@lucern/contracts 0.3.0-alpha.11 → 0.3.0-alpha.13

package/dist/infisical-runtime.contract.d.ts

@@ -496,6 +496,24 @@ declare const INFISICAL_SECRET_DEFINITIONS: readonly [{
         readonly environmentPolicy: "environment_specific";
     }];
     readonly description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities.";
+}, {
+    readonly id: "platform.clerk.webhook-secret";
+    readonly canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET";
+    readonly aliases: readonly ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit.";
 }, {
     readonly id: "platform.clerk.jwks";
     readonly canonicalName: "CLERK_JWKS_URL";
@@ -738,6 +756,32 @@ declare const INFISICAL_SECRET_DEFINITIONS: readonly [{
         readonly environmentPolicy: "environment_specific";
     }];
     readonly description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing.";
+}, {
+    readonly id: "platform.permit.webhook-secret";
+    readonly canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET";
+    readonly aliases: readonly ["PERMIT_WEBHOOK_SECRET"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-gateway", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "mc-credential-maintenance";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing.";
 }, {
     readonly id: "platform.permit.pdp-url";
     readonly canonicalName: "LUCERN_PERMIT_PDP_URL";

package/dist/infisical-runtime.contract.js

@@ -698,6 +698,27 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities."
   },
+  {
+    id: "platform.clerk.webhook-secret",
+    canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET",
+    aliases: ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+  },
   {
     id: "platform.clerk.jwks",
     canonicalName: "CLERK_JWKS_URL",
@@ -997,6 +1018,37 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing."
   },
+  {
+    id: "platform.permit.webhook-secret",
+    canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET",
+    aliases: ["PERMIT_WEBHOOK_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-gateway", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+  },
   {
     id: "platform.permit.pdp-url",
     canonicalName: "LUCERN_PERMIT_PDP_URL",