@lucern/contracts 1.0.0 → 1.0.1

package/dist/infisical-runtime.base.d.ts

@@ -0,0 +1,444 @@
+/**
+ * Infisical runtime contract
+ *
+ * Defines how Lucern runtime surfaces receive platform configuration and
+ * secrets. Vercel-owned apps consume Infisical through secret syncs. Server,
+ * CLI, MCP, and SDK operator contexts may hydrate runtime config directly from
+ * Infisical when they have a scoped machine identity. Tenant user auth still
+ * flows through Lucern device login; tenant tools never receive platform Clerk
+ * secrets.
+ */
+declare const INFISICAL_RUNTIME_CONTRACT_VERSION: "2026-05-06";
+declare const INFISICAL_RUNTIME_DEFAULT_API_URL: "https://app.infisical.com";
+declare const INFISICAL_RUNTIME_DEFAULT_PROJECT_ID: "344b0526-90df-4606-ba50-22c647a36c65";
+declare const INFISICAL_RUNTIME_ENVIRONMENTS: readonly ["dev", "staging", "prod"];
+type InfisicalRuntimeEnvironment = (typeof INFISICAL_RUNTIME_ENVIRONMENTS)[number];
+declare const INFISICAL_RUNTIME_DELIVERY_MODES: readonly ["vercel_sync", "runtime_fetch", "device_auth"];
+type InfisicalRuntimeDeliveryMode = (typeof INFISICAL_RUNTIME_DELIVERY_MODES)[number];
+declare const INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS: readonly ["development", "preview", "staging", "production"];
+type InfisicalVercelDestinationEnvironment = (typeof INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS)[number];
+declare const INFISICAL_VERCEL_TARGETS: readonly ["development", "preview", "production"];
+type InfisicalVercelTarget = (typeof INFISICAL_VERCEL_TARGETS)[number];
+declare const INFISICAL_CONVEX_TIERS: readonly ["preprod", "prod"];
+type InfisicalConvexTier = (typeof INFISICAL_CONVEX_TIERS)[number];
+declare const INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT: {
+    readonly development: "preprod";
+    readonly preview: "preprod";
+    readonly staging: "preprod";
+    readonly production: "prod";
+};
+type InfisicalVercelSyncDestination = {
+    readonly environment: InfisicalVercelDestinationEnvironment;
+    readonly vercelTarget: InfisicalVercelTarget;
+    readonly convexTier: InfisicalConvexTier;
+    readonly customEnvironmentSlug?: string;
+    readonly customEnvironmentIdsByProjectName?: Readonly<Record<string, string>>;
+    readonly domainsByProjectName?: Readonly<Record<string, string>>;
+};
+declare const INFISICAL_VERCEL_SYNC_RECONCILIATION: {
+    readonly sourceOfTruth: "infisical";
+    readonly writer: "vercel_api";
+    readonly disableSecretDeletion: false;
+    readonly pruneDestinationKeys: true;
+};
+declare const INFISICAL_VERCEL_SYNC_DESTINATIONS: readonly [{
+    readonly environment: "development";
+    readonly vercelTarget: "development";
+    readonly convexTier: "preprod";
+}, {
+    readonly environment: "preview";
+    readonly vercelTarget: "preview";
+    readonly convexTier: "preprod";
+}, {
+    readonly environment: "staging";
+    readonly vercelTarget: "preview";
+    readonly convexTier: "preprod";
+    readonly customEnvironmentSlug: "staging";
+    readonly customEnvironmentIdsByProjectName: {
+        readonly stackos: "env_RbS0TYRRvWISTje8qR4u2lRg7TC8";
+    };
+    readonly domainsByProjectName: {
+        readonly stackos: "staging.stack.vc";
+    };
+}, {
+    readonly environment: "production";
+    readonly vercelTarget: "production";
+    readonly convexTier: "prod";
+}];
+declare const INFISICAL_RUNTIME_SURFACE_IDS: readonly ["lucern-web", "lucern-gateway", "lucern-sdk", "lucern-cli", "lucern-mcp", "tenant-client"];
+type InfisicalRuntimeSurfaceId = (typeof INFISICAL_RUNTIME_SURFACE_IDS)[number];
+declare const INFISICAL_RUNTIME_BOOTSTRAP_ENV: {
+    readonly apiUrl: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+    readonly projectId: readonly ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"];
+    readonly clientId: readonly ["INFISICAL_CLIENT_ID", "INFISICAL_MACHINE_CLIENT_ID", "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"];
+    readonly clientSecret: readonly ["INFISICAL_CLIENT_SECRET", "INFISICAL_MACHINE_CLIENT_SECRET", "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"];
+    readonly environment: readonly ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"];
+    readonly organizationSlug: readonly ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"];
+    readonly disabled: readonly ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"];
+};
+type InfisicalRuntimeBootstrapEnv = typeof INFISICAL_RUNTIME_BOOTSTRAP_ENV;
+declare const INFISICAL_RUNTIME_CONTROL_ENV: readonly [{
+    readonly name: "NODE_ENV";
+    readonly category: "framework";
+    readonly description: "Node/Next runtime mode. Framework-owned, not written by Infisical.";
+}, {
+    readonly name: "CI";
+    readonly category: "ci";
+    readonly description: "CI execution signal. Workflow-owned, not written by Infisical.";
+}, {
+    readonly name: "VERCEL";
+    readonly category: "vercel";
+    readonly description: "Vercel runtime signal. Platform-owned, not written by Infisical.";
+}, {
+    readonly name: "VERCEL_ENV";
+    readonly category: "vercel";
+    readonly description: "Vercel environment label used for build/runtime selection.";
+}, {
+    readonly name: "VERCEL_URL";
+    readonly category: "vercel";
+    readonly description: "Vercel deployment URL supplied by Vercel for previews and builds.";
+}, {
+    readonly name: "VERCEL_GIT_COMMIT_SHA";
+    readonly category: "vercel";
+    readonly description: "Vercel git metadata used for release labels. Platform-owned, not written by Infisical.";
+}, {
+    readonly name: "NEXT_RUNTIME";
+    readonly category: "nextjs";
+    readonly description: "Next.js runtime selector for node/edge instrumentation modules.";
+}, {
+    readonly name: "PORT";
+    readonly category: "framework";
+    readonly description: "Local/server port supplied by the runtime process manager.";
+}, {
+    readonly name: "HOST";
+    readonly category: "framework";
+    readonly description: "Local/server host supplied by the runtime process manager.";
+}, {
+    readonly name: "APP_URL";
+    readonly category: "compatibility";
+    readonly description: "Legacy local app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL.";
+}, {
+    readonly name: "NEXT_PUBLIC_APP_URL";
+    readonly category: "compatibility";
+    readonly description: "Legacy public app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL.";
+}, {
+    readonly name: "CLAUDE_PROJECT_DIR";
+    readonly category: "agent_local";
+    readonly description: "Local agent workspace hint. Agent-runtime-owned, not written by Infisical.";
+}, {
+    readonly name: "HOME";
+    readonly category: "os";
+    readonly description: "Operating-system home directory used only for local credential discovery.";
+}, {
+    readonly name: "USERPROFILE";
+    readonly category: "os";
+    readonly description: "Windows home directory used only for local credential discovery.";
+}];
+type InfisicalRuntimeControlEnv = (typeof INFISICAL_RUNTIME_CONTROL_ENV)[number];
+type InfisicalRuntimeVariable = {
+    readonly name: string;
+    readonly required: boolean;
+    readonly secret: boolean;
+    readonly public: boolean;
+    readonly aliases?: readonly string[];
+    readonly description: string;
+};
+type InfisicalRuntimePathDefinition = {
+    readonly id: string;
+    readonly secretPath: string;
+    readonly description: string;
+    readonly variables: readonly InfisicalRuntimeVariable[];
+};
+declare const INFISICAL_RUNTIME_PATHS: readonly [{
+    readonly id: "platform-auth";
+    readonly secretPath: "/platform/auth";
+    readonly description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.";
+    readonly variables: readonly [{
+        readonly name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: true;
+        readonly description: "Clerk publishable key for the Lucern web origin.";
+    }, {
+        readonly name: "CLERK_SECRET_KEY";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly description: "Clerk backend secret key for Lucern server runtimes.";
+    }, {
+        readonly name: "CLERK_JWT_ISSUER_DOMAIN";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly description: "Expected Clerk issuer/JWKS domain for JWT verification.";
+    }, {
+        readonly name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: true;
+        readonly description: "Public sign-in URL for Lucern-owned web flows.";
+    }, {
+        readonly name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: true;
+        readonly description: "Public sign-up URL for Lucern-owned web flows.";
+    }];
+}, {
+    readonly id: "platform-runtime";
+    readonly secretPath: "/platform/runtime";
+    readonly description: "Runtime defaults shared by server-side Lucern clients and operator tooling.";
+    readonly variables: readonly [{
+        readonly name: "LUCERN_API_URL";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+        readonly description: "Canonical Lucern API gateway URL.";
+    }, {
+        readonly name: "LUCERN_LOGIN_BASE_URL";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_AUTH_BASE_URL"];
+        readonly description: "Browser login origin used when it differs from the API.";
+    }, {
+        readonly name: "LUCERN_ENVIRONMENT";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_ENV"];
+        readonly description: "Lucern environment label consumed by CLI profiles.";
+    }, {
+        readonly name: "LUCERN_CLI_SESSION_TTL_MS";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly description: "Optional web-issued CLI login session lifetime override in milliseconds.";
+    }];
+}, {
+    readonly id: "platform-operator-credentials";
+    readonly secretPath: "/platform/runtime";
+    readonly description: "Lucern-owned operator credential material for local CLI, MCP, and SDK sessions.";
+    readonly variables: readonly [{
+        readonly name: "LUCERN_API_KEY";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_KEY"];
+        readonly description: "Lucern-owned operator API key for gateway calls from trusted local tooling.";
+    }];
+}, {
+    readonly id: "tenant-shared-install";
+    readonly secretPath: "tenants/shared";
+    readonly description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.";
+    readonly variables: readonly [{
+        readonly name: "INSTALL_LUCERN_NPM";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly description: "Read-only install token for the published @lucern/* suite.";
+    }];
+}];
+type InfisicalRuntimePath = (typeof INFISICAL_RUNTIME_PATHS)[number];
+type InfisicalRuntimePathId = InfisicalRuntimePath["id"];
+type InfisicalRuntimeSurfaceDefinition = {
+    readonly id: InfisicalRuntimeSurfaceId;
+    readonly packageName?: string;
+    readonly delivery: InfisicalRuntimeDeliveryMode;
+    readonly fallback?: InfisicalRuntimeDeliveryMode;
+    readonly sourcePathIds: readonly InfisicalRuntimePathId[];
+    readonly consumer: string;
+    readonly description: string;
+};
+declare const INFISICAL_RUNTIME_SURFACES: readonly [{
+    readonly id: "lucern-web";
+    readonly delivery: "vercel_sync";
+    readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+    readonly consumer: "apps/web on Vercel project lucern";
+    readonly description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs.";
+}, {
+    readonly id: "lucern-gateway";
+    readonly delivery: "vercel_sync";
+    readonly fallback: "runtime_fetch";
+    readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+    readonly consumer: "apps/gateway on Vercel project lucern-gateway";
+    readonly description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs and may self-hydrate from Infisical when the host environment has scoped bootstrap credentials.";
+}, {
+    readonly id: "lucern-sdk";
+    readonly packageName: "@lucern/sdk";
+    readonly delivery: "runtime_fetch";
+    readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
+    readonly consumer: "server-side SDK operator contexts with a scoped Infisical identity";
+    readonly description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.";
+}, {
+    readonly id: "lucern-cli";
+    readonly packageName: "@lucern/cli";
+    readonly delivery: "runtime_fetch";
+    readonly fallback: "device_auth";
+    readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
+    readonly consumer: "developer/operator CLI processes";
+    readonly description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.";
+}, {
+    readonly id: "lucern-mcp";
+    readonly packageName: "@lucern/mcp";
+    readonly delivery: "runtime_fetch";
+    readonly fallback: "device_auth";
+    readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
+    readonly consumer: "MCP server/client processes";
+    readonly description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.";
+}, {
+    readonly id: "tenant-client";
+    readonly delivery: "device_auth";
+    readonly sourcePathIds: readonly ["tenant-shared-install"];
+    readonly consumer: "tenant-owned apps and coding agents";
+    readonly description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces.";
+}];
+type InfisicalRuntimeSurface = (typeof INFISICAL_RUNTIME_SURFACES)[number];
+type InfisicalTenantSoftwareSystemDefinition = {
+    readonly id: string;
+    readonly tenantKey: string;
+    readonly workspaceKey: string;
+    readonly vercelProjectName: string;
+    readonly vercelTeamId: string;
+    readonly vercelProjectId: string;
+    readonly vercelWriterTokenEnv: string;
+    readonly repository: {
+        readonly owner: string;
+        readonly name: string;
+    };
+    readonly sharedSourcePath: string;
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: string;
+        readonly deployKeyEnv: string;
+        readonly preprodDeployment: string;
+        readonly prodDeployment: string;
+    };
+};
+declare const INFISICAL_TENANT_SOFTWARE_SYSTEMS: readonly [{
+    readonly id: "stack-frontend";
+    readonly tenantKey: "stack";
+    readonly workspaceKey: "frontend";
+    readonly vercelProjectName: "ai-chatbot-diao";
+    readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+    readonly vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517";
+    readonly vercelWriterTokenEnv: "STACK_VERCEL_TOKEN";
+    readonly repository: {
+        readonly owner: "stack-vc";
+        readonly name: "front-end";
+    };
+    readonly sharedSourcePath: "/tenants/stack";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_FRONTEND_URL";
+        readonly deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY";
+        readonly preprodDeployment: "rugged-lobster-664";
+        readonly prodDeployment: "wonderful-toucan-0";
+    };
+}, {
+    readonly id: "stackos";
+    readonly tenantKey: "stack";
+    readonly workspaceKey: "stackos";
+    readonly vercelProjectName: "stackos";
+    readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+    readonly vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau";
+    readonly vercelWriterTokenEnv: "STACK_VERCEL_TOKEN";
+    readonly repository: {
+        readonly owner: "stack-vc";
+        readonly name: "stackos";
+    };
+    readonly sharedSourcePath: "/tenants/stack";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_STACKOS_URL";
+        readonly deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY";
+        readonly preprodDeployment: "giant-mandrill-761";
+        readonly prodDeployment: "good-snake-515";
+    };
+}, {
+    readonly id: "stack-eng";
+    readonly tenantKey: "stack";
+    readonly workspaceKey: "engineering";
+    readonly vercelProjectName: "stackos-engineering-graph";
+    readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+    readonly vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ";
+    readonly vercelWriterTokenEnv: "STACK_VERCEL_TOKEN";
+    readonly repository: {
+        readonly owner: "stack-vc";
+        readonly name: "stackos-engineering-graph";
+    };
+    readonly sharedSourcePath: "/tenants/stack/engineering";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_STACK_ENG_URL";
+        readonly deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY";
+        readonly preprodDeployment: "small-oyster-270";
+        readonly prodDeployment: "bold-cuttlefish-804";
+    };
+}, {
+    readonly id: "lucern-graph";
+    readonly tenantKey: "lucern";
+    readonly workspaceKey: "lucern";
+    readonly vercelProjectName: "lucern-graph";
+    readonly vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY";
+    readonly vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ";
+    readonly vercelWriterTokenEnv: "LUCERN_VERCEL_TOKEN";
+    readonly repository: {
+        readonly owner: "LucernAI";
+        readonly name: "lucern-graph";
+    };
+    readonly sharedSourcePath: "/tenants/lucern/shared";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_LUCERN_URL";
+        readonly deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY";
+        readonly preprodDeployment: "good-blackbird-774";
+        readonly prodDeployment: "precious-dog-365";
+    };
+}];
+type InfisicalTenantSoftwareSystem = (typeof INFISICAL_TENANT_SOFTWARE_SYSTEMS)[number];
+type InfisicalTenantSoftwareSystemId = InfisicalTenantSoftwareSystem["id"];
+declare function findInfisicalTenantSoftwareSystem(systemId: InfisicalTenantSoftwareSystemId): InfisicalTenantSoftwareSystem | undefined;
+declare function tenantSoftwareSystemConvexEnvNames(systemId: InfisicalTenantSoftwareSystemId): readonly [string, string];
+declare function tenantSoftwareSystemOwnsConvexEnvName(systemId: InfisicalTenantSoftwareSystemId, envName: string): boolean;
+declare function convexTierForVercelDestinationEnvironment(environment: InfisicalVercelDestinationEnvironment): InfisicalConvexTier;
+declare function findInfisicalVercelSyncDestination(environment: InfisicalVercelDestinationEnvironment): InfisicalVercelSyncDestination | undefined;
+declare function vercelCustomEnvironmentIdForTenantSoftwareSystem(systemId: InfisicalTenantSoftwareSystemId, environment: InfisicalVercelDestinationEnvironment): string | undefined;
+declare function expectedTenantConvexDeploymentForVercelEnvironment(systemId: InfisicalTenantSoftwareSystemId, environment: InfisicalVercelDestinationEnvironment): string;
+declare function findInfisicalRuntimePath(pathId: InfisicalRuntimePathId): InfisicalRuntimePath | undefined;
+declare function findInfisicalRuntimeSurface(surfaceId: InfisicalRuntimeSurfaceId): InfisicalRuntimeSurface | undefined;
+declare const INFISICAL_SECRET_OWNERS: readonly ["lucern_platform", "tenant", "provider", "operator_local"];
+type InfisicalSecretOwner = (typeof INFISICAL_SECRET_OWNERS)[number];
+declare const INFISICAL_SECRET_SCOPES: readonly ["global", "environment", "tenant", "workspace", "software_system", "deployment", "local"];
+type InfisicalSecretScope = (typeof INFISICAL_SECRET_SCOPES)[number];
+declare const INFISICAL_SECRET_ENVIRONMENT_POLICIES: readonly ["same_all_environments", "environment_specific", "preprod_staging_prod_prod", "local_only"];
+type InfisicalSecretEnvironmentPolicy = (typeof INFISICAL_SECRET_ENVIRONMENT_POLICIES)[number];
+declare const INFISICAL_SECRET_CONSUMERS: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli", "lucern-ai-runtime", "lucern-graph-sync", "lucern-observability", "lucern-repo-ci", "mc-convex", "mc-operator-tooling", "tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime", "tenant-graph-sync", "tenant-observability", "tenant-vector-store", "tenant-deploy-tooling", "tenant-agent-runtime"];
+type InfisicalSecretConsumer = (typeof INFISICAL_SECRET_CONSUMERS)[number];
+declare const INFISICAL_SECRET_DESTINATION_KINDS: readonly ["vercel", "convex", "github_actions", "runtime_fetch", "operator_local"];
+type InfisicalSecretDestinationKind = (typeof INFISICAL_SECRET_DESTINATION_KINDS)[number];
+type InfisicalSecretDestination = {
+    readonly kind: InfisicalSecretDestinationKind;
+    readonly target: string;
+    readonly environmentPolicy: InfisicalSecretEnvironmentPolicy;
+    readonly writeNames?: readonly string[];
+    readonly notes?: string;
+};
+type InfisicalSecretDefinition = {
+    readonly id: string;
+    readonly canonicalName: string;
+    readonly aliases?: readonly string[];
+    readonly owner: InfisicalSecretOwner;
+    readonly scope: InfisicalSecretScope;
+    readonly sourcePath: string;
+    readonly environmentPolicy: InfisicalSecretEnvironmentPolicy;
+    readonly required: boolean;
+    readonly secret: boolean;
+    readonly public: boolean;
+    readonly consumers: readonly InfisicalSecretConsumer[];
+    readonly destinations: readonly InfisicalSecretDestination[];
+    readonly description: string;
+};
+
+export { INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, type InfisicalConvexTier, type InfisicalRuntimeBootstrapEnv, type InfisicalRuntimeControlEnv, type InfisicalRuntimeDeliveryMode, type InfisicalRuntimeEnvironment, type InfisicalRuntimePath, type InfisicalRuntimePathDefinition, type InfisicalRuntimePathId, type InfisicalRuntimeSurface, type InfisicalRuntimeSurfaceDefinition, type InfisicalRuntimeSurfaceId, type InfisicalRuntimeVariable, type InfisicalSecretConsumer, type InfisicalSecretDefinition, type InfisicalSecretDestination, type InfisicalSecretDestinationKind, type InfisicalSecretEnvironmentPolicy, type InfisicalSecretOwner, type InfisicalSecretScope, type InfisicalTenantSoftwareSystem, type InfisicalTenantSoftwareSystemDefinition, type InfisicalTenantSoftwareSystemId, type InfisicalVercelDestinationEnvironment, type InfisicalVercelSyncDestination, type InfisicalVercelTarget, convexTierForVercelDestinationEnvironment, expectedTenantConvexDeploymentForVercelEnvironment, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, vercelCustomEnvironmentIdForTenantSoftwareSystem };