@lucern/contracts 0.3.0-alpha.11 → 0.3.0-alpha.13

package/dist/manifests/infisical-runtime-manifest.d.ts

@@ -290,6 +290,24 @@ declare const INFISICAL_RUNTIME_MANIFEST: {
             readonly environmentPolicy: "environment_specific";
         }];
         readonly description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities.";
+    }, {
+        readonly id: "platform.clerk.webhook-secret";
+        readonly canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET";
+        readonly aliases: readonly ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/auth";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit.";
     }, {
         readonly id: "platform.clerk.jwks";
         readonly canonicalName: "CLERK_JWKS_URL";
@@ -532,6 +550,32 @@ declare const INFISICAL_RUNTIME_MANIFEST: {
             readonly environmentPolicy: "environment_specific";
         }];
         readonly description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing.";
+    }, {
+        readonly id: "platform.permit.webhook-secret";
+        readonly canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET";
+        readonly aliases: readonly ["PERMIT_WEBHOOK_SECRET"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/permit";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["mc-convex", "lucern-gateway", "mc-operator-tooling"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "master-control";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "mc-credential-maintenance";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing.";
     }, {
         readonly id: "platform.permit.pdp-url";
         readonly canonicalName: "LUCERN_PERMIT_PDP_URL";

package/dist/manifests/infisical-runtime-manifest.js

@@ -592,6 +592,27 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities."
   },
+  {
+    id: "platform.clerk.webhook-secret",
+    canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET",
+    aliases: ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+  },
   {
     id: "platform.clerk.jwks",
     canonicalName: "CLERK_JWKS_URL",
@@ -891,6 +912,37 @@ var PLATFORM_SECRET_DEFINITIONS = [
     ],
     description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing."
   },
+  {
+    id: "platform.permit.webhook-secret",
+    canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET",
+    aliases: ["PERMIT_WEBHOOK_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-gateway", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+  },
   {
     id: "platform.permit.pdp-url",
     canonicalName: "LUCERN_PERMIT_PDP_URL",