@lucern/contracts 1.0.0 → 1.0.1

package/dist/infisical-runtime.base.js

@@ -0,0 +1,640 @@
+// src/tenant-client.contract.ts
+var TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH = "tenants/shared";
+var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
+  {
+    packageName: "@lucern/access-control",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/agent",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/auth",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/cli",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/client-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/confidence",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/config",
+    role: "configuration",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/contracts",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/control-plane",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/developer-kit",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    role: "host_addon_runtime",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/secrets",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/transport-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
+  (entry) => entry.packageName
+);
+
+// src/infisical-runtime.base.ts
+var INFISICAL_RUNTIME_CONTRACT_VERSION = "2026-05-06";
+var INFISICAL_RUNTIME_DEFAULT_API_URL = "https://app.infisical.com";
+var INFISICAL_RUNTIME_DEFAULT_PROJECT_ID = "344b0526-90df-4606-ba50-22c647a36c65";
+var INFISICAL_RUNTIME_ENVIRONMENTS = [
+  "dev",
+  "staging",
+  "prod"
+];
+var INFISICAL_RUNTIME_DELIVERY_MODES = [
+  "vercel_sync",
+  "runtime_fetch",
+  "device_auth"
+];
+var INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS = [
+  "development",
+  "preview",
+  "staging",
+  "production"
+];
+var INFISICAL_VERCEL_TARGETS = [
+  "development",
+  "preview",
+  "production"
+];
+var INFISICAL_CONVEX_TIERS = ["preprod", "prod"];
+var INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT = {
+  development: "preprod",
+  preview: "preprod",
+  staging: "preprod",
+  production: "prod"
+};
+var INFISICAL_VERCEL_SYNC_RECONCILIATION = {
+  sourceOfTruth: "infisical",
+  writer: "vercel_api",
+  disableSecretDeletion: false,
+  pruneDestinationKeys: true
+};
+var INFISICAL_VERCEL_SYNC_DESTINATIONS = [
+  {
+    environment: "development",
+    vercelTarget: "development",
+    convexTier: "preprod"
+  },
+  {
+    environment: "preview",
+    vercelTarget: "preview",
+    convexTier: "preprod"
+  },
+  {
+    environment: "staging",
+    vercelTarget: "preview",
+    convexTier: "preprod",
+    customEnvironmentSlug: "staging",
+    customEnvironmentIdsByProjectName: {
+      stackos: "env_RbS0TYRRvWISTje8qR4u2lRg7TC8"
+    },
+    domainsByProjectName: {
+      stackos: "staging.stack.vc"
+    }
+  },
+  {
+    environment: "production",
+    vercelTarget: "production",
+    convexTier: "prod"
+  }
+];
+var INFISICAL_RUNTIME_SURFACE_IDS = [
+  "lucern-web",
+  "lucern-gateway",
+  "lucern-sdk",
+  "lucern-cli",
+  "lucern-mcp",
+  "tenant-client"
+];
+var INFISICAL_RUNTIME_BOOTSTRAP_ENV = {
+  apiUrl: ["INFISICAL_API_URL", "INFISICAL_URL"],
+  projectId: ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"],
+  clientId: [
+    "INFISICAL_CLIENT_ID",
+    "INFISICAL_MACHINE_CLIENT_ID",
+    "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"
+  ],
+  clientSecret: [
+    "INFISICAL_CLIENT_SECRET",
+    "INFISICAL_MACHINE_CLIENT_SECRET",
+    "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"
+  ],
+  environment: ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"],
+  organizationSlug: ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"],
+  disabled: ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"]
+};
+var INFISICAL_RUNTIME_CONTROL_ENV = [
+  {
+    name: "NODE_ENV",
+    category: "framework",
+    description: "Node/Next runtime mode. Framework-owned, not written by Infisical."
+  },
+  {
+    name: "CI",
+    category: "ci",
+    description: "CI execution signal. Workflow-owned, not written by Infisical."
+  },
+  {
+    name: "VERCEL",
+    category: "vercel",
+    description: "Vercel runtime signal. Platform-owned, not written by Infisical."
+  },
+  {
+    name: "VERCEL_ENV",
+    category: "vercel",
+    description: "Vercel environment label used for build/runtime selection."
+  },
+  {
+    name: "VERCEL_URL",
+    category: "vercel",
+    description: "Vercel deployment URL supplied by Vercel for previews and builds."
+  },
+  {
+    name: "VERCEL_GIT_COMMIT_SHA",
+    category: "vercel",
+    description: "Vercel git metadata used for release labels. Platform-owned, not written by Infisical."
+  },
+  {
+    name: "NEXT_RUNTIME",
+    category: "nextjs",
+    description: "Next.js runtime selector for node/edge instrumentation modules."
+  },
+  {
+    name: "PORT",
+    category: "framework",
+    description: "Local/server port supplied by the runtime process manager."
+  },
+  {
+    name: "HOST",
+    category: "framework",
+    description: "Local/server host supplied by the runtime process manager."
+  },
+  {
+    name: "APP_URL",
+    category: "compatibility",
+    description: "Legacy local app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL."
+  },
+  {
+    name: "NEXT_PUBLIC_APP_URL",
+    category: "compatibility",
+    description: "Legacy public app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL."
+  },
+  {
+    name: "CLAUDE_PROJECT_DIR",
+    category: "agent_local",
+    description: "Local agent workspace hint. Agent-runtime-owned, not written by Infisical."
+  },
+  {
+    name: "HOME",
+    category: "os",
+    description: "Operating-system home directory used only for local credential discovery."
+  },
+  {
+    name: "USERPROFILE",
+    category: "os",
+    description: "Windows home directory used only for local credential discovery."
+  }
+];
+var INFISICAL_RUNTIME_PATHS = [
+  {
+    id: "platform-auth",
+    secretPath: "/platform/auth",
+    description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.",
+    variables: [
+      {
+        name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+        required: true,
+        secret: false,
+        public: true,
+        description: "Clerk publishable key for the Lucern web origin."
+      },
+      {
+        name: "CLERK_SECRET_KEY",
+        required: true,
+        secret: true,
+        public: false,
+        description: "Clerk backend secret key for Lucern server runtimes."
+      },
+      {
+        name: "CLERK_JWT_ISSUER_DOMAIN",
+        required: false,
+        secret: false,
+        public: false,
+        description: "Expected Clerk issuer/JWKS domain for JWT verification."
+      },
+      {
+        name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
+        required: false,
+        secret: false,
+        public: true,
+        description: "Public sign-in URL for Lucern-owned web flows."
+      },
+      {
+        name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
+        required: false,
+        secret: false,
+        public: true,
+        description: "Public sign-up URL for Lucern-owned web flows."
+      }
+    ]
+  },
+  {
+    id: "platform-runtime",
+    secretPath: "/platform/runtime",
+    description: "Runtime defaults shared by server-side Lucern clients and operator tooling.",
+    variables: [
+      {
+        name: "LUCERN_API_URL",
+        required: true,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"],
+        description: "Canonical Lucern API gateway URL."
+      },
+      {
+        name: "LUCERN_LOGIN_BASE_URL",
+        required: false,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_AUTH_BASE_URL"],
+        description: "Browser login origin used when it differs from the API."
+      },
+      {
+        name: "LUCERN_ENVIRONMENT",
+        required: false,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_ENV"],
+        description: "Lucern environment label consumed by CLI profiles."
+      },
+      {
+        name: "LUCERN_CLI_SESSION_TTL_MS",
+        required: false,
+        secret: false,
+        public: false,
+        description: "Optional web-issued CLI login session lifetime override in milliseconds."
+      }
+    ]
+  },
+  {
+    id: "platform-operator-credentials",
+    secretPath: "/platform/runtime",
+    description: "Lucern-owned operator credential material for local CLI, MCP, and SDK sessions.",
+    variables: [
+      {
+        name: "LUCERN_API_KEY",
+        required: false,
+        secret: true,
+        public: false,
+        aliases: ["LUCERN_KEY"],
+        description: "Lucern-owned operator API key for gateway calls from trusted local tooling."
+      }
+    ]
+  },
+  {
+    id: "tenant-shared-install",
+    secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
+    description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.",
+    variables: [
+      {
+        name: "INSTALL_LUCERN_NPM",
+        required: true,
+        secret: true,
+        public: false,
+        description: "Read-only install token for the published @lucern/* suite."
+      }
+    ]
+  }
+];
+var INFISICAL_RUNTIME_SURFACES = [
+  {
+    id: "lucern-web",
+    delivery: "vercel_sync",
+    sourcePathIds: ["platform-auth", "platform-runtime"],
+    consumer: "apps/web on Vercel project lucern",
+    description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs."
+  },
+  {
+    id: "lucern-gateway",
+    delivery: "vercel_sync",
+    fallback: "runtime_fetch",
+    sourcePathIds: ["platform-auth", "platform-runtime"],
+    consumer: "apps/gateway on Vercel project lucern-gateway",
+    description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs and may self-hydrate from Infisical when the host environment has scoped bootstrap credentials."
+  },
+  {
+    id: "lucern-sdk",
+    packageName: "@lucern/sdk",
+    delivery: "runtime_fetch",
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
+    consumer: "server-side SDK operator contexts with a scoped Infisical identity",
+    description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials."
+  },
+  {
+    id: "lucern-cli",
+    packageName: "@lucern/cli",
+    delivery: "runtime_fetch",
+    fallback: "device_auth",
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
+    consumer: "developer/operator CLI processes",
+    description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login."
+  },
+  {
+    id: "lucern-mcp",
+    packageName: "@lucern/mcp",
+    delivery: "runtime_fetch",
+    fallback: "device_auth",
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
+    consumer: "MCP server/client processes",
+    description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner."
+  },
+  {
+    id: "tenant-client",
+    delivery: "device_auth",
+    sourcePathIds: ["tenant-shared-install"],
+    consumer: "tenant-owned apps and coding agents",
+    description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces."
+  }
+];
+var INFISICAL_TENANT_SOFTWARE_SYSTEMS = [
+  {
+    id: "stack-frontend",
+    tenantKey: "stack",
+    workspaceKey: "frontend",
+    vercelProjectName: "ai-chatbot-diao",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "front-end"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_FRONTEND_URL",
+      deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY",
+      preprodDeployment: "rugged-lobster-664",
+      prodDeployment: "wonderful-toucan-0"
+    }
+  },
+  {
+    id: "stackos",
+    tenantKey: "stack",
+    workspaceKey: "stackos",
+    vercelProjectName: "stackos",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACKOS_URL",
+      deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY",
+      preprodDeployment: "giant-mandrill-761",
+      prodDeployment: "good-snake-515"
+    }
+  },
+  {
+    id: "stack-eng",
+    tenantKey: "stack",
+    workspaceKey: "engineering",
+    vercelProjectName: "stackos-engineering-graph",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos-engineering-graph"
+    },
+    sharedSourcePath: "/tenants/stack/engineering",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACK_ENG_URL",
+      deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY",
+      preprodDeployment: "small-oyster-270",
+      prodDeployment: "bold-cuttlefish-804"
+    }
+  },
+  {
+    id: "lucern-graph",
+    tenantKey: "lucern",
+    workspaceKey: "lucern",
+    vercelProjectName: "lucern-graph",
+    vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY",
+    vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ",
+    vercelWriterTokenEnv: "LUCERN_VERCEL_TOKEN",
+    repository: {
+      owner: "LucernAI",
+      name: "lucern-graph"
+    },
+    sharedSourcePath: "/tenants/lucern/shared",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_LUCERN_URL",
+      deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY",
+      preprodDeployment: "good-blackbird-774",
+      prodDeployment: "precious-dog-365"
+    }
+  }
+];
+function findInfisicalTenantSoftwareSystem(systemId) {
+  return INFISICAL_TENANT_SOFTWARE_SYSTEMS.find(
+    (system) => system.id === systemId
+  );
+}
+function tenantSoftwareSystemConvexEnvNames(systemId) {
+  const system = findInfisicalTenantSoftwareSystem(systemId);
+  if (!system) {
+    throw new Error(`Unknown tenant software system: ${systemId}.`);
+  }
+  return [system.convex.urlEnv, system.convex.deployKeyEnv];
+}
+function tenantSoftwareSystemOwnsConvexEnvName(systemId, envName) {
+  return tenantSoftwareSystemConvexEnvNames(systemId).includes(envName);
+}
+function convexTierForVercelDestinationEnvironment(environment) {
+  return INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT[environment];
+}
+function findInfisicalVercelSyncDestination(environment) {
+  return INFISICAL_VERCEL_SYNC_DESTINATIONS.find(
+    (destination) => destination.environment === environment
+  );
+}
+function vercelCustomEnvironmentIdForTenantSoftwareSystem(systemId, environment) {
+  const system = findInfisicalTenantSoftwareSystem(systemId);
+  const destination = findInfisicalVercelSyncDestination(environment);
+  if (!system || !destination) {
+    return void 0;
+  }
+  return destination.customEnvironmentIdsByProjectName?.[system.vercelProjectName];
+}
+function expectedTenantConvexDeploymentForVercelEnvironment(systemId, environment) {
+  const system = findInfisicalTenantSoftwareSystem(systemId);
+  if (!system) {
+    throw new Error(`Unknown tenant software system: ${systemId}.`);
+  }
+  return convexTierForVercelDestinationEnvironment(environment) === "prod" ? system.convex.prodDeployment : system.convex.preprodDeployment;
+}
+function findInfisicalRuntimePath(pathId) {
+  return INFISICAL_RUNTIME_PATHS.find((path) => path.id === pathId);
+}
+function findInfisicalRuntimeSurface(surfaceId) {
+  return INFISICAL_RUNTIME_SURFACES.find((surface) => surface.id === surfaceId);
+}
+var INFISICAL_SECRET_OWNERS = [
+  "lucern_platform",
+  "tenant",
+  "provider",
+  "operator_local"
+];
+var INFISICAL_SECRET_SCOPES = [
+  "global",
+  "environment",
+  "tenant",
+  "workspace",
+  "software_system",
+  "deployment",
+  "local"
+];
+var INFISICAL_SECRET_ENVIRONMENT_POLICIES = [
+  "same_all_environments",
+  "environment_specific",
+  "preprod_staging_prod_prod",
+  "local_only"
+];
+var INFISICAL_SECRET_CONSUMERS = [
+  "lucern-web",
+  "lucern-gateway",
+  "lucern-mcp",
+  "lucern-cli",
+  "lucern-ai-runtime",
+  "lucern-graph-sync",
+  "lucern-observability",
+  "lucern-repo-ci",
+  "mc-convex",
+  "mc-operator-tooling",
+  "tenant-vercel-app",
+  "tenant-convex-deployment",
+  "tenant-ai-runtime",
+  "tenant-graph-sync",
+  "tenant-observability",
+  "tenant-vector-store",
+  "tenant-deploy-tooling",
+  "tenant-agent-runtime"
+];
+var INFISICAL_SECRET_DESTINATION_KINDS = [
+  "vercel",
+  "convex",
+  "github_actions",
+  "runtime_fetch",
+  "operator_local"
+];
+
+export { INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, convexTierForVercelDestinationEnvironment, expectedTenantConvexDeploymentForVercelEnvironment, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, vercelCustomEnvironmentIdForTenantSoftwareSystem };
+//# sourceMappingURL=infisical-runtime.base.js.map
+//# sourceMappingURL=infisical-runtime.base.js.map