@lucern/contracts 0.3.0-alpha.11 → 0.3.0-alpha.12

package/dist/index.d.ts

@@ -25,6 +25,7 @@ export { ProjectionRegistry, projections } from './projections/index.js';
 export * from './function-registry/index.js';
 export { t as mcpToolsContract } from './tool-contracts-BevD9Ho2.js';
 export { EntityConnectionMatch, EntityMatchCandidate, EntityTypeMatch, OntologyEntityType, rankEntityConnections, rankEntityTypeMatches, scoreEntityConnection, scoreEntityTypeMatch } from './v1/ontologies/v1.js';
+export { PermitAliasProjection, PermitGroupMembershipProjection, PermitPrincipalProjection, PermitProjectedUserRecord, PermitProjectionPlatformRole, PermitProjectionRows, PermitRoleAssignmentProjection, buildProjectedUserFromPermitPrincipal, findProjectedUserByPermitClerkId, findProjectedUserByPermitPrincipalId, isActivePermitProjectionStatus, mapPermitRoleToPlatformRole, readPermitProjectionString } from './permit-principal-projection.contract.js';
 export { LucernPrompt, LucernPromptModelHint, isLucernPrompt } from './prompt.contract.js';
 export { AddEvidenceInput, AddWorktreeInput, BeliefResult, BisectConfidenceInput, BisectResult, BranchResult, CompileContextInput, CompiledContextResult, ConfidenceResult, ContradictionResult, CreateBeliefInput, CreateBranchInput, CreateEdgeInput, EdgeResult, EvidenceResult, FlagContradictionInput, ForkBeliefInput, ForkResult, JudgmentResult, LineageResult, LucernClient, LucernClientConfig, LucernGraphMethods, LucernWorkflowMethods, MergeInput, MergeResult, ModulateConfidenceInput, OpenPullRequestInput, PullRequestResult, PushInput, PushResult, QueryLineageInput, RecordJudgmentInput, RefineBeliefInput, SearchBeliefsInput, WorktreeResult } from './sdk-methods.contract.js';
 export { s as sdkToolsContract } from './sdk-tools.contract-BNklQDfB.js';

package/dist/index.js

@@ -5789,7 +5789,9 @@ var permitObjectType = z.enum([
   "group",
   "resource_instance",
   "relationship_tuple",
-  "role_assignment"
+  "role_assignment",
+  "attribute_binding",
+  "policy_bundle"
 ]);
 var permitOutboxOperation = z.enum([
   "upsert",
@@ -8732,6 +8734,37 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing."
   },
+  {
+    id: "platform.permit.webhook-secret",
+    canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET",
+    aliases: ["PERMIT_WEBHOOK_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-gateway", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+  },
   {
     id: "platform.permit.pdp-url",
     canonicalName: "LUCERN_PERMIT_PDP_URL",
@@ -11127,6 +11160,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PERMIT_API_KEY",
     "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROD_DEPLOY_KEY",
     "LUCERN_PROD_URL",
     "LUCERN_PROFILE",
@@ -11197,6 +11231,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
+    "PERMIT_WEBHOOK_SECRET",
     "PINECONE_API_KEY",
     "PINECONE_HOST",
     "PINECONE_INDEX",
@@ -11376,6 +11411,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PERMIT_API_KEY",
     "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROD_DEPLOY_KEY",
     "LUCERN_PROD_URL",
     "LUCERN_PROFILE",
@@ -11449,6 +11485,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
+    "PERMIT_WEBHOOK_SECRET",
     "PINECONE_API_KEY",
     "PINECONE_HOST",
     "PINECONE_INDEX",
@@ -14209,6 +14246,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "Optional Permit PDP URL override."
     },
+    "LUCERN_PERMIT_WEBHOOK_SECRET": {
+      "secretId": "platform.permit.webhook-secret",
+      "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+      "envNames": [
+        "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "PERMIT_WEBHOOK_SECRET"
+      ],
+      "aliases": [
+        "PERMIT_WEBHOOK_SECRET"
+      ],
+      "writeNames": [
+        "LUCERN_PERMIT_WEBHOOK_SECRET"
+      ],
+      "required": true,
+      "secret": true,
+      "public": false,
+      "sourcePath": "/platform/permit",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "mc-convex",
+        "lucern-gateway",
+        "mc-operator-tooling"
+      ],
+      "destinations": [
+        {
+          "kind": "convex",
+          "target": "master-control",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        },
+        {
+          "kind": "operator_local",
+          "target": "mc-credential-maintenance",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        }
+      ],
+      "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+    },
     "LUCERN_PROXY_TOKEN_SECRET": {
       "secretId": "tenant.stack-frontend.lucern.proxy-token-secret",
       "canonicalName": "LUCERN_PROXY_TOKEN_SECRET",
@@ -16907,6 +16992,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_URL": "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL": "LUCERN_PERMIT_PDP_URL",
     "PERMIT_PDP_URL": "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET": "LUCERN_PERMIT_WEBHOOK_SECRET",
+    "PERMIT_WEBHOOK_SECRET": "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROXY_TOKEN_SECRET": "LUCERN_PROXY_TOKEN_SECRET",
     "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
     "LUCERN_KERNEL_INSTALL_SPEC": "LUCERN_SDK_NPM_TOKEN",
@@ -18190,6 +18277,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Optional Permit PDP URL override."
         },
+        {
+          "secretId": "platform.permit.webhook-secret",
+          "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "envNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET",
+            "PERMIT_WEBHOOK_SECRET"
+          ],
+          "aliases": [
+            "PERMIT_WEBHOOK_SECRET"
+          ],
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ],
+          "required": true,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/permit",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "mc-convex",
+            "lucern-gateway",
+            "mc-operator-tooling"
+          ],
+          "destinations": [
+            {
+              "kind": "convex",
+              "target": "master-control",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "mc-credential-maintenance",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            }
+          ],
+          "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+        },
         {
           "secretId": "platform.runtime.require-deployment-host-registry",
           "canonicalName": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
@@ -21882,6 +22017,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Optional Permit PDP URL override."
       },
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.mc.session-token-secret",
         "canonicalName": "LUCERN_SESSION_TOKEN_SECRET",
@@ -29694,6 +29877,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       }
     ],
     "operator_local:mc-credential-maintenance": [
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.mc.tenant-secret-encryption-key",
         "canonicalName": "LUCERN_TENANT_SECRET_ENCRYPTION_KEY",
@@ -34016,6 +34247,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Optional Permit PDP URL override."
       },
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.runtime.require-deployment-host-registry",
         "canonicalName": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
@@ -42713,6 +42992,164 @@ function rankEntityConnections(nodeText, candidates, options) {
   ).filter((m) => m.score >= minScore).sort((a, b) => b.score - a.score).slice(0, limit);
 }
 
+// src/permit-principal-projection.contract.ts
+var PLATFORM_ROLE_PRIORITY = {
+  platform_admin: 70,
+  tenant_admin: 60,
+  workspace_admin: 50,
+  editor: 40,
+  auditor: 30,
+  viewer: 20,
+  service_agent: 10
+};
+function readPermitProjectionString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function isActivePermitProjectionStatus(value) {
+  const status = readPermitProjectionString(value)?.toLowerCase();
+  return !status || status === "active" || status === "synced";
+}
+function mapPermitRoleToPlatformRole(role) {
+  switch (readPermitProjectionString(role)?.toLowerCase()) {
+    case "platform_admin":
+      return "platform_admin";
+    case "tenant_admin":
+      return "tenant_admin";
+    case "workspace_admin":
+    case "deployment_admin":
+    case "graph_admin":
+      return "workspace_admin";
+    case "editor":
+    case "workspace_member":
+    case "graph_editor":
+    case "evidence_contributor":
+    case "question_resolver":
+    case "theme_promoter":
+      return "editor";
+    case "auditor":
+      return "auditor";
+    case "viewer":
+    case "graph_viewer":
+    case "stakeholder_viewer":
+    case "stakeholder_summarizer":
+    case "source_drilldown_viewer":
+    case "restricted_data_viewer":
+    case "proprietary_data_viewer":
+      return "viewer";
+    case "service_agent":
+    case "agent_runner":
+      return "service_agent";
+    default:
+      return void 0;
+  }
+}
+function highestPlatformRole(roles) {
+  return roles.reduce(
+    (best, role) => PLATFORM_ROLE_PRIORITY[role] > PLATFORM_ROLE_PRIORITY[best] ? role : best,
+    "viewer"
+  );
+}
+function isClerkAliasFor(alias, clerkId) {
+  return isActivePermitProjectionStatus(alias.status) && readPermitProjectionString(alias.provider)?.toLowerCase() === "clerk" && (readPermitProjectionString(alias.providerSubjectId) === clerkId || readPermitProjectionString(alias.alias) === clerkId);
+}
+function emailFromAlias(aliases, principal) {
+  return aliases.find(
+    (alias) => readPermitProjectionString(alias.aliasKind)?.toLowerCase() === "email"
+  )?.alias ?? readPermitProjectionString(principal.metadata?.email);
+}
+function groupIdsForPrincipal(memberships2, principal) {
+  const principalId = readPermitProjectionString(principal.principalId);
+  if (!principalId) return [];
+  return [
+    ...new Set(
+      memberships2.filter(
+        (membership) => isActivePermitProjectionStatus(membership.status) && readPermitProjectionString(membership.tenantId) === readPermitProjectionString(principal.tenantId) && readPermitProjectionString(membership.memberType) === "principal" && (readPermitProjectionString(membership.memberId) === principalId || readPermitProjectionString(membership.principalId) === principalId)
+      ).map((membership) => readPermitProjectionString(membership.groupId)).filter((groupId) => Boolean(groupId))
+    )
+  ];
+}
+function rolesForPrincipal(assignments, principal, groupIds) {
+  const principalId = readPermitProjectionString(principal.principalId);
+  const tenantId = readPermitProjectionString(principal.tenantId);
+  const roles = assignments.filter(
+    (assignment) => isActivePermitProjectionStatus(assignment.status) && readPermitProjectionString(assignment.tenantId) === tenantId && (readPermitProjectionString(assignment.targetType) === "principal" && readPermitProjectionString(assignment.targetId) === principalId || readPermitProjectionString(assignment.targetType) === "group" && groupIds.includes(
+      readPermitProjectionString(assignment.targetId) ?? ""
+    ))
+  ).map((assignment) => mapPermitRoleToPlatformRole(assignment.role)).filter(
+    (role) => Boolean(role)
+  );
+  if (readPermitProjectionString(principal.principalType) === "agent" || readPermitProjectionString(principal.principalType) === "service_principal") {
+    roles.push("service_agent");
+  }
+  return [...new Set(roles)];
+}
+function workspaceFromPermitProjection(principal, alias, assignments) {
+  return readPermitProjectionString(principal.workspaceId) ?? readPermitProjectionString(alias?.workspaceId) ?? readPermitProjectionString(
+    assignments.find(
+      (assignment) => readPermitProjectionString(assignment.targetId) === readPermitProjectionString(principal.principalId) && readPermitProjectionString(assignment.resourceType) === "workspace"
+    )?.resourceKey
+  ) ?? readPermitProjectionString(
+    assignments.find((assignment) => assignment.workspaceId)?.workspaceId
+  );
+}
+function buildProjectedUserFromPermitPrincipal(rows, principal, matchingAlias, now = Date.now()) {
+  const principalId = readPermitProjectionString(principal.principalId);
+  const tenantId = readPermitProjectionString(principal.tenantId);
+  if (!principalId || !tenantId || !isActivePermitProjectionStatus(principal.status)) {
+    return null;
+  }
+  const aliases = rows.aliases.filter(
+    (alias2) => readPermitProjectionString(alias2.tenantId) === tenantId && readPermitProjectionString(alias2.principalId) === principalId && isActivePermitProjectionStatus(alias2.status)
+  );
+  const groupIds = groupIdsForPrincipal(rows.groupMemberships, principal);
+  const roles = rolesForPrincipal(rows.roleAssignments, principal, groupIds);
+  if (roles.length === 0) {
+    return null;
+  }
+  const alias = matchingAlias ?? aliases[0];
+  const clerkId = readPermitProjectionString(
+    aliases.find(
+      (entry) => readPermitProjectionString(entry.provider)?.toLowerCase() === "clerk"
+    )?.providerSubjectId
+  ) ?? principalId;
+  return {
+    clerkId,
+    email: emailFromAlias(aliases, principal) ?? `${principalId}@permit.local`,
+    name: readPermitProjectionString(principal.displayName),
+    lastSeenAt: principal.lastSeenAt ?? principal.updatedAt ?? now,
+    chatCount: 0,
+    messageCount: 0,
+    mcRole: highestPlatformRole(roles),
+    mcRoleSyncedAt: principal.updatedAt ?? now,
+    defaultTenantId: tenantId,
+    defaultWorkspaceId: workspaceFromPermitProjection(principal, alias, rows.roleAssignments) ?? tenantId,
+    defaultPrincipalId: principalId,
+    principalGroupIds: groupIds,
+    governanceGrantsSyncedAt: principal.updatedAt ?? now,
+    createdAt: principal.createdAt ?? now,
+    updatedAt: principal.updatedAt ?? now
+  };
+}
+function findProjectedUserByPermitPrincipalId(rows, principalId, now = Date.now()) {
+  const normalizedPrincipalId = principalId.trim();
+  const principal = rows.principals.find(
+    (row) => isActivePermitProjectionStatus(row.status) && readPermitProjectionString(row.principalId) === normalizedPrincipalId
+  );
+  return principal ? buildProjectedUserFromPermitPrincipal(rows, principal, void 0, now) : null;
+}
+function findProjectedUserByPermitClerkId(rows, clerkId, now = Date.now()) {
+  const normalizedClerkId = clerkId.trim();
+  const matchingAlias = rows.aliases.find(
+    (alias) => isClerkAliasFor(alias, normalizedClerkId)
+  );
+  const principal = matchingAlias ? rows.principals.find(
+    (row) => readPermitProjectionString(row.tenantId) === readPermitProjectionString(matchingAlias.tenantId) && readPermitProjectionString(row.principalId) === readPermitProjectionString(matchingAlias.principalId)
+  ) : rows.principals.find(
+    (row) => readPermitProjectionString(row.principalId) === normalizedClerkId || readPermitProjectionString(row.principalId) === `user:${normalizedClerkId}`
+  );
+  return principal ? buildProjectedUserFromPermitPrincipal(rows, principal, matchingAlias, now) : null;
+}
+
 // src/prompt.contract.ts
 function isLucernPrompt(value) {
   if (!value || typeof value !== "object") {
@@ -45296,6 +45733,6 @@ var CANONICAL_WORKFLOW_DEFINITIONS = [
   }
 ];
 
-export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GENERATED_INFISICAL_BOOTSTRAP_ENV_NAMES, GENERATED_INFISICAL_CONTROL_ENV_NAMES, GENERATED_INFISICAL_KNOWN_ENV_NAMES, GENERATED_INFISICAL_MANAGED_ENV_NAMES, GENERATED_INFISICAL_RUNTIME_ENV, GENERATED_LUCERN_GATEWAY_ENV_NAMES, GENERATED_LUCERN_WEB_PUBLIC_ENV_NAMES, GENERATED_LUCERN_WEB_SERVER_ENV_NAMES, GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUICK_QUERIES, GRAPH_REF_NODE_TYPES, GraphRefSchema, INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DEFINITIONS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION, TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_PROFILES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, assertTenantClientImportAllowed, bigramTokenize, buildDomainEvent, buildTenantBootstrapTemplateSeedRows, canonicalGeneratedInfisicalEnvName, classifyTenantClientImport, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, convexTierForVercelDestinationEnvironment, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, expectedTenantConvexDeploymentForVercelEnvironment, fillGraphIntelligencePromptTemplate, findEdgePolicy, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalSecretDefinition, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, findTenantClientInstallablePackage, formatTenantClientImportViolation, generatedInfisicalVariableForName, getComponentBoundaryTableLayer, getGraphIntelligenceQuery, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, infisicalSecretDefinitionsForConsumer, infisicalSecretDefinitionsForDestination, isAfterCursor, isComponentBoundaryComponentOwnedTable, isGeneratedInfisicalKnownEnvName, isGeneratedInfisicalManagedEnvName, isGraphIntelligenceQueryMode, isLucernPrompt, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport, jaccardSimilarity, lastDelegator, listBeliefsProjection, listGraphIntelligenceQueries, listTasksProjection, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, readGeneratedInfisicalDestinationEnv, readGeneratedInfisicalEnvValue, readGeneratedInfisicalRuntimeEnvSurface, readGeneratedLucernGatewayEnv, readGeneratedLucernWebPublicEnv, readGeneratedLucernWebServerEnv, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, tokenOverlapScore, tokenizeSearchText, validateInfisicalSecretDefinitions, vercelCustomEnvironmentIdForTenantSoftwareSystem, wordOverlapScore, wordTokenize };
+export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GENERATED_INFISICAL_BOOTSTRAP_ENV_NAMES, GENERATED_INFISICAL_CONTROL_ENV_NAMES, GENERATED_INFISICAL_KNOWN_ENV_NAMES, GENERATED_INFISICAL_MANAGED_ENV_NAMES, GENERATED_INFISICAL_RUNTIME_ENV, GENERATED_LUCERN_GATEWAY_ENV_NAMES, GENERATED_LUCERN_WEB_PUBLIC_ENV_NAMES, GENERATED_LUCERN_WEB_SERVER_ENV_NAMES, GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUICK_QUERIES, GRAPH_REF_NODE_TYPES, GraphRefSchema, INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DEFINITIONS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION, TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_PROFILES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, assertTenantClientImportAllowed, bigramTokenize, buildDomainEvent, buildProjectedUserFromPermitPrincipal, buildTenantBootstrapTemplateSeedRows, canonicalGeneratedInfisicalEnvName, classifyTenantClientImport, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, convexTierForVercelDestinationEnvironment, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, expectedTenantConvexDeploymentForVercelEnvironment, fillGraphIntelligencePromptTemplate, findEdgePolicy, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalSecretDefinition, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, findProjectedUserByPermitClerkId, findProjectedUserByPermitPrincipalId, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, findTenantClientInstallablePackage, formatTenantClientImportViolation, generatedInfisicalVariableForName, getComponentBoundaryTableLayer, getGraphIntelligenceQuery, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, infisicalSecretDefinitionsForConsumer, infisicalSecretDefinitionsForDestination, isActivePermitProjectionStatus, isAfterCursor, isComponentBoundaryComponentOwnedTable, isGeneratedInfisicalKnownEnvName, isGeneratedInfisicalManagedEnvName, isGraphIntelligenceQueryMode, isLucernPrompt, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport, jaccardSimilarity, lastDelegator, listBeliefsProjection, listGraphIntelligenceQueries, listTasksProjection, mapPermitRoleToPlatformRole, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, readGeneratedInfisicalDestinationEnv, readGeneratedInfisicalEnvValue, readGeneratedInfisicalRuntimeEnvSurface, readGeneratedLucernGatewayEnv, readGeneratedLucernWebPublicEnv, readGeneratedLucernWebServerEnv, readPermitProjectionString, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, tokenOverlapScore, tokenizeSearchText, validateInfisicalSecretDefinitions, vercelCustomEnvironmentIdForTenantSoftwareSystem, wordOverlapScore, wordTokenize };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map