@lucern/sdk 0.3.0-alpha.8 → 1.0.0

package/dist/client.js

@@ -32,14 +32,14 @@ function requireString(value, reason, label) {
   }
   return normalized;
 }
-function requirePrincipalType(principalType) {
-  if (!principalType) {
+function requirePrincipalType(principalType2) {
+  if (!principalType2) {
     throw new LucernSdkAuthContextError(
       "principal_missing",
       "Canonical Lucern SDK auth context is missing principalType."
     );
   }
-  return principalType;
+  return principalType2;
 }
 function requireAuthMode(authMode) {
   if (!authMode) {
@@ -85,7 +85,7 @@ function normalizeCanonicalLucernAuthContext(input) {
   );
   const roles = cleanStringList(input.roles);
   const scopes = cleanStringList(input.scopes);
-  const principalType = requirePrincipalType(input.principalType);
+  const principalType2 = requirePrincipalType(input.principalType);
   const authMode = requireAuthMode(input.authMode);
   const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
   if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
@@ -114,7 +114,7 @@ function normalizeCanonicalLucernAuthContext(input) {
     principalId,
     tenantId,
     workspaceId,
-    principalType,
+    principalType: principalType2,
     authMode,
     roles,
     scopes,
@@ -345,13 +345,31 @@ function mergeHeaderRecord(base, addition) {
   }
   return Object.fromEntries(headers.entries());
 }
+function cleanHeaderValue(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
 function createGatewayRequestClient(config = {}) {
   const fetchImpl = config.fetchImpl ?? fetch;
   const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
   const maxRetries = config.maxRetries ?? 2;
   const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
   async function resolveAuthHeaders() {
-    const base = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const provided = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const headers = new Headers(provided);
+    const setIfAbsent = (name, value) => {
+      const normalized = cleanHeaderValue(value);
+      if (normalized && !headers.has(name)) {
+        headers.set(name, normalized);
+      }
+    };
+    setIfAbsent("x-lucern-key", config.apiKey);
+    setIfAbsent("x-lucern-session-token", config.userToken);
+    setIfAbsent("x-lucern-environment", config.environment);
+    setIfAbsent("x-lucern-clerk-id", config.clerkId);
+    setIfAbsent("x-lucern-user-id", config.userId ?? config.clerkId);
+    setIfAbsent("x-lucern-deployment-host", config.deploymentHost);
+    const base = Object.fromEntries(headers.entries());
     const authContextInput = await resolveConfiguredAuthContext(
       config.authContext
     );
@@ -1048,208 +1066,929 @@ function createAdminClient(config = {}) {
   };
 }
 
-// src/answersClient.ts
-function createAnswersClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
+// src/boundaryClientSurface.ts
+function cleanOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function cleanRequiredString(value, label) {
+  const normalized = cleanOptionalString(value);
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function readTopicId(input) {
+  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
+}
+function requireTopicId(input) {
+  const topicId = readTopicId(input);
+  if (!topicId) {
+    throw new Error("topicId is required");
+  }
+  return topicId;
+}
+function assertKnownKeys(input, allowed, operation) {
+  const allowedSet = new Set(allowed);
+  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
+    );
+  }
+}
+function knownPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return { ...input };
+}
+function topicPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
   return {
-    /**
-     * Get the current answer for a question.
-     * @param questionId - The question node identifier.
-     * @returns The answer record for the given question.
-     */
-    async get(questionId) {
-      return gateway.request({
-        path: `/api/platform/v1/questions/${encodeURIComponent(questionId)}/answer`
-      });
-    }
+    ...input,
+    topicId: requireTopicId(input),
+    projectId: void 0
   };
 }
+function listResultFromEnvelope(data, legacyKey) {
+  const record = isRecord3(data) ? data : {};
+  const legacyItems = record[legacyKey];
+  return createListResult(
+    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
+    legacyKey
+  );
+}
 
-// src/audiencesClient.ts
-function createAudiencesClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const listRegistry = async (query5 = {}) => {
-    return gateway.request({
-      path: `/api/platform/v1/audiences/registry${toQueryString({
-        ...query5,
-        effective: typeof query5.effective === "boolean" ? query5.effective ? "true" : "false" : void 0,
-        status: query5.status
-      })}`
-    }).then(
-      (response) => mapGatewayData(
-        response,
-        (data) => createListResult(Array.isArray(data) ? data : [], "registryEntries")
-      )
-    );
-  };
-  const createRegistryEntry = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/registry",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-    });
-  };
-  const updateRegistryEntry = createRegistryEntry;
-  const upsertRegistry = createRegistryEntry;
-  const getRegistry = listRegistry;
-  const listGrants = async (query5 = {}) => {
-    return gateway.request({
-      path: `/api/platform/v1/audiences/grants${toQueryString({
-        ...query5,
-        audienceKey: query5.audienceKey,
-        principalId: query5.principalId,
-        groupId: query5.groupId,
-        status: query5.status
-      })}`
-    }).then(
-      (response) => mapGatewayData(
-        response,
-        (data) => createListResult(Array.isArray(data) ? data : [], "grants")
-      )
-    );
-  };
-  const createGrant = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/grants",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-    });
-  };
-  const getGrants = listGrants;
-  const grant = createGrant;
-  const deleteGrant = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/grants/revoke",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+// src/control-plane.ts
+var LucernControlPlaneIdentityError = class extends Error {
+  reason;
+  principalStatus;
+  tenantStatus;
+  workspaceStatus;
+  details;
+  constructor(failure) {
+    super(failure.message);
+    this.name = "LucernControlPlaneIdentityError";
+    this.reason = failure.reason;
+    this.principalStatus = failure.principalStatus;
+    this.tenantStatus = failure.tenantStatus;
+    this.workspaceStatus = failure.workspaceStatus;
+    this.details = failure.details;
+  }
+};
+function cleanString3(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function stringList(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return [
+    ...new Set(
+      value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean)
+    )
+  ];
+}
+function principalType(value) {
+  switch (value) {
+    case "service":
+    case "service_principal":
+      return "service";
+    case "agent":
+      return "agent";
+    case "group":
+      return "group";
+    case "external_viewer":
+    case "external_stakeholder":
+      return "external_viewer";
+    default:
+      return "human";
+  }
+}
+function adminFlags(roles) {
+  const normalized = roles.map((role) => role.toLowerCase());
+  const isPlatformAdmin = normalized.includes("platform_admin");
+  const isTenantAdmin = isPlatformAdmin || normalized.includes("tenant_admin");
+  const isWorkspaceAdmin = isTenantAdmin || normalized.includes("workspace_admin") || normalized.includes("workspace_owner");
+  return { isPlatformAdmin, isTenantAdmin, isWorkspaceAdmin };
+}
+function normalizeResolvedInteractivePrincipal(payload) {
+  if ("ok" in payload && payload.ok === false) {
+    throw new LucernControlPlaneIdentityError(payload);
+  }
+  const principalId = cleanString3(payload.principalId);
+  const clerkId = cleanString3(payload.clerkId);
+  const tenantId = cleanString3(payload.tenantId);
+  if (!principalId || !clerkId || !tenantId) {
+    throw new LucernControlPlaneIdentityError({
+      ok: false,
+      reason: "resolver_unavailable",
+      message: "Control-plane principal resolver returned an incomplete principal context.",
+      principalStatus: payload.principalStatus ?? "missing",
+      tenantStatus: payload.tenantStatus,
+      workspaceStatus: payload.workspaceStatus
     });
-  };
-  const revokeGrant = deleteGrant;
+  }
+  const roles = stringList(payload.roles);
+  const scopes = stringList(payload.scopes);
+  const workspaceId = cleanString3(payload.workspaceId) ?? null;
+  const flags = adminFlags(roles);
   return {
-    /**
-     * List audience registry entries.
-     */
-    listRegistry,
-    /**
-     * @deprecated Use listRegistry.
-     */
-    getRegistry,
-    /**
-     * Create an audience registry entry.
-     */
-    createRegistryEntry,
-    /**
-     * Update an audience registry entry.
-     */
-    updateRegistryEntry,
-    /**
-     * @deprecated Use createRegistryEntry or updateRegistryEntry.
-     */
-    upsertRegistry,
-    /**
-     * List audience grants.
-     */
-    listGrants,
-    /**
-     * @deprecated Use listGrants.
-     */
-    getGrants,
-    /**
-     * Create an audience grant.
-     */
-    createGrant,
-    /**
-     * @deprecated Use createGrant.
-     */
-    grant,
-    /**
-     * Delete an audience grant by revoking it.
-     */
-    deleteGrant,
-    /**
-     * @deprecated Use deleteGrant.
-     */
-    revokeGrant
+    principalId,
+    principalType: principalType(payload.principalType),
+    clerkId,
+    tenantId,
+    workspaceId,
+    roles,
+    scopes,
+    groupIds: stringList(payload.groupIds),
+    permittedToolNames: stringList(payload.permittedToolNames),
+    permittedPackKeys: stringList(payload.permittedPackKeys),
+    principalStatus: cleanString3(payload.principalStatus) ?? "active",
+    tenantStatus: cleanString3(payload.tenantStatus) ?? "active",
+    workspaceStatus: cleanString3(payload.workspaceStatus) ?? (workspaceId ? "active" : "none"),
+    isPlatformAdmin: typeof payload.isPlatformAdmin === "boolean" ? payload.isPlatformAdmin : flags.isPlatformAdmin,
+    isTenantAdmin: typeof payload.isTenantAdmin === "boolean" ? payload.isTenantAdmin : flags.isTenantAdmin,
+    isWorkspaceAdmin: typeof payload.isWorkspaceAdmin === "boolean" ? payload.isWorkspaceAdmin : flags.isWorkspaceAdmin,
+    permit: {
+      subject: cleanString3(payload.permit?.subject) ?? principalId,
+      tenant: cleanString3(payload.permit?.tenant) ?? tenantId,
+      ...workspaceId ? { workspace: cleanString3(payload.permit?.workspace) ?? workspaceId } : {}
+    },
+    authMode: "interactive_user",
+    sessionId: payload.sessionId,
+    delegatedBy: payload.delegatedBy,
+    expiresAt: payload.expiresAt
   };
 }
-
-// src/auditClient.ts
-function createAuditClient(config = {}) {
+function createControlPlaneIdentityClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
   return {
-    /**
-     * List audit events for the current scope.
-     */
-    async listEvents(query5 = {}) {
+    async resolveInteractivePrincipal(input) {
       return gateway.request({
-        path: `/api/platform/v1/audit/events${toQueryString(
-          normalizeTopicQuery(query5)
-        )}`
+        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
+        method: "POST",
+        body: input
       }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "events")
-        )
+        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
       );
     }
   };
 }
-
-// src/authDeviceClient.ts
-var DeviceAuthorizationError = class extends Error {
-  error;
-  interval;
-  constructor(args) {
-    super(args.description ?? args.error);
-    this.name = "DeviceAuthorizationError";
-    this.error = args.error;
-    this.interval = args.interval;
-  }
-};
-function authBaseUrl(config) {
-  return config.baseUrl?.replace(/\/+$/, "") ?? "";
-}
-async function readJson(response) {
-  try {
-    const payload = await response.json();
-    return isRecord3(payload) ? payload : {};
-  } catch (error) {
-    return unreadableJsonBodyFallback();
-  }
-}
-function unreadableJsonBodyFallback(_error) {
-  return {};
-}
-function isRecord3(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function readString(value) {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  return normalized || void 0;
-}
-function assertDeviceCodeResponse(payload) {
-  const deviceCode = readString(payload.device_code);
-  const userCode = readString(payload.user_code);
-  const verificationUri = readString(payload.verification_uri);
-  const verificationUriComplete = readString(payload.verification_uri_complete);
-  const expiresIn = payload.expires_in;
-  const interval = payload.interval;
-  if (!deviceCode || !userCode || !verificationUri || !verificationUriComplete || typeof expiresIn !== "number" || typeof interval !== "number") {
-    throw new Error("Gateway returned an invalid device-code response.");
-  }
+function createControlPlaneClient(config = {}) {
   return {
-    device_code: deviceCode,
-    user_code: userCode,
-    verification_uri: verificationUri,
-    verification_uri_complete: verificationUriComplete,
-    expires_in: expiresIn,
-    interval
+    identity: createControlPlaneIdentityClient(config)
   };
 }
-function assertDeviceTokenResponse(payload) {
+
+// src/identityClient.ts
+function createIdentityWhoamiClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    async whoami() {
+      return gateway.request({
+        path: "/api/platform/v1/identity/whoami"
+      });
+    }
+  };
+}
+var TENANT_IDENTITY_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "integrationKey",
+  "secretRef",
+  "policySubject",
+  "policyAction",
+  "policyResource",
+  "decision",
+  "config",
+  "configKey",
+  "configValue",
+  "provider",
+  "status",
+  "metadata",
+  "limit",
+  "cursor"
+];
+function tenantIdentityQuery(input) {
+  return {
+    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
+    workspaceId: input.workspaceId,
+    principalId: input.principalId,
+    limit: input.limit,
+    cursor: input.cursor
+  };
+}
+function tenantIdentityBody(input, operation) {
+  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
+}
+function createIdentityClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  const whoamiClient = createIdentityWhoamiClient(config);
+  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
+    path: "/api/platform/v1/identity/principals",
+    method,
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
+  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
+    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
+    method: "POST",
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  return {
+    /**
+     * Resolve the current authenticated identity summary.
+     */
+    async whoami() {
+      return whoamiClient.whoami().then(
+        (response) => mapGatewayData(response, (data) => ({
+          principalId: data.principalId,
+          principalType: data.principalType,
+          clerkId: data.clerkId,
+          tenantId: data.tenantId ?? null,
+          workspaceId: data.workspaceId ?? null,
+          scopes: Array.isArray(data.scopes) ? data.scopes : [],
+          roles: Array.isArray(data.roles) ? data.roles : [],
+          groupIds: Array.isArray(data.groupIds) ? data.groupIds : [],
+          permittedToolNames: Array.isArray(data.permittedToolNames) ? data.permittedToolNames : [],
+          permittedPackKeys: Array.isArray(data.permittedPackKeys) ? data.permittedPackKeys : [],
+          principalStatus: data.principalStatus,
+          tenantStatus: data.tenantStatus,
+          workspaceStatus: data.workspaceStatus,
+          isPlatformAdmin: data.isPlatformAdmin === true,
+          isTenantAdmin: data.isTenantAdmin === true,
+          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
+          permit: data.permit ?? (data.tenantId ? {
+            subject: data.principalId,
+            tenant: data.tenantId,
+            ...data.workspaceId ? { workspace: data.workspaceId } : {}
+          } : void 0),
+          authMode: data.authMode,
+          sessionId: data.sessionId,
+          delegatedBy: data.delegatedBy,
+          expiresAt: data.expiresAt
+        }))
+      );
+    },
+    /**
+     * Resolve a Clerk subject through the tenant control-plane Permit projection.
+     * @deprecated Prefer lucern.controlPlane.identity.resolveInteractivePrincipal().
+     */
+    async resolveInteractivePrincipal(input) {
+      return gateway.request({
+        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
+        method: "POST",
+        body: input
+      }).then(
+        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
+      );
+    },
+    /**
+     * List principals in the current identity scope.
+     */
+    async listPrincipals(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "principals"
+          )
+        )
+      );
+    },
+    /**
+     * Create a principal.
+     */
+    async createPrincipal(input, idempotencyKey) {
+      return requestPrincipalWrite("POST", input, idempotencyKey);
+    },
+    /**
+     * Update a principal.
+     */
+    updatePrincipal,
+    /**
+     * @deprecated Use createPrincipal or updatePrincipal.
+     */
+    upsertPrincipal: updatePrincipal,
+    /**
+     * List keys in the current identity scope.
+     */
+    async listKeys(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+        )
+      );
+    },
+    /**
+     * Create an API key.
+     */
+    async createKey(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/identity/keys",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Rotate an API key.
+     */
+    async rotateKey(keyId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Delete an API key by revoking it.
+     */
+    deleteKey,
+    /**
+     * @deprecated Use deleteKey.
+     */
+    revokeKey: deleteKey,
+    /**
+     * Search Clerk users by email or display attributes.
+     */
+    async searchClerkUsers(q) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+      });
+    },
+    async getTenantConfig(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/tenant-config${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      });
+    },
+    async updateTenantConfig(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      return gateway.request({
+        path: "/api/platform/v1/identity/tenant-config",
+        method: "PATCH",
+        body: tenantIdentityBody(
+          input,
+          "identity.updateTenantConfig"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listIntegrations(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/integrations${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "integrations"
+          )
+        )
+      );
+    },
+    async upsertIntegration(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.integrationKey, "integrationKey");
+      return gateway.request({
+        path: "/api/platform/v1/identity/integrations",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.upsertIntegration"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listSecrets(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/secrets${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "secrets"
+          )
+        )
+      );
+    },
+    async putSecretReference(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.secretRef, "secretRef");
+      return gateway.request({
+        path: "/api/platform/v1/identity/secrets",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.putSecretReference"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async evaluatePolicy(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.policySubject, "policySubject");
+      cleanRequiredString(input.policyAction, "policyAction");
+      cleanRequiredString(input.policyResource, "policyResource");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/evaluate",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.evaluatePolicy"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async recordPolicyDecision(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.decision, "decision");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/decisions",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.recordPolicyDecision"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
+  };
+}
+
+// src/accessControl.ts
+var LucernAccessControlError = class extends LucernSdkAuthContextError {
+  policyDecision;
+  constructor(reason, message, policyDecision) {
+    super(reason, message);
+    this.name = "LucernAccessControlError";
+    this.policyDecision = policyDecision;
+  }
+};
+function cleanString4(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function cleanStringList2(values) {
+  if (!values) {
+    return [];
+  }
+  return [
+    ...new Set(
+      values.map((value) => value.trim()).filter((value) => value.length > 0)
+    )
+  ];
+}
+function requireString2(value, reason, label) {
+  const normalized = cleanString4(value);
+  if (!normalized) {
+    throw new LucernAccessControlError(
+      reason,
+      `Lucern SDK access control requires ${label}.`
+    );
+  }
+  return normalized;
+}
+function normalizePrincipalType(principalType2) {
+  if (principalType2 === "agent") {
+    return "agent";
+  }
+  if (principalType2 === "service") {
+    return "service";
+  }
+  if (principalType2 === "group") {
+    return "group";
+  }
+  if (principalType2 === "external_viewer") {
+    return "external_viewer";
+  }
+  return "human";
+}
+function aliasKey(alias) {
+  return `${alias.provider}:${alias.providerProjectId ?? ""}:${alias.externalSubjectId}`;
+}
+function normalizeAliases(input, canonicalClerkUserId) {
+  const aliases = /* @__PURE__ */ new Map();
+  for (const alias of input ?? []) {
+    const externalSubjectId = cleanString4(alias.externalSubjectId);
+    if (!externalSubjectId) {
+      continue;
+    }
+    const normalized = {
+      provider: cleanString4(alias.provider) ?? "clerk",
+      providerProjectId: cleanString4(alias.providerProjectId),
+      externalSubjectId,
+      status: cleanString4(alias.status)
+    };
+    aliases.set(aliasKey(normalized), normalized);
+  }
+  if (canonicalClerkUserId) {
+    const canonicalAlias = {
+      provider: "clerk",
+      externalSubjectId: canonicalClerkUserId,
+      status: "active"
+    };
+    aliases.set(aliasKey(canonicalAlias), canonicalAlias);
+  }
+  return [...aliases.values()];
+}
+function isKnownClerkSubject(args) {
+  if (args.clerkId === args.canonicalClerkUserId) {
+    return true;
+  }
+  return args.aliases.some(
+    (alias) => alias.provider === "clerk" && alias.externalSubjectId === args.clerkId
+  );
+}
+function authContextToPrincipalInput(input) {
+  const normalized = normalizeCanonicalLucernAuthContext(input);
+  return {
+    principalId: normalized.principalId,
+    principalType: normalized.principalType,
+    canonicalClerkUserId: normalized.clerkId,
+    clerkId: normalized.clerkId,
+    tenantId: normalized.tenantId,
+    workspaceId: normalized.workspaceId,
+    roles: normalized.roles,
+    scopes: normalized.scopes
+  };
+}
+function isAuthContextInput(input) {
+  return "authMode" in input || "permit" in input || "delegationChain" in input;
+}
+function normalizeCanonicalPrincipalIdentity(input, options = {}) {
+  const principalInput = isAuthContextInput(input) ? authContextToPrincipalInput(input) : input;
+  const principalId = requireString2(
+    principalInput.principalId,
+    "principal_missing",
+    "principalId"
+  );
+  const principalType2 = normalizePrincipalType(principalInput.principalType);
+  const observedClerkId = cleanString4(options.observedClerkId);
+  const canonicalClerkUserId = cleanString4(principalInput.canonicalClerkUserId) ?? cleanString4(principalInput.clerkId);
+  if (principalType2 === "human" && !canonicalClerkUserId) {
+    throw new LucernAccessControlError(
+      "clerk_alias_missing",
+      "Human principals require one canonical Clerk user id."
+    );
+  }
+  const aliases = normalizeAliases(
+    principalInput.clerkIdentityAliases,
+    canonicalClerkUserId
+  );
+  if (observedClerkId && !isKnownClerkSubject({
+    clerkId: observedClerkId,
+    canonicalClerkUserId,
+    aliases
+  })) {
+    throw new LucernAccessControlError(
+      "clerk_alias_unrecognized",
+      "Observed Clerk user id does not match the canonical human principal id."
+    );
+  }
+  return {
+    principalId,
+    principalType: principalType2,
+    canonicalClerkUserId,
+    clerkIdentityAliases: aliases,
+    tenantId: cleanString4(principalInput.tenantId),
+    workspaceId: cleanString4(principalInput.workspaceId),
+    roles: cleanStringList2(principalInput.roles),
+    scopes: cleanStringList2(principalInput.scopes)
+  };
+}
+function formatPermitResource(resource) {
+  if (typeof resource === "string") {
+    return requireString2(resource, "policy_denied", "policyResource");
+  }
+  const type = requireString2(resource.type, "policy_denied", "resource.type");
+  const key = requireString2(resource.key, "policy_denied", "resource.key");
+  return key.startsWith(`${type}:`) ? key : `${type}:${key}`;
+}
+function resourceRequiresWorkspace(resource) {
+  if (typeof resource === "string") {
+    return !resource.startsWith("tenant:");
+  }
+  return resource.type !== "tenant";
+}
+function buildPolicyInput(identity, input) {
+  const tenantId = requireString2(
+    input.tenantId ?? identity.tenantId,
+    "tenant_missing",
+    "tenantId"
+  );
+  const workspaceId = cleanString4(input.workspaceId ?? identity.workspaceId);
+  if (resourceRequiresWorkspace(input.resource) && !workspaceId) {
+    throw new LucernAccessControlError(
+      "workspace_missing",
+      "Workspace-scoped Permit checks require workspaceId."
+    );
+  }
+  return {
+    tenantId,
+    workspaceId,
+    principalId: identity.principalId,
+    policySubject: identity.principalId,
+    policyAction: requireString2(input.action, "policy_denied", "policyAction"),
+    policyResource: formatPermitResource(input.resource),
+    metadata: input.context
+  };
+}
+async function resolveConfiguredPrincipalInput(authContext) {
+  if (typeof authContext === "function") {
+    return await authContext();
+  }
+  return authContext;
+}
+function assertPermitAllowed(decision) {
+  if (decision.decision !== "allow") {
+    throw new LucernAccessControlError(
+      decision.decision === "deny" ? "policy_denied" : "policy_unknown",
+      `Permit denied ${decision.policyAction} on ${decision.policyResource}.`,
+      decision
+    );
+  }
+}
+function createAccessControlClient(config = {}) {
+  const identityClient = createIdentityClient(config);
+  async function resolveIdentity(input, observedClerkId) {
+    const identityInput = input ?? await resolveConfiguredPrincipalInput(config.authContext);
+    if (!identityInput) {
+      throw new LucernAccessControlError(
+        "principal_missing",
+        "Lucern SDK access control requires a canonical principal identity."
+      );
+    }
+    return normalizeCanonicalPrincipalIdentity(identityInput, {
+      observedClerkId
+    });
+  }
+  async function checkAccess(input, idempotencyKey) {
+    const identity = await resolveIdentity(input.identity, input.observedClerkId);
+    const policyInput = buildPolicyInput(identity, input);
+    try {
+      const response = await identityClient.evaluatePolicy(
+        policyInput,
+        idempotencyKey
+      );
+      return {
+        identity,
+        policyInput,
+        decision: response.data
+      };
+    } catch (error) {
+      if (error instanceof LucernSdkAuthContextError) {
+        throw error;
+      }
+      throw new LucernAccessControlError(
+        "policy_unavailable",
+        "Permit policy check failed closed before an allow decision was returned."
+      );
+    }
+  }
+  async function requireAccess(input, idempotencyKey) {
+    const result = await checkAccess(input, idempotencyKey);
+    assertPermitAllowed(result.decision);
+    return result;
+  }
+  async function canAccess(input, idempotencyKey) {
+    try {
+      await requireAccess(input, idempotencyKey);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return {
+    normalizePrincipal: normalizeCanonicalPrincipalIdentity,
+    checkAccess,
+    requireAccess,
+    canAccess
+  };
+}
+
+// src/answersClient.ts
+function createAnswersClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    /**
+     * Get the current answer for a question.
+     * @param questionId - The question node identifier.
+     * @returns The answer record for the given question.
+     */
+    async get(questionId) {
+      return gateway.request({
+        path: `/api/platform/v1/questions/${encodeURIComponent(questionId)}/answer`
+      });
+    }
+  };
+}
+
+// src/audiencesClient.ts
+function createAudiencesClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  const listRegistry = async (query5 = {}) => {
+    return gateway.request({
+      path: `/api/platform/v1/audiences/registry${toQueryString({
+        ...query5,
+        effective: typeof query5.effective === "boolean" ? query5.effective ? "true" : "false" : void 0,
+        status: query5.status
+      })}`
+    }).then(
+      (response) => mapGatewayData(
+        response,
+        (data) => createListResult(Array.isArray(data) ? data : [], "registryEntries")
+      )
+    );
+  };
+  const createRegistryEntry = async (input, idempotencyKey) => {
+    return gateway.request({
+      path: "/api/platform/v1/audiences/registry",
+      method: "POST",
+      body: input,
+      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+    });
+  };
+  const updateRegistryEntry = createRegistryEntry;
+  const upsertRegistry = createRegistryEntry;
+  const getRegistry = listRegistry;
+  const listGrants = async (query5 = {}) => {
+    return gateway.request({
+      path: `/api/platform/v1/audiences/grants${toQueryString({
+        ...query5,
+        audienceKey: query5.audienceKey,
+        principalId: query5.principalId,
+        groupId: query5.groupId,
+        status: query5.status
+      })}`
+    }).then(
+      (response) => mapGatewayData(
+        response,
+        (data) => createListResult(Array.isArray(data) ? data : [], "grants")
+      )
+    );
+  };
+  const createGrant = async (input, idempotencyKey) => {
+    return gateway.request({
+      path: "/api/platform/v1/audiences/grants",
+      method: "POST",
+      body: input,
+      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+    });
+  };
+  const getGrants = listGrants;
+  const grant = createGrant;
+  const deleteGrant = async (input, idempotencyKey) => {
+    return gateway.request({
+      path: "/api/platform/v1/audiences/grants/revoke",
+      method: "POST",
+      body: input,
+      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+    });
+  };
+  const revokeGrant = deleteGrant;
+  return {
+    /**
+     * List audience registry entries.
+     */
+    listRegistry,
+    /**
+     * @deprecated Use listRegistry.
+     */
+    getRegistry,
+    /**
+     * Create an audience registry entry.
+     */
+    createRegistryEntry,
+    /**
+     * Update an audience registry entry.
+     */
+    updateRegistryEntry,
+    /**
+     * @deprecated Use createRegistryEntry or updateRegistryEntry.
+     */
+    upsertRegistry,
+    /**
+     * List audience grants.
+     */
+    listGrants,
+    /**
+     * @deprecated Use listGrants.
+     */
+    getGrants,
+    /**
+     * Create an audience grant.
+     */
+    createGrant,
+    /**
+     * @deprecated Use createGrant.
+     */
+    grant,
+    /**
+     * Delete an audience grant by revoking it.
+     */
+    deleteGrant,
+    /**
+     * @deprecated Use deleteGrant.
+     */
+    revokeGrant
+  };
+}
+
+// src/auditClient.ts
+function createAuditClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    /**
+     * List audit events for the current scope.
+     */
+    async listEvents(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/audit/events${toQueryString(
+          normalizeTopicQuery(query5)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "events")
+        )
+      );
+    }
+  };
+}
+
+// src/authDeviceClient.ts
+var DeviceAuthorizationError = class extends Error {
+  error;
+  interval;
+  constructor(args) {
+    super(args.description ?? args.error);
+    this.name = "DeviceAuthorizationError";
+    this.error = args.error;
+    this.interval = args.interval;
+  }
+};
+function authBaseUrl(config) {
+  return config.baseUrl?.replace(/\/+$/, "") ?? "";
+}
+async function readJson(response) {
+  try {
+    const payload = await response.json();
+    return isRecord4(payload) ? payload : {};
+  } catch (error) {
+    return unreadableJsonBodyFallback();
+  }
+}
+function unreadableJsonBodyFallback(_error) {
+  return {};
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readString(value) {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  return normalized || void 0;
+}
+function assertDeviceCodeResponse(payload) {
+  const deviceCode = readString(payload.device_code);
+  const userCode = readString(payload.user_code);
+  const verificationUri = readString(payload.verification_uri);
+  const verificationUriComplete = readString(payload.verification_uri_complete);
+  const expiresIn = payload.expires_in;
+  const interval = payload.interval;
+  if (!deviceCode || !userCode || !verificationUri || !verificationUriComplete || typeof expiresIn !== "number" || typeof interval !== "number") {
+    throw new Error("Gateway returned an invalid device-code response.");
+  }
+  return {
+    device_code: deviceCode,
+    user_code: userCode,
+    verification_uri: verificationUri,
+    verification_uri_complete: verificationUriComplete,
+    expires_in: expiresIn,
+    interval
+  };
+}
+function assertDeviceTokenResponse(payload) {
   const accessToken = readString(payload.access_token);
   const tokenType = readString(payload.token_type);
   const scope = readString(payload.scope);
@@ -1266,7 +2005,7 @@ function assertDeviceTokenResponse(payload) {
     tenant_id: tenantId,
     workspace_id: readString(payload.workspace_id),
     principal_id: principalId,
-    user: isRecord3(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
+    user: isRecord4(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
       id: payload.user.id,
       principalId: payload.user.principalId
     } : void 0
@@ -1605,67 +2344,12 @@ function createEvidenceClient(config = {}) {
           beliefId,
           evidence,
           config: classificationConfig
-        },
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    }
-  };
-}
-
-// src/boundaryClientSurface.ts
-function cleanOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function isRecord4(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function cleanRequiredString(value, label) {
-  const normalized = cleanOptionalString(value);
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
-  return normalized;
-}
-function readTopicId(input) {
-  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
-}
-function requireTopicId(input) {
-  const topicId = readTopicId(input);
-  if (!topicId) {
-    throw new Error("topicId is required");
-  }
-  return topicId;
-}
-function assertKnownKeys(input, allowed, operation) {
-  const allowedSet = new Set(allowed);
-  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
-  if (unknownKeys.length > 0) {
-    throw new Error(
-      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
-    );
-  }
-}
-function knownPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return { ...input };
-}
-function topicPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return {
-    ...input,
-    topicId: requireTopicId(input),
-    projectId: void 0
+        },
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
   };
 }
-function listResultFromEnvelope(data, legacyKey) {
-  const record = isRecord4(data) ? data : {};
-  const legacyItems = record[legacyKey];
-  return createListResult(
-    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
-    legacyKey
-  );
-}
 
 // src/eventingClient.ts
 var EVENTING_FIELDS = [
@@ -2274,419 +2958,151 @@ function createGraphClient(config = {}) {
         },
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
-    },
-    /**
-     * Permanently delete a node via the admin-only hard-delete route.
-     */
-    async hardDeleteNode(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/nodes/hard-delete",
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * List graph edges matching the provided filters.
-     */
-    async listEdges(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/edges${toQueryString(
-          normalizeTopicQuery(query5)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => mapAliasedList(data, "edges")
-        )
-      );
-    },
-    /**
-     * Create a graph edge.
-     */
-    async createEdge(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/edges",
-        method: "POST",
-        body: normalizeTopicQuery(input),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Delete one or more edges matching the provided filter.
-     */
-    async deleteEdge(query5, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/edges${toQueryString(query5)}`,
-        method: "DELETE",
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Retrieve a graph neighborhood around a root node.
-     */
-    async neighborhood(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
-      });
-    },
-    /**
-     * Traverse the graph from a starting node.
-     */
-    async traverse(query5) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/traverse",
-        method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Analyze graph structure for a topic.
-     */
-    async analyze(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/analyze${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Detect confirmation-bias patterns for a topic graph.
-     */
-    async bias(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/bias${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Find graph gaps for beliefs that still need testing.
-     */
-    async gaps(query5) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/gaps${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
-        })}`
-      });
-    },
-    /**
-     * Search across graph resources within a topic.
-     */
-    async search(query5) {
-      return gateway.request({
-        path: "/api/platform/v1/search",
-        method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Retrieve the shortest known path between two graph nodes.
-     */
-    async getPath(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
-      });
-    },
-    /**
-     * Retrieve graph analytics for the requested metric.
-     */
-    async getAnalytics(query5 = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
-      });
-    }
-  };
-  return Object.assign(client, {
-    queryNodes: client.listNodes,
-    queryEdges: client.listEdges,
-    getNeighborhood: client.neighborhood
-  });
-}
-
-// src/identityClient.ts
-function createIdentityWhoamiClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  return {
-    async whoami() {
-      return gateway.request({
-        path: "/api/platform/v1/identity/whoami"
-      });
-    }
-  };
-}
-var TENANT_IDENTITY_FIELDS = [
-  "tenantId",
-  "workspaceId",
-  "principalId",
-  "integrationKey",
-  "secretRef",
-  "policySubject",
-  "policyAction",
-  "policyResource",
-  "decision",
-  "config",
-  "configKey",
-  "configValue",
-  "provider",
-  "status",
-  "metadata",
-  "limit",
-  "cursor"
-];
-function tenantIdentityQuery(input) {
-  return {
-    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
-    workspaceId: input.workspaceId,
-    principalId: input.principalId,
-    limit: input.limit,
-    cursor: input.cursor
-  };
-}
-function tenantIdentityBody(input, operation) {
-  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
-}
-function createIdentityClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const whoamiClient = createIdentityWhoamiClient(config);
-  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
-    path: "/api/platform/v1/identity/principals",
-    method,
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
-  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
-    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
-    method: "POST",
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  return {
-    /**
-     * Resolve the current authenticated identity summary.
-     */
-    async whoami() {
-      return whoamiClient.whoami().then(
-        (response) => mapGatewayData(response, (data) => ({
-          principalId: data.principalId,
-          principalType: data.principalType,
-          tenantId: data.tenantId ?? null,
-          workspaceId: data.workspaceId ?? null,
-          scopes: Array.isArray(data.scopes) ? data.scopes : [],
-          roles: Array.isArray(data.roles) ? data.roles : [],
-          isPlatformAdmin: data.isPlatformAdmin === true,
-          isTenantAdmin: data.isTenantAdmin === true,
-          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
-          authMode: data.authMode,
-          sessionId: data.sessionId,
-          delegatedBy: data.delegatedBy,
-          expiresAt: data.expiresAt
-        }))
-      );
-    },
-    /**
-     * List principals in the current identity scope.
-     */
-    async listPrincipals(query5 = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(
-            Array.isArray(data) ? data : [],
-            "principals"
-          )
-        )
-      );
-    },
-    /**
-     * Create a principal.
-     */
-    async createPrincipal(input, idempotencyKey) {
-      return requestPrincipalWrite("POST", input, idempotencyKey);
-    },
-    /**
-     * Update a principal.
-     */
-    updatePrincipal,
+    },
     /**
-     * @deprecated Use createPrincipal or updatePrincipal.
+     * Permanently delete a node via the admin-only hard-delete route.
      */
-    upsertPrincipal: updatePrincipal,
+    async hardDeleteNode(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/graph/nodes/hard-delete",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
     /**
-     * List keys in the current identity scope.
+     * List graph edges matching the provided filters.
      */
-    async listKeys(query5 = {}) {
+    async listEdges(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
+        path: `/api/platform/v1/graph/edges${toQueryString(
+          normalizeTopicQuery(query5)
+        )}`
       }).then(
         (response) => mapGatewayData(
           response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+          (data) => mapAliasedList(data, "edges")
         )
       );
     },
     /**
-     * Create an API key.
+     * Create a graph edge.
      */
-    async createKey(input, idempotencyKey) {
+    async createEdge(input, idempotencyKey) {
       return gateway.request({
-        path: "/api/platform/v1/identity/keys",
+        path: "/api/platform/v1/graph/edges",
         method: "POST",
-        body: input,
+        body: normalizeTopicQuery(input),
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Rotate an API key.
+     * Delete one or more edges matching the provided filter.
      */
-    async rotateKey(keyId, input = {}, idempotencyKey) {
+    async deleteEdge(query5, idempotencyKey) {
       return gateway.request({
-        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
-        method: "POST",
-        body: input,
+        path: `/api/platform/v1/graph/edges${toQueryString(query5)}`,
+        method: "DELETE",
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
     /**
-     * Delete an API key by revoking it.
-     */
-    deleteKey,
-    /**
-     * @deprecated Use deleteKey.
-     */
-    revokeKey: deleteKey,
-    /**
-     * Search Clerk users by email or display attributes.
+     * Retrieve a graph neighborhood around a root node.
      */
-    async searchClerkUsers(q) {
+    async neighborhood(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
       });
     },
-    async getTenantConfig(input) {
+    /**
+     * Traverse the graph from a starting node.
+     */
+    async traverse(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/tenant-config${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
+        path: "/api/platform/v1/graph/traverse",
+        method: "POST",
+        body: normalizeTopicQuery(query5)
       });
     },
-    async updateTenantConfig(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
+    /**
+     * Analyze graph structure for a topic.
+     */
+    async analyze(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: "/api/platform/v1/identity/tenant-config",
-        method: "PATCH",
-        body: tenantIdentityBody(
-          input,
-          "identity.updateTenantConfig"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/analyze${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
       });
     },
-    async listIntegrations(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/integrations${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "integrations"
-          )
-        )
-      );
-    },
-    async upsertIntegration(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.integrationKey, "integrationKey");
+    /**
+     * Detect confirmation-bias patterns for a topic graph.
+     */
+    async bias(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: "/api/platform/v1/identity/integrations",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.upsertIntegration"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/bias${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
       });
     },
-    async listSecrets(input) {
+    /**
+     * Find graph gaps for beliefs that still need testing.
+     */
+    async gaps(query5) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: `/api/platform/v1/identity/secrets${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "secrets"
-          )
-        )
-      );
+        path: `/api/platform/v1/graph/gaps${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
+        })}`
+      });
     },
-    async putSecretReference(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.secretRef, "secretRef");
+    /**
+     * Search across graph resources within a topic.
+     */
+    async search(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/secrets",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.putSecretReference"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: "/api/platform/v1/search",
+        method: "POST",
+        body: normalizeTopicQuery(query5)
       });
     },
-    async evaluatePolicy(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.policySubject, "policySubject");
-      cleanRequiredString(input.policyAction, "policyAction");
-      cleanRequiredString(input.policyResource, "policyResource");
+    /**
+     * Retrieve the shortest known path between two graph nodes.
+     */
+    async getPath(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/evaluate",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.evaluatePolicy"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
       });
     },
-    async recordPolicyDecision(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.decision, "decision");
+    /**
+     * Retrieve graph analytics for the requested metric.
+     */
+    async getAnalytics(query5 = {}) {
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/decisions",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.recordPolicyDecision"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
       });
     }
   };
+  return Object.assign(client, {
+    queryNodes: client.listNodes,
+    queryEdges: client.listEdges,
+    getNeighborhood: client.neighborhood
+  });
 }
 
 // src/topicsClient.ts
-function cleanString3(value) {
+function cleanString5(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeTopicRecord(value) {
   const record = asRecord(value);
-  const topicId = cleanString3(record.topicId) ?? cleanString3(record.id) ?? cleanString3(record._id);
+  const topicId = cleanString5(record.topicId) ?? cleanString5(record.id) ?? cleanString5(record._id);
   return withTopicAlias({
     ...record,
     ...topicId ? { topicId } : {}
@@ -3405,6 +3821,8 @@ function createTasksFacade(config = {}) {
           description: input.description,
           priority: input.priority,
           status: input.status,
+          assigneeId: input.assigneeId,
+          blockedReason: input.blockedReason,
           linkedBeliefId: input.linkedBeliefId,
           linkedQuestionId: input.linkedQuestionId,
           linkedWorktreeId: input.linkedWorktreeId,
@@ -3899,7 +4317,7 @@ function createEmbeddingsClient(config = {}) {
 }
 
 // src/contextClient.ts
-function cleanString4(value) {
+function cleanString6(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function cleanNumber(value) {
@@ -3911,11 +4329,11 @@ function cleanBoolean(value) {
 function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   const effectiveInput = typeof topicIdOrInput === "string" ? input : topicIdOrInput;
   const payload = {};
-  const topicId = typeof topicIdOrInput === "string" ? cleanString4(topicIdOrInput) : cleanString4(effectiveInput.topicId);
+  const topicId = typeof topicIdOrInput === "string" ? cleanString6(topicIdOrInput) : cleanString6(effectiveInput.topicId);
   if (topicId) {
     payload.topicId = topicId;
   }
-  const query5 = cleanString4(effectiveInput.query);
+  const query5 = cleanString6(effectiveInput.query);
   if (query5) {
     payload.query = query5;
   }
@@ -3923,7 +4341,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (budget !== void 0) {
     payload.budget = budget;
   }
-  const ranking = cleanString4(effectiveInput.ranking) ?? cleanString4(effectiveInput.rankingProfile);
+  const ranking = cleanString6(effectiveInput.ranking) ?? cleanString6(effectiveInput.rankingProfile);
   if (ranking) {
     payload.ranking = ranking;
   }
@@ -3939,7 +4357,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeEntities !== void 0) {
     payload.includeEntities = includeEntities;
   }
-  const mode = cleanString4(effectiveInput.mode);
+  const mode = cleanString6(effectiveInput.mode);
   if (mode) {
     payload.mode = mode;
   }
@@ -3947,11 +4365,11 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeFailures !== void 0) {
     payload.includeFailures = includeFailures;
   }
-  const worktreeId = cleanString4(effectiveInput.worktreeId);
+  const worktreeId = cleanString6(effectiveInput.worktreeId);
   if (worktreeId) {
     payload.worktreeId = worktreeId;
   }
-  const sessionId = cleanString4(effectiveInput.sessionId);
+  const sessionId = cleanString6(effectiveInput.sessionId);
   if (sessionId) {
     payload.sessionId = sessionId;
   }
@@ -4837,7 +5255,8 @@ function createMcpClient(config = {}) {
         transportKind: input.transportKind,
         sessionId: input.sessionId,
         agentIdentity: input.agentIdentity,
-        workspaceId: input.workspaceId
+        workspaceId: input.workspaceId,
+        worktreeId: input.worktreeId
       };
       return gateway.request({
         path: `${MCP_GATEWAY_BOOTSTRAP_ENDPOINT}${toQueryString(scope)}`,
@@ -4928,8 +5347,11 @@ var CONTRACTS = {
   "apply_lens_to_topic": { method: "POST", path: "/lenses/apply", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "apply_ontology": { method: "POST", path: "/ontologies/apply", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "archive_belief": { method: "DELETE", path: "/beliefs", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
+  "archive_epistemic_node": { method: "POST", path: "/nodes/archive", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "archive_ontology": { method: "DELETE", path: "/ontologies", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "archive_question": { method: "DELETE", path: "/questions", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
+  "batch_create_edges": { method: "POST", path: "/edges/batch", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "batch_create_epistemic_nodes": { method: "POST", path: "/nodes/batch", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "begin_build_session": { method: "POST", path: "/mcp/build-session/begin", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "bisect_confidence": { method: "POST", path: "/beliefs/confidence/bisect", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "broadcast_message": { method: "POST", path: "/coordination/messages/broadcast", kind: "mutation", idempotent: true, surfaceIntent: "system" },
@@ -4941,6 +5363,7 @@ var CONTRACTS = {
   "create_belief": { method: "POST", path: "/beliefs", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "create_edge": { method: "POST", path: "/edges", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
   "create_epistemic_contract": { method: "POST", path: "/contracts", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
+  "create_epistemic_node": { method: "POST", path: "/nodes", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "create_evidence": { method: "POST", path: "/evidence", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "create_lens": { method: "POST", path: "/lenses", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "create_ontology": { method: "POST", path: "/ontologies", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
@@ -4968,6 +5391,7 @@ var CONTRACTS = {
   "get_code_context": { method: "POST", path: "/coding/context", kind: "query", idempotent: false, surfaceIntent: "system" },
   "get_confidence_history": { method: "POST", path: "/beliefs/confidence-history", kind: "query", idempotent: false, surfaceIntent: "compatibility" },
   "get_contract_status": { method: "POST", path: "/contracts/status", kind: "query", idempotent: false, surfaceIntent: "mcp_governance" },
+  "get_epistemic_node": { method: "GET", path: "/nodes/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_evidence": { method: "GET", path: "/evidence/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_failure_log": { method: "POST", path: "/coding/failure-log", kind: "query", idempotent: false, surfaceIntent: "system" },
   "get_falsification_questions": { method: "POST", path: "/questions/falsification", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
@@ -4981,6 +5405,7 @@ var CONTRACTS = {
   "get_question": { method: "GET", path: "/questions/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_topic": { method: "GET", path: "/topics/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_topic_coverage": { method: "POST", path: "/graph/topic-coverage", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
+  "get_topic_graph_spine": { method: "GET", path: "/topics/graph-spine", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_topic_tree": { method: "GET", path: "/topics/tree", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "heartbeat_session": { method: "POST", path: "/coordination/heartbeat-session", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "identity_whoami": { method: "GET", path: "/identity/whoami", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
@@ -4992,6 +5417,7 @@ var CONTRACTS = {
   "list_all_worktrees": { method: "GET", path: "/worktrees/all", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
   "list_beliefs": { method: "GET", path: "/beliefs", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "list_campaigns": { method: "GET", path: "/worktrees/campaigns", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
+  "list_epistemic_nodes": { method: "GET", path: "/nodes", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "list_evidence": { method: "GET", path: "/evidence", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "list_graph_intelligence_queries": { method: "POST", path: "/graph-intelligence/queries", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "list_lenses": { method: "GET", path: "/lenses", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
@@ -5002,6 +5428,7 @@ var CONTRACTS = {
   "list_worktrees": { method: "GET", path: "/worktrees", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
   "manage_write_policy": { method: "POST", path: "/policy/write-policy/manage", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "match_entity_type": { method: "POST", path: "/ontologies/match-entity-type", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
+  "materialize_topic_graph": { method: "POST", path: "/topics/materialize-graph", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "merge": { method: "POST", path: "/worktrees/merge", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "modulate_confidence": { method: "POST", path: "/beliefs/confidence", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "open_pull_request": { method: "POST", path: "/worktrees/open-pull-request", kind: "mutation", idempotent: true, surfaceIntent: "system" },
@@ -5015,22 +5442,29 @@ var CONTRACTS = {
   "refine_belief": { method: "PATCH", path: "/beliefs/refine", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "refine_question": { method: "PATCH", path: "/questions/refine", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "register_session": { method: "POST", path: "/coordination/register-session", kind: "mutation", idempotent: true, surfaceIntent: "system" },
+  "remove_edge": { method: "DELETE", path: "/edges", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "remove_edges_between": { method: "DELETE", path: "/edges/between", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
   "remove_lens_from_topic": { method: "DELETE", path: "/lenses/apply", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "resolve_effective_ontology": { method: "POST", path: "/ontologies/effective", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
+  "resolve_interactive_principal": { method: "POST", path: "/control-plane/identity/resolve-interactive-principal", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "run_graph_intelligence_query": { method: "POST", path: "/graph-intelligence/run", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "search_beliefs": { method: "POST", path: "/beliefs/search", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "search_evidence": { method: "POST", path: "/evidence/search", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "seed_belief_lattice": { method: "POST", path: "/scope/belief-lattice/seed", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "send_agent_message": { method: "POST", path: "/coordination/messages/send", kind: "mutation", idempotent: true, surfaceIntent: "system" },
+  "supersede_epistemic_node": { method: "POST", path: "/nodes/supersede", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "trace_entity_impact": { method: "POST", path: "/graph/trace-entity-impact", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "traverse_graph": { method: "POST", path: "/graph/traverse", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "trigger_belief_review": { method: "POST", path: "/context/belief-review", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "update_edge": { method: "PATCH", path: "/edges", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "update_epistemic_node": { method: "PATCH", path: "/nodes", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "update_ontology": { method: "PATCH", path: "/ontologies", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "update_question_status": { method: "PATCH", path: "/questions/status", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "update_task": { method: "PATCH", path: "/tasks", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "update_topic": { method: "PATCH", path: "/topics", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "update_worktree_metadata": { method: "PATCH", path: "/worktrees/metadata", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
-  "update_worktree_targets": { method: "PATCH", path: "/worktrees/targets", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" }
+  "update_worktree_targets": { method: "PATCH", path: "/worktrees/targets", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
+  "verify_epistemic_node": { method: "POST", path: "/nodes/verify", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" }
 };
 function createSessionId() {
   return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : randomIdempotencyKey();
@@ -5098,12 +5532,21 @@ function createFunctionSurfaceClient(config = {}) {
     archiveBelief(input = {}, idempotencyKey) {
       return execute("archive_belief", input, idempotencyKey);
     },
+    archiveEpistemicNode(input = {}, idempotencyKey) {
+      return execute("archive_epistemic_node", input, idempotencyKey);
+    },
     archiveOntology(input = {}, idempotencyKey) {
       return execute("archive_ontology", input, idempotencyKey);
     },
     archiveQuestion(input = {}, idempotencyKey) {
       return execute("archive_question", input, idempotencyKey);
     },
+    batchCreateEdges(input = {}, idempotencyKey) {
+      return execute("batch_create_edges", input, idempotencyKey);
+    },
+    batchCreateEpistemicNodes(input = {}, idempotencyKey) {
+      return execute("batch_create_epistemic_nodes", input, idempotencyKey);
+    },
     beginBuildSession(input = {}, idempotencyKey) {
       return execute("begin_build_session", input, idempotencyKey);
     },
@@ -5137,6 +5580,9 @@ function createFunctionSurfaceClient(config = {}) {
     createEpistemicContract(input = {}, idempotencyKey) {
       return execute("create_epistemic_contract", input, idempotencyKey);
     },
+    createEpistemicNode(input = {}, idempotencyKey) {
+      return execute("create_epistemic_node", input, idempotencyKey);
+    },
     createEvidence(input = {}, idempotencyKey) {
       return execute("create_evidence", input, idempotencyKey);
     },
@@ -5218,6 +5664,9 @@ function createFunctionSurfaceClient(config = {}) {
     getContractStatus(input = {}, idempotencyKey) {
       return execute("get_contract_status", input, idempotencyKey);
     },
+    getEpistemicNode(input = {}, idempotencyKey) {
+      return execute("get_epistemic_node", input, idempotencyKey);
+    },
     getEvidence(input = {}, idempotencyKey) {
       return execute("get_evidence", input, idempotencyKey);
     },
@@ -5257,6 +5706,9 @@ function createFunctionSurfaceClient(config = {}) {
     getTopicCoverage(input = {}, idempotencyKey) {
       return execute("get_topic_coverage", input, idempotencyKey);
     },
+    getTopicGraphSpine(input = {}, idempotencyKey) {
+      return execute("get_topic_graph_spine", input, idempotencyKey);
+    },
     getTopicTree(input = {}, idempotencyKey) {
       return execute("get_topic_tree", input, idempotencyKey);
     },
@@ -5290,6 +5742,9 @@ function createFunctionSurfaceClient(config = {}) {
     listCampaigns(input = {}, idempotencyKey) {
       return execute("list_campaigns", input, idempotencyKey);
     },
+    listEpistemicNodes(input = {}, idempotencyKey) {
+      return execute("list_epistemic_nodes", input, idempotencyKey);
+    },
     listEvidence(input = {}, idempotencyKey) {
       return execute("list_evidence", input, idempotencyKey);
     },
@@ -5320,6 +5775,9 @@ function createFunctionSurfaceClient(config = {}) {
     matchEntityType(input = {}, idempotencyKey) {
       return execute("match_entity_type", input, idempotencyKey);
     },
+    materializeTopicGraph(input = {}, idempotencyKey) {
+      return execute("materialize_topic_graph", input, idempotencyKey);
+    },
     merge(input = {}, idempotencyKey) {
       return execute("merge", input, idempotencyKey);
     },
@@ -5359,12 +5817,21 @@ function createFunctionSurfaceClient(config = {}) {
     registerSession(input = {}, idempotencyKey) {
       return execute("register_session", input, idempotencyKey);
     },
+    removeEdge(input = {}, idempotencyKey) {
+      return execute("remove_edge", input, idempotencyKey);
+    },
+    removeEdgesBetween(input = {}, idempotencyKey) {
+      return execute("remove_edges_between", input, idempotencyKey);
+    },
     removeLensFromTopic(input = {}, idempotencyKey) {
       return execute("remove_lens_from_topic", input, idempotencyKey);
     },
     resolveEffectiveOntology(input = {}, idempotencyKey) {
       return execute("resolve_effective_ontology", input, idempotencyKey);
     },
+    resolveInteractivePrincipal(input = {}, idempotencyKey) {
+      return execute("resolve_interactive_principal", input, idempotencyKey);
+    },
     runGraphIntelligenceQuery(input = {}, idempotencyKey) {
       return execute("run_graph_intelligence_query", input, idempotencyKey);
     },
@@ -5380,6 +5847,9 @@ function createFunctionSurfaceClient(config = {}) {
     sendAgentMessage(input = {}, idempotencyKey) {
       return execute("send_agent_message", input, idempotencyKey);
     },
+    supersedeEpistemicNode(input = {}, idempotencyKey) {
+      return execute("supersede_epistemic_node", input, idempotencyKey);
+    },
     traceEntityImpact(input = {}, idempotencyKey) {
       return execute("trace_entity_impact", input, idempotencyKey);
     },
@@ -5389,6 +5859,12 @@ function createFunctionSurfaceClient(config = {}) {
     triggerBeliefReview(input = {}, idempotencyKey) {
       return execute("trigger_belief_review", input, idempotencyKey);
     },
+    updateEdge(input = {}, idempotencyKey) {
+      return execute("update_edge", input, idempotencyKey);
+    },
+    updateEpistemicNode(input = {}, idempotencyKey) {
+      return execute("update_epistemic_node", input, idempotencyKey);
+    },
     updateOntology(input = {}, idempotencyKey) {
       return execute("update_ontology", input, idempotencyKey);
     },
@@ -5406,6 +5882,9 @@ function createFunctionSurfaceClient(config = {}) {
     },
     updateWorktreeTargets(input = {}, idempotencyKey) {
       return execute("update_worktree_targets", input, idempotencyKey);
+    },
+    verifyEpistemicNode(input = {}, idempotencyKey) {
+      return execute("verify_epistemic_node", input, idempotencyKey);
     }
   };
 }
@@ -5613,7 +6092,7 @@ var ORG_GRAPH_SEARCH_FIELDS = [
   "cursor",
   "provenanceScope"
 ];
-function cleanString5(value, label) {
+function cleanString7(value, label) {
   const normalized = value?.trim();
   if (!normalized) {
     throw new Error(`${label} is required`);
@@ -5635,9 +6114,9 @@ function searchBody(input) {
     "orgGraphSearch.search"
   );
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
-    query: cleanString5(input.query, "query"),
+    tenantId: cleanString7(input.tenantId, "tenantId"),
+    workspaceId: cleanString7(input.workspaceId, "workspaceId"),
+    query: cleanString7(input.query, "query"),
     nodeTypes: input.nodeTypes,
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -5647,8 +6126,8 @@ function searchBody(input) {
 }
 function listQuery2(input) {
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+    tenantId: cleanString7(input.tenantId, "tenantId"),
+    workspaceId: cleanString7(input.workspaceId, "workspaceId"),
     nodeTypes: input.nodeTypes?.join(","),
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -5682,8 +6161,8 @@ function createOrgGraphSearchClient(config = {}) {
       return gateway.request({
         path: `/api/platform/v1/org-graph-search/nodes/${nodePath}${toQueryString(
           {
-            tenantId: cleanString5(input.tenantId, "tenantId"),
-            workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+            tenantId: cleanString7(input.tenantId, "tenantId"),
+            workspaceId: cleanString7(input.workspaceId, "workspaceId"),
             globalId: nodeId ? void 0 : globalId
           }
         )}`
@@ -6256,6 +6735,21 @@ function createSchemaClient(config = {}) {
 }
 
 // src/clientHelpers.ts
+function normalizeCustomNamespace(namespace) {
+  return namespace.trim() || "custom";
+}
+function normalizeCustomToolPayload(input) {
+  return input && typeof input === "object" && !Array.isArray(input) ? input : {};
+}
+function resolveCustomToolFullName(name) {
+  return name.includes(".") ? name : `custom.${name}`;
+}
+function buildBeliefsRefinePayload(textOrInput, rationale) {
+  return typeof textOrInput === "string" ? { text: textOrInput, rationale } : { text: textOrInput.text, rationale: textOrInput.rationale };
+}
+function buildBeliefsArchivePayload(input) {
+  return typeof input === "string" ? { reason: input } : input ? { reason: input.reason ?? input.rationale } : void 0;
+}
 function asNodeArray(data) {
   const rows = asListItems(data, "nodes");
   if (rows.length > 0) {
@@ -6633,7 +7127,7 @@ function createToolRegistryClient(config = {}) {
 }
 
 // src/version.ts
-var LUCERN_SDK_VERSION = "0.3.0-alpha.8";
+var LUCERN_SDK_VERSION = "1.0.0";
 
 // src/workflowClient.ts
 function normalizeLensQuery(value) {
@@ -7041,6 +7535,12 @@ function toGatewayConfig(config) {
   return {
     baseUrl: config.baseUrl,
     fetchImpl: config.fetchImpl,
+    apiKey: config.apiKey,
+    userToken: config.userToken,
+    environment: config.environment,
+    clerkId: config.clerkId,
+    userId: config.userId,
+    deploymentHost: config.deploymentHost,
     maxRetries: config.maxRetries,
     timeoutMs: config.timeoutMs,
     timeoutMsByMethod: config.timeoutMsByMethod,
@@ -7049,23 +7549,15 @@ function toGatewayConfig(config) {
     onResponse: config.onResponse,
     authContext: config.authContext,
     requireCanonicalAuthContext: config.requireCanonicalAuthContext,
-    getAuthHeaders: async () => {
-      const base = config.getAuthHeaders ? await config.getAuthHeaders() : {};
-      if (config.apiKey && !base["x-lucern-key"] && !base.Authorization) {
-        base["x-lucern-key"] = config.apiKey;
-      }
-      if (config.userToken && !base["x-lucern-session-token"]) {
-        base["x-lucern-session-token"] = config.userToken;
-      }
-      if (config.environment && !base["x-lucern-environment"]) {
-        base["x-lucern-environment"] = config.environment;
-      }
-      return base;
-    }
+    getAuthHeaders: config.getAuthHeaders
   };
 }
 function exposeGatewayData(response) {
-  return Object.assign({}, response, response.data);
+  const data = response.data;
+  if (data !== null && typeof data === "object" && !Array.isArray(data)) {
+    return Object.assign({}, response, data);
+  }
+  return { ...response };
 }
 function createLucernClient(config = {}) {
   const gatewayConfig = toGatewayConfig(config);
@@ -7086,6 +7578,7 @@ function createLucernClient(config = {}) {
   const auditClient = createAuditClient(gatewayConfig);
   const authDeviceClient = createAuthDeviceClient(gatewayConfig);
   const adminClient = createAdminClient(gatewayConfig);
+  const accessControlClient = createAccessControlClient(gatewayConfig);
   const answersClient = createAnswersClient(gatewayConfig);
   const contradictionsFacade = createContradictionsFacade(gatewayConfig);
   const edgesFacade = createEdgesFacade(gatewayConfig);
@@ -7105,6 +7598,7 @@ function createLucernClient(config = {}) {
   const ontologyLinksClient = createOntologyLinksClient(gatewayConfig);
   const orgGraphSearchClient = createOrgGraphSearchClient(gatewayConfig);
   const functionSurfaceClient = createFunctionSurfaceClient(gatewayConfig);
+  const controlPlaneClient = createControlPlaneClient(gatewayConfig);
   const toolRegistryClient = createToolRegistryClient(gatewayConfig);
   const modelRuntimeClient = createModelRuntimeClient(gatewayConfig);
   const packsClient = createPacksClient(gatewayConfig);
@@ -7154,11 +7648,11 @@ function createLucernClient(config = {}) {
     }
   }
   const invokeCustomTool = async (fullName, input = {}) => {
-    const payload = input && typeof input === "object" && !Array.isArray(input) ? input : {};
+    const payload = normalizeCustomToolPayload(input);
     return invokeRegisteredCustomTool(fullName, payload, { source: "sdk" });
   };
   const getCustomNamespace = (namespace) => {
-    const normalized = namespace.trim() || "custom";
+    const normalized = normalizeCustomNamespace(namespace);
     const cached = customNamespaceCache.get(normalized);
     if (cached) {
       return cached;
@@ -7476,9 +7970,24 @@ function createLucernClient(config = {}) {
         typeof input === "string" ? { nodeId: input } : input
       );
     },
-    create: graphClient.createNode,
-    update: graphClient.updateNode,
-    batchCreate: graphClient.batchCreateNodes,
+    create(input, idempotencyKey) {
+      return functionSurfaceClient.createEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    createEpistemicNode(input, idempotencyKey) {
+      return functionSurfaceClient.createEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    update(input, idempotencyKey) {
+      return functionSurfaceClient.updateEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    updateEpistemicNode(input, idempotencyKey) {
+      return functionSurfaceClient.updateEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    batchCreate(input, idempotencyKey) {
+      return functionSurfaceClient.batchCreateEpistemicNodes(input, idempotencyKey).then(exposeGatewayData);
+    },
+    batchCreateEpistemicNodes(input, idempotencyKey) {
+      return functionSurfaceClient.batchCreateEpistemicNodes(input, idempotencyKey).then(exposeGatewayData);
+    },
     listByTopicAndType(input) {
       return gateway.request({
         path: `/api/platform/v1/nodes${sdkQueryString({
@@ -7503,8 +8012,15 @@ function createLucernClient(config = {}) {
         })}`
       }).then(exposeGatewayData);
     },
-    supersede: graphClient.supersedeNode,
-    verify: graphClient.verifyNode,
+    supersede(input, idempotencyKey) {
+      return functionSurfaceClient.supersedeEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    verify(input, idempotencyKey) {
+      return functionSurfaceClient.verifyEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    archive(input, idempotencyKey) {
+      return functionSurfaceClient.archiveEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
     hardDelete: graphClient.hardDeleteNode
   };
   const publicationNamespace = {
@@ -7618,10 +8134,7 @@ function createLucernClient(config = {}) {
         return beliefsFacade.get(nodeId).then(exposeGatewayData);
       },
       refine(nodeId, textOrInput, rationale) {
-        const payload = typeof textOrInput === "string" ? { text: textOrInput, rationale } : {
-          text: textOrInput.text,
-          rationale: textOrInput.rationale
-        };
+        const payload = buildBeliefsRefinePayload(textOrInput, rationale);
         return beliefsFacade.refine(nodeId, payload).then(exposeGatewayData);
       },
       updateConfidence(nodeId, input) {
@@ -7659,7 +8172,7 @@ function createLucernClient(config = {}) {
         }).then(exposeGatewayData);
       },
       archive(nodeId, input) {
-        const payload = typeof input === "string" ? { reason: input } : input ? { reason: input.reason ?? input.rationale } : void 0;
+        const payload = buildBeliefsArchivePayload(input);
         return beliefsFacade.archive(nodeId, payload).then(exposeGatewayData);
       },
       list(args) {
@@ -7714,7 +8227,13 @@ function createLucernClient(config = {}) {
       }
     },
     edges: {
-      create(args) {
+      create(args, idempotencyKey) {
+        if (args.from && args.to) {
+          return functionSurfaceClient.createEdge(args, idempotencyKey).then(exposeGatewayData);
+        }
+        if (!args.sourceId || !args.targetId) {
+          throw new Error("from/to graph refs or sourceId/targetId are required");
+        }
         return edgesFacade.create({
           sourceId: args.sourceId,
           targetId: args.targetId,
@@ -7725,17 +8244,32 @@ function createLucernClient(config = {}) {
           context: args.context ?? args.reasoning
         }).then(exposeGatewayData);
       },
+      createEdge(input, idempotencyKey) {
+        return functionSurfaceClient.createEdge(input, idempotencyKey).then(exposeGatewayData);
+      },
       update(input, idempotencyKey) {
-        return edgesFacade.update(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.updateEdge(input, idempotencyKey).then(exposeGatewayData);
+      },
+      updateEdge(input, idempotencyKey) {
+        return functionSurfaceClient.updateEdge(input, idempotencyKey).then(exposeGatewayData);
       },
       remove(input, idempotencyKey) {
-        return edgesFacade.remove(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.removeEdge(input, idempotencyKey).then(exposeGatewayData);
+      },
+      removeEdge(input, idempotencyKey) {
+        return functionSurfaceClient.removeEdge(input, idempotencyKey).then(exposeGatewayData);
       },
       removeBetween(input, idempotencyKey) {
-        return edgesFacade.removeBetween(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.removeEdgesBetween(input, idempotencyKey).then(exposeGatewayData);
+      },
+      removeEdgesBetween(input, idempotencyKey) {
+        return functionSurfaceClient.removeEdgesBetween(input, idempotencyKey).then(exposeGatewayData);
       },
       batchCreate(input, idempotencyKey) {
-        return edgesFacade.batchCreate(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.batchCreateEdges(input, idempotencyKey).then(exposeGatewayData);
+      },
+      batchCreateEdges(input, idempotencyKey) {
+        return functionSurfaceClient.batchCreateEdges(input, idempotencyKey).then(exposeGatewayData);
       },
       delete(input, idempotencyKey) {
         return edgesFacade.delete(input, idempotencyKey).then(exposeGatewayData);
@@ -8447,17 +8981,7 @@ function createLucernClient(config = {}) {
       },
       get: topicsFacade.get,
       create(input) {
-        return topicsFacade.create({
-          name: input.name,
-          description: input.description,
-          type: input.type,
-          parentTopicId: input.parentTopicId,
-          ontologyId: input.ontologyId,
-          tenantId: input.tenantId,
-          workspaceId: input.workspaceId,
-          visibility: input.visibility,
-          createdBy: input.createdBy
-        });
+        return functionSurfaceClient.createTopic(input).then(exposeGatewayData);
       },
       update(topicId, input) {
         return topicsFacade.update({
@@ -8491,7 +9015,19 @@ function createLucernClient(config = {}) {
         });
       },
       remove: topicsFacade.remove,
-      bulkCreate: topicsFacade.bulkCreate
+      bulkCreate: topicsFacade.bulkCreate,
+      materializeGraph(input = {}, idempotencyKey) {
+        return functionSurfaceClient.materializeTopicGraph(input, idempotencyKey).then(exposeGatewayData);
+      },
+      materializeTopicGraph(input = {}, idempotencyKey) {
+        return functionSurfaceClient.materializeTopicGraph(input, idempotencyKey).then(exposeGatewayData);
+      },
+      graphSpine(input = {}) {
+        return functionSurfaceClient.getTopicGraphSpine(input).then(exposeGatewayData);
+      },
+      getTopicGraphSpine(input = {}) {
+        return functionSurfaceClient.getTopicGraphSpine(input).then(exposeGatewayData);
+      }
     },
     answers: {
       create(input) {
@@ -8699,7 +9235,7 @@ function createLucernClient(config = {}) {
       list: listRegisteredCustomTools,
       clear: clearRegisteredCustomTools,
       invoke(name, input = {}) {
-        const fullName = name.includes(".") ? name : `custom.${name}`;
+        const fullName = resolveCustomToolFullName(name);
         return invokeCustomTool(fullName, input);
       },
       namespace: getCustomNamespace
@@ -8726,8 +9262,16 @@ function createLucernClient(config = {}) {
       disable: packsClient.disable
     },
     nodes: nodesNamespace,
+    controlPlane: {
+      identity: {
+        resolveInteractivePrincipal: controlPlaneClient.identity.resolveInteractivePrincipal
+      },
+      raw: controlPlaneClient
+    },
     identity: {
       ...identityFacade,
+      access: accessControlClient,
+      resolveInteractivePrincipal: identityClient.resolveInteractivePrincipal,
       evaluatePolicy: identityClient.evaluatePolicy,
       recordPolicyDecision: identityClient.recordPolicyDecision,
       putSecretReference: identityClient.putSecretReference,
@@ -8772,6 +9316,7 @@ function createLucernClient(config = {}) {
       ontologyLinks: ontologyLinksClient,
       orgGraphSearch: orgGraphSearchClient,
       functionSurface: functionSurfaceClient,
+      controlPlane: controlPlaneClient,
       toolRegistry: toolRegistryClient,
       modelRuntime: modelRuntimeClient,
       packs: packsClient,