@lucern/contracts 0.3.0-alpha.6 → 0.3.0-alpha.7

package/dist/function-registry-input-audit.js

@@ -119,14 +119,16 @@ function projectionReadKeys(projection) {
   return [...keys].sort();
 }
 function acceptedInputKeys(contract) {
-  return [
+  const keys = [
     .../* @__PURE__ */ new Set([
       ...objectSchemaKeys(contract.args),
       ...objectSchemaKeys(contract.input),
       ...Object.keys(contract.mcp.parameters),
       "__sdkSessionId"
     ])
-  ].sort();
+  ];
+  keys.sort();
+  return keys;
 }
 function allowedProjectionKeys(contractName) {
   return /* @__PURE__ */ new Set([

package/dist/function-registry-input-audit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/function-registry-input-audit.ts"],"names":[],"mappings":";;;;AAeA,IAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,EACrC,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,0BAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,4BAAA,GAAkE;AAAA,EACtE,YAAA,EAAc,CAAC,oBAAA,EAAsB,UAAU,CAAA;AAAA,EAC/C,mBAAA,EAAqB,CAAC,UAAU,CAAA;AAAA,EAChC,cAAA,EAAgB,CAAC,QAAQ,CAAA;AAAA,EACzB,gBAAA,EAAkB,CAAC,aAAA,EAAe,UAAA,EAAY,UAAU,aAAa,CAAA;AAAA,EACrE,WAAA,EAAa,CAAC,OAAA,EAAS,cAAc,CAAA;AAAA,EACrC,aAAA,EAAe,CAAC,SAAS,CAAA;AAAA,EACzB,aAAA,EAAe,CAAC,aAAa,CAAA;AAAA,EAC7B,QAAA,EAAU,CAAC,QAAA,EAAU,WAAW,CAAA;AAAA,EAChC,oBAAA,EAAsB,CAAC,aAAA,EAAe,UAAA,EAAY,UAAU,aAAa,CAAA;AAAA,EACzE,kBAAA,EAAoB,CAAC,QAAQ,CAAA;AAAA,EAC7B,eAAA,EAAiB,CAAC,QAAQ,CAAA;AAAA,EAC1B,eAAA,EAAiB,CAAC,aAAA,EAAe,UAAA,EAAY,UAAU,aAAa,CAAA;AAAA,EACpE,kBAAA,EAAoB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EAC5D,aAAA,EAAe;AAAA,IACb,UAAA;AAAA,IACA,cAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA;AAAA,IACA,0BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB;AAAA,IACvB,cAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,0BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,yBAAA,EAA2B;AAAA,IACzB,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,aAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,0BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,aAAA,EAAe,CAAC,QAAQ,CAAA;AAAA,EACxB,mBAAA,EAAqB,CAAC,SAAS,CAAA;AAAA,EAC/B,KAAA,EAAO,CAAC,kBAAA,EAAoB,aAAA,EAAe,WAAW,CAAA;AAAA,EACtD,cAAA,EAAgB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EACxD,eAAA,EAAiB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EACzD,qBAAA,EAAuB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EAC/D,cAAA,EAAgB,CAAC,aAAa,CAAA;AAAA,EAC9B,eAAA,EAAiB,CAAC,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,sBAAA,EAAwB,CAAC,QAAA,EAAU,cAAA,EAAgB,UAAU,YAAY,CAAA;AAAA,EACzE,YAAA,EAAc,CAAC,qBAAqB;AACtC,CAAA;AAEA,SAAS,mBACP,MAAA,EACwC;AACxC,EAAA,IAAI,OAAA,GAAU,MAAA;AACd,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,QAAQ,OAAA,CAAQ,KAAK,QAAA;AAAU,MAC7B,KAAK,EAAE,qBAAA,CAAsB,UAAA;AAC3B,QAAA,OAAA,GAAU,QAAQ,IAAA,CAAK,MAAA;AACvB,QAAA;AAAA,MACF,KAAK,EAAE,qBAAA,CAAsB,UAAA;AAC3B,QAAA,OAAA,GAAU,QAAQ,IAAA,CAAK,IAAA;AACvB,QAAA;AAAA,MACF;AACE,QAAA,OAAO,OAAA,YAAmB,CAAA,CAAE,SAAA,GAAY,OAAA,GAAU,MAAA;AAAA;AACtD,EACF;AACF;AAEA,SAAS,iBAAiB,MAAA,EAAmC;AAC3D,EAAA,MAAM,YAAA,GAAe,mBAAmB,MAAM,CAAA;AAC9C,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,2BAAW,GAAA,EAAI;AAAA,EACjB;AACA,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,CAAa,IAAA,CAAK,KAAA,KAAU,UAAA,GAC/B,YAAA,CAAa,IAAA,CAAK,KAAA,EAAM,GACxB,YAAA,CAAa,IAAA,CAAK,KAAA;AACxB,EAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AACnC;AAEO,SAAS,mBACd,UAAA,EACU;AACV,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,MAAA,GAAS,OAAO,UAAU,CAAA;AAChC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,QAAA,CAAS,qCAAqC,CAAA,EAAG;AAC1E,IAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACnB;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,QAAA,CAAS,wCAAwC,CAAA,EAAG;AAC7E,IAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACnB;AAEA,EAAA,OAAO,CAAC,GAAG,IAAI,CAAA,CAAE,IAAA,EAAK;AACxB;AAEA,SAAS,kBAAkB,QAAA,EAAsC;AAC/D,EAAA,OAAO;AAAA,IACL,uBAAO,GAAA,CAAI;AAAA,MACT,GAAG,gBAAA,CAAiB,QAAA,CAAS,IAAI,CAAA;AAAA,MACjC,GAAG,gBAAA,CAAiB,QAAA,CAAS,KAAK,CAAA;AAAA,MAClC,GAAG,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,IAAI,UAAU,CAAA;AAAA,MACtC;AAAA,KACD;AAAA,IACD,IAAA,EAAK;AACT;AAEA,SAAS,sBAAsB,YAAA,EAAmC;AAChE,EAAA,2BAAW,GAAA,CAAI;AAAA,IACb,GAAG,sBAAA;AAAA,IACH,GAAI,4BAAA,CAA6B,YAAY,CAAA,IAAK;AAAC,GACpD,CAAA;AACH;AAEO,SAAS,2BAAA,CACd,YAAyC,sBAAA,EACJ;AACrC,EAAA,OAAO,SAAA,CAAU,OAAA,CAAQ,CAAC,QAAA,KAAa;AACrC,IAAA,MAAM,cAAA,GAAiB,kBAAA,CAAmB,QAAA,CAAS,MAAA,EAAQ,eAAe,CAAA;AAC1E,IAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,iBAAA,CAAkB,QAAQ,CAAC,CAAA;AACpD,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,QAAA,CAAS,IAAI,CAAA;AACnD,IAAA,MAAM,cAAc,cAAA,CAAe,MAAA;AAAA,MACjC,CAAC,GAAA,KAAQ,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,IAAK,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG;AAAA,KACjD;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,OAAO;AAAA,MACL;AAAA,QACE,cAAc,QAAA,CAAS,IAAA;AAAA,QACvB,cAAA;AAAA,QACA,YAAA,EAAc,CAAC,GAAG,QAAQ,EAAE,IAAA,EAAK;AAAA,QACjC;AAAA;AACF,KACF;AAAA,EACF,CAAC,CAAA;AACH","file":"function-registry-input-audit.js","sourcesContent":["import { z } from \"zod\";\nimport { ALL_FUNCTION_CONTRACTS } from \"./function-registry/index.js\";\nimport type { FunctionContract } from \"./function-registry/types.js\";\n\nexport type FunctionRegistryInputAuditFinding = {\n  contractName: string;\n  projectionKeys: string[];\n  acceptedKeys: string[];\n  missingKeys: string[];\n};\n\ntype InputProjection = NonNullable<\n  FunctionContract[\"convex\"]\n>[\"inputProjection\"];\n\nconst INTERNAL_OR_ALIAS_KEYS = new Set([\n  \"__sdkSessionId\",\n  \"actorId\",\n  \"beliefId\",\n  \"createdBy\",\n  \"evidenceId\",\n  \"id\",\n  \"insightId\",\n  \"nodeId\",\n  \"ontologyId\",\n  \"parentNodeId\",\n  \"principalId\",\n  \"projectId\",\n  \"questionId\",\n  \"tenantId\",\n  \"trustedBypassAccessCheck\",\n  \"userId\",\n  \"versionId\",\n  \"workspaceId\",\n]);\n\nconst INTENTIONAL_PROJECTION_READS: Record<string, readonly string[]> = {\n  add_evidence: [\"linkedBeliefNodeId\", \"targetId\"],\n  apply_lens_to_topic: [\"metadata\"],\n  archive_belief: [\"reason\"],\n  check_permission: [\"principalId\", \"tenantId\", \"userId\", \"workspaceId\"],\n  claim_files: [\"paths\", \"touchedFiles\"],\n  complete_task: [\"summary\"],\n  create_belief: [\"formulation\"],\n  discover: [\"prompt\", \"topicHint\"],\n  filter_by_permission: [\"principalId\", \"tenantId\", \"userId\", \"workspaceId\"],\n  get_change_history: [\"status\"],\n  get_failure_log: [\"status\"],\n  identity_whoami: [\"principalId\", \"tenantId\", \"userId\", \"workspaceId\"],\n  ingest_observation: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  link_evidence: [\n    \"beliefId\",\n    \"beliefNodeId\",\n    \"context\",\n    \"evidenceNodeId\",\n    \"globalId\",\n    \"insightId\",\n    \"topicId\",\n    \"trustedBypassAccessCheck\",\n    \"type\",\n  ],\n  link_evidence_to_belief: [\n    \"beliefNodeId\",\n    \"context\",\n    \"evidenceNodeId\",\n    \"globalId\",\n    \"insightId\",\n    \"targetId\",\n    \"topicId\",\n    \"trustedBypassAccessCheck\",\n    \"type\",\n  ],\n  link_evidence_to_question: [\n    \"context\",\n    \"evidenceNodeId\",\n    \"globalId\",\n    \"impactScore\",\n    \"insightId\",\n    \"questionNodeId\",\n    \"targetId\",\n    \"topicId\",\n    \"trustedBypassAccessCheck\",\n    \"weight\",\n  ],\n  list_evidence: [\"status\"],\n  manage_write_policy: [\"summary\"],\n  merge: [\"decisionsReached\", \"keyFindings\", \"nextSteps\"],\n  record_attempt: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  record_judgment: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  record_scope_learning: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  search_beliefs: [\"searchQuery\"],\n  search_evidence: [\"query\", \"searchQuery\"],\n  update_question_status: [\"answer\", \"answerStatus\", \"nodeId\", \"questionId\"],\n  update_topic: [\"graphScopeProjectId\"],\n};\n\nfunction unwrapObjectSchema(\n  schema: z.ZodTypeAny,\n): z.ZodObject<z.ZodRawShape> | undefined {\n  let current = schema;\n  while (true) {\n    switch (current._def.typeName) {\n      case z.ZodFirstPartyTypeKind.ZodEffects:\n        current = current._def.schema;\n        continue;\n      case z.ZodFirstPartyTypeKind.ZodBranded:\n        current = current._def.type;\n        continue;\n      default:\n        return current instanceof z.ZodObject ? current : undefined;\n    }\n  }\n}\n\nfunction objectSchemaKeys(schema: z.ZodTypeAny): Set<string> {\n  const objectSchema = unwrapObjectSchema(schema);\n  if (!objectSchema) {\n    return new Set();\n  }\n  const shape =\n    typeof objectSchema._def.shape === \"function\"\n      ? objectSchema._def.shape()\n      : objectSchema._def.shape;\n  return new Set(Object.keys(shape));\n}\n\nexport function projectionReadKeys(\n  projection: InputProjection,\n): string[] {\n  if (!projection) {\n    return [];\n  }\n  const source = String(projection);\n  const keys = new Set<string>();\n\n  for (const match of source.matchAll(/\\binput\\s*\\.\\s*([A-Za-z_$][\\w$]*)/gu)) {\n    keys.add(match[1]);\n  }\n  for (const match of source.matchAll(/\\binput\\s*\\[\\s*[\"']([^\"']+)[\"']\\s*\\]/gu)) {\n    keys.add(match[1]);\n  }\n\n  return [...keys].sort();\n}\n\nfunction acceptedInputKeys(contract: FunctionContract): string[] {\n  return [\n    ...new Set([\n      ...objectSchemaKeys(contract.args),\n      ...objectSchemaKeys(contract.input),\n      ...Object.keys(contract.mcp.parameters),\n      \"__sdkSessionId\",\n    ]),\n  ].sort();\n}\n\nfunction allowedProjectionKeys(contractName: string): Set<string> {\n  return new Set([\n    ...INTERNAL_OR_ALIAS_KEYS,\n    ...(INTENTIONAL_PROJECTION_READS[contractName] ?? []),\n  ]);\n}\n\nexport function auditFunctionRegistryInputs(\n  contracts: readonly FunctionContract[] = ALL_FUNCTION_CONTRACTS,\n): FunctionRegistryInputAuditFinding[] {\n  return contracts.flatMap((contract) => {\n    const projectionKeys = projectionReadKeys(contract.convex?.inputProjection);\n    if (projectionKeys.length === 0) {\n      return [];\n    }\n\n    const accepted = new Set(acceptedInputKeys(contract));\n    const allowed = allowedProjectionKeys(contract.name);\n    const missingKeys = projectionKeys.filter(\n      (key) => !accepted.has(key) && !allowed.has(key),\n    );\n\n    if (missingKeys.length === 0) {\n      return [];\n    }\n\n    return [\n      {\n        contractName: contract.name,\n        projectionKeys,\n        acceptedKeys: [...accepted].sort(),\n        missingKeys,\n      },\n    ];\n  });\n}\n"]}
+{"version":3,"sources":["../src/function-registry-input-audit.ts"],"names":[],"mappings":";;;;AAeA,IAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,EACrC,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,0BAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,4BAAA,GAAkE;AAAA,EACtE,YAAA,EAAc,CAAC,oBAAA,EAAsB,UAAU,CAAA;AAAA,EAC/C,mBAAA,EAAqB,CAAC,UAAU,CAAA;AAAA,EAChC,cAAA,EAAgB,CAAC,QAAQ,CAAA;AAAA,EACzB,gBAAA,EAAkB,CAAC,aAAA,EAAe,UAAA,EAAY,UAAU,aAAa,CAAA;AAAA,EACrE,WAAA,EAAa,CAAC,OAAA,EAAS,cAAc,CAAA;AAAA,EACrC,aAAA,EAAe,CAAC,SAAS,CAAA;AAAA,EACzB,aAAA,EAAe,CAAC,aAAa,CAAA;AAAA,EAC7B,QAAA,EAAU,CAAC,QAAA,EAAU,WAAW,CAAA;AAAA,EAChC,oBAAA,EAAsB,CAAC,aAAA,EAAe,UAAA,EAAY,UAAU,aAAa,CAAA;AAAA,EACzE,kBAAA,EAAoB,CAAC,QAAQ,CAAA;AAAA,EAC7B,eAAA,EAAiB,CAAC,QAAQ,CAAA;AAAA,EAC1B,eAAA,EAAiB,CAAC,aAAA,EAAe,UAAA,EAAY,UAAU,aAAa,CAAA;AAAA,EACpE,kBAAA,EAAoB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EAC5D,aAAA,EAAe;AAAA,IACb,UAAA;AAAA,IACA,cAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA;AAAA,IACA,0BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB;AAAA,IACvB,cAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,0BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,yBAAA,EAA2B;AAAA,IACzB,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,aAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,0BAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,aAAA,EAAe,CAAC,QAAQ,CAAA;AAAA,EACxB,mBAAA,EAAqB,CAAC,SAAS,CAAA;AAAA,EAC/B,KAAA,EAAO,CAAC,kBAAA,EAAoB,aAAA,EAAe,WAAW,CAAA;AAAA,EACtD,cAAA,EAAgB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EACxD,eAAA,EAAiB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EACzD,qBAAA,EAAuB,CAAC,WAAA,EAAa,0BAA0B,CAAA;AAAA,EAC/D,cAAA,EAAgB,CAAC,aAAa,CAAA;AAAA,EAC9B,eAAA,EAAiB,CAAC,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,sBAAA,EAAwB,CAAC,QAAA,EAAU,cAAA,EAAgB,UAAU,YAAY,CAAA;AAAA,EACzE,YAAA,EAAc,CAAC,qBAAqB;AACtC,CAAA;AAEA,SAAS,mBACP,MAAA,EACwC;AACxC,EAAA,IAAI,OAAA,GAAU,MAAA;AACd,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,QAAQ,OAAA,CAAQ,KAAK,QAAA;AAAU,MAC7B,KAAK,EAAE,qBAAA,CAAsB,UAAA;AAC3B,QAAA,OAAA,GAAU,QAAQ,IAAA,CAAK,MAAA;AACvB,QAAA;AAAA,MACF,KAAK,EAAE,qBAAA,CAAsB,UAAA;AAC3B,QAAA,OAAA,GAAU,QAAQ,IAAA,CAAK,IAAA;AACvB,QAAA;AAAA,MACF;AACE,QAAA,OAAO,OAAA,YAAmB,CAAA,CAAE,SAAA,GAAY,OAAA,GAAU,MAAA;AAAA;AACtD,EACF;AACF;AAEA,SAAS,iBAAiB,MAAA,EAAmC;AAC3D,EAAA,MAAM,YAAA,GAAe,mBAAmB,MAAM,CAAA;AAC9C,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,2BAAW,GAAA,EAAI;AAAA,EACjB;AACA,EAAA,MAAM,KAAA,GACJ,OAAO,YAAA,CAAa,IAAA,CAAK,KAAA,KAAU,UAAA,GAC/B,YAAA,CAAa,IAAA,CAAK,KAAA,EAAM,GACxB,YAAA,CAAa,IAAA,CAAK,KAAA;AACxB,EAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AACnC;AAEO,SAAS,mBACd,UAAA,EACU;AACV,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,MAAA,GAAS,OAAO,UAAU,CAAA;AAChC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,QAAA,CAAS,qCAAqC,CAAA,EAAG;AAC1E,IAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACnB;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,QAAA,CAAS,wCAAwC,CAAA,EAAG;AAC7E,IAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACnB;AAEA,EAAA,OAAO,CAAC,GAAG,IAAI,CAAA,CAAE,IAAA,EAAK;AACxB;AAEA,SAAS,kBAAkB,QAAA,EAAsC;AAC/D,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,uBAAO,GAAA,CAAI;AAAA,MACT,GAAG,gBAAA,CAAiB,QAAA,CAAS,IAAI,CAAA;AAAA,MACjC,GAAG,gBAAA,CAAiB,QAAA,CAAS,KAAK,CAAA;AAAA,MAClC,GAAG,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,IAAI,UAAU,CAAA;AAAA,MACtC;AAAA,KACD;AAAA,GACH;AACA,EAAA,IAAA,CAAK,IAAA,EAAK;AACV,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,sBAAsB,YAAA,EAAmC;AAChE,EAAA,2BAAW,GAAA,CAAI;AAAA,IACb,GAAG,sBAAA;AAAA,IACH,GAAI,4BAAA,CAA6B,YAAY,CAAA,IAAK;AAAC,GACpD,CAAA;AACH;AAEO,SAAS,2BAAA,CACd,YAAyC,sBAAA,EACJ;AACrC,EAAA,OAAO,SAAA,CAAU,OAAA,CAAQ,CAAC,QAAA,KAAa;AACrC,IAAA,MAAM,cAAA,GAAiB,kBAAA,CAAmB,QAAA,CAAS,MAAA,EAAQ,eAAe,CAAA;AAC1E,IAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,iBAAA,CAAkB,QAAQ,CAAC,CAAA;AACpD,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,QAAA,CAAS,IAAI,CAAA;AACnD,IAAA,MAAM,cAAc,cAAA,CAAe,MAAA;AAAA,MACjC,CAAC,GAAA,KAAQ,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,IAAK,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG;AAAA,KACjD;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,OAAO;AAAA,MACL;AAAA,QACE,cAAc,QAAA,CAAS,IAAA;AAAA,QACvB,cAAA;AAAA,QACA,YAAA,EAAc,CAAC,GAAG,QAAQ,EAAE,IAAA,EAAK;AAAA,QACjC;AAAA;AACF,KACF;AAAA,EACF,CAAC,CAAA;AACH","file":"function-registry-input-audit.js","sourcesContent":["import { z } from \"zod\";\nimport { ALL_FUNCTION_CONTRACTS } from \"./function-registry/index.js\";\nimport type { FunctionContract } from \"./function-registry/types.js\";\n\nexport type FunctionRegistryInputAuditFinding = {\n  contractName: string;\n  projectionKeys: string[];\n  acceptedKeys: string[];\n  missingKeys: string[];\n};\n\ntype InputProjection = NonNullable<\n  FunctionContract[\"convex\"]\n>[\"inputProjection\"];\n\nconst INTERNAL_OR_ALIAS_KEYS = new Set([\n  \"__sdkSessionId\",\n  \"actorId\",\n  \"beliefId\",\n  \"createdBy\",\n  \"evidenceId\",\n  \"id\",\n  \"insightId\",\n  \"nodeId\",\n  \"ontologyId\",\n  \"parentNodeId\",\n  \"principalId\",\n  \"projectId\",\n  \"questionId\",\n  \"tenantId\",\n  \"trustedBypassAccessCheck\",\n  \"userId\",\n  \"versionId\",\n  \"workspaceId\",\n]);\n\nconst INTENTIONAL_PROJECTION_READS: Record<string, readonly string[]> = {\n  add_evidence: [\"linkedBeliefNodeId\", \"targetId\"],\n  apply_lens_to_topic: [\"metadata\"],\n  archive_belief: [\"reason\"],\n  check_permission: [\"principalId\", \"tenantId\", \"userId\", \"workspaceId\"],\n  claim_files: [\"paths\", \"touchedFiles\"],\n  complete_task: [\"summary\"],\n  create_belief: [\"formulation\"],\n  discover: [\"prompt\", \"topicHint\"],\n  filter_by_permission: [\"principalId\", \"tenantId\", \"userId\", \"workspaceId\"],\n  get_change_history: [\"status\"],\n  get_failure_log: [\"status\"],\n  identity_whoami: [\"principalId\", \"tenantId\", \"userId\", \"workspaceId\"],\n  ingest_observation: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  link_evidence: [\n    \"beliefId\",\n    \"beliefNodeId\",\n    \"context\",\n    \"evidenceNodeId\",\n    \"globalId\",\n    \"insightId\",\n    \"topicId\",\n    \"trustedBypassAccessCheck\",\n    \"type\",\n  ],\n  link_evidence_to_belief: [\n    \"beliefNodeId\",\n    \"context\",\n    \"evidenceNodeId\",\n    \"globalId\",\n    \"insightId\",\n    \"targetId\",\n    \"topicId\",\n    \"trustedBypassAccessCheck\",\n    \"type\",\n  ],\n  link_evidence_to_question: [\n    \"context\",\n    \"evidenceNodeId\",\n    \"globalId\",\n    \"impactScore\",\n    \"insightId\",\n    \"questionNodeId\",\n    \"targetId\",\n    \"topicId\",\n    \"trustedBypassAccessCheck\",\n    \"weight\",\n  ],\n  list_evidence: [\"status\"],\n  manage_write_policy: [\"summary\"],\n  merge: [\"decisionsReached\", \"keyFindings\", \"nextSteps\"],\n  record_attempt: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  record_judgment: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  record_scope_learning: [\"reasoning\", \"trustedBypassAccessCheck\"],\n  search_beliefs: [\"searchQuery\"],\n  search_evidence: [\"query\", \"searchQuery\"],\n  update_question_status: [\"answer\", \"answerStatus\", \"nodeId\", \"questionId\"],\n  update_topic: [\"graphScopeProjectId\"],\n};\n\nfunction unwrapObjectSchema(\n  schema: z.ZodTypeAny,\n): z.ZodObject<z.ZodRawShape> | undefined {\n  let current = schema;\n  while (true) {\n    switch (current._def.typeName) {\n      case z.ZodFirstPartyTypeKind.ZodEffects:\n        current = current._def.schema;\n        continue;\n      case z.ZodFirstPartyTypeKind.ZodBranded:\n        current = current._def.type;\n        continue;\n      default:\n        return current instanceof z.ZodObject ? current : undefined;\n    }\n  }\n}\n\nfunction objectSchemaKeys(schema: z.ZodTypeAny): Set<string> {\n  const objectSchema = unwrapObjectSchema(schema);\n  if (!objectSchema) {\n    return new Set();\n  }\n  const shape =\n    typeof objectSchema._def.shape === \"function\"\n      ? objectSchema._def.shape()\n      : objectSchema._def.shape;\n  return new Set(Object.keys(shape));\n}\n\nexport function projectionReadKeys(\n  projection: InputProjection,\n): string[] {\n  if (!projection) {\n    return [];\n  }\n  const source = String(projection);\n  const keys = new Set<string>();\n\n  for (const match of source.matchAll(/\\binput\\s*\\.\\s*([A-Za-z_$][\\w$]*)/gu)) {\n    keys.add(match[1]);\n  }\n  for (const match of source.matchAll(/\\binput\\s*\\[\\s*[\"']([^\"']+)[\"']\\s*\\]/gu)) {\n    keys.add(match[1]);\n  }\n\n  return [...keys].sort();\n}\n\nfunction acceptedInputKeys(contract: FunctionContract): string[] {\n  const keys = [\n    ...new Set([\n      ...objectSchemaKeys(contract.args),\n      ...objectSchemaKeys(contract.input),\n      ...Object.keys(contract.mcp.parameters),\n      \"__sdkSessionId\",\n    ]),\n  ];\n  keys.sort();\n  return keys;\n}\n\nfunction allowedProjectionKeys(contractName: string): Set<string> {\n  return new Set([\n    ...INTERNAL_OR_ALIAS_KEYS,\n    ...(INTENTIONAL_PROJECTION_READS[contractName] ?? []),\n  ]);\n}\n\nexport function auditFunctionRegistryInputs(\n  contracts: readonly FunctionContract[] = ALL_FUNCTION_CONTRACTS,\n): FunctionRegistryInputAuditFinding[] {\n  return contracts.flatMap((contract) => {\n    const projectionKeys = projectionReadKeys(contract.convex?.inputProjection);\n    if (projectionKeys.length === 0) {\n      return [];\n    }\n\n    const accepted = new Set(acceptedInputKeys(contract));\n    const allowed = allowedProjectionKeys(contract.name);\n    const missingKeys = projectionKeys.filter(\n      (key) => !accepted.has(key) && !allowed.has(key),\n    );\n\n    if (missingKeys.length === 0) {\n      return [];\n    }\n\n    return [\n      {\n        contractName: contract.name,\n        projectionKeys,\n        acceptedKeys: [...accepted].sort(),\n        missingKeys,\n      },\n    ];\n  });\n}\n"]}

package/dist/index.d.ts

@@ -8,22 +8,22 @@ export { GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAME
 export { BELIEF_TYPE_BONUS, BeliefLatticeSeed, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, ContextCompilationMode, ContextPackBelief, ContextPackContradiction, ContextPackDeltaReport, ContextPackDiagnostics, ContextPackEntity, ContextPackEvidence, ContextPackFailure, ContextPackFailureContext, ContextPackInjectionPolicy, ContextPackQuestion, ContextPackRequestV1, ContextPackSectionKey, ContextPackSummary, ContextPackV1, ContextRankingProfile, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TOKEN_BUDGET, ENTITY_RANKING_WEIGHTS, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, PRIORITY_SCORES, PackWeightOverride, PublicCompiledContext, PublicContextBelief, PublicContextContradiction, PublicContextEntity, PublicContextEvidence, PublicContextInjectionPolicy, PublicContextQuestion, RANKING_WEIGHTS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, RankingWeightVector, SECTION_BUDGET_RATIOS, SEVERITY_SCORES, TOKENS_PER_WORD, VerificationObligation } from './context-pack.contract.js';
 export { CreateDomainEventInput, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, DomainActorType, DomainEvent, DomainEventData, DomainEventType, DomainResourceType, EVENT_RETENTION_DEFAULT_DAYS, EventCursor, EventListQuery, EventListResult, ReplayEventsInput, ReplayEventsResult, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WebhookCreateInput, WebhookDeliveriesResult, WebhookDeliveryAttemptRecord, WebhookDeliveryRecord, WebhookDeliveryStatus, WebhookHealthResult, WebhookRecord, WebhookSecretMode, WebhookTestResult, WebhookUpdateInput, buildDomainEvent, compareEventCursor, createEventId, decodeEventCursor, emitDomainEvent, encodeEventCursor, inferActorType, isAfterCursor, normalizeRetentionDays, sortEventsByCursor } from './events.contract.js';
 export { DecodedPrefixedId, decodePrefixedId, encodePrefixedId, hasPrefixedIdPrefix } from './ids.contract.js';
-export { d as contractDsl } from './dsl-BgpoVOVQ.js';
+export { d as contractDsl } from './dsl-djCRfuWC.js';
 export { i as schemaContracts } from './index-O09U2xHk.js';
 export { ComponentTableManifest, ComponentTableManifestSchema } from './schemas/component-table-manifest.js';
 export { SLOpinionInput, SLOpinionInputSchema } from './schemas/sl-opinion.js';
-export { e as EdgePolicyEntry, c as EdgePolicyEntrySchema, f as EdgePolicyManifest, d as EdgePolicyManifestSchema, g as EdgePolicyViolation, a as EpistemicNodeType, E as EpistemicNodeTypeSchema, G as GraphRef, b as GraphRefSchema, i as assertEdgePolicyAllowed, h as findEdgePolicy } from './edge-policy-manifest-DpmTtjmm.js';
+export { E as EdgePolicyEntry, a as EdgePolicyEntrySchema, b as EdgePolicyManifest, c as EdgePolicyManifestSchema, d as EdgePolicyViolation, e as EpistemicNodeType, f as EpistemicNodeTypeSchema, G as GraphRef, g as GraphRefSchema, h as assertEdgePolicyAllowed, i as findEdgePolicy } from './edge-policy-manifest-Byv6cQPP.js';
 export { edgePolicyManifest } from './manifests/edge-policy-manifest.data.js';
 export { INFISICAL_RUNTIME_MANIFEST, InfisicalRuntimeManifest } from './manifests/infisical-runtime-manifest.js';
 export { CheckContext, CheckerKind, InvariantId, InvariantManifest, InvariantManifestSchema, InvariantResult, InvariantRule, InvariantSeverity } from './manifests/invariant-manifest.js';
 export { TENANT_CLIENT_MANIFEST, TenantClientManifest } from './manifests/tenant-client-manifest.js';
 export { ProjectionRegistry, projections } from './projections/index.js';
 export * from './function-registry/index.js';
-export { t as mcpToolsContract } from './tool-contracts-CYXVPN4K.js';
+export { t as mcpToolsContract } from './tool-contracts-B4iWhejG.js';
 export { EntityConnectionMatch, EntityMatchCandidate, EntityTypeMatch, OntologyEntityType, rankEntityConnections, rankEntityTypeMatches, scoreEntityConnection, scoreEntityTypeMatch } from './v1/ontologies/v1.js';
 export { LucernPrompt, LucernPromptModelHint, isLucernPrompt } from './prompt.contract.js';
 export { AddEvidenceInput, AddWorktreeInput, BeliefResult, BisectConfidenceInput, BisectResult, BranchResult, CompileContextInput, CompiledContextResult, ConfidenceResult, ContradictionResult, CreateBeliefInput, CreateBranchInput, CreateEdgeInput, EdgeResult, EvidenceResult, FlagContradictionInput, ForkBeliefInput, ForkResult, JudgmentResult, LineageResult, LucernClient, LucernClientConfig, LucernGraphMethods, LucernWorkflowMethods, MergeInput, MergeResult, ModulateConfidenceInput, OpenPullRequestInput, PullRequestResult, PushInput, PushResult, QueryLineageInput, RecordJudgmentInput, RefineBeliefInput, SearchBeliefsInput, WorktreeResult } from './sdk-methods.contract.js';
-export { s as sdkToolsContract } from './sdk-tools.contract-Ng8ULxjr.js';
+export { s as sdkToolsContract } from './sdk-tools.contract-Ci8bkoai.js';
 export { INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, InfisicalRuntimeBootstrapEnv, InfisicalRuntimeDeliveryMode, InfisicalRuntimeEnvironment, InfisicalRuntimePath, InfisicalRuntimePathDefinition, InfisicalRuntimePathId, InfisicalRuntimeSurface, InfisicalRuntimeSurfaceDefinition, InfisicalRuntimeSurfaceId, InfisicalRuntimeVariable, findInfisicalRuntimePath, findInfisicalRuntimeSurface } from './infisical-runtime.contract.js';
 export { TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_PROFILES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TenantClientAllowedImport, TenantClientAuthMode, TenantClientCapability, TenantClientCapabilityId, TenantClientComponentConfigImport, TenantClientForbiddenImportPattern, TenantClientForbiddenImportPatternId, TenantClientForbiddenInstallTokenInfisicalPath, TenantClientForbiddenSecretEnv, TenantClientImportClassification, TenantClientImportDecision, TenantClientInstallProfile, TenantClientInstallProfileId, TenantClientInstallablePackage, TenantClientInstallablePackageName, TenantClientIsolationRule, TenantClientOptionalContextField, TenantClientPackageRole, TenantClientPrincipalType, TenantClientPublicImport, TenantClientPublicPackage, TenantClientPublicSurface, TenantClientRequiredContextField, TenantClientRequiredSdkNamespace, assertTenantClientImportAllowed, classifyTenantClientImport, findTenantClientInstallablePackage, formatTenantClientImportViolation, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport } from './tenant-client.contract.js';
 export { TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TenantBootstrapCopyMode, TenantBootstrapForbiddenSeedTable, TenantBootstrapPrepopulation, TenantBootstrapSeedAuthMetadataField, TenantBootstrapSeedComponent, TenantBootstrapSeedScope, TenantBootstrapSeedTable, TenantBootstrapSeedTableName, TenantBootstrapTableRequirement, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable } from './tenant-bootstrap-seed.contract.js';
@@ -31,11 +31,11 @@ export { TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION
 export { LexicalRerankOptions, LexicalSignal, LexicalStrategy, PreparedLexicalQuery, bigramTokenize, jaccardSimilarity, prepareLexicalQuery, rankWindowScore, rerankLexicalWindow, scoreLexicalSignal, scoreLexicalSignals, stemToken, tokenOverlapScore, tokenizeSearchText, wordOverlapScore, wordTokenize } from './text-matching.contract.js';
 export { ROOT_TOPIC_ID, TopicDoc, collectTopicNeighborhood } from './v1/topics/v1.js';
 export { CANONICAL_WORKFLOW_DEFINITIONS, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, EngineeringBriefOutput, InboxSummaryOutput, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PipelineBriefOutput, ResearchMemoOutput, StrategyArtifactOutput, StructuredPayloadOutput, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WorkflowActionContract, WorkflowActionKind, WorkflowApprovalMode, WorkflowApprovalPolicy, WorkflowAutoFixMode, WorkflowAutoFixPolicy, WorkflowDefinitionV1, WorkflowHookContract, WorkflowHookEvent, WorkflowIntegrityCheckId, WorkflowMutationTier, WorkflowOutputBase, WorkflowOutputContract, WorkflowOutputKind, WorkflowProofArtifact, WorkflowProofArtifactKind, WorkflowRunReceiptV1, WorkflowRunStatus, WorkflowStaffingHint, WorkflowTriggerContract, WorkflowTriggerKind } from './workflow-runtime.contract.js';
+export { ProjectionDef, defineProjection } from './projections/projection-dsl.js';
 export { createEvidenceProjection } from './projections/create-evidence.projection.js';
 export { listBeliefsProjection } from './projections/list-beliefs.projection.js';
 export { listTasksProjection } from './projections/list-tasks.projection.js';
 export { modulateConfidenceProjection } from './projections/modulate-confidence.projection.js';
-export { ProjectionDef, defineProjection } from './projections/projection-dsl.js';
 import './generated/tableOwnership.js';
 import './defineFunction-DO97DKs4.js';
 import 'zod';

package/dist/index.js

@@ -1508,9 +1508,6 @@ function encodeLiteral(value) {
   }
   return JSON.stringify(value);
 }
-function quoteKey(value) {
-  return JSON.stringify(value);
-}
 function sortEntries(entries) {
   return [...entries].sort(([left], [right]) => left.localeCompare(right));
 }
@@ -1673,7 +1670,7 @@ function convertSchemaInner(schema, state, path) {
         convertSchema(value, state, [...path, key])
       ]);
       return {
-        source: `v.object({ ${convertedFields.map(([key, converted]) => `${quoteKey(key)}: ${converted.source}`).join(", ")} })`,
+        source: `v.object({ ${convertedFields.map(([key, converted]) => `${JSON.stringify(key)}: ${converted.source}`).join(", ")} })`,
         defaults: convertedFields.flatMap(([, converted]) => converted.defaults)
       };
     }
@@ -6487,6 +6484,11 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
     role: "sdk_dependency",
     directTenantImport: false
   },
+  {
+    packageName: "@lucern/graph-sync",
+    role: "host_addon_runtime",
+    directTenantImport: true
+  },
   {
     packageName: "@lucern/identity",
     role: "component_runtime",
@@ -6565,6 +6567,12 @@ var TENANT_CLIENT_INSTALL_PROFILES = [
     packageNames: ["@lucern/identity", "@lucern/reasoning-kernel"],
     dependencyField: "dependencies"
   },
+  {
+    id: "graph_mirroring_addon",
+    description: "Optional tenant Convex host install for Neo4j graph projection, edge topology writes, backfill, health checks, and query proxy helpers.",
+    packageNames: ["@lucern/graph-sync"],
+    dependencyField: "dependencies"
+  },
   {
     id: "operator_cli",
     description: "Developer/operator install for the `lucern` binary, including tenant bootstrap seed commands.",
@@ -6609,6 +6617,12 @@ var TENANT_CLIENT_PUBLIC_IMPORTS = [
     subpaths: "published_exports",
     description: "MCP client/server entry points and hosted route helpers."
   },
+  {
+    packageName: "@lucern/graph-sync",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "Optional Neo4j graph mirroring host actions, edge API, query proxy, backfill, and health helpers."
+  },
   {
     packageName: "@lucern/contracts",
     surface: "contract",
@@ -6714,6 +6728,12 @@ var TENANT_CLIENT_CAPABILITIES = [
     surfaces: ["@lucern/sdk", "@lucern/cli", "@lucern/mcp"],
     requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
   },
+  {
+    id: "reasoning.graph_mirroring.install",
+    description: "Install and run the optional Neo4j graph mirror for paid or enterprise tenant deployments.",
+    surfaces: ["@lucern/graph-sync", "@lucern/cli"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
   {
     id: "workflow.worktree_lifecycle",
     description: "Create, review, merge, and close scoped worktrees.",
@@ -7146,8 +7166,11 @@ function compactRecord(input) {
     Object.entries(input).filter(([, value]) => value !== void 0)
   );
 }
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 function recordValue(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  return isRecord(value) ? value : {};
 }
 var createEvidenceProjection = defineProjection({
   contractName: "create_evidence",
@@ -7981,9 +8004,16 @@ var ADD_WORKTREE = {
     },
     projectId: {
       type: "string",
-      description: "Legacy topicId alias"
+      description: "Legacy topicId alias or resolver hint"
+    },
+    topicId: {
+      type: "string",
+      description: "Optional topic scope hint for resolver validation"
+    },
+    topicHint: {
+      type: "string",
+      description: "Natural-language topic hint for automatic topic resolution"
     },
-    topicId: { type: "string", description: "Optional topic scope hint" },
     branchId: {
       type: "string",
       description: "The branch this worktree investigates"
@@ -8081,6 +8111,22 @@ var ADD_WORKTREE = {
       type: "string",
       description: "Optional domain pack whose shaping hooks should influence generated questions and tasks"
     },
+    tags: {
+      type: "array",
+      description: "Additional topic-resolution tags for the worktree"
+    },
+    touchedPaths: {
+      type: "array",
+      description: "File paths used as topic-resolution signals"
+    },
+    sourceRef: {
+      type: "string",
+      description: "Source reference used as a topic-resolution signal"
+    },
+    sourceKind: {
+      type: "string",
+      description: "Source kind used as a topic-resolution signal"
+    },
     campaign: {
       type: "number",
       description: "Top-level pipeline campaign number. Campaigns define the outer execution slice."
@@ -8118,7 +8164,7 @@ var ADD_WORKTREE = {
       description: "Timestamp when worktree metadata was last reconciled"
     }
   },
-  required: ["title", "topicId"],
+  required: ["title"],
   response: {
     description: "The created worktree",
     fields: {
@@ -9821,18 +9867,60 @@ var CREATE_TASK = {
   name: "create_task",
   description: "Create an execution task tied to the reasoning state. Like `git task` \u2014 tracks concrete work items (calls to make, data to gather, analyses to run) linked to questions, beliefs, or worktrees.",
   parameters: {
-    title: { type: "string", description: "Task description" },
+    title: { type: "string", description: "Task title" },
     topicId: { type: "string", description: "Topic scope" },
+    description: {
+      type: "string",
+      description: "Long-form task description"
+    },
     taskType: {
       type: "string",
-      description: "Type: research, interview, analysis, data_collection",
-      enum: ["research", "interview", "analysis", "data_collection"]
+      description: "Task taxonomy",
+      enum: [
+        "general",
+        "find_evidence",
+        "verify_claim",
+        "research",
+        "review",
+        "interview",
+        "analysis",
+        "track_metrics"
+      ]
+    },
+    priority: {
+      type: "string",
+      description: "Priority",
+      enum: ["urgent", "high", "medium", "low"]
+    },
+    status: {
+      type: "string",
+      description: "Initial status (defaults to todo)",
+      enum: ["todo", "in_progress", "blocked", "done"]
+    },
+    linkedWorktreeId: {
+      type: "string",
+      description: "Worktree this task belongs to"
+    },
+    linkedBeliefId: {
+      type: "string",
+      description: "Belief this task supports"
     },
     linkedQuestionId: {
       type: "string",
       description: "Question this task addresses"
     },
-    linkedWorktreeId: { type: "string", description: "Worktree scope" }
+    assigneeId: {
+      type: "string",
+      description: "Principal assigned to the task"
+    },
+    dueDate: {
+      type: "number",
+      description: "Due date as epoch milliseconds"
+    },
+    tags: {
+      type: "array",
+      description: "Free-form string tags"
+    }
   },
   required: ["title"],
   response: {