@lucern/contracts 1.0.0 → 1.0.1

package/dist/infisical-runtime.platform-secrets.js

@@ -0,0 +1,726 @@
+// src/infisical-runtime.platform-secrets.ts
+var PLATFORM_SECRET_DEFINITIONS = [
+  {
+    id: "platform.clerk.publishable",
+    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+    aliases: ["CLERK_PUBLISHABLE_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: true,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk browser key for platform web, gateway, and hosted MCP OAuth flows."
+  },
+  {
+    id: "platform.clerk.secret",
+    canonicalName: "CLERK_SECRET_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk backend secret. Never route to tenant-owned apps unless that tenant is Lucern itself."
+  },
+  {
+    id: "platform.clerk.project",
+    canonicalName: "CLERK_PROJECT_ID",
+    aliases: ["LUCERN_CLERK_PROJECT_ID"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "mc-convex"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities."
+  },
+  {
+    id: "platform.clerk.webhook-secret",
+    canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET",
+    aliases: ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
+  },
+  {
+    id: "platform.clerk.jwks",
+    canonicalName: "CLERK_JWKS_URL",
+    aliases: ["CLERK_JWT_ISSUER_DOMAIN"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-mcp",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Clerk JWKS/issuer override for server-side token verification."
+  },
+  {
+    id: "platform.runtime.api-base-url",
+    canonicalName: "LUCERN_API_URL",
+    aliases: ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Canonical Lucern API gateway base URL. Older names remain aliases only."
+  },
+  {
+    id: "platform.runtime.login-base-url",
+    canonicalName: "LUCERN_LOGIN_BASE_URL",
+    aliases: ["LUCERN_AUTH_BASE_URL", "LUCERN_WEB_BASE_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "lucern-mcp", "lucern-cli"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Browser login origin used when device/OAuth login is not served by the API base URL."
+  },
+  {
+    id: "platform.runtime.environment",
+    canonicalName: "LUCERN_ENVIRONMENT",
+    aliases: ["LUCERN_ENV"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern runtime environment label."
+  },
+  {
+    id: "platform.runtime.require-deployment-host-registry",
+    canonicalName: "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Fail-closed gateway toggle that requires MC deployment host registry resolution before routing."
+  },
+  {
+    id: "platform.mc.convex-url",
+    canonicalName: "CONVEX_MC_URL",
+    aliases: [
+      "CONVEX_MC_PROD_URL",
+      "LUCERN_ADMIN_CONVEX_URL",
+      "LUCERN_CONVEX_URL",
+      "MC_CONVEX_URL"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Master Control Convex URL. Prod must point to successful-clam-833; dev/staging to utmost-ox-403."
+  },
+  {
+    id: "platform.mc.convex-deploy-key",
+    canonicalName: "CONVEX_MC_DEPLOY_KEY",
+    aliases: [
+      "CONVEX_MC_PROD_DEPLOY_KEY",
+      "LUCERN_ADMIN_DEPLOY_KEY",
+      "LUCERN_DEPLOY_KEY",
+      "MC_DEPLOY_KEY",
+      "MC_PROD_DEPLOY_KEY"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Master Control deploy/admin key. Never route to tenant Vercel projects or tenant Convex deployments."
+  },
+  {
+    id: "platform.mc.session-token-secret",
+    canonicalName: "LUCERN_SESSION_TOKEN_SECRET",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-mcp", "mc-convex", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Signs Lucern platform session/delegation tokens. This is platform-owned, not tenant-owned."
+  },
+  {
+    id: "platform.mc.tenant-secret-encryption-key",
+    canonicalName: "LUCERN_TENANT_SECRET_ENCRYPTION_KEY",
+    aliases: ["LUCERN_SESSION_TOKEN_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Encrypts tenant deployment credentials stored in MC. Session-token fallback is legacy only."
+  },
+  {
+    id: "platform.permit.api-key",
+    canonicalName: "LUCERN_PERMIT_API_KEY",
+    aliases: ["PERMIT_API_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing."
+  },
+  {
+    id: "platform.permit.webhook-secret",
+    canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET",
+    aliases: ["PERMIT_WEBHOOK_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-gateway", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+  },
+  {
+    id: "platform.permit.pdp-url",
+    canonicalName: "LUCERN_PERMIT_PDP_URL",
+    aliases: ["PERMIT_PDP_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Permit PDP URL override."
+  },
+  {
+    id: "platform.permit.api-url",
+    canonicalName: "LUCERN_PERMIT_API_URL",
+    aliases: ["PERMIT_API_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Permit API URL override."
+  },
+  {
+    id: "platform.ci.infisical-bootstrap-client-id",
+    canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_ID",
+    aliases: ["INFISICAL_CI_CLIENT_ID"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/ci",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Machine identity client id used by CI to reconcile Infisical desired state."
+  },
+  {
+    id: "platform.ci.infisical-bootstrap-client-secret",
+    canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_SECRET",
+    aliases: ["INFISICAL_CI_CLIENT_SECRET"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/ci",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Machine identity client secret used by CI to reconcile Infisical desired state."
+  },
+  {
+    id: "platform.publish.npm-token",
+    canonicalName: "NPM_TOKEN",
+    aliases: ["NODE_AUTH_TOKEN"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/publish",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Package publish/install token for @lucern/* release automation."
+  }
+];
+var PLATFORM_AI_SECRET_DEFINITIONS = [
+  {
+    id: "platform.ai.openai-api-key",
+    canonicalName: "OPENAI_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/ai",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation."
+  },
+  {
+    id: "platform.ai.anthropic-api-key",
+    canonicalName: "ANTHROPIC_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/ai",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Anthropic key for platform AI jobs, benchmarks, and controlled operator automation."
+  },
+  {
+    id: "platform.ai.gemini-api-key",
+    canonicalName: "GEMINI_API_KEY",
+    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/ai",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Google/Gemini key. Google alias names are read compatibility only."
+  }
+];
+var PLATFORM_LANGFUSE_SECRET_DEFINITIONS = [
+  {
+    id: "platform.langfuse.secret-key",
+    canonicalName: "LANGFUSE_SECRET_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/observability/langfuse",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing."
+  },
+  {
+    id: "platform.langfuse.public-key",
+    canonicalName: "LANGFUSE_PUBLIC_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/observability/langfuse",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY."
+  },
+  {
+    id: "platform.langfuse.base-url",
+    canonicalName: "LANGFUSE_BASE_URL",
+    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/observability/langfuse",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases."
+  }
+];
+
+export { PLATFORM_AI_SECRET_DEFINITIONS, PLATFORM_LANGFUSE_SECRET_DEFINITIONS, PLATFORM_SECRET_DEFINITIONS };
+//# sourceMappingURL=infisical-runtime.platform-secrets.js.map
+//# sourceMappingURL=infisical-runtime.platform-secrets.js.map