@lucern/contracts 1.0.0 → 1.0.1

package/dist/infisical-runtime.tenant-secrets.js

@@ -0,0 +1,1131 @@
+// src/tenant-client.contract.ts
+var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
+  {
+    packageName: "@lucern/access-control",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/agent",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/auth",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/cli",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/client-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/confidence",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/config",
+    role: "configuration",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/contracts",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/control-plane",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/developer-kit",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    role: "host_addon_runtime",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/secrets",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/transport-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
+  (entry) => entry.packageName
+);
+
+// src/infisical-runtime.base.ts
+var INFISICAL_TENANT_SOFTWARE_SYSTEMS = [
+  {
+    id: "stack-frontend",
+    tenantKey: "stack",
+    workspaceKey: "frontend",
+    vercelProjectName: "ai-chatbot-diao",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "front-end"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_FRONTEND_URL",
+      deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY",
+      preprodDeployment: "rugged-lobster-664",
+      prodDeployment: "wonderful-toucan-0"
+    }
+  },
+  {
+    id: "stackos",
+    tenantKey: "stack",
+    workspaceKey: "stackos",
+    vercelProjectName: "stackos",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACKOS_URL",
+      deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY",
+      preprodDeployment: "giant-mandrill-761",
+      prodDeployment: "good-snake-515"
+    }
+  },
+  {
+    id: "stack-eng",
+    tenantKey: "stack",
+    workspaceKey: "engineering",
+    vercelProjectName: "stackos-engineering-graph",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos-engineering-graph"
+    },
+    sharedSourcePath: "/tenants/stack/engineering",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACK_ENG_URL",
+      deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY",
+      preprodDeployment: "small-oyster-270",
+      prodDeployment: "bold-cuttlefish-804"
+    }
+  },
+  {
+    id: "lucern-graph",
+    tenantKey: "lucern",
+    workspaceKey: "lucern",
+    vercelProjectName: "lucern-graph",
+    vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY",
+    vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ",
+    vercelWriterTokenEnv: "LUCERN_VERCEL_TOKEN",
+    repository: {
+      owner: "LucernAI",
+      name: "lucern-graph"
+    },
+    sharedSourcePath: "/tenants/lucern/shared",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_LUCERN_URL",
+      deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY",
+      preprodDeployment: "good-blackbird-774",
+      prodDeployment: "precious-dog-365"
+    }
+  }
+];
+
+// src/infisical-runtime.tenant-secrets.ts
+var TENANT_SHARED_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "clerk.publishable",
+    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+    aliases: ["CLERK_PUBLISHABLE_KEY"],
+    required: true,
+    secret: false,
+    public: true,
+    description: "Tenant-owned Clerk browser key. For Stack this is the master clerk.stack.vc project shared by front-end, StackOS, and the engineering workspace."
+  },
+  {
+    idSuffix: "clerk.secret",
+    canonicalName: "CLERK_SECRET_KEY",
+    required: true,
+    secret: true,
+    public: false,
+    description: "Tenant-owned Clerk backend secret used only by that tenant's server runtimes."
+  },
+  {
+    idSuffix: "clerk.project",
+    canonicalName: "CLERK_PROJECT_ID",
+    required: true,
+    secret: false,
+    public: false,
+    description: "Tenant-owned Clerk project id used to resolve canonical Clerk aliases."
+  },
+  {
+    idSuffix: "clerk.jwks",
+    canonicalName: "CLERK_JWT_ISSUER_DOMAIN",
+    aliases: ["CLERK_ISSUER_URL", "CLERK_JWKS_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Tenant Clerk issuer/JWKS URL consumed by Convex auth.config.ts."
+  },
+  {
+    idSuffix: "clerk.jwt-key",
+    canonicalName: "CLERK_JWT_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    description: "Tenant Clerk JWT public verification key used by bearer-token API routes."
+  },
+  {
+    idSuffix: "clerk.authorized-parties",
+    canonicalName: "CLERK_AUTHORIZED_PARTIES",
+    aliases: ["CLERK_MOBILE_AUTHORIZED_PARTIES"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Comma-separated Clerk authorized parties for browser and mobile bearer-token validation."
+  },
+  {
+    idSuffix: "clerk.sign-in-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-in route for custom app login surfaces."
+  },
+  {
+    idSuffix: "clerk.sign-up-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-up route for custom app login surfaces."
+  }
+];
+var TENANT_SHARED_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => TENANT_SHARED_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+var TENANT_INSTALL_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.map(
+  (system) => ({
+    id: `tenant.${system.id}.install-lucern-npm`,
+    canonicalName: "INSTALL_LUCERN_NPM",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/tenants/shared",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey}: read-only npm install token for published @lucern/* packages.`
+  })
+);
+var TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS = ["stack-frontend", "stackos"];
+var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "ai.openai-api-key",
+    canonicalName: "OPENAI_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned OpenAI key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "ai.anthropic-api-key",
+    canonicalName: "ANTHROPIC_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Anthropic key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "ai.gemini-api-key",
+    canonicalName: "GEMINI_API_KEY",
+    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Google/Gemini key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "langfuse.secret-key",
+    canonicalName: "LANGFUSE_SECRET_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse secret key for product AI tracing."
+  },
+  {
+    idSuffix: "langfuse.public-key",
+    canonicalName: "LANGFUSE_PUBLIC_KEY",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse public key for product AI tracing."
+  },
+  {
+    idSuffix: "langfuse.base-url",
+    canonicalName: "LANGFUSE_BASE_URL",
+    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse API origin."
+  },
+  {
+    idSuffix: "graph.neo4j-uri",
+    canonicalName: "NEO4J_URI",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j URI for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_USERNAME"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j user for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-password",
+    canonicalName: "NEO4J_PASSWORD",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j password for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned shared secret for product Convex-to-HTTP graph-sync calls."
+  },
+  {
+    idSuffix: "graph.neo4j-database",
+    canonicalName: "NEO4J_DATABASE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j database name for product graph-sync."
+  },
+  {
+    idSuffix: "vector.pinecone-api-key",
+    canonicalName: "PINECONE_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone API key for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-index-name",
+    canonicalName: "PINECONE_INDEX_NAME",
+    aliases: ["PINECONE_INDEX"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone index name for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-host",
+    canonicalName: "PINECONE_HOST",
+    aliases: ["PINECONE_INDEX_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone host for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-namespace",
+    canonicalName: "PINECONE_NAMESPACE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone namespace for product vector search isolation."
+  },
+  {
+    idSuffix: "storage.aws-access-key-id",
+    canonicalName: "AWS_ACCESS_KEY_ID",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS access key id for document/file ingestion."
+  },
+  {
+    idSuffix: "storage.aws-secret-access-key",
+    canonicalName: "AWS_SECRET_ACCESS_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS secret access key for document/file ingestion."
+  },
+  {
+    idSuffix: "storage.aws-region",
+    canonicalName: "AWS_REGION",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS region for document/file ingestion."
+  },
+  {
+    idSuffix: "observability.sentry-dsn",
+    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
+    aliases: ["NEXT_PUBLIC_SENTRY_DSN_NEXTJS", "SENTRY_DSN"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry DSN for app telemetry."
+  },
+  {
+    idSuffix: "observability.sentry-auth-token",
+    canonicalName: "SENTRY_AUTH_TOKEN",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry release token for app deployments."
+  },
+  {
+    idSuffix: "observability.sentry-org",
+    canonicalName: "SENTRY_ORG",
+    aliases: ["SENTRY_ORG_SLUG"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry org slug for release uploads."
+  },
+  {
+    idSuffix: "observability.sentry-project",
+    canonicalName: "SENTRY_PROJECT",
+    aliases: ["SENTRY_PROJECT_NEXTJS"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry project slug for release uploads."
+  },
+  {
+    idSuffix: "observability.sentry-environment",
+    canonicalName: "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+    aliases: ["SENTRY_ENVIRONMENT"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry environment label."
+  },
+  {
+    idSuffix: "observability.sentry-release",
+    canonicalName: "NEXT_PUBLIC_SENTRY_RELEASE",
+    aliases: ["SENTRY_RELEASE"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry release label."
+  },
+  {
+    idSuffix: "observability.sentry-client-options",
+    canonicalName: "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE",
+    aliases: [
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_ENABLE_LOGS",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_SESSION_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_SEND_DEFAULT_PII",
+      "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE_NEXTJS"
+    ],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned public Sentry tuning values for Next.js client instrumentation."
+  },
+  {
+    idSuffix: "observability.sentry-webhook-secret",
+    canonicalName: "SENTRY_WEBHOOK_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-convex-deployment", "tenant-observability"],
+    description: "Tenant-owned Sentry webhook verification secret."
+  },
+  {
+    idSuffix: "lucern.gateway-api-key",
+    canonicalName: "LUCERN_API_KEY",
+    aliases: ["STACK_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-scoped Lucern/MC gateway API key for product front-door calls."
+  },
+  {
+    idSuffix: "lucern.gateway-base-url",
+    canonicalName: "LUCERN_BASE_URL",
+    aliases: ["LUCERN_API_BASE_URL", "LUCERN_GATEWAY_BASE_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Lucern/MC gateway base URL used by tenant product apps."
+  },
+  {
+    idSuffix: "lucern.proxy-token-secret",
+    canonicalName: "LUCERN_PROXY_TOKEN_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned secret for signing internal proxy/session tokens in product apps."
+  },
+  {
+    idSuffix: "tenant.integrations.linear-api-key",
+    canonicalName: "LINEAR_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned Linear API key for support/slash-command flows."
+  },
+  {
+    idSuffix: "tenant.vercel.bypass-token",
+    canonicalName: "VERCEL_AUTOMATION_BYPASS_SECRET",
+    aliases: ["NEXT_PUBLIC_VERCEL_BYPASS_TOKEN"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    description: "Tenant-owned Vercel automation bypass token. Public alias is legacy and should be removed from app code."
+  }
+];
+var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.filter(
+  (system) => TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS.includes(system.id)
+).flatMap(
+  (system) => TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: template.consumers,
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "github_actions",
+          target: `${system.repository.owner}/${system.repository.name}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+function tenantVercelConvexUrlWriteNames(system) {
+  const names = [system.convex.urlEnv, "NEXT_PUBLIC_CONVEX_URL"];
+  if (system.id === "stack-eng") {
+    return [...names, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return names;
+}
+function tenantRepositoryConvexUrlWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.urlEnv, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return [system.convex.urlEnv];
+}
+function tenantRepositoryConvexDeployKeyWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.deployKeyEnv, "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  return [system.convex.deployKeyEnv];
+}
+function tenantConvexUrlAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_PROD_URL",
+      "CONVEX_STACK_V2_PROD_URL",
+      "CONVEX_STACK_V2_STAGING_URL",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_CLOUD_URL",
+      "CONVEX_STACK_URL",
+      "CONVEX_URL",
+      "CONVEX_URL_DEVELOPMENT",
+      "CONVEX_URL_PRODUCTION",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_GRAPH_URL",
+      "LUCERN_PROD_URL",
+      "NEXT_PUBLIC_LUCERN_GRAPH_URL"
+    ];
+  }
+  return void 0;
+}
+function tenantConvexDeployKeyAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_STACK_V2_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_V2_STAGING_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_DEV_DEPLOY_KEY",
+      "CONVEX_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["CONVEX_DEPLOY_KEY", "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_GRAPH_DEPLOY_KEY",
+      "LUCERN_CONVEX_DEPLOY_KEY",
+      "LUCERN_DEV_DEPLOY_KEY",
+      "LUCERN_PROD_DEPLOY_KEY"
+    ];
+  }
+  return void 0;
+}
+var TENANT_GRAPH_PUBLIC_CONFIG_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => {
+    if (system.id === "lucern-graph") {
+      return [
+        {
+          id: "tenant.lucern-graph.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_ID",
+          aliases: ["NEXT_PUBLIC_LUCERN_TENANT_ID"],
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant id used by the standalone graph explorer."
+        },
+        {
+          id: "tenant.lucern-graph.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant label used by the standalone graph explorer."
+        }
+      ];
+    }
+    if (system.id === "stack-eng") {
+      return [
+        {
+          id: "tenant.stack-eng.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_ID",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant id used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant label used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.environment",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_ENV",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public environment label used by the graph explorer."
+        }
+      ];
+    }
+    return [];
+  }
+);
+var STACK_ENG_GRAPH_STORE_SECRET_DEFINITIONS = [
+  {
+    id: "tenant.stack-eng.neo4j.uri",
+    canonicalName: "NEO4J_URI",
+    aliases: ["NEO4J_ENG_URI"],
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph Neo4j runtime URI. NEO4J_ENG_URI is the source alias used to avoid StackOS front-office collisions."
+  },
+  {
+    id: "tenant.stack-eng.neo4j.user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_ENG_USER"],
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph Neo4j runtime user."
+  },
+  {
+    id: "tenant.stack-eng.neo4j.password",
+    canonicalName: "NEO4J_PASSWORD",
+    aliases: ["NEO4J_ENG_PASSWORD"],
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph Neo4j runtime password."
+  },
+  {
+    id: "tenant.stack-eng.neo4j.sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph sync secret for Convex-to-HTTP graph query/sync calls."
+  }
+];
+var TENANT_CONVEX_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap((system) => [
+  {
+    id: `tenant.${system.id}.convex.url`,
+    canonicalName: system.convex.urlEnv,
+    aliases: tenantConvexUrlAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantVercelConvexUrlWriteNames(system)
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexUrlWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex URL. Pre-prod resolves to ${system.convex.preprodDeployment}; prod resolves to ${system.convex.prodDeployment}.`
+  },
+  {
+    id: `tenant.${system.id}.convex.deploy-key`,
+    canonicalName: system.convex.deployKeyEnv,
+    aliases: tenantConvexDeployKeyAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexDeployKeyWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex deploy/admin key. Never route to sibling workspaces.`
+  }
+]);
+
+export { STACK_ENG_GRAPH_STORE_SECRET_DEFINITIONS, TENANT_CONVEX_SECRET_DEFINITIONS, TENANT_GRAPH_PUBLIC_CONFIG_SECRET_DEFINITIONS, TENANT_INSTALL_SECRET_DEFINITIONS, TENANT_PRODUCT_RUNTIME_SECRET_DEFINITIONS, TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES, TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS, TENANT_SHARED_SECRET_DEFINITIONS, TENANT_SHARED_SECRET_DEFINITION_TEMPLATES };
+//# sourceMappingURL=infisical-runtime.tenant-secrets.js.map
+//# sourceMappingURL=infisical-runtime.tenant-secrets.js.map