@lucern/contracts 0.3.0-alpha.3 → 0.3.0-alpha.4

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { BELIEF_STATUSES, BRANCH_STATUSES, BeliefStatus, BranchStatus, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ConfidenceTrigger, ContradictionSeverity, ContradictionStatus, DEFEAT_TYPES, DefeatType, EPISTEMIC_LAYERS, EpistemicLayer, FORK_REASONS, ForkReason, INTEGRATION_EDGE_TYPES, IntegrationEdgeType, JUDGMENT_TYPES, JudgmentType, MERGE_OUTCOMES, MergeOutcome, PULL_REQUEST_STATUSES, PullRequestStatus, REASONING_METHODS, ReasoningMethod, WORKTREE_PHASES, WorktreePhase } from './api-enums.contract.js';
 export { AuthContext, LucernSdkClient, McpTransportKind, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SessionAuditEnvelope, SessionAuditOutcome, SessionAuthMode, SessionDelegationHop, SessionLifecycleStatus, SessionPrincipalType, inferSessionPrincipalType, lastDelegator, normalizeDelegationChain } from './auth.contract.js';
 export { COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, ComponentBoundaryComponentLayer, ComponentBoundaryDirectDbMethod, ComponentBoundaryHighRiskTable, getComponentBoundaryTableLayer, isComponentBoundaryComponentOwnedTable } from './component-boundary.contract.js';
+export { COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, ComponentHostDbOperation, ComponentHostDbReadOperation, ComponentHostDbWriteOperation, ComponentHostProtectedTable, ComponentHostWriteAuditRoot } from './component-host-boundary.contract.js';
 export { ConvexAdminClient } from './convex-admin.contract.js';
 export { CutoverDomain, CutoverFlagState, GatewayAuthContext, GatewayAuthMode, GatewayEnvironment, GatewayErrorArgs, GatewayScope, GatewaySuccessArgs, KeyLifecycleStatus, PlatformApiErrorCode, requireActorPrincipalId } from './gateway.contract.js';
 export { BELIEF_TYPE_BONUS, BeliefLatticeSeed, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, ContextCompilationMode, ContextPackBelief, ContextPackContradiction, ContextPackDeltaReport, ContextPackDiagnostics, ContextPackEntity, ContextPackEvidence, ContextPackFailure, ContextPackFailureContext, ContextPackInjectionPolicy, ContextPackQuestion, ContextPackRequestV1, ContextPackSectionKey, ContextPackSummary, ContextPackV1, ContextRankingProfile, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TOKEN_BUDGET, ENTITY_RANKING_WEIGHTS, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, PRIORITY_SCORES, PackWeightOverride, PublicCompiledContext, PublicContextBelief, PublicContextContradiction, PublicContextEntity, PublicContextEvidence, PublicContextInjectionPolicy, PublicContextQuestion, RANKING_WEIGHTS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, RankingWeightVector, SECTION_BUDGET_RATIOS, SEVERITY_SCORES, TOKENS_PER_WORD, VerificationObligation } from './context-pack.contract.js';
@@ -12,14 +13,18 @@ export { ComponentTableManifest, ComponentTableManifestSchema } from './schemas/
 export { SLOpinionInput, SLOpinionInputSchema } from './schemas/sl-opinion.js';
 import * as zod from 'zod';
 import { z } from 'zod';
+import { INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, InfisicalRuntimeEnvironment, InfisicalRuntimeDeliveryMode, InfisicalRuntimeBootstrapEnv, InfisicalRuntimePath, InfisicalRuntimeSurface } from './infisical-runtime.contract.js';
+export { INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, InfisicalRuntimePathDefinition, InfisicalRuntimePathId, InfisicalRuntimeSurfaceDefinition, InfisicalRuntimeSurfaceId, InfisicalRuntimeVariable, findInfisicalRuntimePath, findInfisicalRuntimeSurface } from './infisical-runtime.contract.js';
 import { TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS } from './tenant-client.contract.js';
 export { TenantClientAllowedImport, TenantClientAuthMode, TenantClientCapability, TenantClientCapabilityId, TenantClientComponentConfigImport, TenantClientForbiddenImportPattern, TenantClientForbiddenImportPatternId, TenantClientForbiddenInstallTokenInfisicalPath, TenantClientForbiddenSecretEnv, TenantClientImportClassification, TenantClientImportDecision, TenantClientInstallablePackage, TenantClientInstallablePackageName, TenantClientIsolationRule, TenantClientOptionalContextField, TenantClientPackageRole, TenantClientPrincipalType, TenantClientPublicImport, TenantClientPublicPackage, TenantClientPublicSurface, TenantClientRequiredContextField, TenantClientRequiredSdkNamespace, assertTenantClientImportAllowed, classifyTenantClientImport, findTenantClientInstallablePackage, formatTenantClientImportViolation, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport } from './tenant-client.contract.js';
 export * from './function-registry/index.js';
-export { t as mcpToolsContract } from './tool-contracts-C92-9ueT.js';
+export { t as mcpToolsContract } from './tool-contracts-BcKz-VGj.js';
 export { EntityConnectionMatch, EntityMatchCandidate, EntityTypeMatch, OntologyEntityType, rankEntityConnections, rankEntityTypeMatches, scoreEntityConnection, scoreEntityTypeMatch } from './v1/ontologies/v1.js';
 export { LucernPrompt, LucernPromptModelHint, isLucernPrompt } from './prompt.contract.js';
 export { AddEvidenceInput, AddWorktreeInput, BeliefResult, BisectConfidenceInput, BisectResult, BranchResult, CompileContextInput, CompiledContextResult, ConfidenceResult, ContradictionResult, CreateBeliefInput, CreateBranchInput, CreateEdgeInput, EdgeResult, EvidenceResult, FlagContradictionInput, ForkBeliefInput, ForkResult, JudgmentResult, LineageResult, LucernClient, LucernClientConfig, LucernGraphMethods, LucernWorkflowMethods, MergeInput, MergeResult, ModulateConfidenceInput, OpenPullRequestInput, PullRequestResult, PushInput, PushResult, QueryLineageInput, RecordJudgmentInput, RefineBeliefInput, SearchBeliefsInput, WorktreeResult } from './sdk-methods.contract.js';
-export { s as sdkToolsContract } from './sdk-tools.contract-S4ia0TTo.js';
+export { s as sdkToolsContract } from './sdk-tools.contract-CD-N1Jf7.js';
+export { TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TenantBootstrapCopyMode, TenantBootstrapForbiddenSeedTable, TenantBootstrapPrepopulation, TenantBootstrapSeedAuthMetadataField, TenantBootstrapSeedComponent, TenantBootstrapSeedScope, TenantBootstrapSeedTable, TenantBootstrapSeedTableName, TenantBootstrapTableRequirement, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable } from './tenant-bootstrap-seed.contract.js';
+export { TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION, TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID, TenantBootstrapTemplateSeedOptions, TenantBootstrapTemplateSeedRows, buildTenantBootstrapTemplateSeedRows } from './tenant-bootstrap-seed.defaults.js';
 export { LexicalRerankOptions, LexicalSignal, LexicalStrategy, PreparedLexicalQuery, bigramTokenize, jaccardSimilarity, prepareLexicalQuery, rankWindowScore, rerankLexicalWindow, scoreLexicalSignal, scoreLexicalSignals, stemToken, tokenOverlapScore, tokenizeSearchText, wordOverlapScore, wordTokenize } from './text-matching.contract.js';
 export { ROOT_TOPIC_ID, TopicDoc, collectTopicNeighborhood } from './v1/topics/v1.js';
 export { CANONICAL_WORKFLOW_DEFINITIONS, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, EngineeringBriefOutput, InboxSummaryOutput, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PipelineBriefOutput, ResearchMemoOutput, StrategyArtifactOutput, StructuredPayloadOutput, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WorkflowActionContract, WorkflowActionKind, WorkflowApprovalMode, WorkflowApprovalPolicy, WorkflowAutoFixMode, WorkflowAutoFixPolicy, WorkflowDefinitionV1, WorkflowHookContract, WorkflowHookEvent, WorkflowIntegrityCheckId, WorkflowMutationTier, WorkflowOutputBase, WorkflowOutputContract, WorkflowOutputKind, WorkflowProofArtifact, WorkflowProofArtifactKind, WorkflowRunReceiptV1, WorkflowRunStatus, WorkflowStaffingHint, WorkflowTriggerContract, WorkflowTriggerKind } from './workflow-runtime.contract.js';
@@ -48,13 +53,13 @@ declare const GraphRefSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
     nodeId: z.ZodString;
     nodeType: z.ZodEnum<["belief", "evidence", "question", "answer", "topic", "edge", "ontology", "lens", "contradiction"]>;
 }, "strip", z.ZodTypeAny, {
-    nodeType: "belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens";
-    nodeId: string;
     kind: "epistemic_node";
-}, {
-    nodeType: "belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens";
     nodeId: string;
+    nodeType: "belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer";
+}, {
     kind: "epistemic_node";
+    nodeId: string;
+    nodeType: "belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"external_belief">;
     ref: z.ZodObject<{
@@ -93,15 +98,15 @@ declare const EdgePolicyEntrySchema: z.ZodObject<{
     edgeType: string;
     fromKinds: ("epistemic_node" | "external_belief")[];
     toKinds: ("epistemic_node" | "external_belief")[];
-    fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
-    toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
+    fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
+    toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
 }, {
     description: string;
     edgeType: string;
     fromKinds: ("epistemic_node" | "external_belief")[];
     toKinds: ("epistemic_node" | "external_belief")[];
-    fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
-    toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
+    fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
+    toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
 }>;
 declare const EdgePolicyManifestSchema: z.ZodObject<{
     manifestVersion: z.ZodLiteral<"1.0.0">;
@@ -117,36 +122,36 @@ declare const EdgePolicyManifestSchema: z.ZodObject<{
         edgeType: string;
         fromKinds: ("epistemic_node" | "external_belief")[];
         toKinds: ("epistemic_node" | "external_belief")[];
-        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
-        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
+        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
+        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
     }, {
         description: string;
         edgeType: string;
         fromKinds: ("epistemic_node" | "external_belief")[];
         toKinds: ("epistemic_node" | "external_belief")[];
-        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
-        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
+        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
+        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    manifestVersion: "1.0.0";
     policies: {
         description: string;
         edgeType: string;
         fromKinds: ("epistemic_node" | "external_belief")[];
         toKinds: ("epistemic_node" | "external_belief")[];
-        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
-        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
+        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
+        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
     }[];
-}, {
     manifestVersion: "1.0.0";
+}, {
     policies: {
         description: string;
         edgeType: string;
         fromKinds: ("epistemic_node" | "external_belief")[];
         toKinds: ("epistemic_node" | "external_belief")[];
-        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
-        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "answer" | "lens")[] | undefined;
+        fromNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
+        toNodeTypes?: ("belief" | "evidence" | "question" | "edge" | "contradiction" | "topic" | "ontology" | "lens" | "answer")[] | undefined;
     }[];
+    manifestVersion: "1.0.0";
 }>;
 type EdgePolicyEntry = z.infer<typeof EdgePolicyEntrySchema>;
 type EdgePolicyManifest = z.infer<typeof EdgePolicyManifestSchema>;
@@ -185,6 +190,154 @@ declare const edgePolicyManifest: {
     })[];
 };
 
+type InfisicalRuntimeManifest = {
+    readonly manifestVersion: "1.0.0";
+    readonly contractVersion: typeof INFISICAL_RUNTIME_CONTRACT_VERSION;
+    readonly project: {
+        readonly id: typeof INFISICAL_RUNTIME_DEFAULT_PROJECT_ID;
+        readonly apiUrl: typeof INFISICAL_RUNTIME_DEFAULT_API_URL;
+    };
+    readonly environments: readonly InfisicalRuntimeEnvironment[];
+    readonly deliveryModes: readonly InfisicalRuntimeDeliveryMode[];
+    readonly bootstrapEnv: InfisicalRuntimeBootstrapEnv;
+    readonly paths: readonly InfisicalRuntimePath[];
+    readonly surfaces: readonly InfisicalRuntimeSurface[];
+};
+declare const INFISICAL_RUNTIME_MANIFEST: {
+    readonly manifestVersion: "1.0.0";
+    readonly contractVersion: "2026-04-28";
+    readonly project: {
+        readonly id: "344b0526-90df-4606-ba50-22c647a36c65";
+        readonly apiUrl: "https://app.infisical.com";
+    };
+    readonly environments: readonly ["dev", "staging", "prod"];
+    readonly deliveryModes: readonly ["vercel_sync", "runtime_fetch", "device_auth"];
+    readonly bootstrapEnv: {
+        readonly apiUrl: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+        readonly projectId: readonly ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"];
+        readonly clientId: readonly ["INFISICAL_CLIENT_ID", "INFISICAL_MACHINE_CLIENT_ID", "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"];
+        readonly clientSecret: readonly ["INFISICAL_CLIENT_SECRET", "INFISICAL_MACHINE_CLIENT_SECRET", "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"];
+        readonly environment: readonly ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"];
+        readonly organizationSlug: readonly ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"];
+        readonly disabled: readonly ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"];
+    };
+    readonly paths: readonly [{
+        readonly id: "platform-auth";
+        readonly secretPath: "/platform/auth";
+        readonly description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.";
+        readonly variables: readonly [{
+            readonly name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+            readonly required: true;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Clerk publishable key for the Lucern web origin.";
+        }, {
+            readonly name: "CLERK_SECRET_KEY";
+            readonly required: true;
+            readonly secret: true;
+            readonly public: false;
+            readonly description: "Clerk backend secret key for Lucern server runtimes.";
+        }, {
+            readonly name: "CLERK_JWT_ISSUER_DOMAIN";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly description: "Expected Clerk issuer/JWKS domain for JWT verification.";
+        }, {
+            readonly name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Public sign-in URL for Lucern-owned web flows.";
+        }, {
+            readonly name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Public sign-up URL for Lucern-owned web flows.";
+        }];
+    }, {
+        readonly id: "platform-runtime";
+        readonly secretPath: "/platform/runtime";
+        readonly description: "Runtime defaults shared by server-side Lucern clients and operator tooling.";
+        readonly variables: readonly [{
+            readonly name: "LUCERN_API_URL";
+            readonly required: true;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+            readonly description: "Canonical Lucern API gateway URL.";
+        }, {
+            readonly name: "LUCERN_LOGIN_BASE_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_AUTH_BASE_URL"];
+            readonly description: "Browser login origin used when it differs from the API.";
+        }, {
+            readonly name: "LUCERN_ENVIRONMENT";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_ENV"];
+            readonly description: "Lucern environment label consumed by CLI profiles.";
+        }];
+    }, {
+        readonly id: "tenant-shared-install";
+        readonly secretPath: "tenants/shared";
+        readonly description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.";
+        readonly variables: readonly [{
+            readonly name: "INSTALL_LUCERN_NPM";
+            readonly required: true;
+            readonly secret: true;
+            readonly public: false;
+            readonly description: "Read-only install token for the published @lucern/* suite.";
+        }];
+    }];
+    readonly surfaces: readonly [{
+        readonly id: "lucern-web";
+        readonly delivery: "vercel_sync";
+        readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+        readonly consumer: "apps/web on Vercel project lucern";
+        readonly description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs.";
+    }, {
+        readonly id: "lucern-gateway";
+        readonly delivery: "vercel_sync";
+        readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+        readonly consumer: "apps/gateway on Vercel project lucern-gateway";
+        readonly description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs.";
+    }, {
+        readonly id: "lucern-sdk";
+        readonly packageName: "@lucern/sdk";
+        readonly delivery: "runtime_fetch";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "server-side SDK operator contexts with a scoped Infisical identity";
+        readonly description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.";
+    }, {
+        readonly id: "lucern-cli";
+        readonly packageName: "@lucern/cli";
+        readonly delivery: "runtime_fetch";
+        readonly fallback: "device_auth";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "developer/operator CLI processes";
+        readonly description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.";
+    }, {
+        readonly id: "lucern-mcp";
+        readonly packageName: "@lucern/mcp";
+        readonly delivery: "runtime_fetch";
+        readonly fallback: "device_auth";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "MCP server/client processes";
+        readonly description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.";
+    }, {
+        readonly id: "tenant-client";
+        readonly delivery: "device_auth";
+        readonly sourcePathIds: readonly ["tenant-shared-install"];
+        readonly consumer: "tenant-owned apps and coding agents";
+        readonly description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces.";
+    }];
+};
+
 interface ProjectionDef<TInput, TConvexArgs> {
     contractName: string;
     inputSchema: z.ZodSchema<TInput>;
@@ -234,33 +387,33 @@ declare const listBeliefsProjection: ProjectionDef<{
 
 declare const listTasksProjection: ProjectionDef<{
     topicId: string;
-    status?: "blocked" | "in_progress" | "todo" | "done" | undefined;
+    status?: "todo" | "in_progress" | "blocked" | "done" | undefined;
     worktreeId?: string | undefined;
     limit?: number | undefined;
     linkedWorktreeId?: string | undefined;
 }, Record<string, unknown>>;
 
 declare const modulateConfidenceProjection: ProjectionDef<{
-    trigger: "evidence_added" | "evidence_removed" | "contradiction_detected" | "contradiction_resolved" | "agent_assessment" | "worktree_outcome" | "worktree_completed" | "fusion" | "discount" | "deduction" | "backfill_synthetic" | "answer_recorded";
     rationale: string;
+    trigger: "evidence_added" | "evidence_removed" | "contradiction_detected" | "contradiction_resolved" | "agent_assessment" | "worktree_outcome" | "worktree_completed" | "fusion" | "discount" | "deduction" | "answer_recorded" | "backfill_synthetic";
     belief?: number | undefined;
-    worktreeId?: string | undefined;
+    baseRate?: number | undefined;
+    nodeId?: string | undefined;
     disbelief?: number | undefined;
     uncertainty?: number | undefined;
-    baseRate?: number | undefined;
+    worktreeId?: string | undefined;
     triggeringEvidenceId?: string | undefined;
     triggeringQuestionId?: string | undefined;
     triggeringAnswerId?: string | undefined;
     triggeringContradictionId?: string | undefined;
     triggeringWorktreeId?: string | undefined;
     beliefNodeId?: string | undefined;
-    nodeId?: string | undefined;
     trustedBypassAccessCheck?: boolean | undefined;
     opinion?: {
         belief: number;
+        baseRate: number;
         disbelief: number;
         uncertainty: number;
-        baseRate: number;
     } | undefined;
     provenance?: {
         evidence?: string | undefined;
@@ -326,32 +479,32 @@ declare const projections: {
     }, Record<string, unknown>>;
     readonly list_tasks: ProjectionDef<{
         topicId: string;
-        status?: "blocked" | "in_progress" | "todo" | "done" | undefined;
+        status?: "todo" | "in_progress" | "blocked" | "done" | undefined;
         worktreeId?: string | undefined;
         limit?: number | undefined;
         linkedWorktreeId?: string | undefined;
     }, Record<string, unknown>>;
     readonly modulate_confidence: ProjectionDef<{
-        trigger: "evidence_added" | "evidence_removed" | "contradiction_detected" | "contradiction_resolved" | "agent_assessment" | "worktree_outcome" | "worktree_completed" | "fusion" | "discount" | "deduction" | "backfill_synthetic" | "answer_recorded";
         rationale: string;
+        trigger: "evidence_added" | "evidence_removed" | "contradiction_detected" | "contradiction_resolved" | "agent_assessment" | "worktree_outcome" | "worktree_completed" | "fusion" | "discount" | "deduction" | "answer_recorded" | "backfill_synthetic";
         belief?: number | undefined;
-        worktreeId?: string | undefined;
+        baseRate?: number | undefined;
+        nodeId?: string | undefined;
         disbelief?: number | undefined;
         uncertainty?: number | undefined;
-        baseRate?: number | undefined;
+        worktreeId?: string | undefined;
         triggeringEvidenceId?: string | undefined;
         triggeringQuestionId?: string | undefined;
         triggeringAnswerId?: string | undefined;
         triggeringContradictionId?: string | undefined;
         triggeringWorktreeId?: string | undefined;
         beliefNodeId?: string | undefined;
-        nodeId?: string | undefined;
         trustedBypassAccessCheck?: boolean | undefined;
         opinion?: {
             belief: number;
+            baseRate: number;
             disbelief: number;
             uncertainty: number;
-            baseRate: number;
         } | undefined;
         provenance?: {
             evidence?: string | undefined;
@@ -417,21 +570,21 @@ declare const InvariantManifestSchema: z.ZodObject<{
         checker: "runtime" | "ast" | "manifest";
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
+    manifestVersion: "1.0.0";
     rules: {
         invariant: string;
         description: string;
         severity: "warn" | "block_publish" | "block_pr";
         checker: "runtime" | "ast" | "manifest";
     }[];
-    manifestVersion: "1.0.0";
 }, {
+    manifestVersion: "1.0.0";
     rules: {
         invariant: string;
         description: string;
         severity: "warn" | "block_publish" | "block_pr";
         checker: "runtime" | "ast" | "manifest";
     }[];
-    manifestVersion: "1.0.0";
 }>;
 type InvariantManifest = z.infer<typeof InvariantManifestSchema>;
 
@@ -688,4 +841,4 @@ declare const TENANT_CLIENT_MANIFEST: {
     }];
 };
 
-export { type CheckContext, type CheckerKind, type EdgePolicyEntry, EdgePolicyEntrySchema, type EdgePolicyManifest, EdgePolicyManifestSchema, type EdgePolicyViolation, type EpistemicNodeType, EpistemicNodeTypeSchema, type GraphRef, GraphRefSchema, type InvariantId, type InvariantManifest, InvariantManifestSchema, type InvariantResult, type InvariantRule, type InvariantSeverity, type ProjectionDef, type ProjectionRegistry, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, type TenantClientManifest, assertEdgePolicyAllowed, createEvidenceProjection, defineProjection, edgePolicyManifest, findEdgePolicy, listBeliefsProjection, listTasksProjection, modulateConfidenceProjection, projections };
+export { type CheckContext, type CheckerKind, type EdgePolicyEntry, EdgePolicyEntrySchema, type EdgePolicyManifest, EdgePolicyManifestSchema, type EdgePolicyViolation, type EpistemicNodeType, EpistemicNodeTypeSchema, type GraphRef, GraphRefSchema, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_MANIFEST, InfisicalRuntimeBootstrapEnv, InfisicalRuntimeDeliveryMode, InfisicalRuntimeEnvironment, type InfisicalRuntimeManifest, InfisicalRuntimePath, InfisicalRuntimeSurface, type InvariantId, type InvariantManifest, InvariantManifestSchema, type InvariantResult, type InvariantRule, type InvariantSeverity, type ProjectionDef, type ProjectionRegistry, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, type TenantClientManifest, assertEdgePolicyAllowed, createEvidenceProjection, defineProjection, edgePolicyManifest, findEdgePolicy, listBeliefsProjection, listTasksProjection, modulateConfidenceProjection, projections };