@lucern/contracts 0.3.0-alpha.11 → 0.3.0-alpha.13

package/dist/generated/infisicalRuntimeEnv.js

@@ -127,6 +127,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "CLERK_PROJECT_ID",
     "CLERK_PUBLISHABLE_KEY",
     "CLERK_SECRET_KEY",
+    "CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET",
     "CONVEX_CLOUD_URL",
     "CONVEX_DEPLOY_KEY",
     "CONVEX_DEPLOYMENT",
@@ -190,6 +192,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_AUTH_BASE_URL",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
+    "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS",
     "LUCERN_CONTRACTS_SKIP_DTS",
     "LUCERN_CONVEX_DEPLOY_KEY",
@@ -239,6 +242,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PERMIT_API_KEY",
     "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROD_DEPLOY_KEY",
     "LUCERN_PROD_URL",
     "LUCERN_PROFILE",
@@ -309,6 +313,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
+    "PERMIT_WEBHOOK_SECRET",
     "PINECONE_API_KEY",
     "PINECONE_HOST",
     "PINECONE_INDEX",
@@ -360,6 +365,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "CLERK_PROJECT_ID",
     "CLERK_PUBLISHABLE_KEY",
     "CLERK_SECRET_KEY",
+    "CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET",
     "CONVEX_CLOUD_URL",
     "CONVEX_DEPLOY_KEY",
     "CONVEX_DEPLOYMENT",
@@ -437,6 +444,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_AUTH_BASE_URL",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
+    "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS",
     "LUCERN_CONTRACTS_SKIP_DTS",
     "LUCERN_CONVEX_DEPLOY_KEY",
@@ -488,6 +496,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PERMIT_API_KEY",
     "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROD_DEPLOY_KEY",
     "LUCERN_PROD_URL",
     "LUCERN_PROFILE",
@@ -561,6 +570,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
+    "PERMIT_WEBHOOK_SECRET",
     "PINECONE_API_KEY",
     "PINECONE_HOST",
     "PINECONE_INDEX",
@@ -2747,6 +2757,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "stack/frontend: Lucern/MC gateway base URL used by tenant product apps. stack/stackos: Lucern/MC gateway base URL used by tenant product apps."
     },
+    "LUCERN_CLERK_WEBHOOK_SECRET": {
+      "secretId": "platform.clerk.webhook-secret",
+      "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+      "envNames": [
+        "CLERK_WEBHOOK_SECRET",
+        "CLERK_WEBHOOK_SIGNING_SECRET",
+        "LUCERN_CLERK_WEBHOOK_SECRET"
+      ],
+      "aliases": [
+        "CLERK_WEBHOOK_SECRET",
+        "CLERK_WEBHOOK_SIGNING_SECRET"
+      ],
+      "writeNames": [
+        "LUCERN_CLERK_WEBHOOK_SECRET"
+      ],
+      "required": true,
+      "secret": true,
+      "public": false,
+      "sourcePath": "/platform/auth",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-gateway"
+      ],
+      "destinations": [
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ]
+        }
+      ],
+      "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+    },
     "LUCERN_CLI_SESSION_TTL_MS": {
       "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
       "envNames": [
@@ -3321,6 +3365,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "Optional Permit PDP URL override."
     },
+    "LUCERN_PERMIT_WEBHOOK_SECRET": {
+      "secretId": "platform.permit.webhook-secret",
+      "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+      "envNames": [
+        "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "PERMIT_WEBHOOK_SECRET"
+      ],
+      "aliases": [
+        "PERMIT_WEBHOOK_SECRET"
+      ],
+      "writeNames": [
+        "LUCERN_PERMIT_WEBHOOK_SECRET"
+      ],
+      "required": true,
+      "secret": true,
+      "public": false,
+      "sourcePath": "/platform/permit",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "mc-convex",
+        "lucern-gateway",
+        "mc-operator-tooling"
+      ],
+      "destinations": [
+        {
+          "kind": "convex",
+          "target": "master-control",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        },
+        {
+          "kind": "operator_local",
+          "target": "mc-credential-maintenance",
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ]
+        }
+      ],
+      "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+    },
     "LUCERN_PROXY_TOKEN_SECRET": {
       "secretId": "tenant.stack-frontend.lucern.proxy-token-secret",
       "canonicalName": "LUCERN_PROXY_TOKEN_SECRET",
@@ -5967,6 +6059,9 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_API_URL": "LUCERN_API_URL",
     "LUCERN_BASE_URL": "LUCERN_BASE_URL",
     "LUCERN_GATEWAY_BASE_URL": "LUCERN_BASE_URL",
+    "CLERK_WEBHOOK_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
+    "CLERK_WEBHOOK_SIGNING_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
+    "LUCERN_CLERK_WEBHOOK_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
     "LUCERN_CLI_SESSION_TTL_MS": "LUCERN_CLI_SESSION_TTL_MS",
     "CONVEX_DEPLOYMENT": "LUCERN_CONVEX_DEPLOYMENT_NAME",
     "CONVEX_DEV_DEPLOYMENT_NAME": "LUCERN_CONVEX_DEPLOYMENT_NAME",
@@ -6019,6 +6114,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "PERMIT_API_URL": "LUCERN_PERMIT_API_URL",
     "LUCERN_PERMIT_PDP_URL": "LUCERN_PERMIT_PDP_URL",
     "PERMIT_PDP_URL": "LUCERN_PERMIT_PDP_URL",
+    "LUCERN_PERMIT_WEBHOOK_SECRET": "LUCERN_PERMIT_WEBHOOK_SECRET",
+    "PERMIT_WEBHOOK_SECRET": "LUCERN_PERMIT_WEBHOOK_SECRET",
     "LUCERN_PROXY_TOKEN_SECRET": "LUCERN_PROXY_TOKEN_SECRET",
     "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
     "LUCERN_KERNEL_INSTALL_SPEC": "LUCERN_SDK_NPM_TOKEN",
@@ -6979,6 +7076,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Canonical Lucern API gateway URL. Canonical Lucern API gateway base URL. Older names remain aliases only."
         },
+        {
+          "secretId": "platform.clerk.webhook-secret",
+          "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+          "envNames": [
+            "CLERK_WEBHOOK_SECRET",
+            "CLERK_WEBHOOK_SIGNING_SECRET",
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ],
+          "aliases": [
+            "CLERK_WEBHOOK_SECRET",
+            "CLERK_WEBHOOK_SIGNING_SECRET"
+          ],
+          "writeNames": [
+            "LUCERN_CLERK_WEBHOOK_SECRET"
+          ],
+          "required": true,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/auth",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-gateway"
+          ],
+          "destinations": [
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_CLERK_WEBHOOK_SECRET"
+              ]
+            }
+          ],
+          "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+        },
         {
           "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
           "envNames": [
@@ -7302,6 +7433,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Optional Permit PDP URL override."
         },
+        {
+          "secretId": "platform.permit.webhook-secret",
+          "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "envNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET",
+            "PERMIT_WEBHOOK_SECRET"
+          ],
+          "aliases": [
+            "PERMIT_WEBHOOK_SECRET"
+          ],
+          "writeNames": [
+            "LUCERN_PERMIT_WEBHOOK_SECRET"
+          ],
+          "required": true,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/permit",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "mc-convex",
+            "lucern-gateway",
+            "mc-operator-tooling"
+          ],
+          "destinations": [
+            {
+              "kind": "convex",
+              "target": "master-control",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "mc-credential-maintenance",
+              "writeNames": [
+                "LUCERN_PERMIT_WEBHOOK_SECRET"
+              ]
+            }
+          ],
+          "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+        },
         {
           "secretId": "platform.runtime.require-deployment-host-registry",
           "canonicalName": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
@@ -10994,6 +11173,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Optional Permit PDP URL override."
       },
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.mc.session-token-secret",
         "canonicalName": "LUCERN_SESSION_TOKEN_SECRET",
@@ -18806,6 +19033,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       }
     ],
     "operator_local:mc-credential-maintenance": [
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.mc.tenant-secret-encryption-key",
         "canonicalName": "LUCERN_TENANT_SECRET_ENCRYPTION_KEY",
@@ -22823,6 +23098,40 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Canonical Lucern API gateway base URL. Older names remain aliases only."
       },
+      {
+        "secretId": "platform.clerk.webhook-secret",
+        "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
+        "envNames": [
+          "CLERK_WEBHOOK_SECRET",
+          "CLERK_WEBHOOK_SIGNING_SECRET",
+          "LUCERN_CLERK_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "CLERK_WEBHOOK_SECRET",
+          "CLERK_WEBHOOK_SIGNING_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_CLERK_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/auth",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-gateway"
+        ],
+        "destinations": [
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_CLERK_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+      },
       {
         "secretId": "platform.gateway.device-verification-base-url",
         "canonicalName": "LUCERN_DEVICE_VERIFICATION_BASE_URL",
@@ -23128,6 +23437,54 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Optional Permit PDP URL override."
       },
+      {
+        "secretId": "platform.permit.webhook-secret",
+        "canonicalName": "LUCERN_PERMIT_WEBHOOK_SECRET",
+        "envNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET",
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "aliases": [
+          "PERMIT_WEBHOOK_SECRET"
+        ],
+        "writeNames": [
+          "LUCERN_PERMIT_WEBHOOK_SECRET"
+        ],
+        "required": true,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/permit",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "mc-convex",
+          "lucern-gateway",
+          "mc-operator-tooling"
+        ],
+        "destinations": [
+          {
+            "kind": "convex",
+            "target": "master-control",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "mc-credential-maintenance",
+            "writeNames": [
+              "LUCERN_PERMIT_WEBHOOK_SECRET"
+            ]
+          }
+        ],
+        "description": "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+      },
       {
         "secretId": "platform.runtime.require-deployment-host-registry",
         "canonicalName": "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",