /**
      * @deprecated Use createPrincipal or updatePrincipal.
      */
-    upsertPrincipal: updatePrincipal,
+    async upsertPrincipal(input, idempotencyKey) {
+      return requestPrincipalWrite("PATCH", input, idempotencyKey);
+    },
     /**
      * List keys in the current identity scope.
      */
@@ -1368,11 +964,20 @@ function createIdentityClient(config = {}) {
     /**
      * Delete an API key by revoking it.
      */
-    deleteKey,
+    async deleteKey(keyId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
     /**
      * @deprecated Use deleteKey.
      */
-    revokeKey: deleteKey,
+    async revokeKey(keyId, input = {}, idempotencyKey) {
+      return this.deleteKey(keyId, input, idempotencyKey);
+    },
     /**
      * Search Clerk users by email or display attributes.
      */
@@ -1380,120 +985,20 @@ function createIdentityClient(config = {}) {
       return gateway.request({
         path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
       });
-    },
-    async getTenantConfig(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/tenant-config${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      });
-    },
-    async updateTenantConfig(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      return gateway.request({
-        path: "/api/platform/v1/identity/tenant-config",
-        method: "PATCH",
-        body: tenantIdentityBody(
-          input,
-          "identity.updateTenantConfig"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async listIntegrations(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/integrations${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "integrations"
-          )
-        )
-      );
-    },
-    async upsertIntegration(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.integrationKey, "integrationKey");
-      return gateway.request({
-        path: "/api/platform/v1/identity/integrations",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.upsertIntegration"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async listSecrets(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/secrets${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "secrets"
-          )
-        )
-      );
-    },
-    async putSecretReference(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.secretRef, "secretRef");
-      return gateway.request({
-        path: "/api/platform/v1/identity/secrets",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.putSecretReference"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async evaluatePolicy(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.policySubject, "policySubject");
-      cleanRequiredString(input.policyAction, "policyAction");
-      cleanRequiredString(input.policyResource, "policyResource");
-      return gateway.request({
-        path: "/api/platform/v1/identity/policy/evaluate",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.evaluatePolicy"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async recordPolicyDecision(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.decision, "decision");
-      return gateway.request({
-        path: "/api/platform/v1/identity/policy/decisions",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.recordPolicyDecision"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
     }
   };
 }
 
 // src/topicsClient.ts
-function cleanString4(value) {
+function asRecord2(value) {
+  return value && typeof value === "object" ? value : {};
+}
+function cleanString2(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeTopicRecord(value) {
-  const record = asRecord(value);
-  const topicId = cleanString4(record.topicId) ?? cleanString4(record.id) ?? cleanString4(record._id);
+  const record = asRecord2(value);
+  const topicId = cleanString2(record.topicId) ?? cleanString2(record.id) ?? cleanString2(record._id);
   return withTopicAlias({
     ...record,
     ...topicId ? { topicId } : {}
@@ -1517,7 +1022,7 @@ function createTopicsClient(config = {}) {
         })}`
       }).then(
         (response) => mapGatewayData(response, (data) => {
-          const record = asRecord(data);
+          const record = asRecord2(data);
           const items = Array.isArray(record.topics) ? record.topics.map(normalizeTopicRecord) : [];
           return {
             ...createListResult(items, "topics"),
@@ -1534,7 +1039,7 @@ function createTopicsClient(config = {}) {
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => normalizeTopicRecord(asRecord(data).topic ?? data)
+          (data) => normalizeTopicRecord(asRecord2(data).topic ?? data)
         )
       );
     },
@@ -1570,7 +1075,7 @@ function createTopicsClient(config = {}) {
         )}`
       }).then(
         (response) => mapGatewayData(response, (data) => {
-          const record = asRecord(data);
+          const record = asRecord2(data);
           return {
             tree: Array.isArray(record.tree) ? record.tree.map(normalizeTopicTreeNode) : []
           };
@@ -1989,7 +1494,7 @@ function createEventsFacade(config = {}) {
 function createGraphFacade(config = {}) {
   const graphClient = createGraphClient(config);
   const gateway = createGatewayRequestClient(config);
-  const graphFacade = {
+  return {
     async neighborhood(input) {
       return graphClient.neighborhood({
         globalId: input.globalId,
@@ -1997,6 +1502,18 @@ function createGraphFacade(config = {}) {
         maxDepth: input.maxDepth
       });
     },
+    async traverse(input) {
+      return graphClient.traverse(input);
+    },
+    async analyze(input = {}) {
+      return graphClient.analyze(input);
+    },
+    async bias(input = {}) {
+      return graphClient.bias(input);
+    },
+    async gaps(input) {
+      return graphClient.gaps(input);
+    },
     async falsify(input, idempotencyKey = randomIdempotencyKey()) {
       return gateway.request({
         path: "/api/platform/v1/graph/falsify",
@@ -2006,12 +1523,6 @@ function createGraphFacade(config = {}) {
       });
     }
   };
-  return Object.assign(graphFacade, {
-    traverse: graphClient.traverse,
-    analyze: graphClient.analyze,
-    bias: graphClient.bias,
-    gaps: graphClient.gaps
-  });
 }
 function createIdentityFacade(config = {}) {
   const identityClient = createIdentityClient(config);
@@ -2025,12 +1536,15 @@ function createIdentityFacade(config = {}) {
 function createOntologiesFacade(config = {}) {
   const ontologyClient = createOntologyClient(config);
   const gateway = createGatewayRequestClient(config);
-  const ontologyFacade = {
+  return {
     async get(id) {
       return gateway.request({
         path: `/api/platform/v1/ontologies/${encodeURIComponent(id)}`
       });
     },
+    async list(query = {}) {
+      return ontologyClient.list(query);
+    },
     async bind(input, idempotencyKey) {
       return gateway.request({
         path: `/api/platform/v1/ontologies/${encodeURIComponent(input.ontologyId)}/bind`,
@@ -2050,9 +1564,6 @@ function createOntologiesFacade(config = {}) {
       });
     }
   };
-  return Object.assign(ontologyFacade, {
-    list: ontologyClient.list
-  });
 }
 function createQuestionsFacade(config = {}) {
   const gateway = createGatewayRequestClient(config);
@@ -2212,8 +1723,6 @@ function createTasksFacade(config = {}) {
           description: input.description,
           priority: input.priority,
           status: input.status,
-          assigneeId: input.assigneeId,
-          blockedReason: input.blockedReason,
           linkedBeliefId: input.linkedBeliefId,
           linkedQuestionId: input.linkedQuestionId,
           linkedWorktreeId: input.linkedWorktreeId,
@@ -2247,9 +1756,15 @@ function createTasksFacade(config = {}) {
 function createTopicsFacade(config = {}) {
   const topicsClient = createTopicsClient(config);
   return {
-    create: topicsClient.create,
-    get: topicsClient.get,
-    list: topicsClient.list,
+    async create(input, idempotencyKey) {
+      return topicsClient.create(input, idempotencyKey);
+    },
+    async get(id) {
+      return topicsClient.get(id);
+    },
+    async list(query = {}) {
+      return topicsClient.list(query);
+    },
     async update(input, idempotencyKey) {
       const { id, ...rest } = input;
       return topicsClient.update(id, rest, idempotencyKey);
@@ -2265,8 +1780,12 @@ function createTopicsFacade(config = {}) {
         maxDepth: input.maxDepth
       });
     },
-    remove: topicsClient.remove,
-    bulkCreate: topicsClient.bulkCreate
+    async remove(id, idempotencyKey = randomIdempotencyKey()) {
+      return topicsClient.remove(id, idempotencyKey);
+    },
+    async bulkCreate(input, idempotencyKey = randomIdempotencyKey()) {
+      return topicsClient.bulkCreate(input, idempotencyKey);
+    }
   };
 }
 function createWebhooksFacade(config = {}) {