@lucern/contracts 0.3.0-alpha.1 → 0.3.0-alpha.11

package/dist/infisical-runtime.contract.d.ts

@@ -0,0 +1,1768 @@
+/**
+ * Infisical runtime contract
+ *
+ * Defines how Lucern runtime surfaces receive platform configuration and
+ * secrets. Vercel-owned apps consume Infisical through secret syncs. Server,
+ * CLI, MCP, and SDK operator contexts may hydrate runtime config directly from
+ * Infisical when they have a scoped machine identity. Tenant user auth still
+ * flows through Lucern device login; tenant tools never receive platform Clerk
+ * secrets.
+ */
+declare const INFISICAL_RUNTIME_CONTRACT_VERSION: "2026-05-06";
+declare const INFISICAL_RUNTIME_DEFAULT_API_URL: "https://app.infisical.com";
+declare const INFISICAL_RUNTIME_DEFAULT_PROJECT_ID: "344b0526-90df-4606-ba50-22c647a36c65";
+declare const INFISICAL_RUNTIME_ENVIRONMENTS: readonly ["dev", "staging", "prod"];
+type InfisicalRuntimeEnvironment = (typeof INFISICAL_RUNTIME_ENVIRONMENTS)[number];
+declare const INFISICAL_RUNTIME_DELIVERY_MODES: readonly ["vercel_sync", "runtime_fetch", "device_auth"];
+type InfisicalRuntimeDeliveryMode = (typeof INFISICAL_RUNTIME_DELIVERY_MODES)[number];
+declare const INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS: readonly ["development", "preview", "staging", "production"];
+type InfisicalVercelDestinationEnvironment = (typeof INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS)[number];
+declare const INFISICAL_VERCEL_TARGETS: readonly ["development", "preview", "production"];
+type InfisicalVercelTarget = (typeof INFISICAL_VERCEL_TARGETS)[number];
+declare const INFISICAL_CONVEX_TIERS: readonly ["preprod", "prod"];
+type InfisicalConvexTier = (typeof INFISICAL_CONVEX_TIERS)[number];
+declare const INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT: {
+    readonly development: "preprod";
+    readonly preview: "preprod";
+    readonly staging: "preprod";
+    readonly production: "prod";
+};
+type InfisicalVercelSyncDestination = {
+    readonly environment: InfisicalVercelDestinationEnvironment;
+    readonly vercelTarget: InfisicalVercelTarget;
+    readonly convexTier: InfisicalConvexTier;
+    readonly customEnvironmentSlug?: string;
+    readonly customEnvironmentIdsByProjectName?: Readonly<Record<string, string>>;
+    readonly domainsByProjectName?: Readonly<Record<string, string>>;
+};
+declare const INFISICAL_VERCEL_SYNC_RECONCILIATION: {
+    readonly sourceOfTruth: "infisical";
+    readonly writer: "vercel_api";
+    readonly disableSecretDeletion: false;
+    readonly pruneDestinationKeys: true;
+};
+declare const INFISICAL_VERCEL_SYNC_DESTINATIONS: readonly [{
+    readonly environment: "development";
+    readonly vercelTarget: "development";
+    readonly convexTier: "preprod";
+}, {
+    readonly environment: "preview";
+    readonly vercelTarget: "preview";
+    readonly convexTier: "preprod";
+}, {
+    readonly environment: "staging";
+    readonly vercelTarget: "preview";
+    readonly convexTier: "preprod";
+    readonly customEnvironmentSlug: "staging";
+    readonly customEnvironmentIdsByProjectName: {
+        readonly stackos: "env_RbS0TYRRvWISTje8qR4u2lRg7TC8";
+    };
+    readonly domainsByProjectName: {
+        readonly stackos: "staging.stack.vc";
+    };
+}, {
+    readonly environment: "production";
+    readonly vercelTarget: "production";
+    readonly convexTier: "prod";
+}];
+declare const INFISICAL_RUNTIME_SURFACE_IDS: readonly ["lucern-web", "lucern-gateway", "lucern-sdk", "lucern-cli", "lucern-mcp", "tenant-client"];
+type InfisicalRuntimeSurfaceId = (typeof INFISICAL_RUNTIME_SURFACE_IDS)[number];
+declare const INFISICAL_RUNTIME_BOOTSTRAP_ENV: {
+    readonly apiUrl: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+    readonly projectId: readonly ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"];
+    readonly clientId: readonly ["INFISICAL_CLIENT_ID", "INFISICAL_MACHINE_CLIENT_ID", "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"];
+    readonly clientSecret: readonly ["INFISICAL_CLIENT_SECRET", "INFISICAL_MACHINE_CLIENT_SECRET", "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"];
+    readonly environment: readonly ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"];
+    readonly organizationSlug: readonly ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"];
+    readonly disabled: readonly ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"];
+};
+type InfisicalRuntimeBootstrapEnv = typeof INFISICAL_RUNTIME_BOOTSTRAP_ENV;
+declare const INFISICAL_RUNTIME_CONTROL_ENV: readonly [{
+    readonly name: "NODE_ENV";
+    readonly category: "framework";
+    readonly description: "Node/Next runtime mode. Framework-owned, not written by Infisical.";
+}, {
+    readonly name: "CI";
+    readonly category: "ci";
+    readonly description: "CI execution signal. Workflow-owned, not written by Infisical.";
+}, {
+    readonly name: "VERCEL";
+    readonly category: "vercel";
+    readonly description: "Vercel runtime signal. Platform-owned, not written by Infisical.";
+}, {
+    readonly name: "VERCEL_ENV";
+    readonly category: "vercel";
+    readonly description: "Vercel environment label used for build/runtime selection.";
+}, {
+    readonly name: "VERCEL_URL";
+    readonly category: "vercel";
+    readonly description: "Vercel deployment URL supplied by Vercel for previews and builds.";
+}, {
+    readonly name: "VERCEL_GIT_COMMIT_SHA";
+    readonly category: "vercel";
+    readonly description: "Vercel git metadata used for release labels. Platform-owned, not written by Infisical.";
+}, {
+    readonly name: "NEXT_RUNTIME";
+    readonly category: "nextjs";
+    readonly description: "Next.js runtime selector for node/edge instrumentation modules.";
+}, {
+    readonly name: "PORT";
+    readonly category: "framework";
+    readonly description: "Local/server port supplied by the runtime process manager.";
+}, {
+    readonly name: "HOST";
+    readonly category: "framework";
+    readonly description: "Local/server host supplied by the runtime process manager.";
+}, {
+    readonly name: "APP_URL";
+    readonly category: "compatibility";
+    readonly description: "Legacy local app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL.";
+}, {
+    readonly name: "NEXT_PUBLIC_APP_URL";
+    readonly category: "compatibility";
+    readonly description: "Legacy public app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL.";
+}, {
+    readonly name: "CLAUDE_PROJECT_DIR";
+    readonly category: "agent_local";
+    readonly description: "Local agent workspace hint. Agent-runtime-owned, not written by Infisical.";
+}, {
+    readonly name: "HOME";
+    readonly category: "os";
+    readonly description: "Operating-system home directory used only for local credential discovery.";
+}, {
+    readonly name: "USERPROFILE";
+    readonly category: "os";
+    readonly description: "Windows home directory used only for local credential discovery.";
+}];
+type InfisicalRuntimeControlEnv = (typeof INFISICAL_RUNTIME_CONTROL_ENV)[number];
+type InfisicalRuntimeVariable = {
+    readonly name: string;
+    readonly required: boolean;
+    readonly secret: boolean;
+    readonly public: boolean;
+    readonly aliases?: readonly string[];
+    readonly description: string;
+};
+type InfisicalRuntimePathDefinition = {
+    readonly id: string;
+    readonly secretPath: string;
+    readonly description: string;
+    readonly variables: readonly InfisicalRuntimeVariable[];
+};
+declare const INFISICAL_RUNTIME_PATHS: readonly [{
+    readonly id: "platform-auth";
+    readonly secretPath: "/platform/auth";
+    readonly description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.";
+    readonly variables: readonly [{
+        readonly name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: true;
+        readonly description: "Clerk publishable key for the Lucern web origin.";
+    }, {
+        readonly name: "CLERK_SECRET_KEY";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly description: "Clerk backend secret key for Lucern server runtimes.";
+    }, {
+        readonly name: "CLERK_JWT_ISSUER_DOMAIN";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly description: "Expected Clerk issuer/JWKS domain for JWT verification.";
+    }, {
+        readonly name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: true;
+        readonly description: "Public sign-in URL for Lucern-owned web flows.";
+    }, {
+        readonly name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: true;
+        readonly description: "Public sign-up URL for Lucern-owned web flows.";
+    }];
+}, {
+    readonly id: "platform-runtime";
+    readonly secretPath: "/platform/runtime";
+    readonly description: "Runtime defaults shared by server-side Lucern clients and operator tooling.";
+    readonly variables: readonly [{
+        readonly name: "LUCERN_API_URL";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+        readonly description: "Canonical Lucern API gateway URL.";
+    }, {
+        readonly name: "LUCERN_LOGIN_BASE_URL";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_AUTH_BASE_URL"];
+        readonly description: "Browser login origin used when it differs from the API.";
+    }, {
+        readonly name: "LUCERN_ENVIRONMENT";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_ENV"];
+        readonly description: "Lucern environment label consumed by CLI profiles.";
+    }, {
+        readonly name: "LUCERN_CLI_SESSION_TTL_MS";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly description: "Optional web-issued CLI login session lifetime override in milliseconds.";
+    }];
+}, {
+    readonly id: "tenant-shared-install";
+    readonly secretPath: "tenants/shared";
+    readonly description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.";
+    readonly variables: readonly [{
+        readonly name: "INSTALL_LUCERN_NPM";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly description: "Read-only install token for the published @lucern/* suite.";
+    }];
+}];
+type InfisicalRuntimePath = (typeof INFISICAL_RUNTIME_PATHS)[number];
+type InfisicalRuntimePathId = InfisicalRuntimePath["id"];
+type InfisicalRuntimeSurfaceDefinition = {
+    readonly id: InfisicalRuntimeSurfaceId;
+    readonly packageName?: string;
+    readonly delivery: InfisicalRuntimeDeliveryMode;
+    readonly fallback?: InfisicalRuntimeDeliveryMode;
+    readonly sourcePathIds: readonly InfisicalRuntimePathId[];
+    readonly consumer: string;
+    readonly description: string;
+};
+declare const INFISICAL_RUNTIME_SURFACES: readonly [{
+    readonly id: "lucern-web";
+    readonly delivery: "vercel_sync";
+    readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+    readonly consumer: "apps/web on Vercel project lucern";
+    readonly description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs.";
+}, {
+    readonly id: "lucern-gateway";
+    readonly delivery: "vercel_sync";
+    readonly fallback: "runtime_fetch";
+    readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+    readonly consumer: "apps/gateway on Vercel project lucern-gateway";
+    readonly description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs and may self-hydrate from Infisical when the host environment has scoped bootstrap credentials.";
+}, {
+    readonly id: "lucern-sdk";
+    readonly packageName: "@lucern/sdk";
+    readonly delivery: "runtime_fetch";
+    readonly sourcePathIds: readonly ["platform-runtime"];
+    readonly consumer: "server-side SDK operator contexts with a scoped Infisical identity";
+    readonly description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.";
+}, {
+    readonly id: "lucern-cli";
+    readonly packageName: "@lucern/cli";
+    readonly delivery: "runtime_fetch";
+    readonly fallback: "device_auth";
+    readonly sourcePathIds: readonly ["platform-runtime"];
+    readonly consumer: "developer/operator CLI processes";
+    readonly description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.";
+}, {
+    readonly id: "lucern-mcp";
+    readonly packageName: "@lucern/mcp";
+    readonly delivery: "runtime_fetch";
+    readonly fallback: "device_auth";
+    readonly sourcePathIds: readonly ["platform-runtime"];
+    readonly consumer: "MCP server/client processes";
+    readonly description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.";
+}, {
+    readonly id: "tenant-client";
+    readonly delivery: "device_auth";
+    readonly sourcePathIds: readonly ["tenant-shared-install"];
+    readonly consumer: "tenant-owned apps and coding agents";
+    readonly description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces.";
+}];
+type InfisicalRuntimeSurface = (typeof INFISICAL_RUNTIME_SURFACES)[number];
+type InfisicalTenantSoftwareSystemDefinition = {
+    readonly id: string;
+    readonly tenantKey: string;
+    readonly workspaceKey: string;
+    readonly vercelProjectName: string;
+    readonly vercelTeamId: string;
+    readonly vercelProjectId: string;
+    readonly repository: {
+        readonly owner: string;
+        readonly name: string;
+    };
+    readonly sharedSourcePath: string;
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: string;
+        readonly deployKeyEnv: string;
+        readonly preprodDeployment: string;
+        readonly prodDeployment: string;
+    };
+};
+declare const INFISICAL_TENANT_SOFTWARE_SYSTEMS: readonly [{
+    readonly id: "stack-frontend";
+    readonly tenantKey: "stack";
+    readonly workspaceKey: "frontend";
+    readonly vercelProjectName: "ai-chatbot-diao";
+    readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+    readonly vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517";
+    readonly repository: {
+        readonly owner: "stack-vc";
+        readonly name: "front-end";
+    };
+    readonly sharedSourcePath: "/tenants/stack";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_FRONTEND_URL";
+        readonly deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY";
+        readonly preprodDeployment: "rugged-lobster-664";
+        readonly prodDeployment: "wonderful-toucan-0";
+    };
+}, {
+    readonly id: "stackos";
+    readonly tenantKey: "stack";
+    readonly workspaceKey: "stackos";
+    readonly vercelProjectName: "stackos";
+    readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+    readonly vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau";
+    readonly repository: {
+        readonly owner: "stack-vc";
+        readonly name: "stackos";
+    };
+    readonly sharedSourcePath: "/tenants/stack";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_STACKOS_URL";
+        readonly deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY";
+        readonly preprodDeployment: "giant-mandrill-761";
+        readonly prodDeployment: "good-snake-515";
+    };
+}, {
+    readonly id: "stack-eng";
+    readonly tenantKey: "stack";
+    readonly workspaceKey: "engineering";
+    readonly vercelProjectName: "stackos-engineering-graph";
+    readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+    readonly vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ";
+    readonly repository: {
+        readonly owner: "stack-vc";
+        readonly name: "stackos-engineering-graph";
+    };
+    readonly sharedSourcePath: "/tenants/stack/engineering";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_STACK_ENG_URL";
+        readonly deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY";
+        readonly preprodDeployment: "small-oyster-270";
+        readonly prodDeployment: "bold-cuttlefish-804";
+    };
+}, {
+    readonly id: "lucern-graph";
+    readonly tenantKey: "lucern";
+    readonly workspaceKey: "lucern";
+    readonly vercelProjectName: "lucern-graph";
+    readonly vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY";
+    readonly vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ";
+    readonly repository: {
+        readonly owner: "LucernAI";
+        readonly name: "lucern-graph";
+    };
+    readonly sharedSourcePath: "/tenants/lucern/shared";
+    readonly sharedVariablePolicy: "tenant_shared_all_systems";
+    readonly convex: {
+        readonly urlEnv: "CONVEX_LUCERN_URL";
+        readonly deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY";
+        readonly preprodDeployment: "good-blackbird-774";
+        readonly prodDeployment: "precious-dog-365";
+    };
+}];
+type InfisicalTenantSoftwareSystem = (typeof INFISICAL_TENANT_SOFTWARE_SYSTEMS)[number];
+type InfisicalTenantSoftwareSystemId = InfisicalTenantSoftwareSystem["id"];
+declare function findInfisicalTenantSoftwareSystem(systemId: InfisicalTenantSoftwareSystemId): InfisicalTenantSoftwareSystem | undefined;
+declare function tenantSoftwareSystemConvexEnvNames(systemId: InfisicalTenantSoftwareSystemId): readonly [string, string];
+declare function tenantSoftwareSystemOwnsConvexEnvName(systemId: InfisicalTenantSoftwareSystemId, envName: string): boolean;
+declare function convexTierForVercelDestinationEnvironment(environment: InfisicalVercelDestinationEnvironment): InfisicalConvexTier;
+declare function findInfisicalVercelSyncDestination(environment: InfisicalVercelDestinationEnvironment): InfisicalVercelSyncDestination | undefined;
+declare function vercelCustomEnvironmentIdForTenantSoftwareSystem(systemId: InfisicalTenantSoftwareSystemId, environment: InfisicalVercelDestinationEnvironment): string | undefined;
+declare function expectedTenantConvexDeploymentForVercelEnvironment(systemId: InfisicalTenantSoftwareSystemId, environment: InfisicalVercelDestinationEnvironment): string;
+declare function findInfisicalRuntimePath(pathId: InfisicalRuntimePathId): InfisicalRuntimePath | undefined;
+declare function findInfisicalRuntimeSurface(surfaceId: InfisicalRuntimeSurfaceId): InfisicalRuntimeSurface | undefined;
+declare const INFISICAL_SECRET_OWNERS: readonly ["lucern_platform", "tenant", "provider", "operator_local"];
+type InfisicalSecretOwner = (typeof INFISICAL_SECRET_OWNERS)[number];
+declare const INFISICAL_SECRET_SCOPES: readonly ["global", "environment", "tenant", "workspace", "software_system", "deployment", "local"];
+type InfisicalSecretScope = (typeof INFISICAL_SECRET_SCOPES)[number];
+declare const INFISICAL_SECRET_ENVIRONMENT_POLICIES: readonly ["same_all_environments", "environment_specific", "preprod_staging_prod_prod", "local_only"];
+type InfisicalSecretEnvironmentPolicy = (typeof INFISICAL_SECRET_ENVIRONMENT_POLICIES)[number];
+declare const INFISICAL_SECRET_CONSUMERS: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli", "lucern-ai-runtime", "lucern-graph-sync", "lucern-observability", "lucern-repo-ci", "mc-convex", "mc-operator-tooling", "tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime", "tenant-graph-sync", "tenant-observability", "tenant-vector-store", "tenant-deploy-tooling", "tenant-agent-runtime"];
+type InfisicalSecretConsumer = (typeof INFISICAL_SECRET_CONSUMERS)[number];
+declare const INFISICAL_SECRET_DESTINATION_KINDS: readonly ["vercel", "convex", "github_actions", "runtime_fetch", "operator_local"];
+type InfisicalSecretDestinationKind = (typeof INFISICAL_SECRET_DESTINATION_KINDS)[number];
+type InfisicalSecretDestination = {
+    readonly kind: InfisicalSecretDestinationKind;
+    readonly target: string;
+    readonly environmentPolicy: InfisicalSecretEnvironmentPolicy;
+    readonly writeNames?: readonly string[];
+    readonly notes?: string;
+};
+type InfisicalSecretDefinition = {
+    readonly id: string;
+    readonly canonicalName: string;
+    readonly aliases?: readonly string[];
+    readonly owner: InfisicalSecretOwner;
+    readonly scope: InfisicalSecretScope;
+    readonly sourcePath: string;
+    readonly environmentPolicy: InfisicalSecretEnvironmentPolicy;
+    readonly required: boolean;
+    readonly secret: boolean;
+    readonly public: boolean;
+    readonly consumers: readonly InfisicalSecretConsumer[];
+    readonly destinations: readonly InfisicalSecretDestination[];
+    readonly description: string;
+};
+declare const INFISICAL_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.clerk.publishable";
+    readonly canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+    readonly aliases: readonly ["CLERK_PUBLISHABLE_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: true;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Clerk browser key for platform web, gateway, and hosted MCP OAuth flows.";
+}, {
+    readonly id: "platform.clerk.secret";
+    readonly canonicalName: "CLERK_SECRET_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Clerk backend secret. Never route to tenant-owned apps unless that tenant is Lucern itself.";
+}, {
+    readonly id: "platform.clerk.project";
+    readonly canonicalName: "CLERK_PROJECT_ID";
+    readonly aliases: readonly ["LUCERN_CLERK_PROJECT_ID"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "mc-convex"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities.";
+}, {
+    readonly id: "platform.clerk.jwks";
+    readonly canonicalName: "CLERK_JWKS_URL";
+    readonly aliases: readonly ["CLERK_JWT_ISSUER_DOMAIN"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-mcp";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Clerk JWKS/issuer override for server-side token verification.";
+}, {
+    readonly id: "platform.runtime.api-base-url";
+    readonly canonicalName: "LUCERN_API_URL";
+    readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Canonical Lucern API gateway base URL. Older names remain aliases only.";
+}, {
+    readonly id: "platform.runtime.login-base-url";
+    readonly canonicalName: "LUCERN_LOGIN_BASE_URL";
+    readonly aliases: readonly ["LUCERN_AUTH_BASE_URL", "LUCERN_WEB_BASE_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "lucern-mcp", "lucern-cli"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Browser login origin used when device/OAuth login is not served by the API base URL.";
+}, {
+    readonly id: "platform.runtime.environment";
+    readonly canonicalName: "LUCERN_ENVIRONMENT";
+    readonly aliases: readonly ["LUCERN_ENV"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern runtime environment label.";
+}, {
+    readonly id: "platform.runtime.require-deployment-host-registry";
+    readonly canonicalName: "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Fail-closed gateway toggle that requires MC deployment host registry resolution before routing.";
+}, {
+    readonly id: "platform.mc.convex-url";
+    readonly canonicalName: "CONVEX_MC_URL";
+    readonly aliases: readonly ["CONVEX_MC_PROD_URL", "LUCERN_ADMIN_CONVEX_URL", "LUCERN_CONVEX_URL", "MC_CONVEX_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Master Control Convex URL. Prod must point to successful-clam-833; dev/staging to utmost-ox-403.";
+}, {
+    readonly id: "platform.mc.convex-deploy-key";
+    readonly canonicalName: "CONVEX_MC_DEPLOY_KEY";
+    readonly aliases: readonly ["CONVEX_MC_PROD_DEPLOY_KEY", "LUCERN_ADMIN_DEPLOY_KEY", "LUCERN_DEPLOY_KEY", "MC_DEPLOY_KEY", "MC_PROD_DEPLOY_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Master Control deploy/admin key. Never route to tenant Vercel projects or tenant Convex deployments.";
+}, {
+    readonly id: "platform.mc.session-token-secret";
+    readonly canonicalName: "LUCERN_SESSION_TOKEN_SECRET";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "mc-convex", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Signs Lucern platform session/delegation tokens. This is platform-owned, not tenant-owned.";
+}, {
+    readonly id: "platform.mc.tenant-secret-encryption-key";
+    readonly canonicalName: "LUCERN_TENANT_SECRET_ENCRYPTION_KEY";
+    readonly aliases: readonly ["LUCERN_SESSION_TOKEN_SECRET"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "mc-credential-maintenance";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Encrypts tenant deployment credentials stored in MC. Session-token fallback is legacy only.";
+}, {
+    readonly id: "platform.permit.api-key";
+    readonly canonicalName: "LUCERN_PERMIT_API_KEY";
+    readonly aliases: readonly ["PERMIT_API_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing.";
+}, {
+    readonly id: "platform.permit.pdp-url";
+    readonly canonicalName: "LUCERN_PERMIT_PDP_URL";
+    readonly aliases: readonly ["PERMIT_PDP_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Permit PDP URL override.";
+}, {
+    readonly id: "platform.permit.api-url";
+    readonly canonicalName: "LUCERN_PERMIT_API_URL";
+    readonly aliases: readonly ["PERMIT_API_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Permit API URL override.";
+}, {
+    readonly id: "platform.ci.infisical-bootstrap-client-id";
+    readonly canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_ID";
+    readonly aliases: readonly ["INFISICAL_CI_CLIENT_ID"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ci";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Machine identity client id used by CI to reconcile Infisical desired state.";
+}, {
+    readonly id: "platform.ci.infisical-bootstrap-client-secret";
+    readonly canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_SECRET";
+    readonly aliases: readonly ["INFISICAL_CI_CLIENT_SECRET"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ci";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Machine identity client secret used by CI to reconcile Infisical desired state.";
+}, {
+    readonly id: "platform.publish.npm-token";
+    readonly canonicalName: "NPM_TOKEN";
+    readonly aliases: readonly ["NODE_AUTH_TOKEN"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/publish";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Package publish/install token for @lucern/* release automation.";
+}, {
+    readonly id: "platform.ai.openai-api-key";
+    readonly canonicalName: "OPENAI_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ai";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation.";
+}, {
+    readonly id: "platform.ai.anthropic-api-key";
+    readonly canonicalName: "ANTHROPIC_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ai";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Anthropic key for platform AI jobs, benchmarks, and controlled operator automation.";
+}, {
+    readonly id: "platform.ai.gemini-api-key";
+    readonly canonicalName: "GEMINI_API_KEY";
+    readonly aliases: readonly ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ai";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Google/Gemini key. Google alias names are read compatibility only.";
+}, {
+    readonly id: "platform.langfuse.secret-key";
+    readonly canonicalName: "LANGFUSE_SECRET_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/langfuse";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing.";
+}, {
+    readonly id: "platform.langfuse.public-key";
+    readonly canonicalName: "LANGFUSE_PUBLIC_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/langfuse";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY.";
+}, {
+    readonly id: "platform.langfuse.base-url";
+    readonly canonicalName: "LANGFUSE_BASE_URL";
+    readonly aliases: readonly ["LANGFUSE_BASEURL", "LANGFUSE_HOST"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/langfuse";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases.";
+}, {
+    readonly id: "platform.neo4j.uri";
+    readonly canonicalName: "NEO4J_URI";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Neo4j URI for platform graph-sync surfaces.";
+}, {
+    readonly id: "platform.neo4j.user";
+    readonly canonicalName: "NEO4J_USER";
+    readonly aliases: readonly ["NEO4J_USERNAME"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Neo4j username for platform graph-sync surfaces.";
+}, {
+    readonly id: "platform.neo4j.password";
+    readonly canonicalName: "NEO4J_PASSWORD";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Neo4j password for platform graph-sync surfaces.";
+}, {
+    readonly id: "platform.neo4j.sync-secret";
+    readonly canonicalName: "NEO4J_SYNC_SECRET";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls.";
+}, {
+    readonly id: "platform.neo4j.database";
+    readonly canonicalName: "NEO4J_DATABASE";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces.";
+}, {
+    readonly id: "platform.pinecone.api-key";
+    readonly canonicalName: "PINECONE_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/vector/pinecone";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Pinecone API key for platform vector search.";
+}, {
+    readonly id: "platform.pinecone.index-name";
+    readonly canonicalName: "PINECONE_INDEX_NAME";
+    readonly aliases: readonly ["PINECONE_INDEX"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/vector/pinecone";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Pinecone index name.";
+}, {
+    readonly id: "platform.pinecone.host";
+    readonly canonicalName: "PINECONE_HOST";
+    readonly aliases: readonly ["PINECONE_INDEX_HOST"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/vector/pinecone";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Pinecone host/index host.";
+}, {
+    readonly id: "platform.sentry.dsn";
+    readonly canonicalName: "NEXT_PUBLIC_SENTRY_DSN";
+    readonly aliases: readonly ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN_NEXTJS"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: true;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Sentry DSN for browser/server error telemetry.";
+}, {
+    readonly id: "platform.sentry.auth-token";
+    readonly canonicalName: "SENTRY_AUTH_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Sentry release-upload token. Runtime services must not use it for authorization.";
+}, {
+    readonly id: "platform.sentry.org";
+    readonly canonicalName: "SENTRY_ORG";
+    readonly aliases: readonly ["SENTRY_ORG_SLUG"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Sentry organization slug for Lucern release uploads.";
+}, {
+    readonly id: "platform.sentry.project";
+    readonly canonicalName: "SENTRY_PROJECT";
+    readonly aliases: readonly ["SENTRY_PROJECT_NEXTJS"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Sentry project slug for Lucern release uploads.";
+}, {
+    readonly id: "platform.sentry.environment";
+    readonly canonicalName: "SENTRY_ENVIRONMENT";
+    readonly aliases: readonly ["NEXT_PUBLIC_SENTRY_ENVIRONMENT"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+        readonly writeNames: readonly ["SENTRY_ENVIRONMENT", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"];
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Sentry environment label.";
+}, {
+    readonly id: "platform.sentry.release";
+    readonly canonicalName: "SENTRY_RELEASE";
+    readonly aliases: readonly ["NEXT_PUBLIC_SENTRY_RELEASE"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+        readonly writeNames: readonly ["SENTRY_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"];
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Sentry release name.";
+}, {
+    readonly id: "platform.deploy.vercel-token";
+    readonly canonicalName: "VERCEL_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps.";
+}, {
+    readonly id: "platform.deploy.vercel-org-id";
+    readonly canonicalName: "VERCEL_ORG_ID";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Vercel team/org id used by deployment and sync automation.";
+}, {
+    readonly id: "platform.docs.gap-audit-api-key";
+    readonly canonicalName: "DOC_GAP_AUDIT_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional model key for docs gap audits.";
+}, {
+    readonly id: "platform.docs.gap-audit-provider";
+    readonly canonicalName: "DOC_GAP_AUDIT_PROVIDER";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional docs gap audit provider selector.";
+}, {
+    readonly id: "platform.docs.gap-audit-model";
+    readonly canonicalName: "DOC_GAP_AUDIT_MODEL";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional docs gap audit model selector.";
+}, {
+    readonly id: "platform.infisical.local-cli";
+    readonly canonicalName: "INFISICAL_BIN";
+    readonly aliases: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/infisical";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Operator-only Infisical CLI/API location knobs. Machine credentials are handled by the bootstrap contract.";
+}, {
+    readonly id: "platform.gateway.device-verification-base-url";
+    readonly canonicalName: "LUCERN_DEVICE_VERIFICATION_BASE_URL";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Base URL shown during Lucern CLI/device authentication.";
+}, {
+    readonly id: "platform.gateway.mode";
+    readonly canonicalName: "LUCERN_GATEWAY_MODE";
+    readonly aliases: readonly ["LUCERN_GATEWAY_ENV"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Gateway runtime mode/environment label.";
+}, {
+    readonly id: "platform.mcp.runtime";
+    readonly canonicalName: "LUCERN_MCP_URL";
+    readonly aliases: readonly ["LUCERN_AGENT_IDENTITY", "LUCERN_HTTP_HOST", "LUCERN_HTTP_PORT", "LUCERN_MCP_ALLOW_API_KEY_PASSTHROUGH", "LUCERN_MCP_DEBUG", "LUCERN_MCP_DIAGNOSTICS_FILE", "LUCERN_MCP_HEALTH_PATH", "LUCERN_MCP_HEALTH_URL", "LUCERN_MCP_HOST", "LUCERN_MCP_PATH", "LUCERN_MCP_PORT", "LUCERN_MCP_QUIET", "LUCERN_MCP_TRANSPORT", "LUCERN_PROFILE", "LUCERN_PUBLIC_URL", "MCP_SERVER_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern MCP/CLI runtime knobs. Aliases are compatibility names and not Vercel write names.";
+}, {
+    readonly id: "platform.mcp.auth-token";
+    readonly canonicalName: "LUCERN_MCP_SERVER_AUTH_TOKEN";
+    readonly aliases: readonly ["LUCERN_USER_TOKEN", "MCP_SERVER_TOKEN"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead.";
+}, {
+    readonly id: "platform.graph-sync.proxy";
+    readonly canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL";
+    readonly aliases: readonly ["LUCERN_DEFAULT_TENANT_ID", "LUCERN_GRAPH_SYNC_ALLOWED_PROXY_HOSTS"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Graph-sync proxy URL, tenant filter, and allowed host list.";
+}, {
+    readonly id: "platform.package-smoke.local";
+    readonly canonicalName: "LUCERN_SDK_NPM_TOKEN";
+    readonly aliases: readonly ["LUCERN_KERNEL_INSTALL_SPEC", "LUCERN_KERNEL_KEEP_CLEANROOM", "LUCERN_KERNEL_LOCAL_TARBALL", "LUCERN_KERNEL_NPM_TOKEN", "LUCERN_KERNEL_SCOPE_REGISTRY", "LUCERN_KERNEL_SKIP_CONVEX", "LUCERN_SDK_INSTALL_SPEC", "LUCERN_SDK_KEEP_CLEANROOM", "LUCERN_SDK_LOCAL_TARBALL", "LUCERN_SDK_SCOPE_REGISTRY", "LUCERN_SDK_SKIP_LIVE"];
+    readonly owner: "lucern_platform";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/package-publish";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Private package install smoke-test knobs. Values are not tenant runtime variables.";
+}, {
+    readonly id: "platform.convex-deploy.local-names";
+    readonly canonicalName: "LUCERN_CONVEX_DEPLOYMENT_NAME";
+    readonly aliases: readonly ["CONVEX_DEPLOYMENT", "CONVEX_DEV_DEPLOYMENT_NAME", "CONVEX_PROD_DEPLOYMENT_NAME"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/deploy/convex";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Operator-only Convex deployment name hints. Deploy keys and URLs remain separately scoped.";
+}, {
+    readonly id: "platform.sdk.local-context";
+    readonly canonicalName: "LUCERN_TENANT_ID";
+    readonly aliases: readonly ["LUCERN_AGENT_DISPLAY_NAME", "LUCERN_AGENT_ID", "LUCERN_API_ENVIRONMENT", "LUCERN_PACK_KEY", "LUCERN_PROJECT_ID", "LUCERN_TOPIC_ID", "LUCERN_WORKSPACE_ID", "LUCERN_WORKTREE_ID"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-cli", "lucern-mcp", "tenant-agent-runtime"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves.";
+}, {
+    readonly id: "platform.debug.local-flags";
+    readonly canonicalName: "LUCERN_FUNCTIONAL_DEBUG";
+    readonly aliases: readonly ["LUCERN_CONTRACTS_SKIP_DTS", "LUCERN_DEPLOY_RECONCILIATION_DEBUG", "LUCERN_ENABLE_ADAPTIVE_LEARNING", "LUCERN_ENV_FILE", "LUCERN_EXAMPLE_DEBUG", "LUCERN_HTTP_SMOKE_DEBUG", "LUCERN_MULTI_TENANT", "LUCERN_PACK_ACTION_DEBUG", "LUCERN_RUN_LIVE_MCP"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime/debug";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Local or CI debug toggles. They are manifest-known but not tenant runtime secrets.";
+}, {
+    readonly id: "tenant.stackos.deploy-guard.local";
+    readonly canonicalName: "STACKOS_DEPLOY_TARGET";
+    readonly aliases: readonly ["STACKOS_DEPLOY_ENTRYPOINT", "STACKOS_EXPECTED_STAGING_COMMIT", "STACKOS_PROD_CUTOVER_APPROVED", "STACKOS_REPO_PATH", "STACKOS_REQUIRE_CHAT_RUNTIME", "STACKOS_SLOP_SCAN_BASELINE", "STACKOS_STAGING_API_KEY", "STACKOS_STAGING_BASE_URL", "STACK_DEPLOY_RECONCILIATION_SCHEMA_JSON"];
+    readonly owner: "tenant";
+    readonly scope: "software_system";
+    readonly sourcePath: "/tenants/stack";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-deploy-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "stackos-deploy-guard";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "StackOS deploy/test guard variables. These are not written into the StackOS Vercel runtime.";
+}, ...(InfisicalSecretDefinition | {
+    readonly id: "tenant.stack-eng.neo4j.uri";
+    readonly canonicalName: "NEO4J_URI";
+    readonly aliases: readonly ["NEO4J_ENG_URI"];
+    readonly owner: "tenant";
+    readonly scope: "workspace";
+    readonly sourcePath: "/tenants/stack/engineering";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "small-oyster-270|bold-cuttlefish-804";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }];
+    readonly description: "Stack engineering graph Neo4j runtime URI. NEO4J_ENG_URI is the source alias used to avoid StackOS front-office collisions.";
+} | {
+    readonly id: "tenant.stack-eng.neo4j.user";
+    readonly canonicalName: "NEO4J_USER";
+    readonly aliases: readonly ["NEO4J_ENG_USER"];
+    readonly owner: "tenant";
+    readonly scope: "workspace";
+    readonly sourcePath: "/tenants/stack/engineering";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "small-oyster-270|bold-cuttlefish-804";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }];
+    readonly description: "Stack engineering graph Neo4j runtime user.";
+} | {
+    readonly id: "tenant.stack-eng.neo4j.password";
+    readonly canonicalName: "NEO4J_PASSWORD";
+    readonly aliases: readonly ["NEO4J_ENG_PASSWORD"];
+    readonly owner: "tenant";
+    readonly scope: "workspace";
+    readonly sourcePath: "/tenants/stack/engineering";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "small-oyster-270|bold-cuttlefish-804";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }];
+    readonly description: "Stack engineering graph Neo4j runtime password.";
+} | {
+    readonly id: "tenant.stack-eng.neo4j.sync-secret";
+    readonly canonicalName: "NEO4J_SYNC_SECRET";
+    readonly owner: "tenant";
+    readonly scope: "workspace";
+    readonly sourcePath: "/tenants/stack/engineering";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "small-oyster-270|bold-cuttlefish-804";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos-engineering-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }];
+    readonly description: "Stack engineering graph sync secret for Convex-to-HTTP graph query/sync calls.";
+} | {
+    readonly id: "tenant.stackos.convex.url" | "tenant.stack-frontend.convex.url" | "tenant.stack-eng.convex.url" | "tenant.lucern-graph.convex.url";
+    readonly canonicalName: "CONVEX_FRONTEND_URL" | "CONVEX_STACKOS_URL" | "CONVEX_STACK_ENG_URL" | "CONVEX_LUCERN_URL";
+    readonly aliases: readonly string[] | undefined;
+    readonly owner: "tenant";
+    readonly scope: "software_system";
+    readonly sourcePath: "/tenants/stack" | "/tenants/stack/engineering" | "/tenants/lucern/shared";
+    readonly environmentPolicy: "preprod_staging_prod_prod";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-vercel-app", "tenant-agent-runtime", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "stackos" | "ai-chatbot-diao" | "stackos-engineering-graph" | "lucern-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+        readonly writeNames: readonly string[];
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos" | "stack-vc/stackos-engineering-graph" | "stack-vc/front-end" | "stack-vc/lucern-graph" | "LucernAI/stackos" | "LucernAI/front-end" | "LucernAI/stackos-engineering-graph" | "LucernAI/lucern-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+        readonly writeNames: readonly string[];
+        readonly notes: "Only if that repository deploy/test workflow owns this software system.";
+    }];
+    readonly description: "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365.";
+} | {
+    readonly id: "tenant.stackos.convex.deploy-key" | "tenant.stack-frontend.convex.deploy-key" | "tenant.stack-eng.convex.deploy-key" | "tenant.lucern-graph.convex.deploy-key";
+    readonly canonicalName: "CONVEX_FRONTEND_DEPLOY_KEY" | "CONVEX_STACKOS_DEPLOY_KEY" | "CONVEX_STACK_ENG_DEPLOY_KEY" | "CONVEX_LUCERN_DEPLOY_KEY";
+    readonly aliases: readonly string[] | undefined;
+    readonly owner: "tenant";
+    readonly scope: "software_system";
+    readonly sourcePath: "/tenants/stack" | "/tenants/stack/engineering" | "/tenants/lucern/shared";
+    readonly environmentPolicy: "preprod_staging_prod_prod";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-vercel-app", "tenant-agent-runtime", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "stackos" | "ai-chatbot-diao" | "stackos-engineering-graph" | "lucern-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos" | "stack-vc/stackos-engineering-graph" | "stack-vc/front-end" | "stack-vc/lucern-graph" | "LucernAI/stackos" | "LucernAI/front-end" | "LucernAI/stackos-engineering-graph" | "LucernAI/lucern-graph";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+        readonly writeNames: readonly string[];
+        readonly notes: "Only if that repository deploy/test workflow owns this software system.";
+    }];
+    readonly description: "stack/stackos Convex deploy/admin key. Never route to sibling workspaces." | "stack/frontend Convex deploy/admin key. Never route to sibling workspaces." | "stack/engineering Convex deploy/admin key. Never route to sibling workspaces." | "stack/lucern Convex deploy/admin key. Never route to sibling workspaces." | "lucern/stackos Convex deploy/admin key. Never route to sibling workspaces." | "lucern/frontend Convex deploy/admin key. Never route to sibling workspaces." | "lucern/engineering Convex deploy/admin key. Never route to sibling workspaces." | "lucern/lucern Convex deploy/admin key. Never route to sibling workspaces.";
+})[]];
+type InfisicalSecretId = (typeof INFISICAL_SECRET_DEFINITIONS)[number]["id"];
+declare function findInfisicalSecretDefinition(secretId: InfisicalSecretId): InfisicalSecretDefinition | undefined;
+declare function infisicalSecretDefinitionsForConsumer(consumer: InfisicalSecretConsumer): readonly InfisicalSecretDefinition[];
+declare function infisicalSecretDefinitionsForDestination(kind: InfisicalSecretDestinationKind, target: string): readonly InfisicalSecretDefinition[];
+declare function validateInfisicalSecretDefinitions(definitions?: readonly InfisicalSecretDefinition[]): readonly string[];
+
+export { INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DEFINITIONS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, type InfisicalConvexTier, type InfisicalRuntimeBootstrapEnv, type InfisicalRuntimeControlEnv, type InfisicalRuntimeDeliveryMode, type InfisicalRuntimeEnvironment, type InfisicalRuntimePath, type InfisicalRuntimePathDefinition, type InfisicalRuntimePathId, type InfisicalRuntimeSurface, type InfisicalRuntimeSurfaceDefinition, type InfisicalRuntimeSurfaceId, type InfisicalRuntimeVariable, type InfisicalSecretConsumer, type InfisicalSecretDefinition, type InfisicalSecretDestination, type InfisicalSecretDestinationKind, type InfisicalSecretEnvironmentPolicy, type InfisicalSecretId, type InfisicalSecretOwner, type InfisicalSecretScope, type InfisicalTenantSoftwareSystem, type InfisicalTenantSoftwareSystemDefinition, type InfisicalTenantSoftwareSystemId, type InfisicalVercelDestinationEnvironment, type InfisicalVercelSyncDestination, type InfisicalVercelTarget, convexTierForVercelDestinationEnvironment, expectedTenantConvexDeploymentForVercelEnvironment, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalSecretDefinition, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, infisicalSecretDefinitionsForConsumer, infisicalSecretDefinitionsForDestination, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, validateInfisicalSecretDefinitions, vercelCustomEnvironmentIdForTenantSoftwareSystem };