@agentic-kit/pi 0.13.0 → 0.14.0

package/README.md

@@ -38,6 +38,36 @@ const dbTools = createDbTools({
 pi.use(dbTools);
 ```
 
+## Project context
+
+The tools need a bound database: an access key, a database id, and optionally endpoint/name pins. Where those values come from is the host's choice — `resolveProjectContext` takes values, not a directory:
+
+```ts
+import { fromEnvironment, resolveProjectContext } from '@agentic-kit/pi';
+
+// headless: container, Job, CI — nothing on disk, nothing to commit
+await resolveProjectContext(fromEnvironment());
+
+// local project: read <cwd>/.env (what Desktop and the CLI do)
+await resolveProjectContext(cwd);
+
+// anything else: a record, or a lookup function into a secret store
+await resolveProjectContext((name) => vault.get(name));
+```
+
+Injected variables carry a `CONSTRUCTIVE_` prefix; the bare names are also accepted (that is what the scaffolder writes into a project `.env`), with the prefixed spelling winning:
+
+| Variable | Required | Purpose |
+| --- | --- | --- |
+| `CONSTRUCTIVE_ACCESS_TOKEN` | yes | project data-plane key |
+| `CONSTRUCTIVE_DATABASE_ID` | yes | bound database |
+| `CONSTRUCTIVE_DATABASE_NAME` | no | derives the per-db data endpoint |
+| `CONSTRUCTIVE_API_ENDPOINT` | no | data-plane api pin |
+| `CONSTRUCTIVE_MODULES_ENDPOINT` | no | data-plane modules pin |
+| `CONSTRUCTIVE_OWNER_ID` | no | owner fallback when the probe omits it |
+
+Endpoint pins from the source apply to the **data plane only**. The control plane (binding probe, schema resolution, blueprint/schema tools) always uses the host's `backendConfig()` and the account bearer, so an untrusted cloned project cannot redirect it.
+
 ## Provisioning
 
 `provision_database` requests a database through the `requestDatabase` mutation on the api endpoint. When the requested module set matches a cataloged preset, the backend claims a warm pre-baked database in seconds. Otherwise a background job provisions the database cold. The tool polls the provision ticket on the modules endpoint until the database and its owner bootstrap are complete. Then it writes the credentials to the project `.env` and returns.

package/context.d.ts

@@ -19,6 +19,21 @@ export type ResolveResult = {
     reason: string;
     code?: ProjectContextFailureCode;
 };
+export declare const CONTEXT_ENV_KEYS: readonly ["ACCESS_TOKEN", "DATABASE_ID", "API_ENDPOINT", "MODULES_ENDPOINT", "DATABASE_NAME", "OWNER_ID"];
+export type ContextEnvKey = (typeof CONTEXT_ENV_KEYS)[number];
+/** Prefix for injected variables: `ACCESS_TOKEN` is far too generic to claim in
+ *  a shared process environment, `CONSTRUCTIVE_ACCESS_TOKEN` is not. Inside a
+ *  project `.env` the bare names stay readable (and are what the scaffolder
+ *  writes), so both spellings resolve, prefixed winning. */
+export declare const CONTEXT_ENV_PREFIX = "CONSTRUCTIVE_";
+/** Values keyed by name, or a lookup function (a host with a secret store). */
+export type ContextSource = Record<string, string | undefined> | ((name: string) => string | undefined);
+/** Use the process environment (or any injected record) as the source. */
+export declare function fromEnvironment(environment?: Record<string, string | undefined>): ContextSource;
+/** Read a project `.env` as the source. The file is authoritative here — the
+ *  key in it belongs to whatever backend wrote it, so it is not merged under
+ *  the ambient environment. Returns null when the file is absent. */
+export declare function fromEnvFile(cwd: string): Promise<ContextSource | null>;
 export type ResolveOptions = {
     /** Which plane the context is for. Ownership gates the control plane only:
      *  schema editing and provisioning act under the signed-in account, so a
@@ -28,7 +43,15 @@ export type ResolveOptions = {
      *  the app itself does in the Preview. */
     plane?: 'control' | 'data';
 };
-export declare function resolveProjectContext(cwd: string, options?: ResolveOptions): Promise<ResolveResult>;
+/**
+ * Resolve the project context from injected values, or from a project folder.
+ *
+ * Passing a `cwd` string keeps the original behavior (read `<cwd>/.env`) so
+ * existing hosts — Constructive Desktop, the confirm gate — are unchanged.
+ * Headless hosts pass values instead: `fromEnvironment()` for a container or
+ * Job, an explicit record for anything else.
+ */
+export declare function resolveProjectContext(input: string | ContextSource, options?: ResolveOptions): Promise<ResolveResult>;
 export type DataTokenResult = {
     token?: string;
     userId?: string;

package/context.js

@@ -3,6 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTEXT_ENV_PREFIX = exports.CONTEXT_ENV_KEYS = void 0;
+exports.fromEnvironment = fromEnvironment;
+exports.fromEnvFile = fromEnvFile;
 exports.resolveProjectContext = resolveProjectContext;
 exports.resolveDataToken = resolveDataToken;
 exports.deriveSubdomainEndpoint = deriveSubdomainEndpoint;
@@ -10,52 +13,78 @@ exports.resolveOrgName = resolveOrgName;
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const sdk_1 = require("@constructive-io/sdk");
+const dotenv_1 = require("12factor-env/dotenv");
 const db_probe_1 = require("./db-probe");
 const host_1 = require("./host");
 const DEFAULT_API_ENDPOINT = 'http://api.localhost:3000/graphql';
 const DEFAULT_MODULES_ENDPOINT = 'http://modules.localhost:3000/graphql';
-function parseEnv(source) {
-    const env = {};
-    for (const rawLine of source.split('\n')) {
-        const line = rawLine.trim();
-        if (!line || line.startsWith('#'))
-            continue;
-        const eq = line.indexOf('=');
-        if (eq === -1)
-            continue;
-        const key = line.slice(0, eq).trim();
-        let value = line.slice(eq + 1).trim();
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        env[key] = value;
-    }
-    return env;
+// The project values pi needs, and where they come from. A scaffolded project
+// folder carries them in `.env` (desktop); a headless host — a container, a
+// Job, CI — injects them as real environment variables, so no credential is
+// ever written into a git clone the agent could commit. Both lanes produce the
+// same record, which is why the resolver takes VALUES, not a directory.
+exports.CONTEXT_ENV_KEYS = [
+    'ACCESS_TOKEN',
+    'DATABASE_ID',
+    'API_ENDPOINT',
+    'MODULES_ENDPOINT',
+    'DATABASE_NAME',
+    'OWNER_ID',
+];
+/** Prefix for injected variables: `ACCESS_TOKEN` is far too generic to claim in
+ *  a shared process environment, `CONSTRUCTIVE_ACCESS_TOKEN` is not. Inside a
+ *  project `.env` the bare names stay readable (and are what the scaffolder
+ *  writes), so both spellings resolve, prefixed winning. */
+exports.CONTEXT_ENV_PREFIX = 'CONSTRUCTIVE_';
+const lookup = (source) => typeof source === 'function' ? source : (name) => source[name];
+const readContextValue = (source, key) => {
+    const get = lookup(source);
+    const value = get(`${exports.CONTEXT_ENV_PREFIX}${key}`) ?? get(key);
+    return value ? value : undefined;
+};
+/** Use the process environment (or any injected record) as the source. */
+function fromEnvironment(environment = process.env) {
+    return environment;
 }
-async function resolveProjectContext(cwd, options = {}) {
-    let source;
+/** Read a project `.env` as the source. The file is authoritative here — the
+ *  key in it belongs to whatever backend wrote it, so it is not merged under
+ *  the ambient environment. Returns null when the file is absent. */
+async function fromEnvFile(cwd) {
     try {
-        source = await (0, promises_1.readFile)(node_path_1.default.join(cwd, '.env'), 'utf8');
+        return (0, dotenv_1.parseDotenv)(await (0, promises_1.readFile)(node_path_1.default.join(cwd, '.env'), 'utf8'));
     }
     catch {
+        return null;
+    }
+}
+/**
+ * Resolve the project context from injected values, or from a project folder.
+ *
+ * Passing a `cwd` string keeps the original behavior (read `<cwd>/.env`) so
+ * existing hosts — Constructive Desktop, the confirm gate — are unchanged.
+ * Headless hosts pass values instead: `fromEnvironment()` for a container or
+ * Job, an explicit record for anything else.
+ */
+async function resolveProjectContext(input, options = {}) {
+    const source = typeof input === 'string' ? await fromEnvFile(input) : input;
+    if (!source) {
         return {
             context: null,
             reason: 'No .env found in the project. Provision a Constructive database first (scaffold the project), then retry.',
             code: 'no-env',
         };
     }
-    const env = parseEnv(source);
+    const env = Object.fromEntries(exports.CONTEXT_ENV_KEYS.map((key) => [key, readContextValue(source, key)]));
     const accessToken = env.ACCESS_TOKEN;
     const databaseId = env.DATABASE_ID;
     if (!accessToken || !databaseId) {
         return {
             context: null,
-            reason: 'Project is not connected to a Constructive database yet (missing ACCESS_TOKEN/DATABASE_ID in .env). Provision the database first, then retry.',
+            reason: `Project is not connected to a Constructive database yet (missing ${exports.CONTEXT_ENV_PREFIX}ACCESS_TOKEN/${exports.CONTEXT_ENV_PREFIX}DATABASE_ID in the environment, or ACCESS_TOKEN/DATABASE_ID in .env). Provision the database first, then retry.`,
             code: 'missing-credentials',
         };
     }
-    // A per-project .env pin wins for the DATA plane (the .env key belongs to
+    // A source-supplied pin wins for the DATA plane (the access key belongs to
     // whatever backend wrote it); otherwise fall back to the app's backend-config
     // store (environment-aware) so app + harness share one endpoint source.
     const host = (0, host_1.getHost)();
@@ -65,9 +94,9 @@ async function resolveProjectContext(cwd, options = {}) {
     // The whole control plane (binding probe, schema resolution, blueprint/schema
     // tools) authenticates with the ACCOUNT bearer: the platform api rejects
     // per-database keys, so the project ACCESS_TOKEN can never act on metaschema
-    // surfaces. The .env key stays in the context for the data plane only. The
-    // bearer is only ever sent to the app-configured backend — never a
-    // .env-pinned endpoint, which an untrusted cloned project controls.
+    // surfaces. The source's key stays in the context for the data plane only.
+    // The bearer is only ever sent to the app-configured backend — never a
+    // source-pinned endpoint, which an untrusted cloned project controls.
     const controlApiEndpoint = backend?.apiEndpoint || DEFAULT_API_ENDPOINT;
     const controlModulesEndpoint = backend?.modulesEndpoint || DEFAULT_MODULES_ENDPOINT;
     const account = host.account();
@@ -81,7 +110,7 @@ async function resolveProjectContext(cwd, options = {}) {
     }
     const controlHeaders = { Authorization: `Bearer ${accountBearer}` };
     const apiClient = sdk_1.api.createClient({ endpoint: controlApiEndpoint, headers: controlHeaders });
-    // Always probe the bound database — the .env stamp proves the project WAS
+    // Always probe the bound database — the DATABASE_ID stamp proves it WAS
     // bound, never that the database still exists (backend refresh, deletion,
     // revoked key). The probe is the single source of binding health.
     const probe = await (0, db_probe_1.probeDatabase)({
@@ -108,7 +137,7 @@ async function resolveProjectContext(cwd, options = {}) {
     // never shown in the Schemas tab or written to by the agent. The project's
     // local blueprint survives account changes, so recovery is a reprovision
     // under the signed-in account. Owner truth comes from the probe (backend),
-    // not the .env stamp. Data-plane resolution skips this gate — see
+    // not the source's stamp. Data-plane resolution skips this gate — see
     // ResolveOptions.
     const sessionUserId = account?.userId;
     if (options.plane !== 'data' &&

package/esm/context.d.ts

@@ -19,6 +19,21 @@ export type ResolveResult = {
     reason: string;
     code?: ProjectContextFailureCode;
 };
+export declare const CONTEXT_ENV_KEYS: readonly ["ACCESS_TOKEN", "DATABASE_ID", "API_ENDPOINT", "MODULES_ENDPOINT", "DATABASE_NAME", "OWNER_ID"];
+export type ContextEnvKey = (typeof CONTEXT_ENV_KEYS)[number];
+/** Prefix for injected variables: `ACCESS_TOKEN` is far too generic to claim in
+ *  a shared process environment, `CONSTRUCTIVE_ACCESS_TOKEN` is not. Inside a
+ *  project `.env` the bare names stay readable (and are what the scaffolder
+ *  writes), so both spellings resolve, prefixed winning. */
+export declare const CONTEXT_ENV_PREFIX = "CONSTRUCTIVE_";
+/** Values keyed by name, or a lookup function (a host with a secret store). */
+export type ContextSource = Record<string, string | undefined> | ((name: string) => string | undefined);
+/** Use the process environment (or any injected record) as the source. */
+export declare function fromEnvironment(environment?: Record<string, string | undefined>): ContextSource;
+/** Read a project `.env` as the source. The file is authoritative here — the
+ *  key in it belongs to whatever backend wrote it, so it is not merged under
+ *  the ambient environment. Returns null when the file is absent. */
+export declare function fromEnvFile(cwd: string): Promise<ContextSource | null>;
 export type ResolveOptions = {
     /** Which plane the context is for. Ownership gates the control plane only:
      *  schema editing and provisioning act under the signed-in account, so a
@@ -28,7 +43,15 @@ export type ResolveOptions = {
      *  the app itself does in the Preview. */
     plane?: 'control' | 'data';
 };
-export declare function resolveProjectContext(cwd: string, options?: ResolveOptions): Promise<ResolveResult>;
+/**
+ * Resolve the project context from injected values, or from a project folder.
+ *
+ * Passing a `cwd` string keeps the original behavior (read `<cwd>/.env`) so
+ * existing hosts — Constructive Desktop, the confirm gate — are unchanged.
+ * Headless hosts pass values instead: `fromEnvironment()` for a container or
+ * Job, an explicit record for anything else.
+ */
+export declare function resolveProjectContext(input: string | ContextSource, options?: ResolveOptions): Promise<ResolveResult>;
 export type DataTokenResult = {
     token?: string;
     userId?: string;

package/esm/context.js

@@ -1,52 +1,78 @@
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { api, auth, modules } from '@constructive-io/sdk';
+import { parseDotenv } from '12factor-env/dotenv';
 import { probeDatabase } from './db-probe';
 import { DEFAULT_DATA_TOKEN_SKEW_MS, getHost } from './host';
 const DEFAULT_API_ENDPOINT = 'http://api.localhost:3000/graphql';
 const DEFAULT_MODULES_ENDPOINT = 'http://modules.localhost:3000/graphql';
-function parseEnv(source) {
-    const env = {};
-    for (const rawLine of source.split('\n')) {
-        const line = rawLine.trim();
-        if (!line || line.startsWith('#'))
-            continue;
-        const eq = line.indexOf('=');
-        if (eq === -1)
-            continue;
-        const key = line.slice(0, eq).trim();
-        let value = line.slice(eq + 1).trim();
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        env[key] = value;
-    }
-    return env;
+// The project values pi needs, and where they come from. A scaffolded project
+// folder carries them in `.env` (desktop); a headless host — a container, a
+// Job, CI — injects them as real environment variables, so no credential is
+// ever written into a git clone the agent could commit. Both lanes produce the
+// same record, which is why the resolver takes VALUES, not a directory.
+export const CONTEXT_ENV_KEYS = [
+    'ACCESS_TOKEN',
+    'DATABASE_ID',
+    'API_ENDPOINT',
+    'MODULES_ENDPOINT',
+    'DATABASE_NAME',
+    'OWNER_ID',
+];
+/** Prefix for injected variables: `ACCESS_TOKEN` is far too generic to claim in
+ *  a shared process environment, `CONSTRUCTIVE_ACCESS_TOKEN` is not. Inside a
+ *  project `.env` the bare names stay readable (and are what the scaffolder
+ *  writes), so both spellings resolve, prefixed winning. */
+export const CONTEXT_ENV_PREFIX = 'CONSTRUCTIVE_';
+const lookup = (source) => typeof source === 'function' ? source : (name) => source[name];
+const readContextValue = (source, key) => {
+    const get = lookup(source);
+    const value = get(`${CONTEXT_ENV_PREFIX}${key}`) ?? get(key);
+    return value ? value : undefined;
+};
+/** Use the process environment (or any injected record) as the source. */
+export function fromEnvironment(environment = process.env) {
+    return environment;
 }
-export async function resolveProjectContext(cwd, options = {}) {
-    let source;
+/** Read a project `.env` as the source. The file is authoritative here — the
+ *  key in it belongs to whatever backend wrote it, so it is not merged under
+ *  the ambient environment. Returns null when the file is absent. */
+export async function fromEnvFile(cwd) {
     try {
-        source = await readFile(path.join(cwd, '.env'), 'utf8');
+        return parseDotenv(await readFile(path.join(cwd, '.env'), 'utf8'));
     }
     catch {
+        return null;
+    }
+}
+/**
+ * Resolve the project context from injected values, or from a project folder.
+ *
+ * Passing a `cwd` string keeps the original behavior (read `<cwd>/.env`) so
+ * existing hosts — Constructive Desktop, the confirm gate — are unchanged.
+ * Headless hosts pass values instead: `fromEnvironment()` for a container or
+ * Job, an explicit record for anything else.
+ */
+export async function resolveProjectContext(input, options = {}) {
+    const source = typeof input === 'string' ? await fromEnvFile(input) : input;
+    if (!source) {
         return {
             context: null,
             reason: 'No .env found in the project. Provision a Constructive database first (scaffold the project), then retry.',
             code: 'no-env',
         };
     }
-    const env = parseEnv(source);
+    const env = Object.fromEntries(CONTEXT_ENV_KEYS.map((key) => [key, readContextValue(source, key)]));
     const accessToken = env.ACCESS_TOKEN;
     const databaseId = env.DATABASE_ID;
     if (!accessToken || !databaseId) {
         return {
             context: null,
-            reason: 'Project is not connected to a Constructive database yet (missing ACCESS_TOKEN/DATABASE_ID in .env). Provision the database first, then retry.',
+            reason: `Project is not connected to a Constructive database yet (missing ${CONTEXT_ENV_PREFIX}ACCESS_TOKEN/${CONTEXT_ENV_PREFIX}DATABASE_ID in the environment, or ACCESS_TOKEN/DATABASE_ID in .env). Provision the database first, then retry.`,
             code: 'missing-credentials',
         };
     }
-    // A per-project .env pin wins for the DATA plane (the .env key belongs to
+    // A source-supplied pin wins for the DATA plane (the access key belongs to
     // whatever backend wrote it); otherwise fall back to the app's backend-config
     // store (environment-aware) so app + harness share one endpoint source.
     const host = getHost();
@@ -56,9 +82,9 @@ export async function resolveProjectContext(cwd, options = {}) {
     // The whole control plane (binding probe, schema resolution, blueprint/schema
     // tools) authenticates with the ACCOUNT bearer: the platform api rejects
     // per-database keys, so the project ACCESS_TOKEN can never act on metaschema
-    // surfaces. The .env key stays in the context for the data plane only. The
-    // bearer is only ever sent to the app-configured backend — never a
-    // .env-pinned endpoint, which an untrusted cloned project controls.
+    // surfaces. The source's key stays in the context for the data plane only.
+    // The bearer is only ever sent to the app-configured backend — never a
+    // source-pinned endpoint, which an untrusted cloned project controls.
     const controlApiEndpoint = backend?.apiEndpoint || DEFAULT_API_ENDPOINT;
     const controlModulesEndpoint = backend?.modulesEndpoint || DEFAULT_MODULES_ENDPOINT;
     const account = host.account();
@@ -72,7 +98,7 @@ export async function resolveProjectContext(cwd, options = {}) {
     }
     const controlHeaders = { Authorization: `Bearer ${accountBearer}` };
     const apiClient = api.createClient({ endpoint: controlApiEndpoint, headers: controlHeaders });
-    // Always probe the bound database — the .env stamp proves the project WAS
+    // Always probe the bound database — the DATABASE_ID stamp proves it WAS
     // bound, never that the database still exists (backend refresh, deletion,
     // revoked key). The probe is the single source of binding health.
     const probe = await probeDatabase({
@@ -99,7 +125,7 @@ export async function resolveProjectContext(cwd, options = {}) {
     // never shown in the Schemas tab or written to by the agent. The project's
     // local blueprint survives account changes, so recovery is a reprovision
     // under the signed-in account. Owner truth comes from the probe (backend),
-    // not the .env stamp. Data-plane resolution skips this gate — see
+    // not the source's stamp. Data-plane resolution skips this gate — see
     // ResolveOptions.
     const sessionUserId = account?.userId;
     if (options.plane !== 'data' &&

package/esm/index.d.ts

@@ -4,7 +4,7 @@ export declare const dbTools: ExtensionFactory;
 /** Configure the host and get the extension in one call. */
 export declare function createDbTools(host: PiToolsHost): ExtensionFactory;
 export { type ConfirmGate, type ConfirmGateDeps, type ConfirmGateOptions, createConfirmGate, } from './confirm-gate';
-export { deriveSubdomainEndpoint, type ModulesClient, type ProjectContext, resolveDataToken, resolveProjectContext, } from './context';
+export { CONTEXT_ENV_KEYS, CONTEXT_ENV_PREFIX, type ContextEnvKey, type ContextSource, deriveSubdomainEndpoint, fromEnvFile, fromEnvironment, type ModulesClient, type ProjectContext, type ProjectContextFailureCode, resolveDataToken, resolveProjectContext, } from './context';
 export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type HostProvisionOverlay, type PiToolsHost, type PreviewToken, } from './host';
 export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, type ProvisionManifest, } from './provision-database/manifest';
 export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, type ModulePreset, type ProvisionModule, } from './provision-database/presets';

package/esm/index.js

@@ -45,7 +45,7 @@ export function createDbTools(host) {
     return dbTools;
 }
 export { createConfirmGate, } from './confirm-gate';
-export { deriveSubdomainEndpoint, resolveDataToken, resolveProjectContext, } from './context';
+export { CONTEXT_ENV_KEYS, CONTEXT_ENV_PREFIX, deriveSubdomainEndpoint, fromEnvFile, fromEnvironment, resolveDataToken, resolveProjectContext, } from './context';
 export { configureHost, getHost, } from './host';
 export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, } from './provision-database/manifest';
 export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, } from './provision-database/presets';

package/index.d.ts

@@ -4,7 +4,7 @@ export declare const dbTools: ExtensionFactory;
 /** Configure the host and get the extension in one call. */
 export declare function createDbTools(host: PiToolsHost): ExtensionFactory;
 export { type ConfirmGate, type ConfirmGateDeps, type ConfirmGateOptions, createConfirmGate, } from './confirm-gate';
-export { deriveSubdomainEndpoint, type ModulesClient, type ProjectContext, resolveDataToken, resolveProjectContext, } from './context';
+export { CONTEXT_ENV_KEYS, CONTEXT_ENV_PREFIX, type ContextEnvKey, type ContextSource, deriveSubdomainEndpoint, fromEnvFile, fromEnvironment, type ModulesClient, type ProjectContext, type ProjectContextFailureCode, resolveDataToken, resolveProjectContext, } from './context';
 export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type HostProvisionOverlay, type PiToolsHost, type PreviewToken, } from './host';
 export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, type ProvisionManifest, } from './provision-database/manifest';
 export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, type ModulePreset, type ProvisionModule, } from './provision-database/presets';

package/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTemplatePreviewTables = exports.toolSchema = exports.resolveProvisionModules = exports.moduleKey = exports.getModulePreset = exports.DEFAULT_PROVISION_PRESET = exports.allModulePresets = exports.PROVISION_MANIFEST_FILE = exports.parseProvisionManifest = exports.loadProvisionManifest = exports.getHost = exports.configureHost = exports.resolveProjectContext = exports.resolveDataToken = exports.deriveSubdomainEndpoint = exports.createConfirmGate = exports.dbTools = void 0;
+exports.createTemplatePreviewTables = exports.toolSchema = exports.resolveProvisionModules = exports.moduleKey = exports.getModulePreset = exports.DEFAULT_PROVISION_PRESET = exports.allModulePresets = exports.PROVISION_MANIFEST_FILE = exports.parseProvisionManifest = exports.loadProvisionManifest = exports.getHost = exports.configureHost = exports.resolveProjectContext = exports.resolveDataToken = exports.fromEnvironment = exports.fromEnvFile = exports.deriveSubdomainEndpoint = exports.CONTEXT_ENV_PREFIX = exports.CONTEXT_ENV_KEYS = exports.createConfirmGate = exports.dbTools = void 0;
 exports.createDbTools = createDbTools;
 const confirm_gate_1 = require("./confirm-gate");
 const context_1 = require("./context");
@@ -52,7 +52,11 @@ function createDbTools(host) {
 var confirm_gate_2 = require("./confirm-gate");
 Object.defineProperty(exports, "createConfirmGate", { enumerable: true, get: function () { return confirm_gate_2.createConfirmGate; } });
 var context_2 = require("./context");
+Object.defineProperty(exports, "CONTEXT_ENV_KEYS", { enumerable: true, get: function () { return context_2.CONTEXT_ENV_KEYS; } });
+Object.defineProperty(exports, "CONTEXT_ENV_PREFIX", { enumerable: true, get: function () { return context_2.CONTEXT_ENV_PREFIX; } });
 Object.defineProperty(exports, "deriveSubdomainEndpoint", { enumerable: true, get: function () { return context_2.deriveSubdomainEndpoint; } });
+Object.defineProperty(exports, "fromEnvFile", { enumerable: true, get: function () { return context_2.fromEnvFile; } });
+Object.defineProperty(exports, "fromEnvironment", { enumerable: true, get: function () { return context_2.fromEnvironment; } });
 Object.defineProperty(exports, "resolveDataToken", { enumerable: true, get: function () { return context_2.resolveDataToken; } });
 Object.defineProperty(exports, "resolveProjectContext", { enumerable: true, get: function () { return context_2.resolveProjectContext; } });
 var host_2 = require("./host");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentic-kit/pi",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "description": "Pi adapter for agentic-kit — the Constructive typed db tools (provision, blueprint, codegen, records, policies, templates) and confirm gate as a pi coding-agent extension",
   "main": "index.js",
@@ -29,9 +29,10 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
+    "12factor-env": "^1.28.0",
     "@agentic-kit/harness": "^0.12.0",
-    "@constructive-io/graphql-query": "^4.12.10",
-    "@constructive-io/sdk": "^1.11.11",
+    "@constructive-io/graphql-query": "^4.12.11",
+    "@constructive-io/sdk": "^1.11.12",
     "node-type-registry": "^1.16.0",
     "zod": "^4.4.3"
   },
@@ -48,5 +49,5 @@
     "coding-agent",
     "constructive"
   ],
-  "gitHead": "6d4354f47b8bd4d3d1c2bd918a12dcb0315e1931"
+  "gitHead": "eacbe10ce544848c93a4c17fc8a8474d1a788a18"
 }