@vectros-ai/blueprints 0.5.0

package/dist/index.mjs

@@ -0,0 +1,1257 @@
+// src/types.ts
+import { z } from "zod";
+var CONTEXT_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
+var ValidationRulesSchema = z.object({
+  required: z.boolean().optional(),
+  minLength: z.number().int().optional(),
+  maxLength: z.number().int().optional(),
+  min: z.number().int().optional(),
+  max: z.number().int().optional(),
+  pattern: z.string().optional(),
+  email: z.boolean().optional(),
+  url: z.boolean().optional(),
+  phone: z.boolean().optional(),
+  step: z.number().int().optional(),
+  multipleOf: z.number().int().optional(),
+  minItems: z.number().int().optional(),
+  maxItems: z.number().int().optional()
+}).strict();
+var RenderHintsSchema = z.object({
+  label: z.string().optional(),
+  widget: z.enum(["text", "textarea", "select", "date", "checkbox"]).optional(),
+  order: z.number().int().optional(),
+  section: z.string().optional(),
+  helpText: z.string().optional(),
+  // Marks this field as the record's headline (display) field — the linked
+  // primary column in the records list + the title on the detail view. At most
+  // one per schema (the platform takes the first by order). Format passthrough →
+  // SchemaRequest.renderHints[fieldId].displayField.
+  displayField: z.boolean().optional()
+}).strict();
+var BlueprintFieldDefSchema = z.object({
+  fieldId: z.string().min(1),
+  fieldType: z.string().min(1),
+  required: z.boolean().optional(),
+  searchable: z.boolean().optional(),
+  filterable: z.boolean().optional(),
+  enumValues: z.array(z.string()).optional(),
+  description: z.string().optional(),
+  // NEW (format passthrough) — the loader stopped dropping these.
+  validation: ValidationRulesSchema.optional(),
+  renderHints: RenderHintsSchema.optional(),
+  // Marks the field as sensitive (PHI/PII): the platform redacts it from
+  // logs/audit/errors AT WRITE TIME, blind-indexes it for lookups, EXCLUDES it
+  // from the search index, and masks it in responses unless the token carries
+  // the `s` reveal scope for this record type (SchemaRequest.FieldDef.sensitive).
+  // Format passthrough — the loader forwards it to createSchema. Default false.
+  sensitive: z.boolean().optional(),
+  // Reference-field surface — a typed foreign-key link to another record. The
+  // platform (SchemaRequest.FieldDef) requires BOTH targetTypeName AND
+  // targetSurface on a reference field; the blueprint format uses the SAME names
+  // as the SDK so they forward 1:1, and the loader provisions a real reference.
+  // (Write-time existence enforcement is on by default platform-side; the target
+  // must exist when a referencing record is written — order your seed accordingly.)
+  targetTypeName: z.string().min(1).optional(),
+  // The field on the target record used to resolve the link; defaults (platform
+  // side) to the target's externalId/lookup key when omitted. Must name a UNIQUE
+  // lookup on the target type.
+  targetField: z.string().min(1).optional(),
+  // Which surface the target lives on. REQUIRED on a reference field: the same
+  // typeName can exist on more than one surface, so this disambiguates which
+  // lookup resolves the link (SchemaRequest.FieldDef.targetSurface).
+  targetSurface: z.enum(["record", "document", "user", "org", "client"]).optional(),
+  cardinality: z.enum(["one", "many"]).optional()
+}).strict().superRefine((field, ctx) => {
+  const isReference = field.fieldType === "reference";
+  const hasRefKeys = field.targetTypeName !== void 0 || field.targetField !== void 0 || field.targetSurface !== void 0 || field.cardinality !== void 0;
+  if (isReference && field.targetTypeName === void 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["targetTypeName"],
+      message: "a 'reference' field requires 'targetTypeName' (the typeName it points to)"
+    });
+  }
+  if (isReference && field.targetSurface === void 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["targetSurface"],
+      message: "a 'reference' field requires 'targetSurface' (which surface the target lives on: record | document | user | org | client)"
+    });
+  }
+  if (!isReference && hasRefKeys) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["fieldType"],
+      message: "targetTypeName/targetField/targetSurface/cardinality are only valid on a field with fieldType: 'reference'"
+    });
+  }
+});
+var BlueprintLookupFieldSchema = z.union([
+  z.string().min(1),
+  z.object({
+    fieldName: z.string().min(1),
+    unique: z.boolean().optional(),
+    // Opt this field into ordered range + prefix lookups (from/to/prefix) on
+    // top of exact match. Billed at the range-index rate; not valid on a
+    // sensitive field (a blind index is not orderable). Locked at create.
+    rangeEnabled: z.boolean().optional(),
+    // Sort key for the exact-match index: 'createdAt' (default), 'lastUpdated',
+    // or a declared field on this schema. Locked at create.
+    sortBy: z.string().min(1).optional(),
+    // Opt a field past the fixed fast-index budget into a higher-cost
+    // secondary index. No effect on a field that fits within the budget.
+    allowOverflow: z.boolean().optional()
+  }).strict()
+]);
+var BlueprintCapabilitiesSchema = z.object({
+  auditHistory: z.boolean().optional()
+}).strict();
+var BlueprintSchemaSchema = z.object({
+  typeName: z.string().min(1),
+  displayName: z.string().min(1),
+  description: z.string().optional(),
+  indexMode: z.enum(["HYBRID", "SEMANTIC", "TEXT"]).optional(),
+  fields: z.array(BlueprintFieldDefSchema).default([]),
+  lookupFields: z.array(BlueprintLookupFieldSchema).max(10).optional(),
+  // Which typed surfaces may bind this schema. REQUIRED + non-empty on
+  // the platform `SchemaRequest` (0.23+); the loader defaults it to ['record']
+  // when a blueprint omits it (blueprints provision record types + seed records).
+  allowedSurfaces: z.array(z.enum(["record", "document", "user", "org", "client"])).min(1).optional(),
+  // NEW (format passthrough) — mirror the platform `SchemaRequest` shape 1:1.
+  capabilities: BlueprintCapabilitiesSchema.optional(),
+  // Whether the schema is active; inactive schemas reject new record creation.
+  active: z.boolean().optional(),
+  // Schema-level ownership defaults — flat, matching `SchemaRequest`
+  // userId/orgId/clientId. With a scoped token these must be consistent with
+  // the profile's dataScope (a cross-consistency lint is deferred to the lint slice).
+  userId: z.string().min(1).optional(),
+  orgId: z.string().min(1).optional(),
+  clientId: z.string().min(1).optional()
+}).strict();
+var BlueprintAccessProfileSchema = z.object({
+  // Validated structurally here; the SCOPE GATE (in @vectros-ai/cli) is
+  // what enforces the data-plane-only security boundary.
+  allowedActions: z.array(z.string().min(1)).min(1),
+  // Optional ownership binding: { userId: [...], orgId: [...], clientId: [...] }.
+  // A `null` element in a value list is the documented NULL SENTINEL — it
+  // grants access to TENANT-LEVEL (owner-less) records IN ADDITION to the
+  // listed owner ids. `null` is the literal matched value: a tenant-level
+  // record has a genuinely-null ownership field, and the platform's scope
+  // matcher tests `allowedValues.contains(null)` against the tenant-level
+  // null sentinel (+ ScopeClause). e.g. `{ orgId: ["org_x", null] }` =
+  // "org_x's records AND tenant-shared records". Omitting null restricts to
+  // the listed owners ONLY (the key will NOT see tenant-level/seed records).
+  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional()
+}).strict();
+var BlueprintRoleClauseSchema = z.object({
+  allowedActions: z.array(z.string().min(1)).min(1),
+  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional()
+}).strict();
+var BlueprintRolesSchema = z.record(z.array(BlueprintRoleClauseSchema).min(1));
+var IdentityDeclSchema = z.object({
+  kind: z.enum(["user", "org", "client"]),
+  externalId: z.string().min(1),
+  displayName: z.string().min(1).optional(),
+  metadata: z.record(z.unknown()).optional()
+}).strict();
+var IdentitiesDeclSchema = z.record(IdentityDeclSchema);
+var BlueprintServicePrincipalSchema = z.object({
+  externalId: z.string().min(1),
+  displayName: z.string().min(1)
+}).strict();
+var BlueprintSeedRecordSchema = z.object({
+  typeName: z.string().min(1),
+  externalId: z.string().min(1),
+  fields: z.record(z.unknown())
+}).strict();
+var SELF_TOKEN_RE = /\$\{\{\s*self\.[A-Za-z_]\w*\s*\}\}/;
+function lintSelfTokenPlacement(value, ctx) {
+  const walk = (node, path, inRoleDataScope) => {
+    if (typeof node === "string") {
+      if (!inRoleDataScope && SELF_TOKEN_RE.test(node)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path,
+          message: "'${{ self.* }}' is a runtime per-principal placeholder \u2014 it is only valid inside a roles[].dataScope value"
+        });
+      }
+      return;
+    }
+    if (Array.isArray(node)) {
+      node.forEach((v, i) => walk(v, [...path, i], inRoleDataScope));
+      return;
+    }
+    if (node && typeof node === "object") {
+      for (const [k, v] of Object.entries(node)) {
+        const entering = inRoleDataScope || path.length === 3 && path[0] === "roles" && k === "dataScope";
+        walk(v, [...path, k], entering);
+      }
+    }
+  };
+  walk(value, [], false);
+}
+var IDENTITY_REF_RE = /\$\{\{\s*identities\.([A-Za-z_]\w*)\s*\}\}/g;
+function lintIdentityRefsDeclared(value, ctx) {
+  const declared = new Set(
+    value && typeof value === "object" && "identities" in value && value.identities ? Object.keys(value.identities) : []
+  );
+  const walk = (node, path) => {
+    if (typeof node === "string") {
+      for (const m of node.matchAll(IDENTITY_REF_RE)) {
+        if (!declared.has(m[1])) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path,
+            message: `'\${{ identities.${m[1]} }}' references an undeclared identity \u2014 add '${m[1]}' to the top-level 'identities' block`
+          });
+        }
+      }
+      return;
+    }
+    if (Array.isArray(node)) {
+      node.forEach((v, i) => walk(v, [...path, i]));
+    } else if (node && typeof node === "object") {
+      for (const [k, v] of Object.entries(node)) {
+        if (path.length === 0 && k === "identities") continue;
+        walk(v, [...path, k]);
+      }
+    }
+  };
+  walk(value, []);
+}
+var BlueprintSchema = z.object({
+  /** Stable blueprint id (the `--blueprint <name>` selector + idempotency key). */
+  name: z.string().min(1),
+  version: z.string().min(1),
+  description: z.string().min(1),
+  /** The app-context the profile + scoped key bind to (e.g. "mcp"). */
+  contextId: z.string().regex(CONTEXT_ID_RE, {
+    message: "contextId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'mcp')"
+  }),
+  /** Human-readable app-context name; defaults to `MCP — <name>` (see {@link contextNameOf}) when absent. */
+  contextName: z.string().min(1).optional(),
+  schemas: z.array(BlueprintSchemaSchema).default([]),
+  accessProfile: BlueprintAccessProfileSchema,
+  servicePrincipal: BlueprintServicePrincipalSchema,
+  seed: z.array(BlueprintSeedRecordSchema).optional(),
+  /** Optional multi-clause roles, bound to principals via `access grant --role`. */
+  roles: BlueprintRolesSchema.optional(),
+  /** Optional principals ensured-exist at apply; referenced via ${{ identities.* }}. */
+  identities: IdentitiesDeclSchema.optional()
+}).strict().superRefine((bp, ctx) => {
+  lintSelfTokenPlacement(bp, ctx);
+  lintIdentityRefsDeclared(bp, ctx);
+});
+function formatIssuePath(path) {
+  let out = "";
+  for (const seg of path) {
+    if (typeof seg === "number") out += `[${seg}]`;
+    else out += out.length ? `.${seg}` : seg;
+  }
+  return out.length ? out : "(root)";
+}
+function toBlueprintIssues(error) {
+  return error.issues.map((i) => ({ path: formatIssuePath(i.path), message: i.message }));
+}
+function renderIssues(issues) {
+  return issues.map((i) => `  \u2022 ${i.path}: ${i.message}`).join("\n");
+}
+var BlueprintValidationError = class extends Error {
+  /**
+   * Structured per-field issues. Populated for STRUCTURAL failures (a bad
+   * shape); empty for a JSON/YAML *parse* failure (where there's no field path,
+   * just a syntax error in {@link Error.message}).
+   */
+  issues;
+  constructor(message, issues = []) {
+    super(message);
+    this.name = "BlueprintValidationError";
+    this.issues = issues;
+  }
+};
+function parseBlueprint(input) {
+  const result = BlueprintSchema.safeParse(input);
+  if (!result.success) {
+    const issues = toBlueprintIssues(result.error);
+    throw new BlueprintValidationError(`Malformed blueprint:
+${renderIssues(issues)}`, issues);
+  }
+  return result.data;
+}
+function parseBlueprintJson(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch (err) {
+    throw new BlueprintValidationError(
+      `Blueprint is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return parseBlueprint(parsed);
+}
+function contextNameOf(blueprint) {
+  return blueprint.contextName ?? `MCP \u2014 ${blueprint.name}`;
+}
+
+// src/identities.ts
+var IDENTITY_TOKEN_RE = /\$\{\{\s*identities\.([A-Za-z_]\w*)\s*\}\}/g;
+var BlueprintIdentityError = class extends Error {
+  issues;
+  constructor(message, issues = []) {
+    super(message);
+    this.name = "BlueprintIdentityError";
+    this.issues = issues;
+  }
+};
+function collectIdentityReferences(value) {
+  const found = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    if (typeof node === "string") {
+      for (const m of node.matchAll(IDENTITY_TOKEN_RE)) found.add(m[1]);
+    } else if (Array.isArray(node)) {
+      node.forEach(walk);
+    } else if (node && typeof node === "object") {
+      Object.values(node).forEach(walk);
+    }
+  };
+  walk(value);
+  return [...found];
+}
+function substitute(node, idMap) {
+  if (typeof node === "string") {
+    return node.replace(IDENTITY_TOKEN_RE, (_full, name) => idMap[name]);
+  }
+  if (Array.isArray(node)) return node.map((v) => substitute(v, idMap));
+  if (node && typeof node === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(node)) out[k] = substitute(v, idMap);
+    return out;
+  }
+  return node;
+}
+async function resolveBlueprintIdentities(raw, resolve) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+  const { identities: rawIdentities, ...body } = raw;
+  const refs = collectIdentityReferences(body);
+  if (rawIdentities === void 0 && refs.length === 0) return raw;
+  const parsed = IdentitiesDeclSchema.safeParse(rawIdentities ?? {});
+  if (!parsed.success) {
+    throw new BlueprintIdentityError(
+      "Blueprint identities block is invalid",
+      parsed.error.issues.map((i) => ({
+        path: i.path.length ? `identities.${i.path.join(".")}` : "identities",
+        message: i.message
+      }))
+    );
+  }
+  const declared = parsed.data;
+  const undeclared = refs.filter((name) => !(name in declared));
+  if (undeclared.length) {
+    throw new BlueprintIdentityError(
+      `Blueprint references undeclared identities: ${undeclared.join(", ")}`,
+      undeclared.map((name) => ({
+        path: `identities.${name}`,
+        message: `'\${{ identities.${name} }}' is referenced but not declared in the 'identities' block`
+      }))
+    );
+  }
+  const idMap = {};
+  for (const [name, decl] of Object.entries(declared)) {
+    try {
+      const id = await resolve(name, decl);
+      if (typeof id !== "string" || id.length === 0) {
+        throw new Error(`resolver returned a non-string id (${JSON.stringify(id)})`);
+      }
+      idMap[name] = id;
+    } catch (err) {
+      throw new BlueprintIdentityError(
+        `Failed to resolve identity '${name}' (${decl.kind} externalId=${decl.externalId}): ${err instanceof Error ? err.message : String(err)}`,
+        [{ path: `identities.${name}`, message: err instanceof Error ? err.message : String(err) }]
+      );
+    }
+  }
+  return substitute(body, idMap);
+}
+
+// src/inputs.ts
+import { z as z2 } from "zod";
+var INPUT_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var InputDeclSchema = z2.object({
+  type: z2.enum(["string", "number", "boolean"]),
+  required: z2.boolean().optional(),
+  default: z2.union([z2.string(), z2.number(), z2.boolean()]).optional(),
+  description: z2.string().optional()
+}).strict();
+var InputsDeclSchema = z2.record(InputDeclSchema);
+var BlueprintInputError = class extends Error {
+  issues;
+  constructor(message, issues = []) {
+    super(message);
+    this.name = "BlueprintInputError";
+    this.issues = issues;
+  }
+};
+function renderIssues2(issues) {
+  return issues.map((i) => `  \u2022 ${i.path}: ${i.message}`).join("\n");
+}
+function scalarType(v) {
+  if (typeof v === "string") return "string";
+  if (typeof v === "number") return "number";
+  if (typeof v === "boolean") return "boolean";
+  return "other";
+}
+function deriveSuffix(contextId) {
+  let h = 2166136261;
+  for (let i = 0; i < contextId.length; i++) {
+    h ^= contextId.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return (h >>> 0).toString(36).padStart(7, "0");
+}
+var WHOLE_TOKEN_RE = /^\$\{\{\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*\}\}$/;
+var TOKEN_SCAN_RE = /\$\$\{\{|\$\{\{([\s\S]*?)\}\}|\$\{\{/g;
+var INNER_REF_RE = /^([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
+var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities"]);
+function resolveRef(ns, name, ctx, path) {
+  if (ns === "inputs") {
+    if (!(name in ctx.declared)) {
+      ctx.issues.push({
+        path,
+        message: `unknown input 'inputs.${name}' \u2014 declare it in the top-level 'inputs:' block`
+      });
+      return void 0;
+    }
+    if (!(name in ctx.values)) {
+      ctx.issues.push({
+        path,
+        message: `input 'inputs.${name}' has no value \u2014 supply it (--set ${name}=\u2026 or --values) or give it a default`
+      });
+      return void 0;
+    }
+    return ctx.values[name];
+  }
+  if (ns === "vectros") {
+    if (name !== "context" && name !== "suffix") {
+      ctx.issues.push({
+        path,
+        message: `unknown built-in 'vectros.${name}' (available: vectros.context, vectros.suffix)`
+      });
+      return void 0;
+    }
+    if (!ctx.builtins) {
+      ctx.issues.push({
+        path,
+        message: `'vectros.${name}' is unavailable: contextId must be a literal string to derive built-ins`
+      });
+      return void 0;
+    }
+    return ctx.builtins[name];
+  }
+  ctx.issues.push({
+    path,
+    message: `unknown namespace '${ns}' in '\${{ ${ns}.${name} }}' (available: inputs, vectros)`
+  });
+  return void 0;
+}
+function interpolate(str, ctx, path) {
+  let out = "";
+  let last = 0;
+  TOKEN_SCAN_RE.lastIndex = 0;
+  let m;
+  while ((m = TOKEN_SCAN_RE.exec(str)) !== null) {
+    out += str.slice(last, m.index);
+    if (m[0] === "$${{") {
+      out += "${{";
+    } else if (m[0] === "${{" && m[1] === void 0) {
+      ctx.issues.push({
+        path,
+        message: `unterminated token '\${{' \u2014 expected a closing '}}' (escape a literal with '$\${{')`
+      });
+    } else {
+      const inner = (m[1] ?? "").trim();
+      const ref = inner.match(INNER_REF_RE);
+      if (!ref) {
+        ctx.issues.push({
+          path,
+          message: `malformed reference '\${{ ${inner} }}' \u2014 expected '\${{ namespace.name }}' (escape a literal with '$\${{')`
+        });
+      } else if (DEFERRED_NAMESPACES.has(ref[1])) {
+        out += m[0];
+      } else {
+        const v = resolveRef(ref[1], ref[2], ctx, path);
+        if (v !== void 0) out += String(v);
+      }
+    }
+    last = TOKEN_SCAN_RE.lastIndex;
+  }
+  out += str.slice(last);
+  return out;
+}
+function substituteValue(val, ctx, path) {
+  if (typeof val === "string") {
+    const whole = val.match(WHOLE_TOKEN_RE);
+    if (whole) {
+      if (DEFERRED_NAMESPACES.has(whole[1])) return val;
+      const v = resolveRef(whole[1], whole[2], ctx, path);
+      return v === void 0 ? val : v;
+    }
+    return interpolate(val, ctx, path);
+  }
+  if (Array.isArray(val)) {
+    return val.map((v, i) => substituteValue(v, ctx, `${path}[${i}]`));
+  }
+  if (val !== null && typeof val === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(val)) {
+      out[k] = substituteValue(v, ctx, path ? `${path}.${k}` : k);
+    }
+    return out;
+  }
+  return val;
+}
+function coerce(raw, type, name, issues) {
+  const path = `inputs.${name}`;
+  if (type === "string") {
+    if (typeof raw === "string") return raw;
+    if (typeof raw === "number" || typeof raw === "boolean") return String(raw);
+    issues.push({ path, message: `expected a string value` });
+    return void 0;
+  }
+  if (type === "number") {
+    if (typeof raw === "number") return raw;
+    if (typeof raw === "string") {
+      const n = Number(raw.trim());
+      if (raw.trim() === "" || Number.isNaN(n)) {
+        issues.push({ path, message: `expected a number, got '${raw}'` });
+        return void 0;
+      }
+      return n;
+    }
+    issues.push({ path, message: `expected a number` });
+    return void 0;
+  }
+  if (typeof raw === "boolean") return raw;
+  if (typeof raw === "string") {
+    const t = raw.trim().toLowerCase();
+    if (t === "true") return true;
+    if (t === "false") return false;
+    issues.push({ path, message: `expected a boolean ('true'|'false'), got '${raw}'` });
+    return void 0;
+  }
+  issues.push({ path, message: `expected a boolean` });
+  return void 0;
+}
+function resolveValues(declared, supplied, issues) {
+  const values = {};
+  for (const k of Object.keys(supplied)) {
+    if (!(k in declared)) {
+      issues.push({ path: `inputs.${k}`, message: `no input named '${k}' is declared (cannot set it)` });
+    }
+  }
+  for (const [name, decl] of Object.entries(declared)) {
+    if (name in supplied) {
+      const c = coerce(supplied[name], decl.type, name, issues);
+      if (c !== void 0) values[name] = c;
+    } else if (decl.default !== void 0) {
+      values[name] = decl.default;
+    } else if (decl.required) {
+      issues.push({
+        path: `inputs.${name}`,
+        message: `required input '${name}' was not supplied (--set ${name}=\u2026 or in --values)`
+      });
+    }
+  }
+  return values;
+}
+function resolveBlueprintInputs(raw, supplied = {}) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+  const issues = [];
+  const { inputs: rawInputs, ...body } = raw;
+  let declared = {};
+  if (rawInputs !== void 0) {
+    const parsed = InputsDeclSchema.safeParse(rawInputs);
+    if (!parsed.success) {
+      for (const i of parsed.error.issues) {
+        const p = i.path.length ? `inputs.${i.path.join(".")}` : "inputs";
+        issues.push({ path: p, message: i.message });
+      }
+    } else {
+      declared = parsed.data;
+      for (const [name, decl] of Object.entries(declared)) {
+        if (!INPUT_NAME_RE.test(name)) {
+          issues.push({
+            path: `inputs.${name}`,
+            message: `invalid input name '${name}' \u2014 letters/digits/underscore, not starting with a digit`
+          });
+        }
+        if (decl.default !== void 0 && scalarType(decl.default) !== decl.type) {
+          issues.push({
+            path: `inputs.${name}.default`,
+            message: `default is a ${scalarType(decl.default)} but the declared type is '${decl.type}'`
+          });
+        }
+      }
+    }
+  }
+  let builtins;
+  const ctxId = body.contextId;
+  if (typeof ctxId === "string" && ctxId.length > 0) {
+    if (ctxId.includes("${{")) {
+      issues.push({
+        path: "contextId",
+        message: `contextId must be a literal \u2014 it cannot use '\${{ \u2026 }}' (it is the source of vectros.* built-ins)`
+      });
+    } else {
+      builtins = { context: ctxId, suffix: deriveSuffix(ctxId) };
+    }
+  }
+  const values = resolveValues(declared, supplied, issues);
+  const ctx = { declared, values, builtins, issues };
+  const substituted = substituteValue(body, ctx, "");
+  if (issues.length) {
+    throw new BlueprintInputError(`Blueprint variable resolution failed:
+${renderIssues2(issues)}`, issues);
+  }
+  return substituted;
+}
+
+// src/blueprints/task-management.ts
+var taskManagement = {
+  name: "task-management",
+  version: "1.0.0",
+  description: "Structured task tracking, shareable across sessions, agents, and users.",
+  contextId: "task-management",
+  contextName: "Task Management",
+  schemas: [
+    {
+      typeName: "task",
+      displayName: "Task",
+      indexMode: "HYBRID",
+      // keyword on titles + semantic on descriptions
+      fields: [
+        {
+          fieldId: "title",
+          fieldType: "string",
+          required: true,
+          searchable: true,
+          validation: { minLength: 1, maxLength: 200 },
+          renderHints: { label: "Title", widget: "text", order: 1, section: "Task", displayField: true }
+        },
+        {
+          fieldId: "description",
+          fieldType: "string",
+          searchable: true,
+          description: "Free-text detail \u2014 the RAG-able body.",
+          validation: { maxLength: 8e3 },
+          renderHints: { label: "Description", widget: "textarea", order: 2, section: "Task" }
+        },
+        {
+          fieldId: "status",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["todo", "in_progress", "blocked", "done"],
+          renderHints: { label: "Status", widget: "select", order: 3, section: "Tracking" }
+        },
+        {
+          fieldId: "priority",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["low", "medium", "high", "urgent"],
+          // Equality, NOT range: the values are an ordinal vocabulary but they sort
+          // LEXICALLY (high < low < medium < urgent), not by severity — a range
+          // index here would be permanently wrong. Filter by exact priority instead.
+          renderHints: { label: "Priority", widget: "select", order: 4, section: "Tracking" }
+        },
+        {
+          fieldId: "assignee",
+          fieldType: "string",
+          filterable: true,
+          description: "userId or display name.",
+          renderHints: { label: "Assignee", widget: "text", order: 5, section: "Tracking" }
+        },
+        {
+          fieldId: "project",
+          fieldType: "string",
+          filterable: true,
+          description: "Grouping key for cross-session continuity.",
+          renderHints: { label: "Project", widget: "text", order: 6, section: "Tracking" }
+        },
+        {
+          fieldId: "dueDate",
+          fieldType: "date",
+          description: "ISO-8601. Range-queryable (see lookupFields) \u2014 list tasks due in a window.",
+          renderHints: { label: "Due date", widget: "date", order: 7, section: "Tracking" }
+        },
+        {
+          fieldId: "tags",
+          fieldType: "array",
+          filterable: true,
+          renderHints: { label: "Tags", order: 8, section: "Tracking" }
+        }
+        // externalId is the record's FIRST-CLASS identifier (the dedup/lookup key + the
+        // value a `reference` resolves against) — not a payload field; the loader sends
+        // it top-level on the RecordRequest.
+      ],
+      // Two lookup shapes, chosen deliberately because the equality-vs-range choice
+      // per field is MIGRATION-LOCKED once the schema is live (you cannot flip a
+      // field slot↔range later, even by removing and re-adding it):
+      //   • `project` — EQUALITY (a grouping key, not ordered): enumerate one
+      //     project's tasks directly, no search. Each equality lookup uses 1 of the
+      //     schema's 7 fast index slots.
+      //   • `dueDate` — RANGE: ordered `from`/`to`/`prefix` queries ("tasks due this
+      //     week", "due in 2026-06"). Range lookups use a relationship row, not a
+      //     slot, and are billed at the range rate. ISO-8601 sorts chronologically,
+      //     so the order is correct.
+      // `externalId` has a built-in first-class finder and must NOT be redeclared here.
+      lookupFields: ["project", { fieldName: "dueDate", rangeEnabled: true }]
+    }
+  ],
+  // Least-privilege profile — MUST pass the CLI scope gate.
+  // r/c/u + search + schema discovery. NOT records:d (least privilege).
+  accessProfile: {
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
+    // dataScope omitted → tenant-level shared tracker. Bind to an orgId
+    // for per-org isolation.
+  },
+  servicePrincipal: {
+    externalId: "task-management",
+    displayName: "Task Management"
+  },
+  seed: [
+    {
+      typeName: "task",
+      externalId: "seed-welcome",
+      fields: {
+        title: "Welcome to your Vectros task tracker",
+        description: "Created by the bootstrap loader. Ask your agent to add tasks.",
+        status: "todo",
+        priority: "low",
+        project: "getting-started",
+        dueDate: "2026-06-30"
+      }
+    }
+  ]
+};
+var task_management_default = taskManagement;
+
+// src/blueprints/coding-agent-memory.ts
+var codingAgentMemory = {
+  name: "coding-agent-memory",
+  version: "1.0.0",
+  description: "Persistent project memory for a coding agent \u2014 decisions, conventions, and gotchas that survive across sessions.",
+  contextId: "coding-memory",
+  contextName: "Coding Agent \u2014 Project Memory",
+  schemas: [
+    {
+      // A durable architectural/product decision: what was decided, and WHY.
+      // The rationale is the high-value, RAG-able body — "why did we do X?"
+      // is the question a cold-context agent most needs answered.
+      typeName: "decision",
+      displayName: "Decision",
+      indexMode: "HYBRID",
+      // keyword on titles + semantic on statement/rationale
+      fields: [
+        {
+          fieldId: "title",
+          fieldType: "string",
+          required: true,
+          searchable: true,
+          validation: { minLength: 1, maxLength: 200 },
+          renderHints: { label: "Title", widget: "text", order: 1, displayField: true }
+        },
+        {
+          fieldId: "statement",
+          fieldType: "string",
+          searchable: true,
+          description: "What was decided, in one or two sentences.",
+          renderHints: { label: "Statement", widget: "textarea", order: 2 }
+        },
+        {
+          fieldId: "rationale",
+          fieldType: "string",
+          searchable: true,
+          description: "Why \u2014 the trade-offs and the context. The most-recalled field.",
+          renderHints: { label: "Rationale", widget: "textarea", order: 3 }
+        },
+        {
+          fieldId: "status",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["proposed", "active", "superseded"],
+          renderHints: { label: "Status", widget: "select", order: 4 }
+        },
+        {
+          fieldId: "area",
+          fieldType: "string",
+          filterable: true,
+          description: 'Subsystem / module the decision applies to (e.g. "auth", "search").',
+          renderHints: { label: "Area", widget: "text", order: 5 }
+        },
+        {
+          fieldId: "decidedOn",
+          fieldType: "date",
+          description: 'ISO-8601 date. Range-queryable \u2014 "decisions made this quarter".',
+          renderHints: { label: "Decided on", widget: "date", order: 6 }
+        }
+        // externalId is the record's FIRST-CLASS identifier (the dedup/upsert key + the
+        // value a `reference` resolves against) — it is NOT a payload field, so it is not
+        // declared here; the loader sends it top-level on the RecordRequest.
+      ],
+      // `externalId` is a first-class identifier with its own finder (exact
+      // get/upsert) — look it up directly, never redeclare it as a schema lookup.
+      // The choice below is MIGRATION-LOCKED once the schema is live:
+      //   • `area`/`status` — EQUALITY (categorical): "list active decisions",
+      //     "all decisions in the auth area". 2 of the 7 fast index slots.
+      //   • `decidedOn` — RANGE: ordered `from`/`to`/`prefix` over the date.
+      lookupFields: ["area", "status", { fieldName: "decidedOn", rangeEnabled: true }]
+    },
+    {
+      // A coding convention the team follows — the agent reads these before it
+      // writes code so it matches the surrounding style instead of inventing one.
+      typeName: "convention",
+      displayName: "Convention",
+      indexMode: "HYBRID",
+      fields: [
+        {
+          fieldId: "name",
+          fieldType: "string",
+          required: true,
+          searchable: true,
+          validation: { minLength: 1, maxLength: 200 },
+          renderHints: { label: "Name", widget: "text", order: 1, displayField: true }
+        },
+        {
+          fieldId: "rule",
+          fieldType: "string",
+          searchable: true,
+          description: "The convention itself, stated as an imperative.",
+          renderHints: { label: "Rule", widget: "textarea", order: 2 }
+        },
+        {
+          fieldId: "area",
+          fieldType: "string",
+          filterable: true,
+          renderHints: { label: "Area", widget: "text", order: 3 }
+        },
+        {
+          // Parallels `decision.status` so a convention can be RETIRED rather than
+          // deleted (the blueprint omits records:d — memory is superseded, not lost).
+          fieldId: "status",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["active", "retired"],
+          renderHints: { label: "Status", widget: "select", order: 4 }
+        },
+        {
+          // A typed REFERENCE to the decision that established this convention — a
+          // foreign-key link between record types (the knowledge-graph edge). The
+          // platform requires both the target type AND its surface; the value is the
+          // target decision's externalId (the default `targetField`). Provenance:
+          // "why does this convention exist? → open the decision behind it." Not
+          // searchable (a foreign-key id is search noise); declared as an equality
+          // lookup below so you can also enumerate "conventions from decision X".
+          fieldId: "establishedByDecision",
+          fieldType: "reference",
+          targetTypeName: "decision",
+          targetSurface: "record",
+          targetField: "externalId",
+          cardinality: "one",
+          renderHints: { label: "Established by (decision)", order: 5 }
+        },
+        {
+          fieldId: "adoptedOn",
+          fieldType: "date",
+          description: "ISO-8601 \u2014 when this convention was adopted. Range-queryable.",
+          renderHints: { label: "Adopted on", widget: "date", order: 6 }
+        }
+        // externalId: first-class identifier, not a payload field (see `decision`).
+      ],
+      // externalId has its own first-class finder for exact get — look it up
+      // directly, not as a schema lookup. Locked equality-vs-range choices:
+      //   • `area`/`status` — EQUALITY: "active conventions for auth".
+      //   • `establishedByDecision` — EQUALITY on the reference value: enumerate
+      //     "conventions established by decision X" (a forward link query; the
+      //     platform has no reverse-reference index on this surface).
+      //   • `adoptedOn` — RANGE over the adoption date.
+      // 3 equality lookups (of 7 fast slots) + 1 range row.
+      lookupFields: ["area", "status", "establishedByDecision", { fieldName: "adoptedOn", rangeEnabled: true }]
+    },
+    {
+      // A gotcha / sharp edge: a symptom, its cause, and the fix. Saves the
+      // agent (and the human) from re-discovering the same trap.
+      typeName: "gotcha",
+      displayName: "Gotcha",
+      indexMode: "HYBRID",
+      fields: [
+        {
+          fieldId: "symptom",
+          fieldType: "string",
+          required: true,
+          searchable: true,
+          validation: { minLength: 1, maxLength: 500 },
+          renderHints: { label: "Symptom", widget: "textarea", order: 1, displayField: true }
+        },
+        {
+          fieldId: "cause",
+          fieldType: "string",
+          searchable: true,
+          renderHints: { label: "Cause", widget: "textarea", order: 2 }
+        },
+        {
+          fieldId: "fix",
+          fieldType: "string",
+          searchable: true,
+          renderHints: { label: "Fix", widget: "textarea", order: 3 }
+        },
+        {
+          fieldId: "area",
+          fieldType: "string",
+          filterable: true,
+          renderHints: { label: "Area", widget: "text", order: 4 }
+        },
+        {
+          // A gotcha can be RETIRED once the underlying trap is fixed for good —
+          // superseded, not deleted (the blueprint omits records:d).
+          fieldId: "status",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["active", "retired"],
+          renderHints: { label: "Status", widget: "select", order: 5 }
+        },
+        {
+          fieldId: "discoveredOn",
+          fieldType: "date",
+          description: "ISO-8601 \u2014 when this gotcha was first hit. Range-queryable.",
+          renderHints: { label: "Discovered on", widget: "date", order: 6 }
+        }
+        // externalId: first-class identifier, not a payload field (see `decision`).
+      ],
+      // externalId has its own first-class finder for exact get — look it up
+      // directly, not as a schema lookup. `area`/`status` EQUALITY ("active
+      // gotchas in search"); `discoveredOn` RANGE over the discovery date.
+      lookupFields: ["area", "status", { fieldName: "discoveredOn", rangeEnabled: true }]
+    }
+  ],
+  // Least-privilege profile — MUST pass the CLI scope gate.
+  // r/c/u + search + schema discovery + inference:r (grounded "why did we do X?"
+  // recall over the captured rationale). NOT records:d: memory is superseded,
+  // not deleted, so the project's decision history stays auditable.
+  accessProfile: {
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
+  },
+  servicePrincipal: {
+    externalId: "coding-agent-memory",
+    displayName: "Coding Agent \u2014 Project Memory"
+  },
+  seed: [
+    {
+      // Seeded FIRST so the convention below resolves its reference to it — the
+      // loader creates seeds in array order, and a reference target must exist when
+      // the referencing record is written.
+      typeName: "decision",
+      externalId: "seed-use-vectros-for-memory",
+      fields: {
+        title: "Use Vectros as the coding agent\u2019s project memory",
+        statement: "Persist decisions, conventions, and gotchas as Vectros records so they survive across agent sessions.",
+        rationale: "A coding agent loses context every cold start. A governed, searchable memory lets it recall prior decisions by meaning instead of re-asking \u2014 and the version history shows how the thinking evolved.",
+        status: "active",
+        area: "getting-started",
+        decidedOn: "2026-06-14"
+      }
+    },
+    {
+      // Demonstrates a live typed link at bootstrap: this convention references the
+      // decision above by its externalId, so "open the decision behind this rule"
+      // works the moment the blueprint is applied.
+      typeName: "convention",
+      externalId: "seed-record-the-why",
+      fields: {
+        name: "Record the why, not just the what",
+        rule: "When you record a decision or convention, always capture the rationale \u2014 the trade-offs a future session cannot re-derive from the code.",
+        area: "getting-started",
+        status: "active",
+        establishedByDecision: "seed-use-vectros-for-memory",
+        adoptedOn: "2026-06-14"
+      }
+    }
+  ]
+};
+var coding_agent_memory_default = codingAgentMemory;
+
+// src/blueprints/second-brain.ts
+var secondBrain = {
+  name: "second-brain",
+  version: "1.0.0",
+  description: "A personal knowledge base \u2014 capture notes, ideas, and links, then ask them anything.",
+  contextId: "second-brain",
+  contextName: "Second Brain",
+  schemas: [
+    {
+      typeName: "note",
+      displayName: "Note",
+      indexMode: "HYBRID",
+      // keyword on title + semantic on body — recall by meaning
+      fields: [
+        {
+          fieldId: "title",
+          fieldType: "string",
+          required: true,
+          searchable: true,
+          validation: { minLength: 1, maxLength: 200 },
+          renderHints: { label: "Title", widget: "text", order: 1, section: "Note", displayField: true }
+        },
+        {
+          fieldId: "body",
+          fieldType: "string",
+          searchable: true,
+          description: "The note itself \u2014 the RAG-able body you ask questions against.",
+          validation: { maxLength: 2e4 },
+          renderHints: { label: "Body", widget: "textarea", order: 2, section: "Note" }
+        },
+        {
+          fieldId: "tags",
+          fieldType: "array",
+          filterable: true,
+          description: 'Freeform string labels for filtering (e.g. "idea", "reading", "work").',
+          renderHints: { label: "Tags", order: 3, section: "Organize" }
+        },
+        {
+          // An enum (not freeform) so enumeration-by-source is reliable — a
+          // `record_query` lookup on `source` only works if values are consistent.
+          // `other` keeps it from being a straitjacket for a personal brain-dump.
+          fieldId: "source",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["thought", "web", "meeting", "book", "article", "other"],
+          description: "Where it came from.",
+          renderHints: { label: "Source", widget: "select", order: 4, section: "Organize" }
+        },
+        {
+          fieldId: "status",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["active", "archived"],
+          description: "Archive instead of delete, so nothing is ever lost.",
+          renderHints: { label: "Status", widget: "select", order: 5, section: "Organize" }
+        },
+        {
+          fieldId: "capturedAt",
+          fieldType: "date",
+          description: 'ISO-8601 capture date. Range-queryable \u2014 "notes from last week".',
+          renderHints: { label: "Captured", widget: "date", order: 6, section: "Organize" }
+        }
+        // externalId is the record's FIRST-CLASS identifier (the dedup/upsert key + the
+        // value a `reference` resolves against) — not a payload field; the loader sends
+        // it top-level on the RecordRequest.
+      ],
+      // Lookup shapes are MIGRATION-LOCKED once the schema is live (a field cannot
+      // flip equality↔range later), so each is chosen on purpose:
+      //   • `source` — EQUALITY, sorted by `lastUpdated`: enumerate notes from one
+      //     source, most-recently-touched first. `lastUpdated` is always present, so
+      //     the sort never drops a note (sorting an equality lookup by an OPTIONAL
+      //     field would silently exclude rows that lack it).
+      //   • `status` — EQUALITY: "show archived notes".
+      //   • `capturedAt` — RANGE: ordered `from`/`to`/`prefix` ("captured in 2026-06").
+      // `externalId` has a built-in first-class finder — look it up directly, never
+      // redeclare it here. Equality lookups use the 7 fast index slots (2 used here);
+      // range lookups use a relationship row, billed at the range rate.
+      lookupFields: [
+        { fieldName: "source", sortBy: "lastUpdated" },
+        "status",
+        { fieldName: "capturedAt", rangeEnabled: true }
+      ]
+    }
+  ],
+  // Least-privilege profile — r/c/u + search + schema discovery + inference:r
+  // (so the agent can `rag_ask` a grounded, cited question over your notes). No
+  // records:d: notes are archived (status → 'archived'), never deleted.
+  accessProfile: {
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
+  },
+  servicePrincipal: {
+    externalId: "second-brain",
+    displayName: "Second Brain"
+  },
+  seed: [
+    {
+      typeName: "note",
+      externalId: "seed-welcome",
+      fields: {
+        title: "Welcome to your Second Brain",
+        body: 'Capture anything here \u2014 ideas, links, meeting notes \u2014 then ask your agent things like "what did I note about onboarding?" and it recalls by meaning, not just keywords.',
+        tags: ["getting-started"],
+        source: "thought",
+        status: "active",
+        capturedAt: "2026-06-14"
+      }
+    }
+  ]
+};
+var second_brain_default = secondBrain;
+
+// src/blueprints/clinical-intake.ts
+var clinicalIntake = {
+  name: "clinical-intake",
+  version: "1.0.0",
+  description: "Behavioral-health intake with PHI fields \u2014 demonstrates redact-at-write, audit history, blind-index lookup, and search exclusion. Synthetic data only.",
+  contextId: "clinical-intake",
+  contextName: "Clinical Intake",
+  schemas: [
+    {
+      typeName: "intake",
+      displayName: "Intake",
+      indexMode: "HYBRID",
+      capabilities: { auditHistory: true },
+      // self-documenting compliance posture
+      fields: [
+        // --- Non-sensitive, searchable/filterable working fields ---
+        {
+          fieldId: "caseId",
+          fieldType: "string",
+          required: true,
+          description: "Caller-stable intake id; the dedup/lookup key.",
+          validation: { minLength: 1, maxLength: 64 },
+          renderHints: { label: "Case ID", widget: "text", order: 1, section: "Intake", displayField: true }
+        },
+        {
+          fieldId: "presentingConcern",
+          fieldType: "string",
+          searchable: true,
+          description: "Non-PHI summary of the presenting concern \u2014 safe to index + search.",
+          validation: { maxLength: 2e3 },
+          renderHints: { label: "Presenting concern", widget: "textarea", order: 2, section: "Intake" }
+        },
+        {
+          fieldId: "program",
+          fieldType: "string",
+          filterable: true,
+          description: "Program / service line the intake is routed to.",
+          renderHints: { label: "Program", widget: "text", order: 3, section: "Intake" }
+        },
+        {
+          fieldId: "status",
+          fieldType: "enum",
+          filterable: true,
+          enumValues: ["new", "in_review", "scheduled", "closed"],
+          renderHints: { label: "Status", widget: "select", order: 4, section: "Intake" }
+        },
+        {
+          fieldId: "submittedAt",
+          fieldType: "date",
+          description: 'ISO-8601. Range-queryable \u2014 a coordinator can pull "intakes submitted this week".',
+          renderHints: { label: "Submitted", widget: "date", order: 5, section: "Intake" }
+        },
+        // --- Sensitive (PHI) fields: redacted-at-write, search-excluded, masked-on-read ---
+        {
+          fieldId: "clientName",
+          fieldType: "string",
+          sensitive: true,
+          description: "PHI. Blind-indexed for EXACT lookup (a lookup field below); never in the search index or audit log.",
+          renderHints: { label: "Client name", widget: "text", order: 10, section: "Client (PHI)" }
+        },
+        {
+          fieldId: "dateOfBirth",
+          fieldType: "string",
+          sensitive: true,
+          description: "PHI. ISO-8601. Redacted from audit history at write time.",
+          renderHints: { label: "Date of birth", widget: "date", order: 11, section: "Client (PHI)" }
+        },
+        {
+          fieldId: "ssn",
+          fieldType: "string",
+          sensitive: true,
+          description: "PHI. Destroyed before the audit snapshot is written \u2014 unrecoverable.",
+          validation: { pattern: "^\\d{3}-\\d{2}-\\d{4}$" },
+          renderHints: { label: "SSN", widget: "text", order: 12, section: "Client (PHI)" }
+        },
+        {
+          fieldId: "clinicalNote",
+          fieldType: "string",
+          sensitive: true,
+          description: "PHI free-text. Excluded from search so a note phrase never leaks via results.",
+          renderHints: { label: "Clinical note", widget: "textarea", order: 13, section: "Client (PHI)" }
+        }
+      ],
+      // Lookup fields back access patterns without a search. The equality-vs-range
+      // (and sensitive-blind-index) choice per field is MIGRATION-LOCKED once the
+      // schema is live — chosen deliberately:
+      //   • `caseId` (unique) — EQUALITY: exact get by the stable intake id.
+      //   • `program`/`status` — EQUALITY (categorical): a coordinator ENUMERATES a
+      //     worklist ("all outpatient-counseling intakes", "all new intakes").
+      //   • `clientName` — a SENSITIVE equality lookup: the value is HMAC'd into a
+      //     per-tenant BLIND INDEX, so "find the intake for this exact client name"
+      //     works WITHOUT the name ever being stored in the clear or entering search.
+      //     A sensitive lookup is equality-only — a blind hash is not orderable, so
+      //     it can never be range-enabled.
+      //   • `submittedAt` — RANGE: ordered `from`/`to`/`prefix` for a date worklist.
+      // 4 equality lookups (of 7 fast slots) + 1 range row. The OTHER PHI fields
+      // (dateOfBirth/ssn/clinicalNote) are deliberately NOT lookups here.
+      lookupFields: [
+        { fieldName: "caseId", unique: true },
+        "program",
+        "status",
+        "clientName",
+        { fieldName: "submittedAt", rangeEnabled: true }
+      ]
+    }
+  ],
+  // Least-privilege, data-plane only. No records:d (retain intakes), NO `s`
+  // reveal qualifier (the demo key literally cannot un-redact the PHI fields),
+  // and NO inference:r (we never point a RAG capability at a PHI corpus here).
+  accessProfile: {
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
+  },
+  servicePrincipal: {
+    externalId: "clinical-intake",
+    displayName: "Clinical Intake"
+  },
+  seed: [
+    {
+      typeName: "intake",
+      externalId: "seed-synthetic-intake",
+      fields: {
+        caseId: "seed-synthetic-intake",
+        presentingConcern: "Sleep difficulty and low mood over the past month; seeking counseling.",
+        program: "outpatient-counseling",
+        status: "new",
+        submittedAt: "2026-06-14",
+        // SYNTHETIC PHI — illustrative only, not a real person.
+        clientName: "Jordan Sample",
+        dateOfBirth: "1990-01-01",
+        ssn: "000-00-0000",
+        clinicalNote: "Synthetic note for demonstration. Reports difficulty sleeping; no acute safety concerns noted."
+      }
+    }
+  ]
+};
+var clinical_intake_default = clinicalIntake;
+
+// src/index.ts
+var BUNDLED_BLUEPRINTS = [
+  task_management_default,
+  coding_agent_memory_default,
+  second_brain_default,
+  clinical_intake_default
+];
+var BLUEPRINT_NAMES = BUNDLED_BLUEPRINTS.map((b) => b.name);
+function getBlueprint(name) {
+  return BUNDLED_BLUEPRINTS.find((b) => b.name === name);
+}
+export {
+  BLUEPRINT_NAMES,
+  BUNDLED_BLUEPRINTS,
+  BlueprintIdentityError,
+  BlueprintInputError,
+  BlueprintSchema,
+  BlueprintValidationError,
+  InputsDeclSchema,
+  collectIdentityReferences,
+  contextNameOf,
+  deriveSuffix,
+  getBlueprint,
+  parseBlueprint,
+  parseBlueprintJson,
+  resolveBlueprintIdentities,
+  resolveBlueprintInputs
+};
+//# sourceMappingURL=index.mjs.map