@lucern/sdk 0.3.0-alpha.3 → 0.3.0-alpha.4

package/dist/index.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { MCP_GATEWAY_EVALUATE_RESEARCH_CONTRACT_ENDPOINT, MCP_GATEWAY_EVALUATE_ENGINEERING_CONTRACT_ENDPOINT, MCP_GATEWAY_BEGIN_BUILD_SESSION_ENDPOINT, MCP_GATEWAY_WRITE_POLICY_CHECK_ENDPOINT, MCP_GATEWAY_BOOTSTRAP_ENDPOINT } from '@lucern/contracts/mcp-gateway-boundary.contract';
 import * as tool_contracts_star from '@lucern/contracts/tool-contracts';
 import { LUCERN_OPERATION_MANIFEST } from '@lucern/contracts/function-registry/manifest';
+import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath } from '@lucern/contracts';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -58,6 +59,7 @@ __export(src_exports, {
   GRAPH_ANALYSIS_SUGGESTION_FIELDS: () => GRAPH_ANALYSIS_SUGGESTION_FIELDS,
   GRAPH_RECOMMENDATION_FIELDS: () => GRAPH_RECOMMENDATION_FIELDS,
   GRAPH_STATE_CLASSIFIER_FIELDS: () => GRAPH_STATE_CLASSIFIER_FIELDS,
+  InfisicalRuntimeError: () => InfisicalRuntimeError,
   JOBS_FIELDS: () => JOBS_FIELDS,
   JUDGMENT_TYPES: () => JUDGMENT_TYPES,
   LENS_PERSPECTIVE_TYPES: () => LENS_PERSPECTIVE_TYPES,
@@ -97,6 +99,7 @@ __export(src_exports, {
   WORKFLOW_STAFFING_HINTS: () => WORKFLOW_STAFFING_HINTS,
   WORKFLOW_TRIGGER_KINDS: () => WORKFLOW_TRIGGER_KINDS,
   WORKTREE_PHASES: () => WORKTREE_PHASES,
+  applyInfisicalRuntimeEnv: () => applyInfisicalRuntimeEnv,
   asListItems: () => asListItems,
   assertValidWebhookSecret: () => assertValidWebhookSecret,
   assertValidWebhookUrl: () => assertValidWebhookUrl,
@@ -156,11 +159,13 @@ __export(src_exports, {
   getControlObjectOwnershipCase: () => getControlObjectOwnershipCase,
   getMcpToolExposure: () => getMcpToolExposure,
   getRegisteredCustomTool: () => getRegisteredCustomTool,
+  hydrateInfisicalRuntimeEnv: () => hydrateInfisicalRuntimeEnv,
   inferActorType: () => inferActorType,
   inferLensPerspectiveTypeFromBranchSchema: () => inferLensPerspectiveTypeFromBranchSchema,
   inferSessionPrincipalType: () => inferSessionPrincipalType,
   invokeRegisteredCustomTool: () => invokeRegisteredCustomTool,
   isAfterCursor: () => isAfterCursor,
+  isInfisicalRuntimeDisabled: () => isInfisicalRuntimeDisabled,
   isLensFilterCriteria: () => isLensFilterCriteria,
   isLucernPrompt: () => isLucernPrompt,
   isMcpToolAllowed: () => isMcpToolAllowed,
@@ -189,6 +194,7 @@ __export(src_exports, {
   opinionFromProjected: () => opinionFromProjected,
   planContextPackCompilation: () => planContextPackCompilation,
   randomIdempotencyKey: () => randomIdempotencyKey,
+  readInfisicalRuntimeBootstrap: () => readInfisicalRuntimeBootstrap,
   registerCustomTool: () => registerCustomTool,
   resolveDeliveryFailureStatus: () => resolveDeliveryFailureStatus,
   resolveText: () => resolveText,
@@ -320,14 +326,15 @@ function normalizeCanonicalLucernAuthContext(input) {
   );
   const roles = cleanStringList(input.roles);
   const scopes = cleanStringList(input.scopes);
-  if (roles.length === 0 || scopes.length === 0) {
+  const principalType = requirePrincipalType(input.principalType);
+  const authMode = requireAuthMode(input.authMode);
+  const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
+  if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
     throw new LucernSdkAuthContextError(
       "membership_missing",
       "Canonical Lucern SDK auth context requires non-empty roles and scopes."
     );
   }
-  const principalType = requirePrincipalType(input.principalType);
-  const authMode = requireAuthMode(input.authMode);
   const subject = cleanString(input.permit?.subject) ?? principalId;
   const tenant = cleanString(input.permit?.tenant) ?? tenantId;
   const workspace = cleanString(input.permit?.workspace) ?? workspaceId;
@@ -4434,7 +4441,9 @@ function createGraphAnalysisClient(config = {}) {
           topicId: requireTopicId2(input),
           workspaceId: input.workspaceId,
           analysisId: input.analysisId,
-          since: input.since,
+          minimumCreatedAt: input.minimumCreatedAt ?? input.since ?? input.createdAt ?? input.analysisCreatedAt,
+          sourceNodeIds: input.sourceNodeIds?.join(",") ?? (input.nodeId ? input.nodeId : void 0),
+          sourceEdgeIds: input.sourceEdgeIds?.join(",") ?? (input.edgeId ? input.edgeId : void 0),
           limit: input.limit,
           cursor: input.cursor
         })}`
@@ -5279,6 +5288,7 @@ var FUNCTION_SURFACE_METHOD_PATHS = [
   "topics.updateTopic",
   "worktrees.activateWorktree",
   "worktrees.addWorktree",
+  "worktrees.beginBuildSession",
   "worktrees.listAllWorktrees",
   "worktrees.listCampaigns",
   "worktrees.listWorktrees",
@@ -5301,6 +5311,7 @@ var CONTRACTS = {
   "archive_belief": { method: "DELETE", path: "/beliefs", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
   "archive_ontology": { method: "DELETE", path: "/ontologies", kind: "mutation", idempotent: true, surfaceIntent: "mcp_governance" },
   "archive_question": { method: "DELETE", path: "/questions", kind: "mutation", idempotent: true, surfaceIntent: "mcp_core" },
+  "begin_build_session": { method: "POST", path: "/mcp/build-session/begin", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "bisect_confidence": { method: "POST", path: "/beliefs/confidence/bisect", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
   "broadcast_message": { method: "POST", path: "/coordination/messages/broadcast", kind: "mutation", idempotent: true, surfaceIntent: "system" },
   "check_permission": { method: "POST", path: "/identity/check-permission", kind: "query", idempotent: false, surfaceIntent: "mcp_core" },
@@ -5472,6 +5483,9 @@ function createFunctionSurfaceClient(config = {}) {
     archiveQuestion(input = {}, idempotencyKey) {
       return execute("archive_question", input, idempotencyKey);
     },
+    beginBuildSession(input = {}, idempotencyKey) {
+      return execute("begin_build_session", input, idempotencyKey);
+    },
     bisectConfidence(input = {}, idempotencyKey) {
       return execute("bisect_confidence", input, idempotencyKey);
     },
@@ -7406,6 +7420,13 @@ function requireTopicId4(args) {
   }
   return topicId;
 }
+function requireTopicOrProjectId(args) {
+  const topicId = args.topicId?.trim() || args.projectId?.trim() || void 0;
+  if (!topicId) {
+    throw new Error("topicId is required");
+  }
+  return topicId;
+}
 var AUDIT_NODE_REFERENCE_KEY_PATTERN = /(^|_)(id|nodeid|beliefid|resourceid|targetid|sourceid|subjectid|globalid|entityid|recordid|fromnodeid|tonodeid|linkednodeid|linkedbeliefid|nodeids|beliefids|resourceids)$/i;
 function matchesAuditNodeReference(value, nodeId) {
   if (Array.isArray(value)) {
@@ -7441,6 +7462,23 @@ function requireBaseRate(args) {
 function exposeGatewayData(response) {
   return Object.assign({}, response, response.data);
 }
+function sdkQueryString(input) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(input)) {
+    if (value === void 0 || value === null) {
+      continue;
+    }
+    if (Array.isArray(value)) {
+      if (value.length > 0) {
+        params.set(key, value.join(","));
+      }
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  const serialized = params.toString();
+  return serialized ? `?${serialized}` : "";
+}
 function createLucernClient(config = {}) {
   const gatewayConfig = toGatewayConfig(config);
   const beliefsClient = createBeliefsClient(gatewayConfig);
@@ -7861,6 +7899,30 @@ function createLucernClient(config = {}) {
     batchCreate(input, idempotencyKey) {
       return graphClient.batchCreateNodes(input, idempotencyKey);
     },
+    listByTopicAndType(input) {
+      return gateway.request({
+        path: `/api/platform/v1/nodes${sdkQueryString({
+          topicId: requireTopicOrProjectId(input),
+          nodeType: input.nodeType,
+          nodeTypes: input.nodeTypes,
+          query: input.query,
+          sourceText: input.sourceText,
+          limit: input.limit,
+          cursor: input.cursor
+        })}`
+      }).then(exposeGatewayData);
+    },
+    countByTopicAndType(input) {
+      return gateway.request({
+        path: `/api/platform/v1/nodes/count${sdkQueryString({
+          topicId: requireTopicOrProjectId(input),
+          nodeType: input.nodeType,
+          nodeTypes: input.nodeTypes,
+          query: input.query,
+          limit: input.limit
+        })}`
+      }).then(exposeGatewayData);
+    },
     supersede(input, idempotencyKey) {
       return graphClient.supersedeNode(input, idempotencyKey);
     },
@@ -7871,6 +7933,78 @@ function createLucernClient(config = {}) {
       return graphClient.hardDeleteNode(input, idempotencyKey);
     }
   };
+  const publicationNamespace = {
+    create(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/publication",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      }).then(exposeGatewayData);
+    },
+    update(publicationId, input, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/publication/${encodeURIComponent(
+          publicationId
+        )}`,
+        method: "PATCH",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      }).then(exposeGatewayData);
+    },
+    list(input = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/publication${sdkQueryString(input)}`
+      }).then(exposeGatewayData);
+    },
+    getByTopic(input) {
+      const topicId = typeof input === "string" ? input : input.topicId;
+      const workspaceId = typeof input === "string" ? void 0 : input.workspaceId;
+      return gateway.request({
+        path: `/api/platform/v1/publication/by-topic/${encodeURIComponent(
+          topicId
+        )}${sdkQueryString({ workspaceId })}`
+      }).then(exposeGatewayData);
+    },
+    publish(publicationId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/publication/${encodeURIComponent(
+          publicationId
+        )}/publish`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      }).then(exposeGatewayData);
+    },
+    unpublish(publicationId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/publication/${encodeURIComponent(
+          publicationId
+        )}/unpublish`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      }).then(exposeGatewayData);
+    },
+    remove(publicationId, input = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/publication/${encodeURIComponent(
+          publicationId
+        )}${sdkQueryString(input)}`,
+        method: "DELETE"
+      }).then(exposeGatewayData);
+    }
+  };
+  const ontologyLinksNamespace = {
+    ...ontologyLinksClient,
+    resolveThemeSource(input) {
+      return gateway.request({
+        path: "/api/platform/v1/ontology-links/theme-source",
+        method: "POST",
+        body: input
+      }).then(exposeGatewayData);
+    }
+  };
   return {
     config,
     version: LUCERN_SDK_VERSION,
@@ -8352,6 +8486,54 @@ function createLucernClient(config = {}) {
         }));
       }
     },
+    themes: {
+      listByTopic(input) {
+        return gateway.request({
+          path: `/api/platform/v1/themes${sdkQueryString({
+            topicId: requireTopicOrProjectId(input),
+            query: input.query,
+            limit: input.limit,
+            cursor: input.cursor
+          })}`
+        }).then(exposeGatewayData);
+      }
+    },
+    graphSearch: {
+      keywordSearchNodes(input) {
+        return gateway.request({
+          path: "/api/platform/v1/graph-search/keyword-nodes",
+          method: "POST",
+          body: {
+            ...input,
+            topicId: requireTopicOrProjectId(input),
+            projectId: void 0
+          }
+        }).then(exposeGatewayData);
+      }
+    },
+    classifiers: {
+      listBeliefCandidates(input) {
+        return gateway.request({
+          path: `/api/platform/v1/classifiers/belief-candidates${sdkQueryString({
+            topicId: requireTopicOrProjectId(input),
+            classifierKey: input.classifierKey,
+            query: input.query,
+            limit: input.limit,
+            cursor: input.cursor
+          })}`
+        }).then(exposeGatewayData);
+      }
+    },
+    archetypes: {
+      getJudgmentSignature(input) {
+        return gateway.request({
+          path: `/api/platform/v1/archetypes/judgment-signature${sdkQueryString({
+            topicId: requireTopicOrProjectId(input),
+            principalId: input.principalId
+          })}`
+        }).then(exposeGatewayData);
+      }
+    },
     judgments: {
       create(input) {
         return decisionsClient.createJudgment(input);
@@ -8393,6 +8575,52 @@ function createLucernClient(config = {}) {
         });
       }
     },
+    decisions: {
+      create(input) {
+        return decisionsClient.createJudgment(input);
+      },
+      record(input) {
+        return decisionsClient.recordJudgment(input);
+      },
+      list(query5) {
+        return decisionsClient.listJudgments(query5);
+      },
+      get(decisionId) {
+        return decisionsClient.getJudgment(decisionId);
+      },
+      recordOutcome(decisionId, input) {
+        return decisionsClient.recordJudgmentOutcome(decisionId, input);
+      },
+      lessons(decisionId, input, idempotencyKey) {
+        return gateway.request({
+          path: `/api/platform/v1/decisions/${encodeURIComponent(
+            decisionId
+          )}/lessons`,
+          method: "POST",
+          body: input,
+          idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        }).then(exposeGatewayData);
+      },
+      archive(decisionId, input = {}, idempotencyKey) {
+        return gateway.request({
+          path: `/api/platform/v1/decisions/${encodeURIComponent(
+            decisionId
+          )}/archive`,
+          method: "POST",
+          body: input,
+          idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        }).then(exposeGatewayData);
+      },
+      readiness(topicId) {
+        return decisionsClient.getJudgmentReadiness({ topicId });
+      },
+      calibration(topicId) {
+        return decisionsClient.getJudgmentCalibration({ topicId });
+      },
+      pendingOutcomeReview(topicId) {
+        return decisionsClient.listPendingJudgmentOutcomeReview({ topicId });
+      }
+    },
     worktrees: {
       createBranch(input) {
         return workflowClient.createBranch(input);
@@ -8415,7 +8643,21 @@ function createLucernClient(config = {}) {
           topicId: requireTopicId4(input),
           objective: input.objective,
           hypothesis: input.hypothesis,
+          rationale: input.rationale,
+          worktreeType: input.worktreeType,
+          startDate: input.startDate,
+          endDate: input.endDate,
+          durationWeeks: input.durationWeeks,
+          confidenceImpact: input.confidenceImpact,
+          beliefFocus: input.beliefFocus,
           beliefIds: input.beliefIds,
+          targetBeliefIds: input.targetBeliefIds,
+          targetQuestionIds: input.targetQuestionIds,
+          keyQuestions: input.keyQuestions,
+          evidenceSignals: input.evidenceSignals,
+          decisionGate: input.decisionGate,
+          goCriteria: input.goCriteria,
+          noGoSignals: input.noGoSignals,
           autoShape: input.autoShape,
           domainPackId: input.domainPackId,
           campaign: input.campaign,
@@ -8428,7 +8670,8 @@ function createLucernClient(config = {}) {
           proofArtifacts: input.proofArtifacts,
           staffingHint: typeof input.staffingHint === "string" ? input.staffingHint : void 0,
           lastReconciledAt: input.lastReconciledAt,
-          autoFixPolicy: input.autoFixPolicy
+          autoFixPolicy: input.autoFixPolicy,
+          lensId: input.lensId
         });
       },
       add(input) {
@@ -8437,7 +8680,21 @@ function createLucernClient(config = {}) {
           topicId: requireTopicId4(input),
           objective: input.objective,
           hypothesis: input.hypothesis,
+          rationale: input.rationale,
+          worktreeType: input.worktreeType,
+          startDate: input.startDate,
+          endDate: input.endDate,
+          durationWeeks: input.durationWeeks,
+          confidenceImpact: input.confidenceImpact,
+          beliefFocus: input.beliefFocus,
           beliefIds: input.beliefIds,
+          targetBeliefIds: input.targetBeliefIds,
+          targetQuestionIds: input.targetQuestionIds,
+          keyQuestions: input.keyQuestions,
+          evidenceSignals: input.evidenceSignals,
+          decisionGate: input.decisionGate,
+          goCriteria: input.goCriteria,
+          noGoSignals: input.noGoSignals,
           autoShape: input.autoShape,
           domainPackId: input.domainPackId,
           campaign: input.campaign,
@@ -8450,7 +8707,8 @@ function createLucernClient(config = {}) {
           proofArtifacts: input.proofArtifacts,
           staffingHint: typeof input.staffingHint === "string" ? input.staffingHint : void 0,
           lastReconciledAt: input.lastReconciledAt,
-          autoFixPolicy: input.autoFixPolicy
+          autoFixPolicy: input.autoFixPolicy,
+          lensId: input.lensId
         });
       },
       list(query5) {
@@ -8460,6 +8718,22 @@ function createLucernClient(config = {}) {
           limit: query5.limit
         });
       },
+      listByTopic(query5) {
+        return worktreesFacade.list({
+          topicId: requireTopicId4(query5),
+          status: query5.status,
+          limit: query5.limit
+        });
+      },
+      findByPairedSprint(input) {
+        return gateway.request({
+          path: `/api/platform/v1/worktrees/paired-sprint${sdkQueryString({
+            sprintId: input.sprintId,
+            topicId: input.topicId ?? input.projectId,
+            limit: input.limit
+          })}`
+        }).then(exposeGatewayData);
+      },
       activate(worktreeId) {
         return worktreesFacade.activate({ id: worktreeId });
       },
@@ -8611,6 +8885,31 @@ function createLucernClient(config = {}) {
           status: typeof input.status === "string" ? input.status : void 0,
           limit: typeof input.limit === "number" ? input.limit : void 0
         });
+      },
+      listByTopic(input) {
+        return tasksFacade.list({
+          topicId: requireTopicId4(input),
+          status: typeof input.status === "string" ? input.status : void 0,
+          limit: typeof input.limit === "number" ? input.limit : void 0
+        });
+      },
+      listByWorktree(input) {
+        return tasksFacade.list({
+          topicId: typeof input.topicId === "string" ? input.topicId : void 0,
+          worktreeId: input.worktreeId,
+          status: typeof input.status === "string" ? input.status : void 0,
+          limit: typeof input.limit === "number" ? input.limit : void 0
+        });
+      },
+      linkChat(taskId, input, idempotencyKey) {
+        return gateway.request({
+          path: `/api/platform/v1/tasks/${encodeURIComponent(
+            taskId
+          )}/link-chat`,
+          method: "POST",
+          body: input,
+          idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+        }).then(exposeGatewayData);
       }
     },
     topics: {
@@ -8895,11 +9194,13 @@ function createLucernClient(config = {}) {
     graphAnalysis: graphAnalysisClient,
     graphRecommendations: graphRecommendationsClient,
     orgGraphSearch: orgGraphSearchClient,
-    ontologyLinks: ontologyLinksClient,
+    ontologyLinks: ontologyLinksNamespace,
     graphStateClassifier: graphStateClassifierClient,
     modelRuntime: modelRuntimeClient,
     jobs: jobsClient,
     telemetry: telemetryClient,
+    publication: publicationNamespace,
+    contentPublication: publicationNamespace,
     tools: {
       listCatalog: toolRegistryClient.listCatalog,
       listExecutable: toolRegistryClient.listExecutable,
@@ -11367,7 +11668,291 @@ function createWebhooksClientCore(config = {}) {
     }
   };
 }
+var InfisicalRuntimeError = class extends Error {
+  code;
+  status;
+  constructor(args) {
+    super(args.message);
+    this.name = "InfisicalRuntimeError";
+    this.code = args.code;
+    this.status = args.status;
+  }
+};
+function readInfisicalRuntimeBootstrap(env = {}, overrides = {}) {
+  if (isInfisicalRuntimeDisabled(env)) {
+    return null;
+  }
+  const bootstrapEnv = INFISICAL_RUNTIME_MANIFEST.bootstrapEnv;
+  const clientId = overrides.clientId ?? readFirst(env, bootstrapEnv.clientId);
+  const clientSecret = overrides.clientSecret ?? readFirst(env, bootstrapEnv.clientSecret);
+  const hasAuthSignal = Boolean(clientId || clientSecret);
+  if (!hasAuthSignal) {
+    return null;
+  }
+  if (!clientId || !clientSecret) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_BOOTSTRAP_INCOMPLETE",
+      message: "Infisical runtime bootstrap requires both INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET."
+    });
+  }
+  return {
+    apiUrl: overrides.apiUrl ?? readFirst(env, bootstrapEnv.apiUrl) ?? INFISICAL_RUNTIME_DEFAULT_API_URL,
+    projectId: overrides.projectId ?? readFirst(env, bootstrapEnv.projectId) ?? INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,
+    clientId,
+    clientSecret,
+    environment: normalizeInfisicalEnvironment(
+      overrides.environment ?? readFirst(env, bootstrapEnv.environment)
+    ),
+    organizationSlug: overrides.organizationSlug ?? readFirst(env, bootstrapEnv.organizationSlug)
+  };
+}
+function isInfisicalRuntimeDisabled(env = {}) {
+  return INFISICAL_RUNTIME_MANIFEST.bootstrapEnv.disabled.some(
+    (name) => isTruthyEnv(env[name])
+  );
+}
+async function hydrateInfisicalRuntimeEnv(options) {
+  const env = options.env ?? {};
+  const bootstrap = mergeBootstrap(
+    readInfisicalRuntimeBootstrap(env, options.bootstrap),
+    options.bootstrap
+  );
+  if (!bootstrap) {
+    return {
+      status: "disabled",
+      surfaceId: options.surfaceId,
+      values: {},
+      sourcePaths: []
+    };
+  }
+  const surface = findInfisicalRuntimeSurface(options.surfaceId);
+  if (!surface) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNKNOWN_SURFACE",
+      message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`
+    });
+  }
+  if (surface.delivery !== "runtime_fetch") {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNSUPPORTED_SURFACE_DELIVERY",
+      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces.`
+    });
+  }
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_FETCH_UNAVAILABLE",
+      message: "No fetch implementation is available for Infisical runtime hydration."
+    });
+  }
+  const token = await loginWithUniversalAuth(bootstrap, fetchImpl);
+  const values = {};
+  const missingRequired = [];
+  const sourcePaths = [];
+  for (const pathId of surface.sourcePathIds) {
+    const path = findInfisicalRuntimePath(pathId);
+    if (!path) {
+      throw new InfisicalRuntimeError({
+        code: "INFISICAL_UNKNOWN_PATH",
+        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
+      });
+    }
+    sourcePaths.push(path.secretPath);
+    for (const variable of path.variables) {
+      const runtimeVariable = variable;
+      const secretValue = await readVariableSecret({
+        bootstrap,
+        fetchImpl,
+        token,
+        secretPath: path.secretPath,
+        variable: runtimeVariable
+      });
+      if (!secretValue) {
+        if (runtimeVariable.required) {
+          missingRequired.push(runtimeVariable.name);
+        }
+        continue;
+      }
+      values[runtimeVariable.name] = secretValue.value;
+      for (const alias of runtimeVariable.aliases ?? []) {
+        values[alias] = secretValue.value;
+      }
+    }
+  }
+  if (missingRequired.length > 0) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_REQUIRED_SECRETS_MISSING",
+      message: `Missing required Infisical runtime secrets: ${missingRequired.join(", ")}.`
+    });
+  }
+  return {
+    status: "hydrated",
+    surfaceId: options.surfaceId,
+    environment: bootstrap.environment,
+    values,
+    sourcePaths
+  };
+}
+function applyInfisicalRuntimeEnv(result, targetEnv, options = {}) {
+  for (const [key, value] of Object.entries(result.values)) {
+    if (options.overrideExisting || !targetEnv[key]) {
+      targetEnv[key] = value;
+    }
+  }
+}
+function normalizeInfisicalEnvironment(value) {
+  if (value === "dev" || value === "staging" || value === "prod") {
+    return value;
+  }
+  if (value === "development") {
+    return "dev";
+  }
+  if (value === "production") {
+    return "prod";
+  }
+  return "prod";
+}
+function mergeBootstrap(base, overrides) {
+  if (!base) {
+    return null;
+  }
+  return {
+    ...base,
+    ...compact(overrides ?? {}),
+    apiUrl: trimTrailingSlash(overrides?.apiUrl ?? base.apiUrl)
+  };
+}
+async function loginWithUniversalAuth(bootstrap, fetchImpl) {
+  const response = await fetchImpl(
+    `${trimTrailingSlash(bootstrap.apiUrl)}/api/v1/auth/universal-auth/login`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        clientId: bootstrap.clientId,
+        clientSecret: bootstrap.clientSecret,
+        ...bootstrap.organizationSlug ? { organizationSlug: bootstrap.organizationSlug } : {}
+      })
+    }
+  );
+  const body4 = await readJson2(response);
+  if (!response.ok) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNIVERSAL_AUTH_FAILED",
+      status: response.status,
+      message: `Infisical Universal Auth failed with HTTP ${response.status}: ${messageFromBody(body4)}`
+    });
+  }
+  const accessToken = readNestedString(body4, ["accessToken"]);
+  if (!accessToken) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNIVERSAL_AUTH_INVALID_RESPONSE",
+      message: "Infisical Universal Auth response did not include accessToken."
+    });
+  }
+  return accessToken;
+}
+async function readVariableSecret(args) {
+  const names = [args.variable.name, ...args.variable.aliases ?? []];
+  for (const name of names) {
+    const value = await readSecretValue({
+      bootstrap: args.bootstrap,
+      fetchImpl: args.fetchImpl,
+      token: args.token,
+      secretPath: args.secretPath,
+      name,
+      optional: true
+    });
+    if (value) {
+      return { name, value };
+    }
+  }
+  return null;
+}
+async function readSecretValue(args) {
+  const params = new URLSearchParams({
+    projectId: args.bootstrap.projectId,
+    environment: args.bootstrap.environment,
+    secretPath: args.secretPath,
+    type: "shared",
+    viewSecretValue: "true",
+    expandSecretReferences: "true",
+    includeImports: "true"
+  });
+  const response = await args.fetchImpl(
+    `${trimTrailingSlash(args.bootstrap.apiUrl)}/api/v4/secrets/${encodeURIComponent(args.name)}?${params.toString()}`,
+    {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${args.token}`
+      }
+    }
+  );
+  const body4 = await readJson2(response);
+  if (response.status === 404 && args.optional) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_SECRET_READ_FAILED",
+      status: response.status,
+      message: `Infisical secret ${args.name} read failed with HTTP ${response.status}: ${messageFromBody(body4)}`
+    });
+  }
+  return readNestedString(body4, ["secret", "secretValue"]);
+}
+async function readJson2(response) {
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
+function readNestedString(value, path) {
+  let current = value;
+  for (const key of path) {
+    if (!current || typeof current !== "object" || !(key in current)) {
+      return null;
+    }
+    current = current[key];
+  }
+  return typeof current === "string" && current.length > 0 ? current : null;
+}
+function messageFromBody(body4) {
+  if (!body4 || typeof body4 !== "object") {
+    return "no response body";
+  }
+  const record = body4;
+  for (const key of ["message", "error", "errorMessage"]) {
+    if (typeof record[key] === "string") {
+      return record[key];
+    }
+  }
+  return JSON.stringify(body4);
+}
+function readFirst(env, names) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function isTruthyEnv(value) {
+  return ["1", "true", "yes", "on"].includes(value?.toLowerCase() ?? "");
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/u, "");
+}
+function compact(value) {
+  return Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== void 0)
+  );
+}
 
-export { BELIEF_STATUSES, BRANCH_DEPRECATION_MESSAGE, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, CONTROL_OBJECT_BLAST_RADII, CONTROL_OBJECT_EDIT_SURFACES, CONTROL_OBJECT_INHERITANCE_RULES, CONTROL_OBJECT_KINDS, CONTROL_OBJECT_OWNERSHIP_CONTRACT, CONTROL_OBJECT_OWNERSHIP_MATRIX, CONTROL_OBJECT_OWNERSHIP_ROWS, CONTROL_OBJECT_OWNER_SCOPES, CustomToolRegistryError, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, DeviceAuthorizationError, EDGE_TYPES, EMBEDDINGS_FIELDS, EPISTEMIC_EDGE_TYPES, EPISTEMIC_LAYERS, EVENTING_FIELDS, EVENT_RETENTION_DEFAULT_DAYS, FORK_REASONS, FUNCTION_SURFACE_METHOD_PATHS, GRAPH_ANALYSIS_ANALYSIS_FIELDS, GRAPH_ANALYSIS_COMPUTE_FIELDS, GRAPH_ANALYSIS_SUGGESTION_FIELDS, GRAPH_RECOMMENDATION_FIELDS, GRAPH_STATE_CLASSIFIER_FIELDS, JOBS_FIELDS, JUDGMENT_TYPES, LENS_PERSPECTIVE_TYPES, LENS_STATUSES, LENS_TASK_TEMPLATE_PRIORITIES, LUCERN_SDK_VERSION, LucernApiError, LucernSdkAuthContextError, MAX_ENTITY_LIMIT, MCP_ALWAYS_ALLOWED_TOOL_NAMES, MERGE_OUTCOMES, MODEL_RUNTIME_FIELDS, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, ONTOLOGY_LINK_FIELDS, ORG_GRAPH_SEARCH_FIELDS, REASONING_METHODS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, STRUCTURAL_EDGE_TYPES, TELEMETRY_FIELDS, TENANT_IDENTITY_FIELDS, TOOL_REGISTRY_FIELDS, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, asListItems, assertValidWebhookSecret, assertValidWebhookUrl, buildDeprecatedBranchMetadata, buildDomainEvent, buildMcpToolContracts, buildMcpToolManifest, clearRegisteredCustomTools, compareEventCursor, compileContextPackFromSnapshot, computeWebhookSignature, createAdminClient, createAnswersClient, createAudiencesClient, createAuditClient, createAuthDeviceClient, createBeliefsClient, createCanonicalAuthHeaders, createContextClient, createContextFacade, createDecisionsClient, createEmbeddingsClient, createEventId, createEventingClient, createEventsClientCore, createEvidenceClient, createFunctionSurfaceClient, createGatewayRequestClient, createGraphAnalysisClient, createGraphClient, createGraphRecommendationsClient, createGraphStateClassifierClient, createHarnessClient, createIdentityClient, createJobsClient, createLearningClient, createListResult, createLucernClient, createModelRuntimeClient, createOntologyClient, createOntologyLinksClient, createOrgGraphSearchClient, createPacksClient, createPolicyClient, createReportsClient, createSchemaClient, createSourcesClient, createTelemetryClient, createToolRegistryClient, createTopicsClient, createWebhooksClientCore, createWorkflowClient, decodeEventCursor, emitDomainEvent, encodeEventCursor, eventPatternToRegExp, getControlObjectOwnershipCase, getMcpToolExposure, getRegisteredCustomTool, inferActorType, inferLensPerspectiveTypeFromBranchSchema, inferSessionPrincipalType, invokeRegisteredCustomTool, isAfterCursor, isLensFilterCriteria, isLucernPrompt, isMcpToolAllowed, isTaxonomyFilterCriteriaV1, lastDelegator, listControlObjectOwnershipCases, listRegisteredCustomTools, mapAliasedList, mapGatewayData, mapOpinionHistoryEntriesFromGatewayData, matchesAnyEventPattern, matchesEventPattern, mcpContractToInputSchema, mcpContractToManifestEntry, migrateBranchToLens, nextDeliveryAttemptAt, normalizeCanonicalLucernAuthContext, normalizeDelegationChain, normalizeNodeVerificationStatus, normalizeNodeWriteInput, normalizeRetentionDays, normalizeTopicQuery, normalizeWebhookPatterns, opinionFromBaseRate, opinionFromDogmatic, opinionFromProjected, planContextPackCompilation, randomIdempotencyKey, registerCustomTool, resolveDeliveryFailureStatus, resolveText, resolveTopicId, sanitizeWebhookRecord, sortEventsByCursor, toQueryString, truncateWebhookResponseBody, unregisterCustomTool, validateFilterCriteria, withSdkAliases, withTextAlias, withTopicAlias };
+export { BELIEF_STATUSES, BRANCH_DEPRECATION_MESSAGE, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, CONTROL_OBJECT_BLAST_RADII, CONTROL_OBJECT_EDIT_SURFACES, CONTROL_OBJECT_INHERITANCE_RULES, CONTROL_OBJECT_KINDS, CONTROL_OBJECT_OWNERSHIP_CONTRACT, CONTROL_OBJECT_OWNERSHIP_MATRIX, CONTROL_OBJECT_OWNERSHIP_ROWS, CONTROL_OBJECT_OWNER_SCOPES, CustomToolRegistryError, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, DeviceAuthorizationError, EDGE_TYPES, EMBEDDINGS_FIELDS, EPISTEMIC_EDGE_TYPES, EPISTEMIC_LAYERS, EVENTING_FIELDS, EVENT_RETENTION_DEFAULT_DAYS, FORK_REASONS, FUNCTION_SURFACE_METHOD_PATHS, GRAPH_ANALYSIS_ANALYSIS_FIELDS, GRAPH_ANALYSIS_COMPUTE_FIELDS, GRAPH_ANALYSIS_SUGGESTION_FIELDS, GRAPH_RECOMMENDATION_FIELDS, GRAPH_STATE_CLASSIFIER_FIELDS, InfisicalRuntimeError, JOBS_FIELDS, JUDGMENT_TYPES, LENS_PERSPECTIVE_TYPES, LENS_STATUSES, LENS_TASK_TEMPLATE_PRIORITIES, LUCERN_SDK_VERSION, LucernApiError, LucernSdkAuthContextError, MAX_ENTITY_LIMIT, MCP_ALWAYS_ALLOWED_TOOL_NAMES, MERGE_OUTCOMES, MODEL_RUNTIME_FIELDS, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, ONTOLOGY_LINK_FIELDS, ORG_GRAPH_SEARCH_FIELDS, REASONING_METHODS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, STRUCTURAL_EDGE_TYPES, TELEMETRY_FIELDS, TENANT_IDENTITY_FIELDS, TOOL_REGISTRY_FIELDS, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, applyInfisicalRuntimeEnv, asListItems, assertValidWebhookSecret, assertValidWebhookUrl, buildDeprecatedBranchMetadata, buildDomainEvent, buildMcpToolContracts, buildMcpToolManifest, clearRegisteredCustomTools, compareEventCursor, compileContextPackFromSnapshot, computeWebhookSignature, createAdminClient, createAnswersClient, createAudiencesClient, createAuditClient, createAuthDeviceClient, createBeliefsClient, createCanonicalAuthHeaders, createContextClient, createContextFacade, createDecisionsClient, createEmbeddingsClient, createEventId, createEventingClient, createEventsClientCore, createEvidenceClient, createFunctionSurfaceClient, createGatewayRequestClient, createGraphAnalysisClient, createGraphClient, createGraphRecommendationsClient, createGraphStateClassifierClient, createHarnessClient, createIdentityClient, createJobsClient, createLearningClient, createListResult, createLucernClient, createModelRuntimeClient, createOntologyClient, createOntologyLinksClient, createOrgGraphSearchClient, createPacksClient, createPolicyClient, createReportsClient, createSchemaClient, createSourcesClient, createTelemetryClient, createToolRegistryClient, createTopicsClient, createWebhooksClientCore, createWorkflowClient, decodeEventCursor, emitDomainEvent, encodeEventCursor, eventPatternToRegExp, getControlObjectOwnershipCase, getMcpToolExposure, getRegisteredCustomTool, hydrateInfisicalRuntimeEnv, inferActorType, inferLensPerspectiveTypeFromBranchSchema, inferSessionPrincipalType, invokeRegisteredCustomTool, isAfterCursor, isInfisicalRuntimeDisabled, isLensFilterCriteria, isLucernPrompt, isMcpToolAllowed, isTaxonomyFilterCriteriaV1, lastDelegator, listControlObjectOwnershipCases, listRegisteredCustomTools, mapAliasedList, mapGatewayData, mapOpinionHistoryEntriesFromGatewayData, matchesAnyEventPattern, matchesEventPattern, mcpContractToInputSchema, mcpContractToManifestEntry, migrateBranchToLens, nextDeliveryAttemptAt, normalizeCanonicalLucernAuthContext, normalizeDelegationChain, normalizeNodeVerificationStatus, normalizeNodeWriteInput, normalizeRetentionDays, normalizeTopicQuery, normalizeWebhookPatterns, opinionFromBaseRate, opinionFromDogmatic, opinionFromProjected, planContextPackCompilation, randomIdempotencyKey, readInfisicalRuntimeBootstrap, registerCustomTool, resolveDeliveryFailureStatus, resolveText, resolveTopicId, sanitizeWebhookRecord, sortEventsByCursor, toQueryString, truncateWebhookResponseBody, unregisterCustomTool, validateFilterCriteria, withSdkAliases, withTextAlias, withTopicAlias };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map