@lucern/contracts 1.0.1 → 1.0.3

package/dist/infisical-runtime.platform-automation-secrets.d.ts

@@ -0,0 +1,436 @@
+declare const PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.deploy.vercel-token";
+    readonly canonicalName: "VERCEL_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps.";
+}, {
+    readonly id: "platform.deploy.vercel-token.stack";
+    readonly canonicalName: "STACK_VERCEL_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Stack Vercel API token for manifest-scoped Stack tenant Vercel secret sync. Never copy into tenant apps.";
+}, {
+    readonly id: "platform.deploy.vercel-token.lucern";
+    readonly canonicalName: "LUCERN_VERCEL_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Lucern Vercel API token for manifest-scoped Lucern tenant Vercel secret sync. Never copy into tenant apps.";
+}, {
+    readonly id: "platform.deploy.vercel-org-id";
+    readonly canonicalName: "VERCEL_ORG_ID";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Vercel team/org id used by deployment and sync automation.";
+}, {
+    readonly id: "platform.deploy.socket-api-key";
+    readonly canonicalName: "SOCKET_API_KEY";
+    readonly aliases: readonly ["socket_token", "SOCKET_SECURITY_API_KEY", "SOCKET_SECURITY_API_TOKEN"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+        readonly writeNames: readonly ["SOCKET_API_KEY", "SOCKET_SECURITY_API_KEY", "SOCKET_SECURITY_API_TOKEN"];
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "socket-firewall-wrapper";
+        readonly environmentPolicy: "same_all_environments";
+        readonly writeNames: readonly ["SOCKET_API_KEY", "SOCKET_SECURITY_API_KEY", "SOCKET_SECURITY_API_TOKEN"];
+    }];
+    readonly description: "Socket API token for authenticated Socket Firewall wrapper, CLI, and CI policy checks.";
+}, {
+    readonly id: "platform.deploy.socket-token-hash";
+    readonly canonicalName: "SOCKET_TOKEN_HASH";
+    readonly aliases: readonly ["socket_token_hash", "SOCKET_API_KEY_HASH"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "socket-token-audit";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Socket token fingerprint retained for rotation evidence; not consumed by Socket tooling.";
+}];
+declare const PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.docs.gap-audit-api-key";
+    readonly canonicalName: "DOC_GAP_AUDIT_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional model key for docs gap audits.";
+}, {
+    readonly id: "platform.docs.gap-audit-provider";
+    readonly canonicalName: "DOC_GAP_AUDIT_PROVIDER";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional docs gap audit provider selector.";
+}, {
+    readonly id: "platform.docs.gap-audit-model";
+    readonly canonicalName: "DOC_GAP_AUDIT_MODEL";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional docs gap audit model selector.";
+}, {
+    readonly id: "platform.infisical.local-cli";
+    readonly canonicalName: "INFISICAL_BIN";
+    readonly aliases: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/infisical";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Operator-only Infisical CLI/API location knobs. Machine credentials are handled by the bootstrap contract.";
+}, {
+    readonly id: "platform.gateway.device-verification-base-url";
+    readonly canonicalName: "LUCERN_DEVICE_VERIFICATION_BASE_URL";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Base URL shown during Lucern CLI/device authentication.";
+}, {
+    readonly id: "platform.gateway.mode";
+    readonly canonicalName: "LUCERN_GATEWAY_MODE";
+    readonly aliases: readonly ["LUCERN_GATEWAY_ENV"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Gateway runtime mode/environment label.";
+}, {
+    readonly id: "platform.mcp.runtime";
+    readonly canonicalName: "LUCERN_MCP_URL";
+    readonly aliases: readonly ["LUCERN_AGENT_IDENTITY", "LUCERN_HTTP_HOST", "LUCERN_HTTP_PORT", "LUCERN_MCP_ALLOW_API_KEY_PASSTHROUGH", "LUCERN_MCP_DEBUG", "LUCERN_MCP_DIAGNOSTICS_FILE", "LUCERN_MCP_HEALTH_PATH", "LUCERN_MCP_HEALTH_URL", "LUCERN_MCP_HOST", "LUCERN_MCP_PATH", "LUCERN_MCP_PORT", "LUCERN_MCP_QUIET", "LUCERN_MCP_TRANSPORT", "LUCERN_PROFILE", "LUCERN_PUBLIC_URL", "MCP_SERVER_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern MCP/CLI runtime knobs. Aliases are compatibility names and not Vercel write names.";
+}, {
+    readonly id: "platform.mcp.auth-token";
+    readonly canonicalName: "LUCERN_MCP_SERVER_AUTH_TOKEN";
+    readonly aliases: readonly ["LUCERN_USER_TOKEN", "MCP_SERVER_TOKEN"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead.";
+}, {
+    readonly id: "platform.operator.api-key";
+    readonly canonicalName: "LUCERN_API_KEY";
+    readonly aliases: readonly ["LUCERN_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-cli", "lucern-mcp", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files.";
+}, {
+    readonly id: "platform.graph-sync.proxy";
+    readonly canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL";
+    readonly aliases: readonly ["LUCERN_DEFAULT_TENANT_ID", "LUCERN_GRAPH_SYNC_ALLOWED_PROXY_HOSTS"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Graph-sync proxy URL, tenant filter, and allowed host list.";
+}, {
+    readonly id: "platform.package-smoke.local";
+    readonly canonicalName: "LUCERN_SDK_NPM_TOKEN";
+    readonly aliases: readonly ["LUCERN_KERNEL_INSTALL_SPEC", "LUCERN_KERNEL_KEEP_CLEANROOM", "LUCERN_KERNEL_LOCAL_TARBALL", "LUCERN_KERNEL_NPM_TOKEN", "LUCERN_KERNEL_SCOPE_REGISTRY", "LUCERN_KERNEL_SKIP_CONVEX", "LUCERN_SDK_INSTALL_SPEC", "LUCERN_SDK_KEEP_CLEANROOM", "LUCERN_SDK_LOCAL_TARBALL", "LUCERN_SDK_SCOPE_REGISTRY", "LUCERN_SDK_SKIP_LIVE"];
+    readonly owner: "lucern_platform";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/package-publish";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Private package install smoke-test knobs. Values are not tenant runtime variables.";
+}, {
+    readonly id: "platform.convex-deploy.local-names";
+    readonly canonicalName: "LUCERN_CONVEX_DEPLOYMENT_NAME";
+    readonly aliases: readonly ["CONVEX_DEPLOYMENT", "CONVEX_DEV_DEPLOYMENT_NAME", "CONVEX_PROD_DEPLOYMENT_NAME"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/deploy/convex";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Operator-only Convex deployment name hints. Deploy keys and URLs remain separately scoped.";
+}, {
+    readonly id: "platform.sdk.local-context";
+    readonly canonicalName: "LUCERN_TENANT_ID";
+    readonly aliases: readonly ["LUCERN_AGENT_DISPLAY_NAME", "LUCERN_AGENT_ID", "LUCERN_API_ENVIRONMENT", "LUCERN_PACK_KEY", "LUCERN_PROJECT_ID", "LUCERN_TOPIC_ID", "LUCERN_WORKSPACE_ID", "LUCERN_WORKTREE_ID"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-cli", "lucern-mcp", "tenant-agent-runtime"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves.";
+}, {
+    readonly id: "platform.debug.local-flags";
+    readonly canonicalName: "LUCERN_FUNCTIONAL_DEBUG";
+    readonly aliases: readonly ["LUCERN_CONTRACTS_SKIP_DTS", "LUCERN_DEPLOY_RECONCILIATION_DEBUG", "LUCERN_ENABLE_ADAPTIVE_LEARNING", "LUCERN_ENV_FILE", "LUCERN_EXAMPLE_DEBUG", "LUCERN_HTTP_SMOKE_DEBUG", "LUCERN_MULTI_TENANT", "LUCERN_PACK_ACTION_DEBUG", "LUCERN_RUN_LIVE_MCP"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime/debug";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Local or CI debug toggles. They are manifest-known but not tenant runtime secrets.";
+}, {
+    readonly id: "tenant.stackos.deploy-guard.local";
+    readonly canonicalName: "STACKOS_DEPLOY_TARGET";
+    readonly aliases: readonly ["STACKOS_DEPLOY_ENTRYPOINT", "STACKOS_EXPECTED_STAGING_COMMIT", "STACKOS_PROD_CUTOVER_APPROVED", "STACKOS_REPO_PATH", "STACKOS_REQUIRE_CHAT_RUNTIME", "STACKOS_SLOP_SCAN_BASELINE", "STACKOS_STAGING_API_KEY", "STACKOS_STAGING_BASE_URL", "STACK_DEPLOY_RECONCILIATION_SCHEMA_JSON"];
+    readonly owner: "tenant";
+    readonly scope: "software_system";
+    readonly sourcePath: "/tenants/stack";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-deploy-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "stackos-deploy-guard";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "StackOS deploy/test guard variables. These are not written into the StackOS Vercel runtime.";
+}];
+
+export { PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS, PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS };