@lucern/sdk 0.3.0-alpha.9 → 1.0.0

package/dist/index.js

@@ -5,7 +5,9 @@ import { LUCERN_OPERATION_MANIFEST } from '@lucern/contracts/function-registry/m
 import * as graphIntel_star from '@lucern/reasoning-kernel/graphIntel';
 import { listGraphIntelligenceQueries, isGraphIntelligenceQueryMode, getGraphIntelligenceQuery, fillGraphIntelligencePromptTemplate, GRAPH_INTELLIGENCE_QUICK_QUERIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_MODE_TOOL_NAMES } from '@lucern/contracts/graph-intelligence.contract';
 export { GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUICK_QUERIES, fillGraphIntelligencePromptTemplate, getGraphIntelligenceQuery, isGraphIntelligenceQueryMode, listGraphIntelligenceQueries } from '@lucern/contracts/graph-intelligence.contract';
-import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath } from '@lucern/contracts';
+import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath, GENERATED_INFISICAL_RUNTIME_ENV } from '@lucern/contracts';
+import { resolveInfisicalSecretFromBinding, requestBrokeredInfisicalSecret, SecretResolverError } from '@lucern/secrets';
+export { SecretResolverError, requestBrokeredInfisicalSecret, resolveInfisicalSecretFromBinding } from '@lucern/secrets';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -77,7 +79,9 @@ __export(src_exports, {
   LENS_STATUSES: () => LENS_STATUSES,
   LENS_TASK_TEMPLATE_PRIORITIES: () => LENS_TASK_TEMPLATE_PRIORITIES,
   LUCERN_SDK_VERSION: () => LUCERN_SDK_VERSION,
+  LucernAccessControlError: () => LucernAccessControlError,
   LucernApiError: () => LucernApiError,
+  LucernControlPlaneIdentityError: () => LucernControlPlaneIdentityError,
   LucernSdkAuthContextError: () => LucernSdkAuthContextError,
   MAX_ENTITY_LIMIT: () => MAX_ENTITY_LIMIT,
   MCP_ALWAYS_ALLOWED_TOOL_NAMES: () => MCP_ALWAYS_ALLOWED_TOOL_NAMES,
@@ -92,6 +96,7 @@ __export(src_exports, {
   SESSION_LIFECYCLE_STATUSES: () => SESSION_LIFECYCLE_STATUSES,
   SESSION_PRINCIPAL_TYPES: () => SESSION_PRINCIPAL_TYPES,
   STRUCTURAL_EDGE_TYPES: () => STRUCTURAL_EDGE_TYPES,
+  SecretResolverError: () => SecretResolverError,
   TELEMETRY_FIELDS: () => TELEMETRY_FIELDS,
   TENANT_IDENTITY_FIELDS: () => TENANT_IDENTITY_FIELDS,
   TOOL_REGISTRY_FIELDS: () => TOOL_REGISTRY_FIELDS,
@@ -113,6 +118,7 @@ __export(src_exports, {
   applyInfisicalRuntimeEnv: () => applyInfisicalRuntimeEnv,
   asListItems: () => asListItems,
   asRecord: () => asRecord,
+  assertPermitAllowed: () => assertPermitAllowed,
   assertValidWebhookSecret: () => assertValidWebhookSecret,
   assertValidWebhookUrl: () => assertValidWebhookUrl,
   buildDeprecatedBranchMetadata: () => buildDeprecatedBranchMetadata,
@@ -123,6 +129,7 @@ __export(src_exports, {
   compareEventCursor: () => compareEventCursor,
   compileContextPackFromSnapshot: () => compileContextPackFromSnapshot,
   computeWebhookSignature: () => computeWebhookSignature,
+  createAccessControlClient: () => createAccessControlClient,
   createAdminClient: () => createAdminClient,
   createAnswersClient: () => createAnswersClient,
   createAudiencesClient: () => createAudiencesClient,
@@ -132,6 +139,8 @@ __export(src_exports, {
   createCanonicalAuthHeaders: () => createCanonicalAuthHeaders,
   createContextClient: () => createContextClient,
   createContextFacade: () => createContextFacade,
+  createControlPlaneClient: () => createControlPlaneClient,
+  createControlPlaneIdentityClient: () => createControlPlaneIdentityClient,
   createDecisionsClient: () => createDecisionsClient,
   createEmbeddingsClient: () => createEmbeddingsClient,
   createEventId: () => createEventId,
@@ -169,6 +178,7 @@ __export(src_exports, {
   encodeEventCursor: () => encodeEventCursor,
   eventPatternToRegExp: () => eventPatternToRegExp,
   fillGraphIntelligencePromptTemplate: () => fillGraphIntelligencePromptTemplate,
+  formatPermitResource: () => formatPermitResource,
   getControlObjectOwnershipCase: () => getControlObjectOwnershipCase,
   getGraphIntelligenceQuery: () => getGraphIntelligenceQuery,
   getMcpToolExposure: () => getMcpToolExposure,
@@ -200,9 +210,11 @@ __export(src_exports, {
   migrateBranchToLens: () => migrateBranchToLens,
   nextDeliveryAttemptAt: () => nextDeliveryAttemptAt,
   normalizeCanonicalLucernAuthContext: () => normalizeCanonicalLucernAuthContext,
+  normalizeCanonicalPrincipalIdentity: () => normalizeCanonicalPrincipalIdentity,
   normalizeDelegationChain: () => normalizeDelegationChain,
   normalizeNodeVerificationStatus: () => normalizeNodeVerificationStatus,
   normalizeNodeWriteInput: () => normalizeNodeWriteInput,
+  normalizeResolvedInteractivePrincipal: () => normalizeResolvedInteractivePrincipal,
   normalizeRetentionDays: () => normalizeRetentionDays,
   normalizeTopicQuery: () => normalizeTopicQuery,
   normalizeWebhookPatterns: () => normalizeWebhookPatterns,
@@ -213,7 +225,9 @@ __export(src_exports, {
   randomIdempotencyKey: () => randomIdempotencyKey,
   readInfisicalRuntimeBootstrap: () => readInfisicalRuntimeBootstrap,
   registerCustomTool: () => registerCustomTool,
+  requestBrokeredInfisicalSecret: () => requestBrokeredInfisicalSecret,
   resolveDeliveryFailureStatus: () => resolveDeliveryFailureStatus,
+  resolveInfisicalSecretFromBinding: () => resolveInfisicalSecretFromBinding,
   resolveText: () => resolveText,
   resolveTopicId: () => resolveTopicId,
   sanitizeWebhookRecord: () => sanitizeWebhookRecord,
@@ -290,14 +304,14 @@ function requireString(value, reason, label) {
   }
   return normalized;
 }
-function requirePrincipalType(principalType) {
-  if (!principalType) {
+function requirePrincipalType(principalType2) {
+  if (!principalType2) {
     throw new LucernSdkAuthContextError(
       "principal_missing",
       "Canonical Lucern SDK auth context is missing principalType."
     );
   }
-  return principalType;
+  return principalType2;
 }
 function requireAuthMode(authMode) {
   if (!authMode) {
@@ -343,7 +357,7 @@ function normalizeCanonicalLucernAuthContext(input) {
   );
   const roles = cleanStringList(input.roles);
   const scopes = cleanStringList(input.scopes);
-  const principalType = requirePrincipalType(input.principalType);
+  const principalType2 = requirePrincipalType(input.principalType);
   const authMode = requireAuthMode(input.authMode);
   const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
   if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
@@ -372,7 +386,7 @@ function normalizeCanonicalLucernAuthContext(input) {
     principalId,
     tenantId,
     workspaceId,
-    principalType,
+    principalType: principalType2,
     authMode,
     roles,
     scopes,
@@ -603,13 +617,31 @@ function mergeHeaderRecord(base, addition) {
   }
   return Object.fromEntries(headers.entries());
 }
+function cleanHeaderValue(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
 function createGatewayRequestClient(config = {}) {
   const fetchImpl = config.fetchImpl ?? fetch;
   const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
   const maxRetries = config.maxRetries ?? 2;
   const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
   async function resolveAuthHeaders() {
-    const base = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const provided = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const headers = new Headers(provided);
+    const setIfAbsent = (name, value) => {
+      const normalized = cleanHeaderValue(value);
+      if (normalized && !headers.has(name)) {
+        headers.set(name, normalized);
+      }
+    };
+    setIfAbsent("x-lucern-key", config.apiKey);
+    setIfAbsent("x-lucern-session-token", config.userToken);
+    setIfAbsent("x-lucern-environment", config.environment);
+    setIfAbsent("x-lucern-clerk-id", config.clerkId);
+    setIfAbsent("x-lucern-user-id", config.userId ?? config.clerkId);
+    setIfAbsent("x-lucern-deployment-host", config.deploymentHost);
+    const base = Object.fromEntries(headers.entries());
     const authContextInput = await resolveConfiguredAuthContext(
       config.authContext
     );
@@ -1306,190 +1338,911 @@ function createAdminClient(config = {}) {
   };
 }
 
-// src/answersClient.ts
-function createAnswersClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
+// src/boundaryClientSurface.ts
+function cleanOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function cleanRequiredString(value, label) {
+  const normalized = cleanOptionalString(value);
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function readTopicId(input) {
+  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
+}
+function requireTopicId(input) {
+  const topicId = readTopicId(input);
+  if (!topicId) {
+    throw new Error("topicId is required");
+  }
+  return topicId;
+}
+function assertKnownKeys(input, allowed, operation) {
+  const allowedSet = new Set(allowed);
+  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
+    );
+  }
+}
+function knownPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return { ...input };
+}
+function topicPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
   return {
-    /**
-     * Get the current answer for a question.
-     * @param questionId - The question node identifier.
-     * @returns The answer record for the given question.
-     */
-    async get(questionId) {
-      return gateway.request({
-        path: `/api/platform/v1/questions/${encodeURIComponent(questionId)}/answer`
-      });
-    }
+    ...input,
+    topicId: requireTopicId(input),
+    projectId: void 0
   };
 }
+function listResultFromEnvelope(data, legacyKey) {
+  const record = isRecord3(data) ? data : {};
+  const legacyItems = record[legacyKey];
+  return createListResult(
+    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
+    legacyKey
+  );
+}
 
-// src/audiencesClient.ts
-function createAudiencesClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const listRegistry = async (query5 = {}) => {
-    return gateway.request({
-      path: `/api/platform/v1/audiences/registry${toQueryString({
-        ...query5,
-        effective: typeof query5.effective === "boolean" ? query5.effective ? "true" : "false" : void 0,
-        status: query5.status
-      })}`
-    }).then(
-      (response) => mapGatewayData(
-        response,
-        (data) => createListResult(Array.isArray(data) ? data : [], "registryEntries")
-      )
-    );
-  };
-  const createRegistryEntry = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/registry",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-    });
-  };
-  const updateRegistryEntry = createRegistryEntry;
-  const upsertRegistry = createRegistryEntry;
-  const getRegistry = listRegistry;
-  const listGrants = async (query5 = {}) => {
-    return gateway.request({
-      path: `/api/platform/v1/audiences/grants${toQueryString({
-        ...query5,
-        audienceKey: query5.audienceKey,
-        principalId: query5.principalId,
-        groupId: query5.groupId,
-        status: query5.status
-      })}`
-    }).then(
-      (response) => mapGatewayData(
-        response,
-        (data) => createListResult(Array.isArray(data) ? data : [], "grants")
-      )
-    );
-  };
-  const createGrant = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/grants",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-    });
-  };
-  const getGrants = listGrants;
-  const grant = createGrant;
-  const deleteGrant = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/grants/revoke",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+// src/control-plane.ts
+var LucernControlPlaneIdentityError = class extends Error {
+  reason;
+  principalStatus;
+  tenantStatus;
+  workspaceStatus;
+  details;
+  constructor(failure) {
+    super(failure.message);
+    this.name = "LucernControlPlaneIdentityError";
+    this.reason = failure.reason;
+    this.principalStatus = failure.principalStatus;
+    this.tenantStatus = failure.tenantStatus;
+    this.workspaceStatus = failure.workspaceStatus;
+    this.details = failure.details;
+  }
+};
+function cleanString3(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function stringList(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return [
+    ...new Set(
+      value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean)
+    )
+  ];
+}
+function principalType(value) {
+  switch (value) {
+    case "service":
+    case "service_principal":
+      return "service";
+    case "agent":
+      return "agent";
+    case "group":
+      return "group";
+    case "external_viewer":
+    case "external_stakeholder":
+      return "external_viewer";
+    default:
+      return "human";
+  }
+}
+function adminFlags(roles) {
+  const normalized = roles.map((role) => role.toLowerCase());
+  const isPlatformAdmin = normalized.includes("platform_admin");
+  const isTenantAdmin = isPlatformAdmin || normalized.includes("tenant_admin");
+  const isWorkspaceAdmin = isTenantAdmin || normalized.includes("workspace_admin") || normalized.includes("workspace_owner");
+  return { isPlatformAdmin, isTenantAdmin, isWorkspaceAdmin };
+}
+function normalizeResolvedInteractivePrincipal(payload) {
+  if ("ok" in payload && payload.ok === false) {
+    throw new LucernControlPlaneIdentityError(payload);
+  }
+  const principalId = cleanString3(payload.principalId);
+  const clerkId = cleanString3(payload.clerkId);
+  const tenantId = cleanString3(payload.tenantId);
+  if (!principalId || !clerkId || !tenantId) {
+    throw new LucernControlPlaneIdentityError({
+      ok: false,
+      reason: "resolver_unavailable",
+      message: "Control-plane principal resolver returned an incomplete principal context.",
+      principalStatus: payload.principalStatus ?? "missing",
+      tenantStatus: payload.tenantStatus,
+      workspaceStatus: payload.workspaceStatus
     });
-  };
-  const revokeGrant = deleteGrant;
+  }
+  const roles = stringList(payload.roles);
+  const scopes = stringList(payload.scopes);
+  const workspaceId = cleanString3(payload.workspaceId) ?? null;
+  const flags = adminFlags(roles);
   return {
-    /**
-     * List audience registry entries.
-     */
-    listRegistry,
-    /**
-     * @deprecated Use listRegistry.
-     */
-    getRegistry,
-    /**
-     * Create an audience registry entry.
-     */
-    createRegistryEntry,
-    /**
-     * Update an audience registry entry.
-     */
-    updateRegistryEntry,
-    /**
-     * @deprecated Use createRegistryEntry or updateRegistryEntry.
-     */
-    upsertRegistry,
-    /**
-     * List audience grants.
-     */
-    listGrants,
-    /**
-     * @deprecated Use listGrants.
-     */
-    getGrants,
-    /**
-     * Create an audience grant.
-     */
-    createGrant,
-    /**
-     * @deprecated Use createGrant.
-     */
-    grant,
-    /**
-     * Delete an audience grant by revoking it.
-     */
-    deleteGrant,
-    /**
-     * @deprecated Use deleteGrant.
-     */
-    revokeGrant
+    principalId,
+    principalType: principalType(payload.principalType),
+    clerkId,
+    tenantId,
+    workspaceId,
+    roles,
+    scopes,
+    groupIds: stringList(payload.groupIds),
+    permittedToolNames: stringList(payload.permittedToolNames),
+    permittedPackKeys: stringList(payload.permittedPackKeys),
+    principalStatus: cleanString3(payload.principalStatus) ?? "active",
+    tenantStatus: cleanString3(payload.tenantStatus) ?? "active",
+    workspaceStatus: cleanString3(payload.workspaceStatus) ?? (workspaceId ? "active" : "none"),
+    isPlatformAdmin: typeof payload.isPlatformAdmin === "boolean" ? payload.isPlatformAdmin : flags.isPlatformAdmin,
+    isTenantAdmin: typeof payload.isTenantAdmin === "boolean" ? payload.isTenantAdmin : flags.isTenantAdmin,
+    isWorkspaceAdmin: typeof payload.isWorkspaceAdmin === "boolean" ? payload.isWorkspaceAdmin : flags.isWorkspaceAdmin,
+    permit: {
+      subject: cleanString3(payload.permit?.subject) ?? principalId,
+      tenant: cleanString3(payload.permit?.tenant) ?? tenantId,
+      ...workspaceId ? { workspace: cleanString3(payload.permit?.workspace) ?? workspaceId } : {}
+    },
+    authMode: "interactive_user",
+    sessionId: payload.sessionId,
+    delegatedBy: payload.delegatedBy,
+    expiresAt: payload.expiresAt
   };
 }
-
-// src/auditClient.ts
-function createAuditClient(config = {}) {
+function createControlPlaneIdentityClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
   return {
-    /**
-     * List audit events for the current scope.
-     */
-    async listEvents(query5 = {}) {
+    async resolveInteractivePrincipal(input) {
       return gateway.request({
-        path: `/api/platform/v1/audit/events${toQueryString(
-          normalizeTopicQuery(query5)
-        )}`
+        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
+        method: "POST",
+        body: input
       }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "events")
-        )
+        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
       );
     }
   };
 }
-
-// src/authDeviceClient.ts
-var DeviceAuthorizationError = class extends Error {
-  error;
-  interval;
-  constructor(args) {
-    super(args.description ?? args.error);
-    this.name = "DeviceAuthorizationError";
-    this.error = args.error;
-    this.interval = args.interval;
-  }
-};
-function authBaseUrl(config) {
-  return config.baseUrl?.replace(/\/+$/, "") ?? "";
-}
-async function readJson(response) {
-  try {
-    const payload = await response.json();
-    return isRecord3(payload) ? payload : {};
-  } catch (error) {
-    return unreadableJsonBodyFallback();
-  }
-}
-function unreadableJsonBodyFallback(_error) {
-  return {};
-}
-function isRecord3(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+function createControlPlaneClient(config = {}) {
+  return {
+    identity: createControlPlaneIdentityClient(config)
+  };
 }
-function readString(value) {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  return normalized || void 0;
+
+// src/identityClient.ts
+function createIdentityWhoamiClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    async whoami() {
+      return gateway.request({
+        path: "/api/platform/v1/identity/whoami"
+      });
+    }
+  };
 }
-function assertDeviceCodeResponse(payload) {
-  const deviceCode = readString(payload.device_code);
+var TENANT_IDENTITY_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "integrationKey",
+  "secretRef",
+  "policySubject",
+  "policyAction",
+  "policyResource",
+  "decision",
+  "config",
+  "configKey",
+  "configValue",
+  "provider",
+  "status",
+  "metadata",
+  "limit",
+  "cursor"
+];
+function tenantIdentityQuery(input) {
+  return {
+    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
+    workspaceId: input.workspaceId,
+    principalId: input.principalId,
+    limit: input.limit,
+    cursor: input.cursor
+  };
+}
+function tenantIdentityBody(input, operation) {
+  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
+}
+function createIdentityClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  const whoamiClient = createIdentityWhoamiClient(config);
+  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
+    path: "/api/platform/v1/identity/principals",
+    method,
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
+  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
+    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
+    method: "POST",
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  return {
+    /**
+     * Resolve the current authenticated identity summary.
+     */
+    async whoami() {
+      return whoamiClient.whoami().then(
+        (response) => mapGatewayData(response, (data) => ({
+          principalId: data.principalId,
+          principalType: data.principalType,
+          clerkId: data.clerkId,
+          tenantId: data.tenantId ?? null,
+          workspaceId: data.workspaceId ?? null,
+          scopes: Array.isArray(data.scopes) ? data.scopes : [],
+          roles: Array.isArray(data.roles) ? data.roles : [],
+          groupIds: Array.isArray(data.groupIds) ? data.groupIds : [],
+          permittedToolNames: Array.isArray(data.permittedToolNames) ? data.permittedToolNames : [],
+          permittedPackKeys: Array.isArray(data.permittedPackKeys) ? data.permittedPackKeys : [],
+          principalStatus: data.principalStatus,
+          tenantStatus: data.tenantStatus,
+          workspaceStatus: data.workspaceStatus,
+          isPlatformAdmin: data.isPlatformAdmin === true,
+          isTenantAdmin: data.isTenantAdmin === true,
+          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
+          permit: data.permit ?? (data.tenantId ? {
+            subject: data.principalId,
+            tenant: data.tenantId,
+            ...data.workspaceId ? { workspace: data.workspaceId } : {}
+          } : void 0),
+          authMode: data.authMode,
+          sessionId: data.sessionId,
+          delegatedBy: data.delegatedBy,
+          expiresAt: data.expiresAt
+        }))
+      );
+    },
+    /**
+     * Resolve a Clerk subject through the tenant control-plane Permit projection.
+     * @deprecated Prefer lucern.controlPlane.identity.resolveInteractivePrincipal().
+     */
+    async resolveInteractivePrincipal(input) {
+      return gateway.request({
+        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
+        method: "POST",
+        body: input
+      }).then(
+        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
+      );
+    },
+    /**
+     * List principals in the current identity scope.
+     */
+    async listPrincipals(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "principals"
+          )
+        )
+      );
+    },
+    /**
+     * Create a principal.
+     */
+    async createPrincipal(input, idempotencyKey) {
+      return requestPrincipalWrite("POST", input, idempotencyKey);
+    },
+    /**
+     * Update a principal.
+     */
+    updatePrincipal,
+    /**
+     * @deprecated Use createPrincipal or updatePrincipal.
+     */
+    upsertPrincipal: updatePrincipal,
+    /**
+     * List keys in the current identity scope.
+     */
+    async listKeys(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+        )
+      );
+    },
+    /**
+     * Create an API key.
+     */
+    async createKey(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/identity/keys",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Rotate an API key.
+     */
+    async rotateKey(keyId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Delete an API key by revoking it.
+     */
+    deleteKey,
+    /**
+     * @deprecated Use deleteKey.
+     */
+    revokeKey: deleteKey,
+    /**
+     * Search Clerk users by email or display attributes.
+     */
+    async searchClerkUsers(q) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+      });
+    },
+    async getTenantConfig(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/tenant-config${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      });
+    },
+    async updateTenantConfig(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      return gateway.request({
+        path: "/api/platform/v1/identity/tenant-config",
+        method: "PATCH",
+        body: tenantIdentityBody(
+          input,
+          "identity.updateTenantConfig"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listIntegrations(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/integrations${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "integrations"
+          )
+        )
+      );
+    },
+    async upsertIntegration(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.integrationKey, "integrationKey");
+      return gateway.request({
+        path: "/api/platform/v1/identity/integrations",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.upsertIntegration"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listSecrets(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/secrets${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "secrets"
+          )
+        )
+      );
+    },
+    async putSecretReference(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.secretRef, "secretRef");
+      return gateway.request({
+        path: "/api/platform/v1/identity/secrets",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.putSecretReference"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async evaluatePolicy(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.policySubject, "policySubject");
+      cleanRequiredString(input.policyAction, "policyAction");
+      cleanRequiredString(input.policyResource, "policyResource");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/evaluate",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.evaluatePolicy"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async recordPolicyDecision(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.decision, "decision");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/decisions",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.recordPolicyDecision"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
+  };
+}
+
+// src/accessControl.ts
+var LucernAccessControlError = class extends LucernSdkAuthContextError {
+  policyDecision;
+  constructor(reason, message, policyDecision) {
+    super(reason, message);
+    this.name = "LucernAccessControlError";
+    this.policyDecision = policyDecision;
+  }
+};
+function cleanString4(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function cleanStringList2(values) {
+  if (!values) {
+    return [];
+  }
+  return [
+    ...new Set(
+      values.map((value) => value.trim()).filter((value) => value.length > 0)
+    )
+  ];
+}
+function requireString2(value, reason, label) {
+  const normalized = cleanString4(value);
+  if (!normalized) {
+    throw new LucernAccessControlError(
+      reason,
+      `Lucern SDK access control requires ${label}.`
+    );
+  }
+  return normalized;
+}
+function normalizePrincipalType(principalType2) {
+  if (principalType2 === "agent") {
+    return "agent";
+  }
+  if (principalType2 === "service") {
+    return "service";
+  }
+  if (principalType2 === "group") {
+    return "group";
+  }
+  if (principalType2 === "external_viewer") {
+    return "external_viewer";
+  }
+  return "human";
+}
+function aliasKey(alias) {
+  return `${alias.provider}:${alias.providerProjectId ?? ""}:${alias.externalSubjectId}`;
+}
+function normalizeAliases(input, canonicalClerkUserId) {
+  const aliases = /* @__PURE__ */ new Map();
+  for (const alias of input ?? []) {
+    const externalSubjectId = cleanString4(alias.externalSubjectId);
+    if (!externalSubjectId) {
+      continue;
+    }
+    const normalized = {
+      provider: cleanString4(alias.provider) ?? "clerk",
+      providerProjectId: cleanString4(alias.providerProjectId),
+      externalSubjectId,
+      status: cleanString4(alias.status)
+    };
+    aliases.set(aliasKey(normalized), normalized);
+  }
+  if (canonicalClerkUserId) {
+    const canonicalAlias = {
+      provider: "clerk",
+      externalSubjectId: canonicalClerkUserId,
+      status: "active"
+    };
+    aliases.set(aliasKey(canonicalAlias), canonicalAlias);
+  }
+  return [...aliases.values()];
+}
+function isKnownClerkSubject(args) {
+  if (args.clerkId === args.canonicalClerkUserId) {
+    return true;
+  }
+  return args.aliases.some(
+    (alias) => alias.provider === "clerk" && alias.externalSubjectId === args.clerkId
+  );
+}
+function authContextToPrincipalInput(input) {
+  const normalized = normalizeCanonicalLucernAuthContext(input);
+  return {
+    principalId: normalized.principalId,
+    principalType: normalized.principalType,
+    canonicalClerkUserId: normalized.clerkId,
+    clerkId: normalized.clerkId,
+    tenantId: normalized.tenantId,
+    workspaceId: normalized.workspaceId,
+    roles: normalized.roles,
+    scopes: normalized.scopes
+  };
+}
+function isAuthContextInput(input) {
+  return "authMode" in input || "permit" in input || "delegationChain" in input;
+}
+function normalizeCanonicalPrincipalIdentity(input, options = {}) {
+  const principalInput = isAuthContextInput(input) ? authContextToPrincipalInput(input) : input;
+  const principalId = requireString2(
+    principalInput.principalId,
+    "principal_missing",
+    "principalId"
+  );
+  const principalType2 = normalizePrincipalType(principalInput.principalType);
+  const observedClerkId = cleanString4(options.observedClerkId);
+  const canonicalClerkUserId = cleanString4(principalInput.canonicalClerkUserId) ?? cleanString4(principalInput.clerkId);
+  if (principalType2 === "human" && !canonicalClerkUserId) {
+    throw new LucernAccessControlError(
+      "clerk_alias_missing",
+      "Human principals require one canonical Clerk user id."
+    );
+  }
+  const aliases = normalizeAliases(
+    principalInput.clerkIdentityAliases,
+    canonicalClerkUserId
+  );
+  if (observedClerkId && !isKnownClerkSubject({
+    clerkId: observedClerkId,
+    canonicalClerkUserId,
+    aliases
+  })) {
+    throw new LucernAccessControlError(
+      "clerk_alias_unrecognized",
+      "Observed Clerk user id does not match the canonical human principal id."
+    );
+  }
+  return {
+    principalId,
+    principalType: principalType2,
+    canonicalClerkUserId,
+    clerkIdentityAliases: aliases,
+    tenantId: cleanString4(principalInput.tenantId),
+    workspaceId: cleanString4(principalInput.workspaceId),
+    roles: cleanStringList2(principalInput.roles),
+    scopes: cleanStringList2(principalInput.scopes)
+  };
+}
+function formatPermitResource(resource) {
+  if (typeof resource === "string") {
+    return requireString2(resource, "policy_denied", "policyResource");
+  }
+  const type = requireString2(resource.type, "policy_denied", "resource.type");
+  const key = requireString2(resource.key, "policy_denied", "resource.key");
+  return key.startsWith(`${type}:`) ? key : `${type}:${key}`;
+}
+function resourceRequiresWorkspace(resource) {
+  if (typeof resource === "string") {
+    return !resource.startsWith("tenant:");
+  }
+  return resource.type !== "tenant";
+}
+function buildPolicyInput(identity, input) {
+  const tenantId = requireString2(
+    input.tenantId ?? identity.tenantId,
+    "tenant_missing",
+    "tenantId"
+  );
+  const workspaceId = cleanString4(input.workspaceId ?? identity.workspaceId);
+  if (resourceRequiresWorkspace(input.resource) && !workspaceId) {
+    throw new LucernAccessControlError(
+      "workspace_missing",
+      "Workspace-scoped Permit checks require workspaceId."
+    );
+  }
+  return {
+    tenantId,
+    workspaceId,
+    principalId: identity.principalId,
+    policySubject: identity.principalId,
+    policyAction: requireString2(input.action, "policy_denied", "policyAction"),
+    policyResource: formatPermitResource(input.resource),
+    metadata: input.context
+  };
+}
+async function resolveConfiguredPrincipalInput(authContext) {
+  if (typeof authContext === "function") {
+    return await authContext();
+  }
+  return authContext;
+}
+function assertPermitAllowed(decision) {
+  if (decision.decision !== "allow") {
+    throw new LucernAccessControlError(
+      decision.decision === "deny" ? "policy_denied" : "policy_unknown",
+      `Permit denied ${decision.policyAction} on ${decision.policyResource}.`,
+      decision
+    );
+  }
+}
+function createAccessControlClient(config = {}) {
+  const identityClient = createIdentityClient(config);
+  async function resolveIdentity(input, observedClerkId) {
+    const identityInput = input ?? await resolveConfiguredPrincipalInput(config.authContext);
+    if (!identityInput) {
+      throw new LucernAccessControlError(
+        "principal_missing",
+        "Lucern SDK access control requires a canonical principal identity."
+      );
+    }
+    return normalizeCanonicalPrincipalIdentity(identityInput, {
+      observedClerkId
+    });
+  }
+  async function checkAccess(input, idempotencyKey) {
+    const identity = await resolveIdentity(input.identity, input.observedClerkId);
+    const policyInput = buildPolicyInput(identity, input);
+    try {
+      const response = await identityClient.evaluatePolicy(
+        policyInput,
+        idempotencyKey
+      );
+      return {
+        identity,
+        policyInput,
+        decision: response.data
+      };
+    } catch (error) {
+      if (error instanceof LucernSdkAuthContextError) {
+        throw error;
+      }
+      throw new LucernAccessControlError(
+        "policy_unavailable",
+        "Permit policy check failed closed before an allow decision was returned."
+      );
+    }
+  }
+  async function requireAccess(input, idempotencyKey) {
+    const result = await checkAccess(input, idempotencyKey);
+    assertPermitAllowed(result.decision);
+    return result;
+  }
+  async function canAccess(input, idempotencyKey) {
+    try {
+      await requireAccess(input, idempotencyKey);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return {
+    normalizePrincipal: normalizeCanonicalPrincipalIdentity,
+    checkAccess,
+    requireAccess,
+    canAccess
+  };
+}
+
+// src/answersClient.ts
+function createAnswersClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    /**
+     * Get the current answer for a question.
+     * @param questionId - The question node identifier.
+     * @returns The answer record for the given question.
+     */
+    async get(questionId) {
+      return gateway.request({
+        path: `/api/platform/v1/questions/${encodeURIComponent(questionId)}/answer`
+      });
+    }
+  };
+}
+
+// src/audiencesClient.ts
+function createAudiencesClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  const listRegistry = async (query5 = {}) => {
+    return gateway.request({
+      path: `/api/platform/v1/audiences/registry${toQueryString({
+        ...query5,
+        effective: typeof query5.effective === "boolean" ? query5.effective ? "true" : "false" : void 0,
+        status: query5.status
+      })}`
+    }).then(
+      (response) => mapGatewayData(
+        response,
+        (data) => createListResult(Array.isArray(data) ? data : [], "registryEntries")
+      )
+    );
+  };
+  const createRegistryEntry = async (input, idempotencyKey) => {
+    return gateway.request({
+      path: "/api/platform/v1/audiences/registry",
+      method: "POST",
+      body: input,
+      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+    });
+  };
+  const updateRegistryEntry = createRegistryEntry;
+  const upsertRegistry = createRegistryEntry;
+  const getRegistry = listRegistry;
+  const listGrants = async (query5 = {}) => {
+    return gateway.request({
+      path: `/api/platform/v1/audiences/grants${toQueryString({
+        ...query5,
+        audienceKey: query5.audienceKey,
+        principalId: query5.principalId,
+        groupId: query5.groupId,
+        status: query5.status
+      })}`
+    }).then(
+      (response) => mapGatewayData(
+        response,
+        (data) => createListResult(Array.isArray(data) ? data : [], "grants")
+      )
+    );
+  };
+  const createGrant = async (input, idempotencyKey) => {
+    return gateway.request({
+      path: "/api/platform/v1/audiences/grants",
+      method: "POST",
+      body: input,
+      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+    });
+  };
+  const getGrants = listGrants;
+  const grant = createGrant;
+  const deleteGrant = async (input, idempotencyKey) => {
+    return gateway.request({
+      path: "/api/platform/v1/audiences/grants/revoke",
+      method: "POST",
+      body: input,
+      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+    });
+  };
+  const revokeGrant = deleteGrant;
+  return {
+    /**
+     * List audience registry entries.
+     */
+    listRegistry,
+    /**
+     * @deprecated Use listRegistry.
+     */
+    getRegistry,
+    /**
+     * Create an audience registry entry.
+     */
+    createRegistryEntry,
+    /**
+     * Update an audience registry entry.
+     */
+    updateRegistryEntry,
+    /**
+     * @deprecated Use createRegistryEntry or updateRegistryEntry.
+     */
+    upsertRegistry,
+    /**
+     * List audience grants.
+     */
+    listGrants,
+    /**
+     * @deprecated Use listGrants.
+     */
+    getGrants,
+    /**
+     * Create an audience grant.
+     */
+    createGrant,
+    /**
+     * @deprecated Use createGrant.
+     */
+    grant,
+    /**
+     * Delete an audience grant by revoking it.
+     */
+    deleteGrant,
+    /**
+     * @deprecated Use deleteGrant.
+     */
+    revokeGrant
+  };
+}
+
+// src/auditClient.ts
+function createAuditClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    /**
+     * List audit events for the current scope.
+     */
+    async listEvents(query5 = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/audit/events${toQueryString(
+          normalizeTopicQuery(query5)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "events")
+        )
+      );
+    }
+  };
+}
+
+// src/authDeviceClient.ts
+var DeviceAuthorizationError = class extends Error {
+  error;
+  interval;
+  constructor(args) {
+    super(args.description ?? args.error);
+    this.name = "DeviceAuthorizationError";
+    this.error = args.error;
+    this.interval = args.interval;
+  }
+};
+function authBaseUrl(config) {
+  return config.baseUrl?.replace(/\/+$/, "") ?? "";
+}
+async function readJson(response) {
+  try {
+    const payload = await response.json();
+    return isRecord4(payload) ? payload : {};
+  } catch (error) {
+    return unreadableJsonBodyFallback();
+  }
+}
+function unreadableJsonBodyFallback(_error) {
+  return {};
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readString(value) {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  return normalized || void 0;
+}
+function assertDeviceCodeResponse(payload) {
+  const deviceCode = readString(payload.device_code);
   const userCode = readString(payload.user_code);
   const verificationUri = readString(payload.verification_uri);
   const verificationUriComplete = readString(payload.verification_uri_complete);
@@ -1524,7 +2277,7 @@ function assertDeviceTokenResponse(payload) {
     tenant_id: tenantId,
     workspace_id: readString(payload.workspace_id),
     principal_id: principalId,
-    user: isRecord3(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
+    user: isRecord4(payload.user) && typeof payload.user.id === "string" && typeof payload.user.principalId === "string" ? {
       id: payload.user.id,
       principalId: payload.user.principalId
     } : void 0
@@ -1865,64 +2618,9 @@ function createEvidenceClient(config = {}) {
           config: classificationConfig
         },
         idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    }
-  };
-}
-
-// src/boundaryClientSurface.ts
-function cleanOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function isRecord4(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function cleanRequiredString(value, label) {
-  const normalized = cleanOptionalString(value);
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
-  return normalized;
-}
-function readTopicId(input) {
-  return cleanOptionalString(input.topicId) ?? cleanOptionalString(input.projectId);
-}
-function requireTopicId(input) {
-  const topicId = readTopicId(input);
-  if (!topicId) {
-    throw new Error("topicId is required");
-  }
-  return topicId;
-}
-function assertKnownKeys(input, allowed, operation) {
-  const allowedSet = new Set(allowed);
-  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
-  if (unknownKeys.length > 0) {
-    throw new Error(
-      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
-    );
-  }
-}
-function knownPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return { ...input };
-}
-function topicPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return {
-    ...input,
-    topicId: requireTopicId(input),
-    projectId: void 0
-  };
-}
-function listResultFromEnvelope(data, legacyKey) {
-  const record = isRecord4(data) ? data : {};
-  const legacyItems = record[legacyKey];
-  return createListResult(
-    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
-    legacyKey
-  );
+      });
+    }
+  };
 }
 
 // src/eventingClient.ts
@@ -2577,374 +3275,106 @@ function createGraphClient(config = {}) {
       return gateway.request({
         path: `/api/platform/v1/graph/edges${toQueryString(query5)}`,
         method: "DELETE",
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Retrieve a graph neighborhood around a root node.
-     */
-    async neighborhood(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
-      });
-    },
-    /**
-     * Traverse the graph from a starting node.
-     */
-    async traverse(query5) {
-      return gateway.request({
-        path: "/api/platform/v1/graph/traverse",
-        method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Analyze graph structure for a topic.
-     */
-    async analyze(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/analyze${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Detect confirmation-bias patterns for a topic graph.
-     */
-    async bias(query5 = {}) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/bias${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
-          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
-        })}`
-      });
-    },
-    /**
-     * Find graph gaps for beliefs that still need testing.
-     */
-    async gaps(query5) {
-      const normalized = normalizeTopicQuery(query5);
-      return gateway.request({
-        path: `/api/platform/v1/graph/gaps${toQueryString({
-          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
-          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
-        })}`
-      });
-    },
-    /**
-     * Search across graph resources within a topic.
-     */
-    async search(query5) {
-      return gateway.request({
-        path: "/api/platform/v1/search",
-        method: "POST",
-        body: normalizeTopicQuery(query5)
-      });
-    },
-    /**
-     * Retrieve the shortest known path between two graph nodes.
-     */
-    async getPath(query5) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
-      });
-    },
-    /**
-     * Retrieve graph analytics for the requested metric.
-     */
-    async getAnalytics(query5 = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
-      });
-    }
-  };
-  return Object.assign(client, {
-    queryNodes: client.listNodes,
-    queryEdges: client.listEdges,
-    getNeighborhood: client.neighborhood
-  });
-}
-
-// src/identityClient.ts
-function createIdentityWhoamiClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  return {
-    async whoami() {
-      return gateway.request({
-        path: "/api/platform/v1/identity/whoami"
-      });
-    }
-  };
-}
-var TENANT_IDENTITY_FIELDS = [
-  "tenantId",
-  "workspaceId",
-  "principalId",
-  "integrationKey",
-  "secretRef",
-  "policySubject",
-  "policyAction",
-  "policyResource",
-  "decision",
-  "config",
-  "configKey",
-  "configValue",
-  "provider",
-  "status",
-  "metadata",
-  "limit",
-  "cursor"
-];
-function tenantIdentityQuery(input) {
-  return {
-    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
-    workspaceId: input.workspaceId,
-    principalId: input.principalId,
-    limit: input.limit,
-    cursor: input.cursor
-  };
-}
-function tenantIdentityBody(input, operation) {
-  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
-}
-function createIdentityClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const whoamiClient = createIdentityWhoamiClient(config);
-  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
-    path: "/api/platform/v1/identity/principals",
-    method,
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
-  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
-    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
-    method: "POST",
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  return {
-    /**
-     * Resolve the current authenticated identity summary.
-     */
-    async whoami() {
-      return whoamiClient.whoami().then(
-        (response) => mapGatewayData(response, (data) => ({
-          principalId: data.principalId,
-          principalType: data.principalType,
-          tenantId: data.tenantId ?? null,
-          workspaceId: data.workspaceId ?? null,
-          scopes: Array.isArray(data.scopes) ? data.scopes : [],
-          roles: Array.isArray(data.roles) ? data.roles : [],
-          isPlatformAdmin: data.isPlatformAdmin === true,
-          isTenantAdmin: data.isTenantAdmin === true,
-          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
-          authMode: data.authMode,
-          sessionId: data.sessionId,
-          delegatedBy: data.delegatedBy,
-          expiresAt: data.expiresAt
-        }))
-      );
-    },
-    /**
-     * List principals in the current identity scope.
-     */
-    async listPrincipals(query5 = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/principals${toQueryString(query5)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(
-            Array.isArray(data) ? data : [],
-            "principals"
-          )
-        )
-      );
-    },
-    /**
-     * Create a principal.
-     */
-    async createPrincipal(input, idempotencyKey) {
-      return requestPrincipalWrite("POST", input, idempotencyKey);
-    },
-    /**
-     * Update a principal.
-     */
-    updatePrincipal,
-    /**
-     * @deprecated Use createPrincipal or updatePrincipal.
-     */
-    upsertPrincipal: updatePrincipal,
-    /**
-     * List keys in the current identity scope.
-     */
-    async listKeys(query5 = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/keys${toQueryString(query5)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
-        )
-      );
-    },
-    /**
-     * Create an API key.
-     */
-    async createKey(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/identity/keys",
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Rotate an API key.
-     */
-    async rotateKey(keyId, input = {}, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Delete an API key by revoking it.
-     */
-    deleteKey,
-    /**
-     * @deprecated Use deleteKey.
-     */
-    revokeKey: deleteKey,
-    /**
-     * Search Clerk users by email or display attributes.
-     */
-    async searchClerkUsers(q) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
       });
     },
-    async getTenantConfig(input) {
+    /**
+     * Retrieve a graph neighborhood around a root node.
+     */
+    async neighborhood(query5) {
       return gateway.request({
-        path: `/api/platform/v1/identity/tenant-config${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
+        path: `/api/platform/v1/graph/neighborhood${toQueryString(query5)}`
       });
     },
-    async updateTenantConfig(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
+    /**
+     * Traverse the graph from a starting node.
+     */
+    async traverse(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/tenant-config",
-        method: "PATCH",
-        body: tenantIdentityBody(
-          input,
-          "identity.updateTenantConfig"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: "/api/platform/v1/graph/traverse",
+        method: "POST",
+        body: normalizeTopicQuery(query5)
       });
     },
-    async listIntegrations(input) {
+    /**
+     * Analyze graph structure for a topic.
+     */
+    async analyze(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: `/api/platform/v1/identity/integrations${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "integrations"
-          )
-        )
-      );
+        path: `/api/platform/v1/graph/analyze${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          metric: typeof normalized.metric === "string" ? normalized.metric : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
+      });
     },
-    async upsertIntegration(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.integrationKey, "integrationKey");
+    /**
+     * Detect confirmation-bias patterns for a topic graph.
+     */
+    async bias(query5 = {}) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: "/api/platform/v1/identity/integrations",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.upsertIntegration"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/bias${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          threshold: typeof normalized.threshold === "number" ? normalized.threshold : void 0,
+          limit: typeof normalized.limit === "number" ? normalized.limit : void 0
+        })}`
       });
     },
-    async listSecrets(input) {
+    /**
+     * Find graph gaps for beliefs that still need testing.
+     */
+    async gaps(query5) {
+      const normalized = normalizeTopicQuery(query5);
       return gateway.request({
-        path: `/api/platform/v1/identity/secrets${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "secrets"
-          )
-        )
-      );
+        path: `/api/platform/v1/graph/gaps${toQueryString({
+          topicId: typeof normalized.topicId === "string" ? normalized.topicId : void 0,
+          minConfidence: typeof normalized.minConfidence === "number" ? normalized.minConfidence : void 0
+        })}`
+      });
     },
-    async putSecretReference(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.secretRef, "secretRef");
+    /**
+     * Search across graph resources within a topic.
+     */
+    async search(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/secrets",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.putSecretReference"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: "/api/platform/v1/search",
+        method: "POST",
+        body: normalizeTopicQuery(query5)
       });
     },
-    async evaluatePolicy(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.policySubject, "policySubject");
-      cleanRequiredString(input.policyAction, "policyAction");
-      cleanRequiredString(input.policyResource, "policyResource");
+    /**
+     * Retrieve the shortest known path between two graph nodes.
+     */
+    async getPath(query5) {
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/evaluate",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.evaluatePolicy"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/path${toQueryString(query5)}`
       });
     },
-    async recordPolicyDecision(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.decision, "decision");
+    /**
+     * Retrieve graph analytics for the requested metric.
+     */
+    async getAnalytics(query5 = {}) {
       return gateway.request({
-        path: "/api/platform/v1/identity/policy/decisions",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.recordPolicyDecision"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        path: `/api/platform/v1/graph/analytics${toQueryString(query5)}`
       });
     }
   };
+  return Object.assign(client, {
+    queryNodes: client.listNodes,
+    queryEdges: client.listEdges,
+    getNeighborhood: client.neighborhood
+  });
 }
 
 // src/topicsClient.ts
-function cleanString3(value) {
+function cleanString5(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeTopicRecord(value) {
   const record = asRecord(value);
-  const topicId = cleanString3(record.topicId) ?? cleanString3(record.id) ?? cleanString3(record._id);
+  const topicId = cleanString5(record.topicId) ?? cleanString5(record.id) ?? cleanString5(record._id);
   return withTopicAlias({
     ...record,
     ...topicId ? { topicId } : {}
@@ -3663,6 +4093,8 @@ function createTasksFacade(config = {}) {
           description: input.description,
           priority: input.priority,
           status: input.status,
+          assigneeId: input.assigneeId,
+          blockedReason: input.blockedReason,
           linkedBeliefId: input.linkedBeliefId,
           linkedQuestionId: input.linkedQuestionId,
           linkedWorktreeId: input.linkedWorktreeId,
@@ -4157,7 +4589,7 @@ function createEmbeddingsClient(config = {}) {
 }
 
 // src/contextClient.ts
-function cleanString4(value) {
+function cleanString6(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function cleanNumber(value) {
@@ -4169,11 +4601,11 @@ function cleanBoolean(value) {
 function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   const effectiveInput = typeof topicIdOrInput === "string" ? input : topicIdOrInput;
   const payload = {};
-  const topicId = typeof topicIdOrInput === "string" ? cleanString4(topicIdOrInput) : cleanString4(effectiveInput.topicId);
+  const topicId = typeof topicIdOrInput === "string" ? cleanString6(topicIdOrInput) : cleanString6(effectiveInput.topicId);
   if (topicId) {
     payload.topicId = topicId;
   }
-  const query5 = cleanString4(effectiveInput.query);
+  const query5 = cleanString6(effectiveInput.query);
   if (query5) {
     payload.query = query5;
   }
@@ -4181,7 +4613,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (budget !== void 0) {
     payload.budget = budget;
   }
-  const ranking = cleanString4(effectiveInput.ranking) ?? cleanString4(effectiveInput.rankingProfile);
+  const ranking = cleanString6(effectiveInput.ranking) ?? cleanString6(effectiveInput.rankingProfile);
   if (ranking) {
     payload.ranking = ranking;
   }
@@ -4197,7 +4629,7 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeEntities !== void 0) {
     payload.includeEntities = includeEntities;
   }
-  const mode = cleanString4(effectiveInput.mode);
+  const mode = cleanString6(effectiveInput.mode);
   if (mode) {
     payload.mode = mode;
   }
@@ -4205,11 +4637,11 @@ function buildCompileContextRequest(topicIdOrInput = {}, input = {}) {
   if (includeFailures !== void 0) {
     payload.includeFailures = includeFailures;
   }
-  const worktreeId = cleanString4(effectiveInput.worktreeId);
+  const worktreeId = cleanString6(effectiveInput.worktreeId);
   if (worktreeId) {
     payload.worktreeId = worktreeId;
   }
-  const sessionId = cleanString4(effectiveInput.sessionId);
+  const sessionId = cleanString6(effectiveInput.sessionId);
   if (sessionId) {
     payload.sessionId = sessionId;
   }
@@ -5095,7 +5527,8 @@ function createMcpClient(config = {}) {
         transportKind: input.transportKind,
         sessionId: input.sessionId,
         agentIdentity: input.agentIdentity,
-        workspaceId: input.workspaceId
+        workspaceId: input.workspaceId,
+        worktreeId: input.worktreeId
       };
       return gateway.request({
         path: `${MCP_GATEWAY_BOOTSTRAP_ENDPOINT}${toQueryString(scope)}`,
@@ -5208,6 +5641,7 @@ var FUNCTION_SURFACE_METHOD_PATHS = [
   "contracts.evaluateContract",
   "contracts.getContractStatus",
   "contradictions.flagContradiction",
+  "controlPlane.identity.resolveInteractivePrincipal",
   "coordination.broadcastMessage",
   "coordination.claimFiles",
   "coordination.endSession",
@@ -5216,8 +5650,12 @@ var FUNCTION_SURFACE_METHOD_PATHS = [
   "coordination.listActiveSessions",
   "coordination.registerSession",
   "coordination.sendAgentMessage",
+  "edges.batchCreateEdges",
   "edges.createEdge",
   "edges.queryLineage",
+  "edges.removeEdge",
+  "edges.removeEdgesBetween",
+  "edges.updateEdge",
   "evidence.addEvidence",
   "evidence.createEvidence",
   "evidence.getEvidence",
@@ -5245,6 +5683,14 @@ var FUNCTION_SURFACE_METHOD_PATHS = [
   "lenses.createLens",
   "lenses.listLenses",
   "lenses.removeLensFromTopic",
+  "nodes.archiveEpistemicNode",
+  "nodes.batchCreateEpistemicNodes",
+  "nodes.createEpistemicNode",
+  "nodes.getEpistemicNode",
+  "nodes.listEpistemicNodes",
+  "nodes.supersedeEpistemicNode",
+  "nodes.updateEpistemicNode",
+  "nodes.verifyEpistemicNode",
   "observations.getObservationContext",
   "observations.ingestObservation",
   "ontologies.applyOntology",
@@ -5274,8 +5720,10 @@ var FUNCTION_SURFACE_METHOD_PATHS = [
   "tasks.updateTask",
   "topics.createTopic",
   "topics.getTopic",
+  "topics.getTopicGraphSpine",
   "topics.getTopicTree",
   "topics.listTopics",
+  "topics.materializeTopicGraph",
   "topics.updateTopic",
   "worktrees.activateWorktree",
   "worktrees.addWorktree",
@@ -5300,8 +5748,11 @@ var CONTRACTS = {
   "apply_lens_to_topic": { method: "POST", path: "/lenses/apply", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "apply_ontology": { method: "POST", path: "/ontologies/apply", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "archive_belief": { method: "DELETE", path: "/beliefs", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
+  "archive_epistemic_node": { method: "POST", path: "/nodes/archive", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "archive_ontology": { method: "DELETE", path: "/ontologies", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "archive_question": { method: "DELETE", path: "/questions", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
+  "batch_create_edges": { method: "POST", path: "/edges/batch", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "batch_create_epistemic_nodes": { method: "POST", path: "/nodes/batch", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "begin_build_session": { method: "POST", path: "/mcp/build-session/begin", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "bisect_confidence": { method: "POST", path: "/beliefs/confidence/bisect", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "broadcast_message": { method: "POST", path: "/coordination/messages/broadcast", kind: "mutation", idempotent: true, surfaceIntent: "system" },
@@ -5313,6 +5764,7 @@ var CONTRACTS = {
   "create_belief": { method: "POST", path: "/beliefs", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "create_edge": { method: "POST", path: "/edges", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
   "create_epistemic_contract": { method: "POST", path: "/contracts", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
+  "create_epistemic_node": { method: "POST", path: "/nodes", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "create_evidence": { method: "POST", path: "/evidence", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "create_lens": { method: "POST", path: "/lenses", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "create_ontology": { method: "POST", path: "/ontologies", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
@@ -5340,6 +5792,7 @@ var CONTRACTS = {
   "get_code_context": { method: "POST", path: "/coding/context", kind: "query", idempotent: false, surfaceIntent: "system" },
   "get_confidence_history": { method: "POST", path: "/beliefs/confidence-history", kind: "query", idempotent: false, surfaceIntent: "compatibility" },
   "get_contract_status": { method: "POST", path: "/contracts/status", kind: "query", idempotent: false, surfaceIntent: "mcp_governance" },
+  "get_epistemic_node": { method: "GET", path: "/nodes/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_evidence": { method: "GET", path: "/evidence/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_failure_log": { method: "POST", path: "/coding/failure-log", kind: "query", idempotent: false, surfaceIntent: "system" },
   "get_falsification_questions": { method: "POST", path: "/questions/falsification", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
@@ -5353,6 +5806,7 @@ var CONTRACTS = {
   "get_question": { method: "GET", path: "/questions/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_topic": { method: "GET", path: "/topics/get", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_topic_coverage": { method: "POST", path: "/graph/topic-coverage", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
+  "get_topic_graph_spine": { method: "GET", path: "/topics/graph-spine", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "get_topic_tree": { method: "GET", path: "/topics/tree", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "heartbeat_session": { method: "POST", path: "/coordination/heartbeat-session", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "identity_whoami": { method: "GET", path: "/identity/whoami", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
@@ -5364,6 +5818,7 @@ var CONTRACTS = {
   "list_all_worktrees": { method: "GET", path: "/worktrees/all", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
   "list_beliefs": { method: "GET", path: "/beliefs", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "list_campaigns": { method: "GET", path: "/worktrees/campaigns", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
+  "list_epistemic_nodes": { method: "GET", path: "/nodes", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "list_evidence": { method: "GET", path: "/evidence", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "list_graph_intelligence_queries": { method: "POST", path: "/graph-intelligence/queries", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "list_lenses": { method: "GET", path: "/lenses", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
@@ -5374,6 +5829,7 @@ var CONTRACTS = {
   "list_worktrees": { method: "GET", path: "/worktrees", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
   "manage_write_policy": { method: "POST", path: "/policy/write-policy/manage", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "match_entity_type": { method: "POST", path: "/ontologies/match-entity-type", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
+  "materialize_topic_graph": { method: "POST", path: "/topics/materialize-graph", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "merge": { method: "POST", path: "/worktrees/merge", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "modulate_confidence": { method: "POST", path: "/beliefs/confidence", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "open_pull_request": { method: "POST", path: "/worktrees/open-pull-request", kind: "mutation", idempotent: true, surfaceIntent: "system" },
@@ -5387,22 +5843,29 @@ var CONTRACTS = {
   "refine_belief": { method: "PATCH", path: "/beliefs/refine", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "refine_question": { method: "PATCH", path: "/questions/refine", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "register_session": { method: "POST", path: "/coordination/register-session", kind: "mutation", idempotent: true, surfaceIntent: "system" },
+  "remove_edge": { method: "DELETE", path: "/edges", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "remove_edges_between": { method: "DELETE", path: "/edges/between", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
   "remove_lens_from_topic": { method: "DELETE", path: "/lenses/apply", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "resolve_effective_ontology": { method: "POST", path: "/ontologies/effective", kind: "query", idempotent: false, surfaceIntent: "mcp_workflow" },
+  "resolve_interactive_principal": { method: "POST", path: "/control-plane/identity/resolve-interactive-principal", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "run_graph_intelligence_query": { method: "POST", path: "/graph-intelligence/run", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "search_beliefs": { method: "POST", path: "/beliefs/search", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "search_evidence": { method: "POST", path: "/evidence/search", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "seed_belief_lattice": { method: "POST", path: "/scope/belief-lattice/seed", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "send_agent_message": { method: "POST", path: "/coordination/messages/send", kind: "mutation", idempotent: true, surfaceIntent: "system" },
+  "supersede_epistemic_node": { method: "POST", path: "/nodes/supersede", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "trace_entity_impact": { method: "POST", path: "/graph/trace-entity-impact", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "traverse_graph": { method: "POST", path: "/graph/traverse", kind: "query", idempotent: false, surfaceIntent: "mcp_analysis" },
   "trigger_belief_review": { method: "POST", path: "/context/belief-review", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "update_edge": { method: "PATCH", path: "/edges", kind: "mutation", idempotent: true, surfaceIntent: "mcp_analysis" },
+  "update_epistemic_node": { method: "PATCH", path: "/nodes", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "update_ontology": { method: "PATCH", path: "/ontologies", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "update_question_status": { method: "PATCH", path: "/questions/status", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "update_task": { method: "PATCH", path: "/tasks", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
   "update_topic": { method: "PATCH", path: "/topics", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "update_worktree_metadata": { method: "PATCH", path: "/worktrees/metadata", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
-  "update_worktree_targets": { method: "PATCH", path: "/worktrees/targets", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" }
+  "update_worktree_targets": { method: "PATCH", path: "/worktrees/targets", kind: "mutation", idempotent: true, surfaceIntent: "mcp_workflow" },
+  "verify_epistemic_node": { method: "POST", path: "/nodes/verify", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" }
 };
 function createSessionId() {
   return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : randomIdempotencyKey();
@@ -5470,12 +5933,21 @@ function createFunctionSurfaceClient(config = {}) {
     archiveBelief(input = {}, idempotencyKey) {
       return execute("archive_belief", input, idempotencyKey);
     },
+    archiveEpistemicNode(input = {}, idempotencyKey) {
+      return execute("archive_epistemic_node", input, idempotencyKey);
+    },
     archiveOntology(input = {}, idempotencyKey) {
       return execute("archive_ontology", input, idempotencyKey);
     },
     archiveQuestion(input = {}, idempotencyKey) {
       return execute("archive_question", input, idempotencyKey);
     },
+    batchCreateEdges(input = {}, idempotencyKey) {
+      return execute("batch_create_edges", input, idempotencyKey);
+    },
+    batchCreateEpistemicNodes(input = {}, idempotencyKey) {
+      return execute("batch_create_epistemic_nodes", input, idempotencyKey);
+    },
     beginBuildSession(input = {}, idempotencyKey) {
       return execute("begin_build_session", input, idempotencyKey);
     },
@@ -5509,6 +5981,9 @@ function createFunctionSurfaceClient(config = {}) {
     createEpistemicContract(input = {}, idempotencyKey) {
       return execute("create_epistemic_contract", input, idempotencyKey);
     },
+    createEpistemicNode(input = {}, idempotencyKey) {
+      return execute("create_epistemic_node", input, idempotencyKey);
+    },
     createEvidence(input = {}, idempotencyKey) {
       return execute("create_evidence", input, idempotencyKey);
     },
@@ -5590,6 +6065,9 @@ function createFunctionSurfaceClient(config = {}) {
     getContractStatus(input = {}, idempotencyKey) {
       return execute("get_contract_status", input, idempotencyKey);
     },
+    getEpistemicNode(input = {}, idempotencyKey) {
+      return execute("get_epistemic_node", input, idempotencyKey);
+    },
     getEvidence(input = {}, idempotencyKey) {
       return execute("get_evidence", input, idempotencyKey);
     },
@@ -5629,6 +6107,9 @@ function createFunctionSurfaceClient(config = {}) {
     getTopicCoverage(input = {}, idempotencyKey) {
       return execute("get_topic_coverage", input, idempotencyKey);
     },
+    getTopicGraphSpine(input = {}, idempotencyKey) {
+      return execute("get_topic_graph_spine", input, idempotencyKey);
+    },
     getTopicTree(input = {}, idempotencyKey) {
       return execute("get_topic_tree", input, idempotencyKey);
     },
@@ -5662,6 +6143,9 @@ function createFunctionSurfaceClient(config = {}) {
     listCampaigns(input = {}, idempotencyKey) {
       return execute("list_campaigns", input, idempotencyKey);
     },
+    listEpistemicNodes(input = {}, idempotencyKey) {
+      return execute("list_epistemic_nodes", input, idempotencyKey);
+    },
     listEvidence(input = {}, idempotencyKey) {
       return execute("list_evidence", input, idempotencyKey);
     },
@@ -5692,6 +6176,9 @@ function createFunctionSurfaceClient(config = {}) {
     matchEntityType(input = {}, idempotencyKey) {
       return execute("match_entity_type", input, idempotencyKey);
     },
+    materializeTopicGraph(input = {}, idempotencyKey) {
+      return execute("materialize_topic_graph", input, idempotencyKey);
+    },
     merge(input = {}, idempotencyKey) {
       return execute("merge", input, idempotencyKey);
     },
@@ -5731,12 +6218,21 @@ function createFunctionSurfaceClient(config = {}) {
     registerSession(input = {}, idempotencyKey) {
       return execute("register_session", input, idempotencyKey);
     },
+    removeEdge(input = {}, idempotencyKey) {
+      return execute("remove_edge", input, idempotencyKey);
+    },
+    removeEdgesBetween(input = {}, idempotencyKey) {
+      return execute("remove_edges_between", input, idempotencyKey);
+    },
     removeLensFromTopic(input = {}, idempotencyKey) {
       return execute("remove_lens_from_topic", input, idempotencyKey);
     },
     resolveEffectiveOntology(input = {}, idempotencyKey) {
       return execute("resolve_effective_ontology", input, idempotencyKey);
     },
+    resolveInteractivePrincipal(input = {}, idempotencyKey) {
+      return execute("resolve_interactive_principal", input, idempotencyKey);
+    },
     runGraphIntelligenceQuery(input = {}, idempotencyKey) {
       return execute("run_graph_intelligence_query", input, idempotencyKey);
     },
@@ -5752,6 +6248,9 @@ function createFunctionSurfaceClient(config = {}) {
     sendAgentMessage(input = {}, idempotencyKey) {
       return execute("send_agent_message", input, idempotencyKey);
     },
+    supersedeEpistemicNode(input = {}, idempotencyKey) {
+      return execute("supersede_epistemic_node", input, idempotencyKey);
+    },
     traceEntityImpact(input = {}, idempotencyKey) {
       return execute("trace_entity_impact", input, idempotencyKey);
     },
@@ -5761,6 +6260,12 @@ function createFunctionSurfaceClient(config = {}) {
     triggerBeliefReview(input = {}, idempotencyKey) {
       return execute("trigger_belief_review", input, idempotencyKey);
     },
+    updateEdge(input = {}, idempotencyKey) {
+      return execute("update_edge", input, idempotencyKey);
+    },
+    updateEpistemicNode(input = {}, idempotencyKey) {
+      return execute("update_epistemic_node", input, idempotencyKey);
+    },
     updateOntology(input = {}, idempotencyKey) {
       return execute("update_ontology", input, idempotencyKey);
     },
@@ -5778,6 +6283,9 @@ function createFunctionSurfaceClient(config = {}) {
     },
     updateWorktreeTargets(input = {}, idempotencyKey) {
       return execute("update_worktree_targets", input, idempotencyKey);
+    },
+    verifyEpistemicNode(input = {}, idempotencyKey) {
+      return execute("verify_epistemic_node", input, idempotencyKey);
     }
   };
 }
@@ -5985,7 +6493,7 @@ var ORG_GRAPH_SEARCH_FIELDS = [
   "cursor",
   "provenanceScope"
 ];
-function cleanString5(value, label) {
+function cleanString7(value, label) {
   const normalized = value?.trim();
   if (!normalized) {
     throw new Error(`${label} is required`);
@@ -6007,9 +6515,9 @@ function searchBody(input) {
     "orgGraphSearch.search"
   );
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
-    query: cleanString5(input.query, "query"),
+    tenantId: cleanString7(input.tenantId, "tenantId"),
+    workspaceId: cleanString7(input.workspaceId, "workspaceId"),
+    query: cleanString7(input.query, "query"),
     nodeTypes: input.nodeTypes,
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -6019,8 +6527,8 @@ function searchBody(input) {
 }
 function listQuery2(input) {
   return {
-    tenantId: cleanString5(input.tenantId, "tenantId"),
-    workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+    tenantId: cleanString7(input.tenantId, "tenantId"),
+    workspaceId: cleanString7(input.workspaceId, "workspaceId"),
     nodeTypes: input.nodeTypes?.join(","),
     minConfidence: input.minConfidence,
     limit: input.limit,
@@ -6054,8 +6562,8 @@ function createOrgGraphSearchClient(config = {}) {
       return gateway.request({
         path: `/api/platform/v1/org-graph-search/nodes/${nodePath}${toQueryString(
           {
-            tenantId: cleanString5(input.tenantId, "tenantId"),
-            workspaceId: cleanString5(input.workspaceId, "workspaceId"),
+            tenantId: cleanString7(input.tenantId, "tenantId"),
+            workspaceId: cleanString7(input.workspaceId, "workspaceId"),
             globalId: nodeId ? void 0 : globalId
           }
         )}`
@@ -7020,7 +7528,7 @@ function createToolRegistryClient(config = {}) {
 }
 
 // src/version.ts
-var LUCERN_SDK_VERSION = "0.3.0-alpha.9";
+var LUCERN_SDK_VERSION = "1.0.0";
 
 // src/workflowClient.ts
 function normalizeLensQuery(value) {
@@ -7428,6 +7936,12 @@ function toGatewayConfig(config) {
   return {
     baseUrl: config.baseUrl,
     fetchImpl: config.fetchImpl,
+    apiKey: config.apiKey,
+    userToken: config.userToken,
+    environment: config.environment,
+    clerkId: config.clerkId,
+    userId: config.userId,
+    deploymentHost: config.deploymentHost,
     maxRetries: config.maxRetries,
     timeoutMs: config.timeoutMs,
     timeoutMsByMethod: config.timeoutMsByMethod,
@@ -7436,23 +7950,15 @@ function toGatewayConfig(config) {
     onResponse: config.onResponse,
     authContext: config.authContext,
     requireCanonicalAuthContext: config.requireCanonicalAuthContext,
-    getAuthHeaders: async () => {
-      const base = config.getAuthHeaders ? await config.getAuthHeaders() : {};
-      if (config.apiKey && !base["x-lucern-key"] && !base.Authorization) {
-        base["x-lucern-key"] = config.apiKey;
-      }
-      if (config.userToken && !base["x-lucern-session-token"]) {
-        base["x-lucern-session-token"] = config.userToken;
-      }
-      if (config.environment && !base["x-lucern-environment"]) {
-        base["x-lucern-environment"] = config.environment;
-      }
-      return base;
-    }
+    getAuthHeaders: config.getAuthHeaders
   };
 }
 function exposeGatewayData(response) {
-  return Object.assign({}, response, response.data);
+  const data = response.data;
+  if (data !== null && typeof data === "object" && !Array.isArray(data)) {
+    return Object.assign({}, response, data);
+  }
+  return { ...response };
 }
 function createLucernClient(config = {}) {
   const gatewayConfig = toGatewayConfig(config);
@@ -7473,6 +7979,7 @@ function createLucernClient(config = {}) {
   const auditClient = createAuditClient(gatewayConfig);
   const authDeviceClient = createAuthDeviceClient(gatewayConfig);
   const adminClient = createAdminClient(gatewayConfig);
+  const accessControlClient = createAccessControlClient(gatewayConfig);
   const answersClient = createAnswersClient(gatewayConfig);
   const contradictionsFacade = createContradictionsFacade(gatewayConfig);
   const edgesFacade = createEdgesFacade(gatewayConfig);
@@ -7492,6 +7999,7 @@ function createLucernClient(config = {}) {
   const ontologyLinksClient = createOntologyLinksClient(gatewayConfig);
   const orgGraphSearchClient = createOrgGraphSearchClient(gatewayConfig);
   const functionSurfaceClient = createFunctionSurfaceClient(gatewayConfig);
+  const controlPlaneClient = createControlPlaneClient(gatewayConfig);
   const toolRegistryClient = createToolRegistryClient(gatewayConfig);
   const modelRuntimeClient = createModelRuntimeClient(gatewayConfig);
   const packsClient = createPacksClient(gatewayConfig);
@@ -7863,9 +8371,24 @@ function createLucernClient(config = {}) {
         typeof input === "string" ? { nodeId: input } : input
       );
     },
-    create: graphClient.createNode,
-    update: graphClient.updateNode,
-    batchCreate: graphClient.batchCreateNodes,
+    create(input, idempotencyKey) {
+      return functionSurfaceClient.createEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    createEpistemicNode(input, idempotencyKey) {
+      return functionSurfaceClient.createEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    update(input, idempotencyKey) {
+      return functionSurfaceClient.updateEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    updateEpistemicNode(input, idempotencyKey) {
+      return functionSurfaceClient.updateEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    batchCreate(input, idempotencyKey) {
+      return functionSurfaceClient.batchCreateEpistemicNodes(input, idempotencyKey).then(exposeGatewayData);
+    },
+    batchCreateEpistemicNodes(input, idempotencyKey) {
+      return functionSurfaceClient.batchCreateEpistemicNodes(input, idempotencyKey).then(exposeGatewayData);
+    },
     listByTopicAndType(input) {
       return gateway.request({
         path: `/api/platform/v1/nodes${sdkQueryString({
@@ -7890,8 +8413,15 @@ function createLucernClient(config = {}) {
         })}`
       }).then(exposeGatewayData);
     },
-    supersede: graphClient.supersedeNode,
-    verify: graphClient.verifyNode,
+    supersede(input, idempotencyKey) {
+      return functionSurfaceClient.supersedeEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    verify(input, idempotencyKey) {
+      return functionSurfaceClient.verifyEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
+    archive(input, idempotencyKey) {
+      return functionSurfaceClient.archiveEpistemicNode(input, idempotencyKey).then(exposeGatewayData);
+    },
     hardDelete: graphClient.hardDeleteNode
   };
   const publicationNamespace = {
@@ -8098,7 +8628,13 @@ function createLucernClient(config = {}) {
       }
     },
     edges: {
-      create(args) {
+      create(args, idempotencyKey) {
+        if (args.from && args.to) {
+          return functionSurfaceClient.createEdge(args, idempotencyKey).then(exposeGatewayData);
+        }
+        if (!args.sourceId || !args.targetId) {
+          throw new Error("from/to graph refs or sourceId/targetId are required");
+        }
         return edgesFacade.create({
           sourceId: args.sourceId,
           targetId: args.targetId,
@@ -8109,17 +8645,32 @@ function createLucernClient(config = {}) {
           context: args.context ?? args.reasoning
         }).then(exposeGatewayData);
       },
+      createEdge(input, idempotencyKey) {
+        return functionSurfaceClient.createEdge(input, idempotencyKey).then(exposeGatewayData);
+      },
       update(input, idempotencyKey) {
-        return edgesFacade.update(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.updateEdge(input, idempotencyKey).then(exposeGatewayData);
+      },
+      updateEdge(input, idempotencyKey) {
+        return functionSurfaceClient.updateEdge(input, idempotencyKey).then(exposeGatewayData);
       },
       remove(input, idempotencyKey) {
-        return edgesFacade.remove(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.removeEdge(input, idempotencyKey).then(exposeGatewayData);
+      },
+      removeEdge(input, idempotencyKey) {
+        return functionSurfaceClient.removeEdge(input, idempotencyKey).then(exposeGatewayData);
       },
       removeBetween(input, idempotencyKey) {
-        return edgesFacade.removeBetween(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.removeEdgesBetween(input, idempotencyKey).then(exposeGatewayData);
+      },
+      removeEdgesBetween(input, idempotencyKey) {
+        return functionSurfaceClient.removeEdgesBetween(input, idempotencyKey).then(exposeGatewayData);
       },
       batchCreate(input, idempotencyKey) {
-        return edgesFacade.batchCreate(input, idempotencyKey).then(exposeGatewayData);
+        return functionSurfaceClient.batchCreateEdges(input, idempotencyKey).then(exposeGatewayData);
+      },
+      batchCreateEdges(input, idempotencyKey) {
+        return functionSurfaceClient.batchCreateEdges(input, idempotencyKey).then(exposeGatewayData);
       },
       delete(input, idempotencyKey) {
         return edgesFacade.delete(input, idempotencyKey).then(exposeGatewayData);
@@ -8831,17 +9382,7 @@ function createLucernClient(config = {}) {
       },
       get: topicsFacade.get,
       create(input) {
-        return topicsFacade.create({
-          name: input.name,
-          description: input.description,
-          type: input.type,
-          parentTopicId: input.parentTopicId,
-          ontologyId: input.ontologyId,
-          tenantId: input.tenantId,
-          workspaceId: input.workspaceId,
-          visibility: input.visibility,
-          createdBy: input.createdBy
-        });
+        return functionSurfaceClient.createTopic(input).then(exposeGatewayData);
       },
       update(topicId, input) {
         return topicsFacade.update({
@@ -8875,7 +9416,19 @@ function createLucernClient(config = {}) {
         });
       },
       remove: topicsFacade.remove,
-      bulkCreate: topicsFacade.bulkCreate
+      bulkCreate: topicsFacade.bulkCreate,
+      materializeGraph(input = {}, idempotencyKey) {
+        return functionSurfaceClient.materializeTopicGraph(input, idempotencyKey).then(exposeGatewayData);
+      },
+      materializeTopicGraph(input = {}, idempotencyKey) {
+        return functionSurfaceClient.materializeTopicGraph(input, idempotencyKey).then(exposeGatewayData);
+      },
+      graphSpine(input = {}) {
+        return functionSurfaceClient.getTopicGraphSpine(input).then(exposeGatewayData);
+      },
+      getTopicGraphSpine(input = {}) {
+        return functionSurfaceClient.getTopicGraphSpine(input).then(exposeGatewayData);
+      }
     },
     answers: {
       create(input) {
@@ -9110,8 +9663,16 @@ function createLucernClient(config = {}) {
       disable: packsClient.disable
     },
     nodes: nodesNamespace,
+    controlPlane: {
+      identity: {
+        resolveInteractivePrincipal: controlPlaneClient.identity.resolveInteractivePrincipal
+      },
+      raw: controlPlaneClient
+    },
     identity: {
       ...identityFacade,
+      access: accessControlClient,
+      resolveInteractivePrincipal: identityClient.resolveInteractivePrincipal,
       evaluatePolicy: identityClient.evaluatePolicy,
       recordPolicyDecision: identityClient.recordPolicyDecision,
       putSecretReference: identityClient.putSecretReference,
@@ -9156,6 +9717,7 @@ function createLucernClient(config = {}) {
       ontologyLinks: ontologyLinksClient,
       orgGraphSearch: orgGraphSearchClient,
       functionSurface: functionSurfaceClient,
+      controlPlane: controlPlaneClient,
       toolRegistry: toolRegistryClient,
       modelRuntime: modelRuntimeClient,
       packs: packsClient,
@@ -9173,7 +9735,7 @@ function createLucernClient(config = {}) {
 }
 
 // src/facade/context.ts
-function cleanString6(value) {
+function cleanString8(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function cleanNumber2(value) {
@@ -9185,11 +9747,11 @@ function cleanBoolean2(value) {
 function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   const effectiveInput = typeof topicIdOrInput === "string" ? input : topicIdOrInput;
   const payload = {};
-  const topicId = typeof topicIdOrInput === "string" ? cleanString6(topicIdOrInput) : cleanString6(effectiveInput.topicId);
+  const topicId = typeof topicIdOrInput === "string" ? cleanString8(topicIdOrInput) : cleanString8(effectiveInput.topicId);
   if (topicId) {
     payload.topicId = topicId;
   }
-  const query5 = cleanString6(effectiveInput.query);
+  const query5 = cleanString8(effectiveInput.query);
   if (query5) {
     payload.query = query5;
   }
@@ -9197,7 +9759,7 @@ function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   if (budget !== void 0) {
     payload.budget = budget;
   }
-  const ranking = cleanString6(effectiveInput.ranking) ?? cleanString6(effectiveInput.rankingProfile);
+  const ranking = cleanString8(effectiveInput.ranking) ?? cleanString8(effectiveInput.rankingProfile);
   if (ranking) {
     payload.ranking = ranking;
   }
@@ -9213,7 +9775,7 @@ function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   if (includeEntities !== void 0) {
     payload.includeEntities = includeEntities;
   }
-  const mode = cleanString6(effectiveInput.mode);
+  const mode = cleanString8(effectiveInput.mode);
   if (mode) {
     payload.mode = mode;
   }
@@ -9221,11 +9783,11 @@ function buildCompileContextRequest2(topicIdOrInput = {}, input = {}) {
   if (includeFailures !== void 0) {
     payload.includeFailures = includeFailures;
   }
-  const worktreeId = cleanString6(effectiveInput.worktreeId);
+  const worktreeId = cleanString8(effectiveInput.worktreeId);
   if (worktreeId) {
     payload.worktreeId = worktreeId;
   }
-  const sessionId = cleanString6(effectiveInput.sessionId);
+  const sessionId = cleanString8(effectiveInput.sessionId);
   if (sessionId) {
     payload.sessionId = sessionId;
   }
@@ -10591,7 +11153,12 @@ var REASONING_METHODS = [
   "inductive",
   "abductive",
   "analogical",
-  "empirical"
+  "causal",
+  "correlational",
+  "testimonial",
+  "statistical",
+  "implicit",
+  "pattern_match"
 ];
 var DEFEAT_TYPES = [
   "rebuts",
@@ -10642,19 +11209,31 @@ var SESSION_AUTH_MODES = [
   "tenant_api_key",
   "session_token"
 ];
-var SESSION_PRINCIPAL_TYPES = ["human", "service", "agent"];
+var SESSION_PRINCIPAL_TYPES = [
+  "human",
+  "service",
+  "agent",
+  "group",
+  "external_viewer"
+];
 var SESSION_LIFECYCLE_STATUSES = [
   "active",
   "expired",
   "revoked"
 ];
 function inferSessionPrincipalType(principalId) {
-  if (principalId.startsWith("user:")) {
+  if (/^user_[A-Za-z0-9]+$/.test(principalId)) {
     return "human";
   }
   if (principalId.startsWith("agent:")) {
     return "agent";
   }
+  if (principalId.startsWith("group:")) {
+    return "group";
+  }
+  if (principalId.startsWith("external:") || principalId.startsWith("external_viewer:")) {
+    return "external_viewer";
+  }
   return "service";
 }
 function normalizeDelegationChain(args) {
@@ -10888,6 +11467,12 @@ function isMcpToolAllowed(toolName, options = {}) {
   if (options.permittedTools !== void 0 && options.permittedTools !== null) {
     return options.permittedTools.some((tool) => tool.toolName === toolName);
   }
+  if (options.sessionType === "agent") {
+    if (options.allowedTools === null || options.allowedTools === void 0) {
+      return false;
+    }
+    return options.allowedTools.includes(toolName);
+  }
   if (options.allowedTools === null || options.allowedTools === void 0) {
     return true;
   }
@@ -11600,10 +12185,11 @@ async function hydrateInfisicalRuntimeEnv(options) {
       message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`
     });
   }
-  if (surface.delivery !== "runtime_fetch") {
+  const fallbackDelivery = surface.fallback;
+  if (surface.delivery !== "runtime_fetch" && fallbackDelivery !== "runtime_fetch") {
     throw new InfisicalRuntimeError({
       code: "INFISICAL_UNSUPPORTED_SURFACE_DELIVERY",
-      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces.`
+      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces or surfaces with a runtime_fetch fallback.`
     });
   }
   const fetchImpl = options.fetchImpl ?? globalThis.fetch;
@@ -11616,35 +12202,26 @@ async function hydrateInfisicalRuntimeEnv(options) {
   const token = await loginWithUniversalAuth(bootstrap, fetchImpl);
   const values = {};
   const missingRequired = [];
-  const sourcePaths = [];
-  for (const pathId of surface.sourcePathIds) {
-    const path = findInfisicalRuntimePath(pathId);
-    if (!path) {
-      throw new InfisicalRuntimeError({
-        code: "INFISICAL_UNKNOWN_PATH",
-        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
-      });
-    }
-    sourcePaths.push(path.secretPath);
-    for (const variable of path.variables) {
-      const runtimeVariable = variable;
-      const secretValue = await readVariableSecret({
-        bootstrap,
-        fetchImpl,
-        token,
-        secretPath: path.secretPath,
-        variable: runtimeVariable
-      });
-      if (!secretValue) {
-        if (runtimeVariable.required) {
-          missingRequired.push(runtimeVariable.name);
-        }
-        continue;
-      }
-      values[runtimeVariable.name] = secretValue.value;
-      for (const alias of runtimeVariable.aliases ?? []) {
-        values[alias] = secretValue.value;
+  const sourcePaths = /* @__PURE__ */ new Set();
+  const variables = options.includeGeneratedSurfaceVariables ? generatedSurfaceVariables(options.surfaceId) : contractSurfaceVariables(surface.sourcePathIds);
+  for (const runtimeVariable of variables) {
+    sourcePaths.add(runtimeVariable.secretPath);
+    const secretValue = await readVariableSecret({
+      bootstrap,
+      fetchImpl,
+      token,
+      secretPath: runtimeVariable.secretPath,
+      variable: runtimeVariable
+    });
+    if (!secretValue) {
+      if (runtimeVariable.required) {
+        missingRequired.push(runtimeVariable.name);
       }
+      continue;
+    }
+    values[runtimeVariable.name] = secretValue.value;
+    for (const alias of runtimeVariable.aliases ?? []) {
+      values[alias] = secretValue.value;
     }
   }
   if (missingRequired.length > 0) {
@@ -11658,7 +12235,7 @@ async function hydrateInfisicalRuntimeEnv(options) {
     surfaceId: options.surfaceId,
     environment: bootstrap.environment,
     values,
-    sourcePaths
+    sourcePaths: [...sourcePaths]
   };
 }
 function applyInfisicalRuntimeEnv(result, targetEnv, options = {}) {
@@ -11729,6 +12306,46 @@ async function readVariableSecret(args) {
   }
   return null;
 }
+function contractSurfaceVariables(sourcePathIds) {
+  return sourcePathIds.flatMap((pathId) => {
+    const path = findInfisicalRuntimePath(pathId);
+    if (!path) {
+      throw new InfisicalRuntimeError({
+        code: "INFISICAL_UNKNOWN_PATH",
+        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
+      });
+    }
+    return path.variables.map((variable) => ({
+      ...variable,
+      secretPath: path.secretPath
+    }));
+  });
+}
+function generatedSurfaceVariables(surfaceId) {
+  const surface = GENERATED_INFISICAL_RUNTIME_ENV.surfaces[surfaceId];
+  if (!surface) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNKNOWN_SURFACE",
+      message: `Unknown generated Lucern Infisical runtime surface: ${surfaceId}.`
+    });
+  }
+  return surface.variables.map(generatedVariableToRuntimeVariable);
+}
+function generatedVariableToRuntimeVariable(variable) {
+  const aliases = /* @__PURE__ */ new Set([
+    ...variable.envNames.filter((name) => name !== variable.canonicalName),
+    ...variable.aliases
+  ]);
+  return {
+    name: variable.canonicalName,
+    required: variable.required,
+    secret: variable.secret,
+    public: variable.public,
+    aliases: [...aliases],
+    description: variable.description,
+    secretPath: variable.sourcePath
+  };
+}
 async function readSecretValue(args) {
   const params = new URLSearchParams({
     projectId: args.bootstrap.projectId,
@@ -11836,6 +12453,6 @@ function formatInfisicalRuntimeError(error) {
   return "Unknown Infisical runtime error shape";
 }
 
-export { BELIEF_STATUSES, BRANCH_DEPRECATION_MESSAGE, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, CONTROL_OBJECT_BLAST_RADII, CONTROL_OBJECT_EDIT_SURFACES, CONTROL_OBJECT_INHERITANCE_RULES, CONTROL_OBJECT_KINDS, CONTROL_OBJECT_OWNERSHIP_CONTRACT, CONTROL_OBJECT_OWNERSHIP_MATRIX, CONTROL_OBJECT_OWNERSHIP_ROWS, CONTROL_OBJECT_OWNER_SCOPES, CustomToolRegistryError, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, DeviceAuthorizationError, EDGE_TYPES, EMBEDDINGS_FIELDS, EPISTEMIC_EDGE_TYPES, EPISTEMIC_LAYERS, EVENTING_FIELDS, EVENT_RETENTION_DEFAULT_DAYS, FORK_REASONS, FUNCTION_SURFACE_METHOD_PATHS, GRAPH_ANALYSIS_ANALYSIS_FIELDS, GRAPH_ANALYSIS_COMPUTE_FIELDS, GRAPH_ANALYSIS_SUGGESTION_FIELDS, GRAPH_RECOMMENDATION_FIELDS, GRAPH_STATE_CLASSIFIER_FIELDS, InfisicalRuntimeError, JOBS_FIELDS, JUDGMENT_TYPES, LENS_PERSPECTIVE_TYPES, LENS_STATUSES, LENS_TASK_TEMPLATE_PRIORITIES, LUCERN_SDK_VERSION, LucernApiError, LucernSdkAuthContextError, MAX_ENTITY_LIMIT, MCP_ALWAYS_ALLOWED_TOOL_NAMES, MERGE_OUTCOMES, MODEL_RUNTIME_FIELDS, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, ONTOLOGY_LINK_FIELDS, ORG_GRAPH_SEARCH_FIELDS, REASONING_METHODS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, STRUCTURAL_EDGE_TYPES, TELEMETRY_FIELDS, TENANT_IDENTITY_FIELDS, TOOL_REGISTRY_FIELDS, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, applyInfisicalRuntimeEnv, asListItems, asRecord, assertValidWebhookSecret, assertValidWebhookUrl, buildDeprecatedBranchMetadata, buildDomainEvent, buildMcpToolContracts, buildMcpToolManifest, clearRegisteredCustomTools, compareEventCursor, compileContextPackFromSnapshot, computeWebhookSignature, createAdminClient, createAnswersClient, createAudiencesClient, createAuditClient, createAuthDeviceClient, createBeliefsClient, createCanonicalAuthHeaders, createContextClient, createContextFacade, createDecisionsClient, createEmbeddingsClient, createEventId, createEventingClient, createEventsClientCore, createEvidenceClient, createFunctionSurfaceClient, createGatewayRequestClient, createGraphAnalysisClient, createGraphClient, createGraphRecommendationsClient, createGraphStateClassifierClient, createHarnessClient, createIdentityClient, createJobsClient, createLearningClient, createListResult, createLucernClient, createModelRuntimeClient, createOntologyClient, createOntologyLinksClient, createOrgGraphSearchClient, createPacksClient, createPolicyClient, createReportsClient, createSchemaClient, createSourcesClient, createTelemetryClient, createToolRegistryClient, createTopicsClient, createWebhooksClientCore, createWorkflowClient, decodeEventCursor, emitDomainEvent, encodeEventCursor, eventPatternToRegExp, getControlObjectOwnershipCase, getMcpToolExposure, getRegisteredCustomTool, hydrateInfisicalRuntimeEnv, inferActorType, inferLensPerspectiveTypeFromBranchSchema, inferSessionPrincipalType, invokeRegisteredCustomTool, isAfterCursor, isInfisicalRuntimeDisabled, isLensFilterCriteria, isLucernPrompt, isMcpToolAllowed, isRecord2 as isRecord, isTaxonomyFilterCriteriaV1, lastDelegator, listControlObjectOwnershipCases, listRegisteredCustomTools, mapAliasedList, mapGatewayData, mapOpinionHistoryEntriesFromGatewayData, matchesAnyEventPattern, matchesEventPattern, mcpContractToInputSchema, mcpContractToManifestEntry, migrateBranchToLens, nextDeliveryAttemptAt, normalizeCanonicalLucernAuthContext, normalizeDelegationChain, normalizeNodeVerificationStatus, normalizeNodeWriteInput, normalizeRetentionDays, normalizeTopicQuery, normalizeWebhookPatterns, opinionFromBaseRate, opinionFromDogmatic, opinionFromProjected, planContextPackCompilation, randomIdempotencyKey, readInfisicalRuntimeBootstrap, registerCustomTool, resolveDeliveryFailureStatus, resolveText, resolveTopicId, sanitizeWebhookRecord, sortEventsByCursor, toQueryString, truncateWebhookResponseBody, unregisterCustomTool, validateFilterCriteria, withSdkAliases, withTextAlias, withTopicAlias };
+export { BELIEF_STATUSES, BRANCH_DEPRECATION_MESSAGE, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, CONTROL_OBJECT_BLAST_RADII, CONTROL_OBJECT_EDIT_SURFACES, CONTROL_OBJECT_INHERITANCE_RULES, CONTROL_OBJECT_KINDS, CONTROL_OBJECT_OWNERSHIP_CONTRACT, CONTROL_OBJECT_OWNERSHIP_MATRIX, CONTROL_OBJECT_OWNERSHIP_ROWS, CONTROL_OBJECT_OWNER_SCOPES, CustomToolRegistryError, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, DeviceAuthorizationError, EDGE_TYPES, EMBEDDINGS_FIELDS, EPISTEMIC_EDGE_TYPES, EPISTEMIC_LAYERS, EVENTING_FIELDS, EVENT_RETENTION_DEFAULT_DAYS, FORK_REASONS, FUNCTION_SURFACE_METHOD_PATHS, GRAPH_ANALYSIS_ANALYSIS_FIELDS, GRAPH_ANALYSIS_COMPUTE_FIELDS, GRAPH_ANALYSIS_SUGGESTION_FIELDS, GRAPH_RECOMMENDATION_FIELDS, GRAPH_STATE_CLASSIFIER_FIELDS, InfisicalRuntimeError, JOBS_FIELDS, JUDGMENT_TYPES, LENS_PERSPECTIVE_TYPES, LENS_STATUSES, LENS_TASK_TEMPLATE_PRIORITIES, LUCERN_SDK_VERSION, LucernAccessControlError, LucernApiError, LucernControlPlaneIdentityError, LucernSdkAuthContextError, MAX_ENTITY_LIMIT, MCP_ALWAYS_ALLOWED_TOOL_NAMES, MERGE_OUTCOMES, MODEL_RUNTIME_FIELDS, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, ONTOLOGY_LINK_FIELDS, ORG_GRAPH_SEARCH_FIELDS, REASONING_METHODS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, STRUCTURAL_EDGE_TYPES, TELEMETRY_FIELDS, TENANT_IDENTITY_FIELDS, TOOL_REGISTRY_FIELDS, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, applyInfisicalRuntimeEnv, asListItems, asRecord, assertPermitAllowed, assertValidWebhookSecret, assertValidWebhookUrl, buildDeprecatedBranchMetadata, buildDomainEvent, buildMcpToolContracts, buildMcpToolManifest, clearRegisteredCustomTools, compareEventCursor, compileContextPackFromSnapshot, computeWebhookSignature, createAccessControlClient, createAdminClient, createAnswersClient, createAudiencesClient, createAuditClient, createAuthDeviceClient, createBeliefsClient, createCanonicalAuthHeaders, createContextClient, createContextFacade, createControlPlaneClient, createControlPlaneIdentityClient, createDecisionsClient, createEmbeddingsClient, createEventId, createEventingClient, createEventsClientCore, createEvidenceClient, createFunctionSurfaceClient, createGatewayRequestClient, createGraphAnalysisClient, createGraphClient, createGraphRecommendationsClient, createGraphStateClassifierClient, createHarnessClient, createIdentityClient, createJobsClient, createLearningClient, createListResult, createLucernClient, createModelRuntimeClient, createOntologyClient, createOntologyLinksClient, createOrgGraphSearchClient, createPacksClient, createPolicyClient, createReportsClient, createSchemaClient, createSourcesClient, createTelemetryClient, createToolRegistryClient, createTopicsClient, createWebhooksClientCore, createWorkflowClient, decodeEventCursor, emitDomainEvent, encodeEventCursor, eventPatternToRegExp, formatPermitResource, getControlObjectOwnershipCase, getMcpToolExposure, getRegisteredCustomTool, hydrateInfisicalRuntimeEnv, inferActorType, inferLensPerspectiveTypeFromBranchSchema, inferSessionPrincipalType, invokeRegisteredCustomTool, isAfterCursor, isInfisicalRuntimeDisabled, isLensFilterCriteria, isLucernPrompt, isMcpToolAllowed, isRecord2 as isRecord, isTaxonomyFilterCriteriaV1, lastDelegator, listControlObjectOwnershipCases, listRegisteredCustomTools, mapAliasedList, mapGatewayData, mapOpinionHistoryEntriesFromGatewayData, matchesAnyEventPattern, matchesEventPattern, mcpContractToInputSchema, mcpContractToManifestEntry, migrateBranchToLens, nextDeliveryAttemptAt, normalizeCanonicalLucernAuthContext, normalizeCanonicalPrincipalIdentity, normalizeDelegationChain, normalizeNodeVerificationStatus, normalizeNodeWriteInput, normalizeResolvedInteractivePrincipal, normalizeRetentionDays, normalizeTopicQuery, normalizeWebhookPatterns, opinionFromBaseRate, opinionFromDogmatic, opinionFromProjected, planContextPackCompilation, randomIdempotencyKey, readInfisicalRuntimeBootstrap, registerCustomTool, resolveDeliveryFailureStatus, resolveText, resolveTopicId, sanitizeWebhookRecord, sortEventsByCursor, toQueryString, truncateWebhookResponseBody, unregisterCustomTool, validateFilterCriteria, withSdkAliases, withTextAlias, withTopicAlias };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map