@agentic-kit/pi 0.17.1 → 0.18.1

package/esm/context.js

@@ -1,270 +0,0 @@
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import { api, auth, modules } from '@constructive-io/sdk';
-import { parseDotenv } from '12factor-env/dotenv';
-import { probeDatabase } from './db-probe';
-import { DEFAULT_DATA_TOKEN_SKEW_MS, getHost } from './host';
-const DEFAULT_API_ENDPOINT = 'http://api.localhost:3000/graphql';
-const DEFAULT_MODULES_ENDPOINT = 'http://modules.localhost:3000/graphql';
-// The project values pi needs, and where they come from. A scaffolded project
-// folder carries them in `.env` (desktop); a headless host — a container, a
-// Job, CI — injects them as real environment variables, so no credential is
-// ever written into a git clone the agent could commit. Both lanes produce the
-// same record, which is why the resolver takes VALUES, not a directory.
-export const CONTEXT_ENV_KEYS = [
-    'ACCESS_TOKEN',
-    'DATABASE_ID',
-    'API_ENDPOINT',
-    'MODULES_ENDPOINT',
-    'DATABASE_NAME',
-    'OWNER_ID',
-];
-/** Prefix for injected variables: `ACCESS_TOKEN` is far too generic to claim in
- *  a shared process environment, `CONSTRUCTIVE_ACCESS_TOKEN` is not. Inside a
- *  project `.env` the bare names stay readable (and are what the scaffolder
- *  writes), so both spellings resolve, prefixed winning. */
-export const CONTEXT_ENV_PREFIX = 'CONSTRUCTIVE_';
-const lookup = (source) => typeof source === 'function' ? source : (name) => source[name];
-const readContextValue = (source, key) => {
-    const get = lookup(source);
-    const value = get(`${CONTEXT_ENV_PREFIX}${key}`) ?? get(key);
-    return value ? value : undefined;
-};
-/** Use the process environment (or any injected record) as the source. */
-export function fromEnvironment(environment = process.env) {
-    return environment;
-}
-/** Read a project `.env` as the source. The file is authoritative here — the
- *  key in it belongs to whatever backend wrote it, so it is not merged under
- *  the ambient environment. Returns null when the file is absent. */
-export async function fromEnvFile(cwd) {
-    try {
-        return parseDotenv(await readFile(path.join(cwd, '.env'), 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Resolve the project context from injected values, or from a project folder.
- *
- * Passing a `cwd` string keeps the original behavior (read `<cwd>/.env`) so
- * existing hosts — Constructive Desktop, the confirm gate — are unchanged.
- * Headless hosts pass values instead: `fromEnvironment()` for a container or
- * Job, an explicit record for anything else.
- */
-export async function resolveProjectContext(input, options = {}) {
-    const source = typeof input === 'string' ? await fromEnvFile(input) : input;
-    if (!source) {
-        return {
-            context: null,
-            reason: 'No .env found in the project. Provision a Constructive database first (scaffold the project), then retry.',
-            code: 'no-env',
-        };
-    }
-    const env = Object.fromEntries(CONTEXT_ENV_KEYS.map((key) => [key, readContextValue(source, key)]));
-    const accessToken = env.ACCESS_TOKEN;
-    const databaseId = env.DATABASE_ID;
-    if (!accessToken || !databaseId) {
-        return {
-            context: null,
-            reason: `Project is not connected to a Constructive database yet (missing ${CONTEXT_ENV_PREFIX}ACCESS_TOKEN/${CONTEXT_ENV_PREFIX}DATABASE_ID in the environment, or ACCESS_TOKEN/DATABASE_ID in .env). Provision the database first, then retry.`,
-            code: 'missing-credentials',
-        };
-    }
-    // A source-supplied pin wins for the DATA plane (the access key belongs to
-    // whatever backend wrote it); otherwise fall back to the app's backend-config
-    // store (environment-aware) so app + harness share one endpoint source.
-    const host = getHost();
-    const backend = host.backendConfig();
-    const apiEndpoint = env.API_ENDPOINT || backend?.apiEndpoint || DEFAULT_API_ENDPOINT;
-    const modulesEndpoint = env.MODULES_ENDPOINT || backend?.modulesEndpoint || DEFAULT_MODULES_ENDPOINT;
-    // The whole control plane (binding probe, schema resolution, blueprint/schema
-    // tools) authenticates with the ACCOUNT bearer: the platform api rejects
-    // per-database keys, so the project ACCESS_TOKEN can never act on metaschema
-    // surfaces. The source's key stays in the context for the data plane only.
-    // The bearer is only ever sent to the app-configured backend — never a
-    // source-pinned endpoint, which an untrusted cloned project controls.
-    const controlApiEndpoint = backend?.apiEndpoint || DEFAULT_API_ENDPOINT;
-    const controlModulesEndpoint = backend?.modulesEndpoint || DEFAULT_MODULES_ENDPOINT;
-    const account = host.account();
-    const accountBearer = account?.apiKey ?? account?.accessToken;
-    if (!accountBearer) {
-        return {
-            context: null,
-            reason: `No usable account credential to reach the Constructive control plane. ${host.signInHint ?? 'Sign in to the app, then retry.'}`,
-            code: 'missing-credentials',
-        };
-    }
-    const controlHeaders = { Authorization: `Bearer ${accountBearer}` };
-    const apiClient = api.createClient({ endpoint: controlApiEndpoint, headers: controlHeaders });
-    // Always probe the bound database — the DATABASE_ID stamp proves it WAS
-    // bound, never that the database still exists (backend refresh, deletion,
-    // revoked key). The probe is the single source of binding health.
-    const probe = await probeDatabase({
-        endpoint: controlApiEndpoint,
-        bearer: accountBearer,
-        databaseId,
-        signInHint: host.signInHint,
-    });
-    if (probe.outcome === 'unreachable') {
-        return {
-            context: null,
-            reason: `Could not reach the Constructive backend at ${controlApiEndpoint} (${probe.detail}). Check it is running, then retry.`,
-            code: 'backend-unreachable',
-        };
-    }
-    if (probe.outcome === 'missing') {
-        return {
-            context: null,
-            reason: `The bound database (DATABASE_ID=${databaseId}) no longer exists on this backend. Re-provision with provision_database (reprovision: true) — the schema is rebuilt from the project; records do not carry over.`,
-            code: 'db-missing',
-        };
-    }
-    // Schemas are account-scoped: a live binding under a different account is
-    // never shown in the Schemas tab or written to by the agent. The project's
-    // local blueprint survives account changes, so recovery is a reprovision
-    // under the signed-in account. Owner truth comes from the probe (backend),
-    // not the source's stamp. Data-plane resolution skips this gate — see
-    // ResolveOptions.
-    const sessionUserId = account?.userId;
-    if (options.plane !== 'data' &&
-        probe.ownerId &&
-        sessionUserId &&
-        probe.ownerId !== sessionUserId) {
-        return {
-            context: null,
-            reason: `The bound database (DATABASE_ID=${databaseId}) was provisioned under a different account than the one signed in. Re-provision with provision_database (reprovision: true) to rebuild it under this account — the schema is rebuilt from the project; records do not carry over.`,
-            code: 'account-mismatch',
-        };
-    }
-    const databaseName = env.DATABASE_NAME || probe.name || '';
-    const ownerId = probe.ownerId || env.OWNER_ID || undefined;
-    const dataEndpoint = databaseName
-        ? deriveSubdomainEndpoint(apiEndpoint, `api-${databaseName}`)
-        : '';
-    const schemaId = await resolveSchemaId(apiClient, databaseId);
-    if (!schemaId) {
-        return {
-            context: null,
-            reason: 'Could not resolve a schema (app_public/public) for this database. The database may not be fully provisioned yet.',
-            code: 'schema-unresolved',
-        };
-    }
-    return {
-        context: {
-            api: apiClient,
-            modules: modules.createClient({ endpoint: controlModulesEndpoint, headers: controlHeaders }),
-            databaseId,
-            schemaId,
-            ownerId,
-            apiEndpoint,
-            modulesEndpoint,
-            databaseName,
-            accessToken,
-            dataEndpoint,
-        },
-        reason: '',
-    };
-}
-const needsAuthReason = () => `Not signed in to the app database yet. ${getHost().signInHint ??
-    'Sign in from the Sheets tab, or open the Preview and sign in to your app, then try again.'}`;
-// Resolve a data-plane token for record operations: serve the broker's active
-// account while valid, otherwise harvest the token the user created by signing
-// into their app in the Preview and adopt it into the broker. Also returns the
-// signed-in user's id (used to scope rows by entityId). Returns a reason (no
-// token) when neither source has a valid token — the caller surfaces a sign-in
-// prompt.
-export async function resolveDataToken(context) {
-    const host = getHost();
-    const broker = host.dataAuthBroker;
-    const active = broker?.getActiveToken(context.databaseId);
-    if (active)
-        return { token: active.token, userId: active.userId };
-    const preview = host.previewToken ? await host.previewToken() : null;
-    if (!preview)
-        return { reason: needsAuthReason() };
-    if (broker?.isInvalidToken(context.databaseId, preview.accessToken)) {
-        return { reason: needsAuthReason() };
-    }
-    const parsed = preview.accessTokenExpiresAt ? Date.parse(preview.accessTokenExpiresAt) : NaN;
-    const expiresAt = Number.isNaN(parsed) ? Date.now() + 60 * 60 * 1000 : parsed;
-    const skewMs = host.dataTokenSkewMs ?? DEFAULT_DATA_TOKEN_SKEW_MS;
-    if (expiresAt <= Date.now() + skewMs)
-        return { reason: needsAuthReason() };
-    broker?.adoptToken(context.databaseId, {
-        userId: preview.userId,
-        token: preview.accessToken,
-        expiresAt,
-        origin: 'harvest',
-    });
-    return { token: preview.accessToken, userId: preview.userId };
-}
-// Per-DB endpoints are deterministic on the provisioning subdomain (= DATABASE_NAME):
-// each plane swaps the first host label of its control-plane endpoint
-// (e.g. api.localhost -> api-myapp.localhost, auth.localhost -> auth-myapp.localhost).
-export function deriveSubdomainEndpoint(baseEndpoint, firstLabel) {
-    try {
-        const url = new URL(baseEndpoint);
-        const labels = url.hostname.split('.');
-        labels[0] = firstLabel;
-        url.hostname = labels.join('.');
-        return url.toString();
-    }
-    catch {
-        return '';
-    }
-}
-// The backend hierarchy is org -> db -> tables; the owning org is the auth-plane
-// user the database's ownerId points at. Best-effort display lookup only —
-// binding health never depends on it. Authenticates with the account bearer
-// against the app-configured auth endpoint (the platform rejects per-database
-// keys, and the bearer never goes to a .env-pinned endpoint).
-export async function resolveOrgName(ownerId) {
-    try {
-        const host = getHost();
-        const account = host.account();
-        const bearer = account?.apiKey ?? account?.accessToken;
-        if (!bearer)
-            return undefined;
-        const backend = host.backendConfig();
-        const authEndpoint = deriveSubdomainEndpoint(backend?.apiEndpoint || DEFAULT_API_ENDPOINT, 'auth');
-        if (!authEndpoint)
-            return undefined;
-        const client = auth.createClient({
-            endpoint: authEndpoint,
-            headers: { Authorization: `Bearer ${bearer}` },
-        });
-        const result = await client.user
-            .findMany({
-            select: { displayName: true, username: true },
-            where: { id: { equalTo: ownerId } },
-        })
-            .execute();
-        if (!result.ok)
-            return undefined;
-        const node = (result.data.users?.nodes ?? [])[0];
-        return node?.displayName || node?.username || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function resolveSchemaId(apiClient, databaseId) {
-    const result = await apiClient.schema
-        .findMany({
-        select: { id: true, name: true },
-        where: { databaseId: { equalTo: databaseId } },
-    })
-        .execute();
-    if (!result.ok)
-        return undefined;
-    const nodes = (result.data.schemas?.nodes ?? []).filter((s) => Boolean(s && s.id));
-    const appPublic = nodes.find((s) => s.name === 'app_public');
-    if (appPublic)
-        return appPublic.id;
-    const pub = nodes.find((s) => s.name === 'public');
-    if (pub)
-        return pub.id;
-    return nodes[0]?.id;
-}

package/esm/db-probe.d.ts

@@ -1,30 +0,0 @@
-export type DatabaseProbe = {
-    outcome: 'found';
-    name?: string;
-    ownerId?: string;
-} | {
-    outcome: 'missing';
-} | {
-    outcome: 'unreachable';
-    detail: string;
-};
-export type ProbeExecutor = {
-    execute<T>(document: string, variables?: Record<string, unknown>): Promise<{
-        ok: true;
-        data: T;
-        errors: undefined;
-    } | {
-        ok: false;
-        data: null;
-        errors: {
-            message: string;
-        }[];
-    }>;
-};
-export declare function probeDatabase(args: {
-    endpoint: string;
-    bearer: string;
-    databaseId: string;
-    executor?: ProbeExecutor;
-    signInHint?: string;
-}): Promise<DatabaseProbe>;

package/esm/db-probe.js

@@ -1,47 +0,0 @@
-import { api } from '@constructive-io/sdk';
-const AUTH_ERROR_RE = /unauthenticated|unauthorized|permission denied|jwt|http 401|http 403/i;
-// Liveness probe for a bound database. The split drives recovery: 'missing'
-// means the backend answered and the binding is dead (database deleted,
-// backend refreshed) — recovery is reprovision. 'unreachable' means no usable
-// answer (backend down, network error, rejected credential) — recovery is
-// retry/re-sign-in, never reprovision.
-//
-// The probe authenticates with the ACCOUNT bearer, not the project's .env key:
-// the platform api rejects per-database keys, and the singular `database(id:)`
-// field is gone from the current contract, so the lookup goes through the
-// `databases` collection filter via the SDK's raw FetchAdapter.
-export async function probeDatabase(args) {
-    const executor = args.executor ??
-        new api.FetchAdapter(args.endpoint, { Authorization: `Bearer ${args.bearer}` });
-    const document = `
-    query ProbeDatabase {
-      databases(where: { id: { equalTo: ${JSON.stringify(args.databaseId)} } }) {
-        nodes { id name ownerId }
-      }
-    }`;
-    try {
-        const result = await executor.execute(document);
-        if (result.ok) {
-            const node = result.data.databases?.nodes?.[0];
-            if (!node)
-                return { outcome: 'missing' };
-            return { outcome: 'found', name: node.name ?? undefined, ownerId: node.ownerId ?? undefined };
-        }
-        const detail = result.errors?.[0]?.message ?? 'unknown error';
-        // A 5xx is the backend failing, not an answer about this database. An auth
-        // rejection is a dead ACCOUNT credential — never evidence the binding is
-        // dead, so it must not push toward reprovision.
-        if (/^HTTP 5\d\d/i.test(detail))
-            return { outcome: 'unreachable', detail };
-        if (AUTH_ERROR_RE.test(detail)) {
-            return {
-                outcome: 'unreachable',
-                detail: `${detail} — the account credential was rejected. ${args.signInHint ?? 'Sign in again, then retry.'}`,
-            };
-        }
-        return { outcome: 'missing' };
-    }
-    catch (err) {
-        return { outcome: 'unreachable', detail: err instanceof Error ? err.message : String(err) };
-    }
-}

package/esm/policy/add-policies-to-table.d.ts

@@ -1,26 +0,0 @@
-import { type PolicyProvisioningCategory } from '@agentic-kit/harness';
-import type { ModulesClient } from '../context';
-import { type CrudOperation, type CrudPolicyConfigs } from './provision-helpers';
-export interface AddPoliciesToTablePolicyEntry {
-    policyType: string;
-    dataNodeType?: string;
-    nodeData?: Record<string, unknown>;
-    sharedPolicyData: Record<string, unknown>;
-    operations: CrudPolicyConfigs;
-    enabledOperations?: CrudOperation[];
-}
-export interface AddPoliciesToTableInput {
-    client: ModulesClient;
-    databaseId: string;
-    schemaId: string;
-    tableId: string;
-    policies: AddPoliciesToTablePolicyEntry[];
-}
-export declare class UnsupportedPolicyCategoryError extends Error {
-    readonly policyType: string;
-    readonly category: PolicyProvisioningCategory;
-    constructor(policyType: string, category: PolicyProvisioningCategory);
-}
-export declare function addPoliciesToExistingTable(input: AddPoliciesToTableInput): Promise<{
-    success: true;
-}>;

package/esm/policy/add-policies-to-table.js

@@ -1,66 +0,0 @@
-import { getPolicyCategory } from '@agentic-kit/harness';
-import { buildGrants, buildPolicyEntry, CRUD_OPERATIONS, groupOperationsByConfig, } from './provision-helpers';
-const SUPPORTED_CATEGORIES = new Set([
-    'has-module',
-    'no-fields',
-    'needs-table',
-]);
-export class UnsupportedPolicyCategoryError extends Error {
-    policyType;
-    category;
-    constructor(policyType, category) {
-        super(`Policy type "${policyType}" has category "${category}" which requires column creation or composite handling — use the policies UI instead.`);
-        this.policyType = policyType;
-        this.category = category;
-        this.name = 'UnsupportedPolicyCategoryError';
-    }
-}
-export async function addPoliciesToExistingTable(input) {
-    const { client } = input;
-    for (const entry of input.policies) {
-        const category = getPolicyCategory(entry.policyType);
-        if (!SUPPORTED_CATEGORIES.has(category)) {
-            throw new UnsupportedPolicyCategoryError(entry.policyType, category);
-        }
-    }
-    const policiesArray = [];
-    const nodesByType = new Map();
-    for (const entry of input.policies) {
-        const groups = groupOperationsByConfig(entry.enabledOperations ?? CRUD_OPERATIONS, entry.operations);
-        for (const group of groups) {
-            const ops = group.privileges.join('_');
-            const rand = Math.random().toString(36).slice(2, 8);
-            policiesArray.push(buildPolicyEntry(entry.policyType, {
-                privileges: group.privileges,
-                policy_role: group.roleName,
-                permissive: group.isPermissive,
-                data: entry.sharedPolicyData,
-                policy_name: `${ops}_${rand}`,
-            }));
-        }
-        if (entry.dataNodeType && !nodesByType.has(entry.dataNodeType)) {
-            const nodeData = entry.nodeData ?? {};
-            nodesByType.set(entry.dataNodeType, {
-                $type: entry.dataNodeType,
-                ...(Object.keys(nodeData).length > 0 ? { data: nodeData } : {}),
-            });
-        }
-    }
-    const provisionInput = {
-        databaseId: input.databaseId,
-        schemaId: input.schemaId,
-        tableId: input.tableId,
-        grants: buildGrants(),
-        policies: policiesArray,
-    };
-    if (nodesByType.size > 0) {
-        provisionInput.nodes = [...nodesByType.values()];
-    }
-    await client.secureTableProvision
-        .create({
-        data: provisionInput,
-        select: { id: true, tableId: true, tableName: true },
-    })
-        .unwrap();
-    return { success: true };
-}

package/esm/policy/provision-helpers.d.ts

@@ -1,38 +0,0 @@
-export type CrudOperation = 'create' | 'read' | 'update' | 'delete';
-export interface OperationPolicyConfig {
-    roleName: string;
-    isPermissive: boolean;
-    policyData: Record<string, unknown>;
-    isCustomized: boolean;
-}
-export interface CrudPolicyConfigs {
-    create: OperationPolicyConfig;
-    read: OperationPolicyConfig;
-    update: OperationPolicyConfig;
-    delete: OperationPolicyConfig;
-}
-export declare const CRUD_OPERATIONS: CrudOperation[];
-export type GrantPrivilege = [string, string | string[]];
-export interface GrantEntry {
-    roles: string[];
-    privileges: GrantPrivilege[];
-}
-export interface PolicyEntry {
-    $type: string;
-    data?: Record<string, unknown>;
-    privileges?: string[];
-    policy_role?: string;
-    permissive?: boolean;
-    policy_name?: string;
-}
-export declare const ALL_CRUD_PRIVILEGES: GrantPrivilege[];
-export declare function crudOpToPrivilege(op: CrudOperation): string;
-export declare function crudOpsToPrivileges(ops: readonly CrudOperation[]): string[];
-export declare function buildGrants(roles?: string[], privileges?: GrantPrivilege[]): GrantEntry[];
-export declare function buildPolicyEntry(type: string, opts?: Partial<Omit<PolicyEntry, '$type'>>): PolicyEntry;
-export interface OperationGroup {
-    roleName: string;
-    isPermissive: boolean;
-    privileges: string[];
-}
-export declare function groupOperationsByConfig(enabledOperations: readonly CrudOperation[], operations: CrudPolicyConfigs): OperationGroup[];

package/esm/policy/provision-helpers.js

@@ -1,50 +0,0 @@
-export const CRUD_OPERATIONS = ['create', 'read', 'update', 'delete'];
-export const ALL_CRUD_PRIVILEGES = [
-    ['select', '*'],
-    ['insert', '*'],
-    ['update', '*'],
-    ['delete', '*'],
-];
-const CRUD_OP_TO_LOWER_PRIVILEGE = {
-    create: 'insert',
-    read: 'select',
-    update: 'update',
-    delete: 'delete',
-};
-export function crudOpToPrivilege(op) {
-    return CRUD_OP_TO_LOWER_PRIVILEGE[op];
-}
-export function crudOpsToPrivileges(ops) {
-    return ops.map(crudOpToPrivilege);
-}
-export function buildGrants(roles = ['authenticated'], privileges = ALL_CRUD_PRIVILEGES) {
-    return [{ roles, privileges }];
-}
-export function buildPolicyEntry(type, opts = {}) {
-    const entry = { $type: type };
-    if (opts.data && Object.keys(opts.data).length > 0)
-        entry.data = opts.data;
-    if (opts.privileges && opts.privileges.length > 0)
-        entry.privileges = opts.privileges;
-    if (opts.policy_role)
-        entry.policy_role = opts.policy_role;
-    if (opts.permissive !== undefined)
-        entry.permissive = opts.permissive;
-    if (opts.policy_name)
-        entry.policy_name = opts.policy_name;
-    return entry;
-}
-export function groupOperationsByConfig(enabledOperations, operations) {
-    const groupMap = new Map();
-    for (const op of enabledOperations) {
-        const config = operations[op];
-        const key = `${config.roleName}:${config.isPermissive}`;
-        let group = groupMap.get(key);
-        if (!group) {
-            group = { roleName: config.roleName, isPermissive: config.isPermissive, privileges: [] };
-            groupMap.set(key, group);
-        }
-        group.privileges.push(...crudOpsToPrivileges([op]));
-    }
-    return [...groupMap.values()];
-}

package/esm/provision-database/credential.d.ts

@@ -1,14 +0,0 @@
-export type AccountCredential = {
-    userId: string;
-    accessToken: string;
-    apiKey?: string;
-};
-export type ProvisionCredential = {
-    mode: 'account';
-    ownerId: string;
-    bearer: string;
-} | {
-    mode: 'error';
-    reason: string;
-};
-export declare function selectProvisionCredential(account: AccountCredential | null | undefined, signInHint?: string): ProvisionCredential;

package/esm/provision-database/credential.js

@@ -1,19 +0,0 @@
-// Pure: decide which credential authenticates a project's provisioning. Under the
-// account gate a signed-in session is guaranteed, so every new project provisions
-// UNDER the account (account-owned + enumerable): the database's owner_id is the
-// account's own userId, and the account's API key (falling back to its session
-// token) is the bearer that authenticates the provision mutation and lands in the
-// project .env as ACCESS_TOKEN (refreshed on every provision run, including the
-// skip path). A signed-in session with no usable bearer (keychain locked) is an
-// explicit error, never a silent throwaway owner.
-// Side-effect-free so the branch is unit-testable without runtime/network.
-export function selectProvisionCredential(account, signInHint) {
-    const bearer = account?.apiKey ?? account?.accessToken;
-    if (account?.userId && bearer) {
-        return { mode: 'account', ownerId: account.userId, bearer };
-    }
-    return {
-        mode: 'error',
-        reason: `No usable account credential. ${signInHint ?? 'Sign in (or unlock your session) before provisioning a database.'}`,
-    };
-}

package/esm/provision-database/env-file.d.ts

@@ -1,37 +0,0 @@
-export type EnvVars = Record<string, string>;
-/**
- * Upsert `vars` into the existing `.env` `content`. Existing keys are replaced
- * in place (preserving surrounding lines/comments); new keys are appended.
- * Returns the new file body, trailing-newline-terminated.
- */
-export declare function mergeEnv(content: string, vars: EnvVars): string;
-/** The credential keys provision_database owns in a project's .env. */
-export declare const PROVISION_ENV_KEYS: readonly ["DATABASE_ID", "DATABASE_NAME", "OWNER_ID", "ACCESS_TOKEN", "PGDATABASE", "API_ENDPOINT", "MODULES_ENDPOINT"];
-/**
- * Keys archived as comments on reprovision — the binding identity: which
- * database, under whom, on which backend. ACCESS_TOKEN is the account login
- * token, identical across bindings, so it is overwritten in place rather than
- * archived.
- */
-export declare const ARCHIVED_BINDING_KEYS: readonly ["DATABASE_ID", "DATABASE_NAME", "OWNER_ID", "PGDATABASE", "API_ENDPOINT", "MODULES_ENDPOINT"];
-/**
- * Build the provisioning credential block written to a project's .env. The
- * endpoint pins record which backend owns this binding — outside-app consumers
- * (verify-feature.sh, skill scripts, dev-server shells) resolve them instead of
- * falling back to localhost defaults when the app targets a hosted backend.
- */
-export declare function provisionEnvVars(args: {
-    databaseId: string;
-    databaseName: string;
-    ownerId: string;
-    accessToken: string;
-    apiEndpoint: string;
-    modulesEndpoint: string;
-}): EnvVars;
-/**
- * Comment out the given keys in place (`# archived <date>: KEY=value`) so a
- * reprovision keeps the previous binding readable in the file instead of
- * silently overwriting it. Every other line — including existing comments and
- * already-archived entries — passes through untouched.
- */
-export declare function archiveBindingKeys(content: string, keys: readonly string[], archivedOn: string): string;