@lucern/contracts 0.3.0-alpha.1 → 0.3.0-alpha.11

package/dist/manifests/infisical-runtime-manifest.d.ts

@@ -0,0 +1,1672 @@
+import { InfisicalSecretDefinition, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, InfisicalRuntimeEnvironment, InfisicalRuntimeDeliveryMode, InfisicalRuntimeBootstrapEnv, InfisicalRuntimeControlEnv, InfisicalRuntimePath, InfisicalRuntimeSurface, InfisicalVercelDestinationEnvironment, InfisicalConvexTier, INFISICAL_VERCEL_SYNC_RECONCILIATION, InfisicalVercelSyncDestination, InfisicalTenantSoftwareSystem } from '../infisical-runtime.contract.js';
+
+type InfisicalRuntimeManifest = {
+    readonly manifestVersion: "1.0.0";
+    readonly contractVersion: typeof INFISICAL_RUNTIME_CONTRACT_VERSION;
+    readonly project: {
+        readonly id: typeof INFISICAL_RUNTIME_DEFAULT_PROJECT_ID;
+        readonly apiUrl: typeof INFISICAL_RUNTIME_DEFAULT_API_URL;
+    };
+    readonly environments: readonly InfisicalRuntimeEnvironment[];
+    readonly deliveryModes: readonly InfisicalRuntimeDeliveryMode[];
+    readonly bootstrapEnv: InfisicalRuntimeBootstrapEnv;
+    readonly controlEnv: readonly InfisicalRuntimeControlEnv[];
+    readonly paths: readonly InfisicalRuntimePath[];
+    readonly surfaces: readonly InfisicalRuntimeSurface[];
+    readonly secretDefinitions: readonly InfisicalSecretDefinition[];
+    readonly vercelDestinationEnvironments: readonly InfisicalVercelDestinationEnvironment[];
+    readonly convexTierByVercelEnvironment: Record<InfisicalVercelDestinationEnvironment, InfisicalConvexTier>;
+    readonly vercelSyncReconciliation: typeof INFISICAL_VERCEL_SYNC_RECONCILIATION;
+    readonly vercelSyncDestinations: readonly InfisicalVercelSyncDestination[];
+    readonly tenantSoftwareSystems: readonly InfisicalTenantSoftwareSystem[];
+};
+declare const INFISICAL_RUNTIME_MANIFEST: {
+    readonly manifestVersion: "1.0.0";
+    readonly contractVersion: "2026-05-06";
+    readonly project: {
+        readonly id: "344b0526-90df-4606-ba50-22c647a36c65";
+        readonly apiUrl: "https://app.infisical.com";
+    };
+    readonly environments: readonly ["dev", "staging", "prod"];
+    readonly deliveryModes: readonly ["vercel_sync", "runtime_fetch", "device_auth"];
+    readonly bootstrapEnv: {
+        readonly apiUrl: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+        readonly projectId: readonly ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"];
+        readonly clientId: readonly ["INFISICAL_CLIENT_ID", "INFISICAL_MACHINE_CLIENT_ID", "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"];
+        readonly clientSecret: readonly ["INFISICAL_CLIENT_SECRET", "INFISICAL_MACHINE_CLIENT_SECRET", "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"];
+        readonly environment: readonly ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"];
+        readonly organizationSlug: readonly ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"];
+        readonly disabled: readonly ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"];
+    };
+    readonly controlEnv: readonly [{
+        readonly name: "NODE_ENV";
+        readonly category: "framework";
+        readonly description: "Node/Next runtime mode. Framework-owned, not written by Infisical.";
+    }, {
+        readonly name: "CI";
+        readonly category: "ci";
+        readonly description: "CI execution signal. Workflow-owned, not written by Infisical.";
+    }, {
+        readonly name: "VERCEL";
+        readonly category: "vercel";
+        readonly description: "Vercel runtime signal. Platform-owned, not written by Infisical.";
+    }, {
+        readonly name: "VERCEL_ENV";
+        readonly category: "vercel";
+        readonly description: "Vercel environment label used for build/runtime selection.";
+    }, {
+        readonly name: "VERCEL_URL";
+        readonly category: "vercel";
+        readonly description: "Vercel deployment URL supplied by Vercel for previews and builds.";
+    }, {
+        readonly name: "VERCEL_GIT_COMMIT_SHA";
+        readonly category: "vercel";
+        readonly description: "Vercel git metadata used for release labels. Platform-owned, not written by Infisical.";
+    }, {
+        readonly name: "NEXT_RUNTIME";
+        readonly category: "nextjs";
+        readonly description: "Next.js runtime selector for node/edge instrumentation modules.";
+    }, {
+        readonly name: "PORT";
+        readonly category: "framework";
+        readonly description: "Local/server port supplied by the runtime process manager.";
+    }, {
+        readonly name: "HOST";
+        readonly category: "framework";
+        readonly description: "Local/server host supplied by the runtime process manager.";
+    }, {
+        readonly name: "APP_URL";
+        readonly category: "compatibility";
+        readonly description: "Legacy local app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL.";
+    }, {
+        readonly name: "NEXT_PUBLIC_APP_URL";
+        readonly category: "compatibility";
+        readonly description: "Legacy public app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL.";
+    }, {
+        readonly name: "CLAUDE_PROJECT_DIR";
+        readonly category: "agent_local";
+        readonly description: "Local agent workspace hint. Agent-runtime-owned, not written by Infisical.";
+    }, {
+        readonly name: "HOME";
+        readonly category: "os";
+        readonly description: "Operating-system home directory used only for local credential discovery.";
+    }, {
+        readonly name: "USERPROFILE";
+        readonly category: "os";
+        readonly description: "Windows home directory used only for local credential discovery.";
+    }];
+    readonly paths: readonly [{
+        readonly id: "platform-auth";
+        readonly secretPath: "/platform/auth";
+        readonly description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.";
+        readonly variables: readonly [{
+            readonly name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+            readonly required: true;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Clerk publishable key for the Lucern web origin.";
+        }, {
+            readonly name: "CLERK_SECRET_KEY";
+            readonly required: true;
+            readonly secret: true;
+            readonly public: false;
+            readonly description: "Clerk backend secret key for Lucern server runtimes.";
+        }, {
+            readonly name: "CLERK_JWT_ISSUER_DOMAIN";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly description: "Expected Clerk issuer/JWKS domain for JWT verification.";
+        }, {
+            readonly name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Public sign-in URL for Lucern-owned web flows.";
+        }, {
+            readonly name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: true;
+            readonly description: "Public sign-up URL for Lucern-owned web flows.";
+        }];
+    }, {
+        readonly id: "platform-runtime";
+        readonly secretPath: "/platform/runtime";
+        readonly description: "Runtime defaults shared by server-side Lucern clients and operator tooling.";
+        readonly variables: readonly [{
+            readonly name: "LUCERN_API_URL";
+            readonly required: true;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+            readonly description: "Canonical Lucern API gateway URL.";
+        }, {
+            readonly name: "LUCERN_LOGIN_BASE_URL";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_AUTH_BASE_URL"];
+            readonly description: "Browser login origin used when it differs from the API.";
+        }, {
+            readonly name: "LUCERN_ENVIRONMENT";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_ENV"];
+            readonly description: "Lucern environment label consumed by CLI profiles.";
+        }, {
+            readonly name: "LUCERN_CLI_SESSION_TTL_MS";
+            readonly required: false;
+            readonly secret: false;
+            readonly public: false;
+            readonly description: "Optional web-issued CLI login session lifetime override in milliseconds.";
+        }];
+    }, {
+        readonly id: "tenant-shared-install";
+        readonly secretPath: "tenants/shared";
+        readonly description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.";
+        readonly variables: readonly [{
+            readonly name: "INSTALL_LUCERN_NPM";
+            readonly required: true;
+            readonly secret: true;
+            readonly public: false;
+            readonly description: "Read-only install token for the published @lucern/* suite.";
+        }];
+    }];
+    readonly surfaces: readonly [{
+        readonly id: "lucern-web";
+        readonly delivery: "vercel_sync";
+        readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+        readonly consumer: "apps/web on Vercel project lucern";
+        readonly description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs.";
+    }, {
+        readonly id: "lucern-gateway";
+        readonly delivery: "vercel_sync";
+        readonly fallback: "runtime_fetch";
+        readonly sourcePathIds: readonly ["platform-auth", "platform-runtime"];
+        readonly consumer: "apps/gateway on Vercel project lucern-gateway";
+        readonly description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs and may self-hydrate from Infisical when the host environment has scoped bootstrap credentials.";
+    }, {
+        readonly id: "lucern-sdk";
+        readonly packageName: "@lucern/sdk";
+        readonly delivery: "runtime_fetch";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "server-side SDK operator contexts with a scoped Infisical identity";
+        readonly description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.";
+    }, {
+        readonly id: "lucern-cli";
+        readonly packageName: "@lucern/cli";
+        readonly delivery: "runtime_fetch";
+        readonly fallback: "device_auth";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "developer/operator CLI processes";
+        readonly description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.";
+    }, {
+        readonly id: "lucern-mcp";
+        readonly packageName: "@lucern/mcp";
+        readonly delivery: "runtime_fetch";
+        readonly fallback: "device_auth";
+        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly consumer: "MCP server/client processes";
+        readonly description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.";
+    }, {
+        readonly id: "tenant-client";
+        readonly delivery: "device_auth";
+        readonly sourcePathIds: readonly ["tenant-shared-install"];
+        readonly consumer: "tenant-owned apps and coding agents";
+        readonly description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces.";
+    }];
+    readonly secretDefinitions: readonly [{
+        readonly id: "platform.clerk.publishable";
+        readonly canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+        readonly aliases: readonly ["CLERK_PUBLISHABLE_KEY"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/auth";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: true;
+        readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "hosted-mcp-oauth";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Clerk browser key for platform web, gateway, and hosted MCP OAuth flows.";
+    }, {
+        readonly id: "platform.clerk.secret";
+        readonly canonicalName: "CLERK_SECRET_KEY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/auth";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "hosted-mcp-oauth";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Clerk backend secret. Never route to tenant-owned apps unless that tenant is Lucern itself.";
+    }, {
+        readonly id: "platform.clerk.project";
+        readonly canonicalName: "CLERK_PROJECT_ID";
+        readonly aliases: readonly ["LUCERN_CLERK_PROJECT_ID"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/auth";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway", "mc-convex"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "convex";
+            readonly target: "master-control";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities.";
+    }, {
+        readonly id: "platform.clerk.jwks";
+        readonly canonicalName: "CLERK_JWKS_URL";
+        readonly aliases: readonly ["CLERK_JWT_ISSUER_DOMAIN"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/auth";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-mcp", "lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-mcp";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Optional Clerk JWKS/issuer override for server-side token verification.";
+    }, {
+        readonly id: "platform.runtime.api-base-url";
+        readonly canonicalName: "LUCERN_API_URL";
+        readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-cli-mcp-sdk";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Canonical Lucern API gateway base URL. Older names remain aliases only.";
+    }, {
+        readonly id: "platform.runtime.login-base-url";
+        readonly canonicalName: "LUCERN_LOGIN_BASE_URL";
+        readonly aliases: readonly ["LUCERN_AUTH_BASE_URL", "LUCERN_WEB_BASE_URL"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway", "lucern-mcp", "lucern-cli"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-cli-mcp-sdk";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Browser login origin used when device/OAuth login is not served by the API base URL.";
+    }, {
+        readonly id: "platform.runtime.environment";
+        readonly canonicalName: "LUCERN_ENVIRONMENT";
+        readonly aliases: readonly ["LUCERN_ENV"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-cli-mcp-sdk";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern runtime environment label.";
+    }, {
+        readonly id: "platform.runtime.require-deployment-host-registry";
+        readonly canonicalName: "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Fail-closed gateway toggle that requires MC deployment host registry resolution before routing.";
+    }, {
+        readonly id: "platform.mc.convex-url";
+        readonly canonicalName: "CONVEX_MC_URL";
+        readonly aliases: readonly ["CONVEX_MC_PROD_URL", "LUCERN_ADMIN_CONVEX_URL", "LUCERN_CONVEX_URL", "MC_CONVEX_URL"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/mc";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Master Control Convex URL. Prod must point to successful-clam-833; dev/staging to utmost-ox-403.";
+    }, {
+        readonly id: "platform.mc.convex-deploy-key";
+        readonly canonicalName: "CONVEX_MC_DEPLOY_KEY";
+        readonly aliases: readonly ["CONVEX_MC_PROD_DEPLOY_KEY", "LUCERN_ADMIN_DEPLOY_KEY", "LUCERN_DEPLOY_KEY", "MC_DEPLOY_KEY", "MC_PROD_DEPLOY_KEY"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/mc";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Master Control deploy/admin key. Never route to tenant Vercel projects or tenant Convex deployments.";
+    }, {
+        readonly id: "platform.mc.session-token-secret";
+        readonly canonicalName: "LUCERN_SESSION_TOKEN_SECRET";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/mc";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-mcp", "mc-convex", "lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "master-control";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "hosted-mcp-oauth";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Signs Lucern platform session/delegation tokens. This is platform-owned, not tenant-owned.";
+    }, {
+        readonly id: "platform.mc.tenant-secret-encryption-key";
+        readonly canonicalName: "LUCERN_TENANT_SECRET_ENCRYPTION_KEY";
+        readonly aliases: readonly ["LUCERN_SESSION_TOKEN_SECRET"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/mc";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["mc-convex", "mc-operator-tooling"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "master-control";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "mc-credential-maintenance";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Encrypts tenant deployment credentials stored in MC. Session-token fallback is legacy only.";
+    }, {
+        readonly id: "platform.permit.api-key";
+        readonly canonicalName: "LUCERN_PERMIT_API_KEY";
+        readonly aliases: readonly ["PERMIT_API_KEY"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/permit";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "master-control";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "hosted-mcp-oauth";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing.";
+    }, {
+        readonly id: "platform.permit.pdp-url";
+        readonly canonicalName: "LUCERN_PERMIT_PDP_URL";
+        readonly aliases: readonly ["PERMIT_PDP_URL"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/permit";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "master-control";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "hosted-mcp-oauth";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Optional Permit PDP URL override.";
+    }, {
+        readonly id: "platform.permit.api-url";
+        readonly canonicalName: "LUCERN_PERMIT_API_URL";
+        readonly aliases: readonly ["PERMIT_API_URL"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/permit";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "master-control";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "runtime_fetch";
+            readonly target: "hosted-mcp-oauth";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Optional Permit API URL override.";
+    }, {
+        readonly id: "platform.ci.infisical-bootstrap-client-id";
+        readonly canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_ID";
+        readonly aliases: readonly ["INFISICAL_CI_CLIENT_ID"];
+        readonly owner: "provider";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/ci";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Machine identity client id used by CI to reconcile Infisical desired state.";
+    }, {
+        readonly id: "platform.ci.infisical-bootstrap-client-secret";
+        readonly canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_SECRET";
+        readonly aliases: readonly ["INFISICAL_CI_CLIENT_SECRET"];
+        readonly owner: "provider";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/ci";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Machine identity client secret used by CI to reconcile Infisical desired state.";
+    }, {
+        readonly id: "platform.publish.npm-token";
+        readonly canonicalName: "NPM_TOKEN";
+        readonly aliases: readonly ["NODE_AUTH_TOKEN"];
+        readonly owner: "provider";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/publish";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Package publish/install token for @lucern/* release automation.";
+    }, {
+        readonly id: "platform.ai.openai-api-key";
+        readonly canonicalName: "OPENAI_API_KEY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/ai";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation.";
+    }, {
+        readonly id: "platform.ai.anthropic-api-key";
+        readonly canonicalName: "ANTHROPIC_API_KEY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/ai";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Anthropic key for platform AI jobs, benchmarks, and controlled operator automation.";
+    }, {
+        readonly id: "platform.ai.gemini-api-key";
+        readonly canonicalName: "GEMINI_API_KEY";
+        readonly aliases: readonly ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/ai";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Google/Gemini key. Google alias names are read compatibility only.";
+    }, {
+        readonly id: "platform.langfuse.secret-key";
+        readonly canonicalName: "LANGFUSE_SECRET_KEY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/observability/langfuse";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing.";
+    }, {
+        readonly id: "platform.langfuse.public-key";
+        readonly canonicalName: "LANGFUSE_PUBLIC_KEY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/observability/langfuse";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY.";
+    }, {
+        readonly id: "platform.langfuse.base-url";
+        readonly canonicalName: "LANGFUSE_BASE_URL";
+        readonly aliases: readonly ["LANGFUSE_BASEURL", "LANGFUSE_HOST"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/observability/langfuse";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases.";
+    }, {
+        readonly id: "platform.neo4j.uri";
+        readonly canonicalName: "NEO4J_URI";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/graph/neo4j";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-graph-sync";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Neo4j URI for platform graph-sync surfaces.";
+    }, {
+        readonly id: "platform.neo4j.user";
+        readonly canonicalName: "NEO4J_USER";
+        readonly aliases: readonly ["NEO4J_USERNAME"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/graph/neo4j";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-graph-sync";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Neo4j username for platform graph-sync surfaces.";
+    }, {
+        readonly id: "platform.neo4j.password";
+        readonly canonicalName: "NEO4J_PASSWORD";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/graph/neo4j";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-graph-sync";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Neo4j password for platform graph-sync surfaces.";
+    }, {
+        readonly id: "platform.neo4j.sync-secret";
+        readonly canonicalName: "NEO4J_SYNC_SECRET";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/graph/neo4j";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-graph-sync";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls.";
+    }, {
+        readonly id: "platform.neo4j.database";
+        readonly canonicalName: "NEO4J_DATABASE";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/graph/neo4j";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-graph-sync";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces.";
+    }, {
+        readonly id: "platform.pinecone.api-key";
+        readonly canonicalName: "PINECONE_API_KEY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/vector/pinecone";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Pinecone API key for platform vector search.";
+    }, {
+        readonly id: "platform.pinecone.index-name";
+        readonly canonicalName: "PINECONE_INDEX_NAME";
+        readonly aliases: readonly ["PINECONE_INDEX"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/vector/pinecone";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Pinecone index name.";
+    }, {
+        readonly id: "platform.pinecone.host";
+        readonly canonicalName: "PINECONE_HOST";
+        readonly aliases: readonly ["PINECONE_INDEX_HOST"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/vector/pinecone";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-ai-runtime";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Pinecone host/index host.";
+    }, {
+        readonly id: "platform.sentry.dsn";
+        readonly canonicalName: "NEXT_PUBLIC_SENTRY_DSN";
+        readonly aliases: readonly ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN_NEXTJS"];
+        readonly owner: "provider";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/observability/sentry";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: true;
+        readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Sentry DSN for browser/server error telemetry.";
+    }, {
+        readonly id: "platform.sentry.auth-token";
+        readonly canonicalName: "SENTRY_AUTH_TOKEN";
+        readonly owner: "provider";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/observability/sentry";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Sentry release-upload token. Runtime services must not use it for authorization.";
+    }, {
+        readonly id: "platform.sentry.org";
+        readonly canonicalName: "SENTRY_ORG";
+        readonly aliases: readonly ["SENTRY_ORG_SLUG"];
+        readonly owner: "provider";
+        readonly scope: "global";
+        readonly sourcePath: "/platform/observability/sentry";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Sentry organization slug for Lucern release uploads.";
+    }, {
+        readonly id: "platform.sentry.project";
+        readonly canonicalName: "SENTRY_PROJECT";
+        readonly aliases: readonly ["SENTRY_PROJECT_NEXTJS"];
+        readonly owner: "provider";
+        readonly scope: "global";
+        readonly sourcePath: "/platform/observability/sentry";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Sentry project slug for Lucern release uploads.";
+    }, {
+        readonly id: "platform.sentry.environment";
+        readonly canonicalName: "SENTRY_ENVIRONMENT";
+        readonly aliases: readonly ["NEXT_PUBLIC_SENTRY_ENVIRONMENT"];
+        readonly owner: "provider";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/observability/sentry";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "environment_specific";
+            readonly writeNames: readonly ["SENTRY_ENVIRONMENT", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"];
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Sentry environment label.";
+    }, {
+        readonly id: "platform.sentry.release";
+        readonly canonicalName: "SENTRY_RELEASE";
+        readonly aliases: readonly ["NEXT_PUBLIC_SENTRY_RELEASE"];
+        readonly owner: "provider";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/observability/sentry";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern";
+            readonly environmentPolicy: "environment_specific";
+            readonly writeNames: readonly ["SENTRY_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"];
+        }, {
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned Sentry release name.";
+    }, {
+        readonly id: "platform.deploy.vercel-token";
+        readonly canonicalName: "VERCEL_TOKEN";
+        readonly owner: "provider";
+        readonly scope: "global";
+        readonly sourcePath: "/platform/deploy/vercel";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "secret-sync-writer";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps.";
+    }, {
+        readonly id: "platform.deploy.vercel-org-id";
+        readonly canonicalName: "VERCEL_ORG_ID";
+        readonly owner: "provider";
+        readonly scope: "global";
+        readonly sourcePath: "/platform/deploy/vercel";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "secret-sync-writer";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Vercel team/org id used by deployment and sync automation.";
+    }, {
+        readonly id: "platform.docs.gap-audit-api-key";
+        readonly canonicalName: "DOC_GAP_AUDIT_API_KEY";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/docs";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Optional model key for docs gap audits.";
+    }, {
+        readonly id: "platform.docs.gap-audit-provider";
+        readonly canonicalName: "DOC_GAP_AUDIT_PROVIDER";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/docs";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Optional docs gap audit provider selector.";
+    }, {
+        readonly id: "platform.docs.gap-audit-model";
+        readonly canonicalName: "DOC_GAP_AUDIT_MODEL";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/docs";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Optional docs gap audit model selector.";
+    }, {
+        readonly id: "platform.infisical.local-cli";
+        readonly canonicalName: "INFISICAL_BIN";
+        readonly aliases: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+        readonly owner: "lucern_platform";
+        readonly scope: "global";
+        readonly sourcePath: "/platform/infisical";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Operator-only Infisical CLI/API location knobs. Machine credentials are handled by the bootstrap contract.";
+    }, {
+        readonly id: "platform.gateway.device-verification-base-url";
+        readonly canonicalName: "LUCERN_DEVICE_VERIFICATION_BASE_URL";
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Base URL shown during Lucern CLI/device authentication.";
+    }, {
+        readonly id: "platform.gateway.mode";
+        readonly canonicalName: "LUCERN_GATEWAY_MODE";
+        readonly aliases: readonly ["LUCERN_GATEWAY_ENV"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-gateway", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "lucern-gateway";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Gateway runtime mode/environment label.";
+    }, {
+        readonly id: "platform.mcp.runtime";
+        readonly canonicalName: "LUCERN_MCP_URL";
+        readonly aliases: readonly ["LUCERN_AGENT_IDENTITY", "LUCERN_HTTP_HOST", "LUCERN_HTTP_PORT", "LUCERN_MCP_ALLOW_API_KEY_PASSTHROUGH", "LUCERN_MCP_DEBUG", "LUCERN_MCP_DIAGNOSTICS_FILE", "LUCERN_MCP_HEALTH_PATH", "LUCERN_MCP_HEALTH_URL", "LUCERN_MCP_HOST", "LUCERN_MCP_PATH", "LUCERN_MCP_PORT", "LUCERN_MCP_QUIET", "LUCERN_MCP_TRANSPORT", "LUCERN_PROFILE", "LUCERN_PUBLIC_URL", "MCP_SERVER_URL"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-cli-mcp-sdk";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern MCP/CLI runtime knobs. Aliases are compatibility names and not Vercel write names.";
+    }, {
+        readonly id: "platform.mcp.auth-token";
+        readonly canonicalName: "LUCERN_MCP_SERVER_AUTH_TOKEN";
+        readonly aliases: readonly ["LUCERN_USER_TOKEN", "MCP_SERVER_TOKEN"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-cli-mcp-sdk";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead.";
+    }, {
+        readonly id: "platform.graph-sync.proxy";
+        readonly canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL";
+        readonly aliases: readonly ["LUCERN_DEFAULT_TENANT_ID", "LUCERN_GRAPH_SYNC_ALLOWED_PROXY_HOSTS"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/graph/neo4j";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-graph-sync";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Graph-sync proxy URL, tenant filter, and allowed host list.";
+    }, {
+        readonly id: "platform.package-smoke.local";
+        readonly canonicalName: "LUCERN_SDK_NPM_TOKEN";
+        readonly aliases: readonly ["LUCERN_KERNEL_INSTALL_SPEC", "LUCERN_KERNEL_KEEP_CLEANROOM", "LUCERN_KERNEL_LOCAL_TARBALL", "LUCERN_KERNEL_NPM_TOKEN", "LUCERN_KERNEL_SCOPE_REGISTRY", "LUCERN_KERNEL_SKIP_CONVEX", "LUCERN_SDK_INSTALL_SPEC", "LUCERN_SDK_KEEP_CLEANROOM", "LUCERN_SDK_LOCAL_TARBALL", "LUCERN_SDK_SCOPE_REGISTRY", "LUCERN_SDK_SKIP_LIVE"];
+        readonly owner: "lucern_platform";
+        readonly scope: "global";
+        readonly sourcePath: "/platform/package-publish";
+        readonly environmentPolicy: "same_all_environments";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "same_all_environments";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "same_all_environments";
+        }];
+        readonly description: "Private package install smoke-test knobs. Values are not tenant runtime variables.";
+    }, {
+        readonly id: "platform.convex-deploy.local-names";
+        readonly canonicalName: "LUCERN_CONVEX_DEPLOYMENT_NAME";
+        readonly aliases: readonly ["CONVEX_DEPLOYMENT", "CONVEX_DEV_DEPLOYMENT_NAME", "CONVEX_PROD_DEPLOYMENT_NAME"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/deploy/convex";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Operator-only Convex deployment name hints. Deploy keys and URLs remain separately scoped.";
+    }, {
+        readonly id: "platform.sdk.local-context";
+        readonly canonicalName: "LUCERN_TENANT_ID";
+        readonly aliases: readonly ["LUCERN_AGENT_DISPLAY_NAME", "LUCERN_AGENT_ID", "LUCERN_API_ENVIRONMENT", "LUCERN_PACK_KEY", "LUCERN_PROJECT_ID", "LUCERN_TOPIC_ID", "LUCERN_WORKSPACE_ID", "LUCERN_WORKTREE_ID"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-cli", "lucern-mcp", "tenant-agent-runtime"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-cli-mcp-sdk";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves.";
+    }, {
+        readonly id: "platform.debug.local-flags";
+        readonly canonicalName: "LUCERN_FUNCTIONAL_DEBUG";
+        readonly aliases: readonly ["LUCERN_CONTRACTS_SKIP_DTS", "LUCERN_DEPLOY_RECONCILIATION_DEBUG", "LUCERN_ENABLE_ADAPTIVE_LEARNING", "LUCERN_ENV_FILE", "LUCERN_EXAMPLE_DEBUG", "LUCERN_HTTP_SMOKE_DEBUG", "LUCERN_MULTI_TENANT", "LUCERN_PACK_ACTION_DEBUG", "LUCERN_RUN_LIVE_MCP"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime/debug";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-repo-ci", "mc-operator-tooling"];
+        readonly destinations: readonly [{
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Local or CI debug toggles. They are manifest-known but not tenant runtime secrets.";
+    }, {
+        readonly id: "tenant.stackos.deploy-guard.local";
+        readonly canonicalName: "STACKOS_DEPLOY_TARGET";
+        readonly aliases: readonly ["STACKOS_DEPLOY_ENTRYPOINT", "STACKOS_EXPECTED_STAGING_COMMIT", "STACKOS_PROD_CUTOVER_APPROVED", "STACKOS_REPO_PATH", "STACKOS_REQUIRE_CHAT_RUNTIME", "STACKOS_SLOP_SCAN_BASELINE", "STACKOS_STAGING_API_KEY", "STACKOS_STAGING_BASE_URL", "STACK_DEPLOY_RECONCILIATION_SCHEMA_JSON"];
+        readonly owner: "tenant";
+        readonly scope: "software_system";
+        readonly sourcePath: "/tenants/stack";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["tenant-deploy-tooling", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "operator_local";
+            readonly target: "stackos-deploy-guard";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "stack-vc/stackos";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "StackOS deploy/test guard variables. These are not written into the StackOS Vercel runtime.";
+    }, ...(InfisicalSecretDefinition | {
+        readonly id: "tenant.stack-eng.neo4j.uri";
+        readonly canonicalName: "NEO4J_URI";
+        readonly aliases: readonly ["NEO4J_ENG_URI"];
+        readonly owner: "tenant";
+        readonly scope: "workspace";
+        readonly sourcePath: "/tenants/stack/engineering";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "small-oyster-270|bold-cuttlefish-804";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "stack-vc/stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }];
+        readonly description: "Stack engineering graph Neo4j runtime URI. NEO4J_ENG_URI is the source alias used to avoid StackOS front-office collisions.";
+    } | {
+        readonly id: "tenant.stack-eng.neo4j.user";
+        readonly canonicalName: "NEO4J_USER";
+        readonly aliases: readonly ["NEO4J_ENG_USER"];
+        readonly owner: "tenant";
+        readonly scope: "workspace";
+        readonly sourcePath: "/tenants/stack/engineering";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "small-oyster-270|bold-cuttlefish-804";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "stack-vc/stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }];
+        readonly description: "Stack engineering graph Neo4j runtime user.";
+    } | {
+        readonly id: "tenant.stack-eng.neo4j.password";
+        readonly canonicalName: "NEO4J_PASSWORD";
+        readonly aliases: readonly ["NEO4J_ENG_PASSWORD"];
+        readonly owner: "tenant";
+        readonly scope: "workspace";
+        readonly sourcePath: "/tenants/stack/engineering";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "small-oyster-270|bold-cuttlefish-804";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "stack-vc/stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }];
+        readonly description: "Stack engineering graph Neo4j runtime password.";
+    } | {
+        readonly id: "tenant.stack-eng.neo4j.sync-secret";
+        readonly canonicalName: "NEO4J_SYNC_SECRET";
+        readonly owner: "tenant";
+        readonly scope: "workspace";
+        readonly sourcePath: "/tenants/stack/engineering";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["tenant-graph-sync", "tenant-convex-deployment"];
+        readonly destinations: readonly [{
+            readonly kind: "convex";
+            readonly target: "small-oyster-270|bold-cuttlefish-804";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "vercel";
+            readonly target: "stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "stack-vc/stackos-engineering-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }];
+        readonly description: "Stack engineering graph sync secret for Convex-to-HTTP graph query/sync calls.";
+    } | {
+        readonly id: "tenant.stackos.convex.url" | "tenant.stack-frontend.convex.url" | "tenant.stack-eng.convex.url" | "tenant.lucern-graph.convex.url";
+        readonly canonicalName: "CONVEX_FRONTEND_URL" | "CONVEX_STACKOS_URL" | "CONVEX_STACK_ENG_URL" | "CONVEX_LUCERN_URL";
+        readonly aliases: readonly string[] | undefined;
+        readonly owner: "tenant";
+        readonly scope: "software_system";
+        readonly sourcePath: "/tenants/stack" | "/tenants/stack/engineering" | "/tenants/lucern/shared";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+        readonly required: true;
+        readonly secret: false;
+        readonly public: false;
+        readonly consumers: readonly ["tenant-vercel-app", "tenant-agent-runtime", "mc-operator-tooling"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "stackos" | "ai-chatbot-diao" | "stackos-engineering-graph" | "lucern-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+            readonly writeNames: readonly string[];
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "stack-vc/stackos" | "stack-vc/stackos-engineering-graph" | "stack-vc/front-end" | "stack-vc/lucern-graph" | "LucernAI/stackos" | "LucernAI/front-end" | "LucernAI/stackos-engineering-graph" | "LucernAI/lucern-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+            readonly writeNames: readonly string[];
+            readonly notes: "Only if that repository deploy/test workflow owns this software system.";
+        }];
+        readonly description: "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "stack/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/stackos Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/frontend Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/engineering Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to rugged-lobster-664; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to giant-mandrill-761; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to small-oyster-270; prod resolves to precious-dog-365." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to wonderful-toucan-0." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to good-snake-515." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to bold-cuttlefish-804." | "lucern/lucern Convex URL. Pre-prod resolves to good-blackbird-774; prod resolves to precious-dog-365.";
+    } | {
+        readonly id: "tenant.stackos.convex.deploy-key" | "tenant.stack-frontend.convex.deploy-key" | "tenant.stack-eng.convex.deploy-key" | "tenant.lucern-graph.convex.deploy-key";
+        readonly canonicalName: "CONVEX_FRONTEND_DEPLOY_KEY" | "CONVEX_STACKOS_DEPLOY_KEY" | "CONVEX_STACK_ENG_DEPLOY_KEY" | "CONVEX_LUCERN_DEPLOY_KEY";
+        readonly aliases: readonly string[] | undefined;
+        readonly owner: "tenant";
+        readonly scope: "software_system";
+        readonly sourcePath: "/tenants/stack" | "/tenants/stack/engineering" | "/tenants/lucern/shared";
+        readonly environmentPolicy: "preprod_staging_prod_prod";
+        readonly required: true;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["tenant-vercel-app", "tenant-agent-runtime", "mc-operator-tooling"];
+        readonly destinations: readonly [{
+            readonly kind: "vercel";
+            readonly target: "stackos" | "ai-chatbot-diao" | "stackos-engineering-graph" | "lucern-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "stack-vc/stackos" | "stack-vc/stackos-engineering-graph" | "stack-vc/front-end" | "stack-vc/lucern-graph" | "LucernAI/stackos" | "LucernAI/front-end" | "LucernAI/stackos-engineering-graph" | "LucernAI/lucern-graph";
+            readonly environmentPolicy: "preprod_staging_prod_prod";
+            readonly writeNames: readonly string[];
+            readonly notes: "Only if that repository deploy/test workflow owns this software system.";
+        }];
+        readonly description: "stack/stackos Convex deploy/admin key. Never route to sibling workspaces." | "stack/frontend Convex deploy/admin key. Never route to sibling workspaces." | "stack/engineering Convex deploy/admin key. Never route to sibling workspaces." | "stack/lucern Convex deploy/admin key. Never route to sibling workspaces." | "lucern/stackos Convex deploy/admin key. Never route to sibling workspaces." | "lucern/frontend Convex deploy/admin key. Never route to sibling workspaces." | "lucern/engineering Convex deploy/admin key. Never route to sibling workspaces." | "lucern/lucern Convex deploy/admin key. Never route to sibling workspaces.";
+    })[]];
+    readonly vercelDestinationEnvironments: readonly ["development", "preview", "staging", "production"];
+    readonly convexTierByVercelEnvironment: {
+        readonly development: "preprod";
+        readonly preview: "preprod";
+        readonly staging: "preprod";
+        readonly production: "prod";
+    };
+    readonly vercelSyncReconciliation: {
+        readonly sourceOfTruth: "infisical";
+        readonly writer: "vercel_api";
+        readonly disableSecretDeletion: false;
+        readonly pruneDestinationKeys: true;
+    };
+    readonly vercelSyncDestinations: readonly [{
+        readonly environment: "development";
+        readonly vercelTarget: "development";
+        readonly convexTier: "preprod";
+    }, {
+        readonly environment: "preview";
+        readonly vercelTarget: "preview";
+        readonly convexTier: "preprod";
+    }, {
+        readonly environment: "staging";
+        readonly vercelTarget: "preview";
+        readonly convexTier: "preprod";
+        readonly customEnvironmentSlug: "staging";
+        readonly customEnvironmentIdsByProjectName: {
+            readonly stackos: "env_RbS0TYRRvWISTje8qR4u2lRg7TC8";
+        };
+        readonly domainsByProjectName: {
+            readonly stackos: "staging.stack.vc";
+        };
+    }, {
+        readonly environment: "production";
+        readonly vercelTarget: "production";
+        readonly convexTier: "prod";
+    }];
+    readonly tenantSoftwareSystems: readonly [{
+        readonly id: "stack-frontend";
+        readonly tenantKey: "stack";
+        readonly workspaceKey: "frontend";
+        readonly vercelProjectName: "ai-chatbot-diao";
+        readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+        readonly vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517";
+        readonly repository: {
+            readonly owner: "stack-vc";
+            readonly name: "front-end";
+        };
+        readonly sharedSourcePath: "/tenants/stack";
+        readonly sharedVariablePolicy: "tenant_shared_all_systems";
+        readonly convex: {
+            readonly urlEnv: "CONVEX_FRONTEND_URL";
+            readonly deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY";
+            readonly preprodDeployment: "rugged-lobster-664";
+            readonly prodDeployment: "wonderful-toucan-0";
+        };
+    }, {
+        readonly id: "stackos";
+        readonly tenantKey: "stack";
+        readonly workspaceKey: "stackos";
+        readonly vercelProjectName: "stackos";
+        readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+        readonly vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau";
+        readonly repository: {
+            readonly owner: "stack-vc";
+            readonly name: "stackos";
+        };
+        readonly sharedSourcePath: "/tenants/stack";
+        readonly sharedVariablePolicy: "tenant_shared_all_systems";
+        readonly convex: {
+            readonly urlEnv: "CONVEX_STACKOS_URL";
+            readonly deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY";
+            readonly preprodDeployment: "giant-mandrill-761";
+            readonly prodDeployment: "good-snake-515";
+        };
+    }, {
+        readonly id: "stack-eng";
+        readonly tenantKey: "stack";
+        readonly workspaceKey: "engineering";
+        readonly vercelProjectName: "stackos-engineering-graph";
+        readonly vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK";
+        readonly vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ";
+        readonly repository: {
+            readonly owner: "stack-vc";
+            readonly name: "stackos-engineering-graph";
+        };
+        readonly sharedSourcePath: "/tenants/stack/engineering";
+        readonly sharedVariablePolicy: "tenant_shared_all_systems";
+        readonly convex: {
+            readonly urlEnv: "CONVEX_STACK_ENG_URL";
+            readonly deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY";
+            readonly preprodDeployment: "small-oyster-270";
+            readonly prodDeployment: "bold-cuttlefish-804";
+        };
+    }, {
+        readonly id: "lucern-graph";
+        readonly tenantKey: "lucern";
+        readonly workspaceKey: "lucern";
+        readonly vercelProjectName: "lucern-graph";
+        readonly vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY";
+        readonly vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ";
+        readonly repository: {
+            readonly owner: "LucernAI";
+            readonly name: "lucern-graph";
+        };
+        readonly sharedSourcePath: "/tenants/lucern/shared";
+        readonly sharedVariablePolicy: "tenant_shared_all_systems";
+        readonly convex: {
+            readonly urlEnv: "CONVEX_LUCERN_URL";
+            readonly deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY";
+            readonly preprodDeployment: "good-blackbird-774";
+            readonly prodDeployment: "precious-dog-365";
+        };
+    }];
+};
+
+export { INFISICAL_RUNTIME_MANIFEST, type InfisicalRuntimeManifest };