@lucern/contracts 0.3.0-alpha.10 → 0.3.0-alpha.12

package/dist/infisical-runtime.contract.js

@@ -43,7 +43,7 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
   },
   {
     packageName: "@lucern/control-plane",
-    role: "platform_runtime",
+    role: "component_runtime",
     directTenantImport: false
   },
   {
@@ -66,11 +66,6 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
     role: "host_addon_runtime",
     directTenantImport: true
   },
-  {
-    packageName: "@lucern/identity",
-    role: "component_runtime",
-    directTenantImport: false
-  },
   {
     packageName: "@lucern/mcp",
     role: "runtime_entrypoint",
@@ -106,6 +101,11 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
     role: "runtime_entrypoint",
     directTenantImport: true
   },
+  {
+    packageName: "@lucern/secrets",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
   {
     packageName: "@lucern/server-core",
     role: "platform_runtime",
@@ -127,7 +127,7 @@ TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
 );
 
 // src/infisical-runtime.contract.ts
-var INFISICAL_RUNTIME_CONTRACT_VERSION = "2026-04-28";
+var INFISICAL_RUNTIME_CONTRACT_VERSION = "2026-05-06";
 var INFISICAL_RUNTIME_DEFAULT_API_URL = "https://app.infisical.com";
 var INFISICAL_RUNTIME_DEFAULT_PROJECT_ID = "344b0526-90df-4606-ba50-22c647a36c65";
 var INFISICAL_RUNTIME_ENVIRONMENTS = [
@@ -140,6 +140,59 @@ var INFISICAL_RUNTIME_DELIVERY_MODES = [
   "runtime_fetch",
   "device_auth"
 ];
+var INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS = [
+  "development",
+  "preview",
+  "staging",
+  "production"
+];
+var INFISICAL_VERCEL_TARGETS = [
+  "development",
+  "preview",
+  "production"
+];
+var INFISICAL_CONVEX_TIERS = ["preprod", "prod"];
+var INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT = {
+  development: "preprod",
+  preview: "preprod",
+  staging: "preprod",
+  production: "prod"
+};
+var INFISICAL_VERCEL_SYNC_RECONCILIATION = {
+  sourceOfTruth: "infisical",
+  writer: "vercel_api",
+  disableSecretDeletion: false,
+  pruneDestinationKeys: true
+};
+var INFISICAL_VERCEL_SYNC_DESTINATIONS = [
+  {
+    environment: "development",
+    vercelTarget: "development",
+    convexTier: "preprod"
+  },
+  {
+    environment: "preview",
+    vercelTarget: "preview",
+    convexTier: "preprod"
+  },
+  {
+    environment: "staging",
+    vercelTarget: "preview",
+    convexTier: "preprod",
+    customEnvironmentSlug: "staging",
+    customEnvironmentIdsByProjectName: {
+      stackos: "env_RbS0TYRRvWISTje8qR4u2lRg7TC8"
+    },
+    domainsByProjectName: {
+      stackos: "staging.stack.vc"
+    }
+  },
+  {
+    environment: "production",
+    vercelTarget: "production",
+    convexTier: "prod"
+  }
+];
 var INFISICAL_RUNTIME_SURFACE_IDS = [
   "lucern-web",
   "lucern-gateway",
@@ -165,6 +218,78 @@ var INFISICAL_RUNTIME_BOOTSTRAP_ENV = {
   organizationSlug: ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"],
   disabled: ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"]
 };
+var INFISICAL_RUNTIME_CONTROL_ENV = [
+  {
+    name: "NODE_ENV",
+    category: "framework",
+    description: "Node/Next runtime mode. Framework-owned, not written by Infisical."
+  },
+  {
+    name: "CI",
+    category: "ci",
+    description: "CI execution signal. Workflow-owned, not written by Infisical."
+  },
+  {
+    name: "VERCEL",
+    category: "vercel",
+    description: "Vercel runtime signal. Platform-owned, not written by Infisical."
+  },
+  {
+    name: "VERCEL_ENV",
+    category: "vercel",
+    description: "Vercel environment label used for build/runtime selection."
+  },
+  {
+    name: "VERCEL_URL",
+    category: "vercel",
+    description: "Vercel deployment URL supplied by Vercel for previews and builds."
+  },
+  {
+    name: "VERCEL_GIT_COMMIT_SHA",
+    category: "vercel",
+    description: "Vercel git metadata used for release labels. Platform-owned, not written by Infisical."
+  },
+  {
+    name: "NEXT_RUNTIME",
+    category: "nextjs",
+    description: "Next.js runtime selector for node/edge instrumentation modules."
+  },
+  {
+    name: "PORT",
+    category: "framework",
+    description: "Local/server port supplied by the runtime process manager."
+  },
+  {
+    name: "HOST",
+    category: "framework",
+    description: "Local/server host supplied by the runtime process manager."
+  },
+  {
+    name: "APP_URL",
+    category: "compatibility",
+    description: "Legacy local app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL."
+  },
+  {
+    name: "NEXT_PUBLIC_APP_URL",
+    category: "compatibility",
+    description: "Legacy public app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL."
+  },
+  {
+    name: "CLAUDE_PROJECT_DIR",
+    category: "agent_local",
+    description: "Local agent workspace hint. Agent-runtime-owned, not written by Infisical."
+  },
+  {
+    name: "HOME",
+    category: "os",
+    description: "Operating-system home directory used only for local credential discovery."
+  },
+  {
+    name: "USERPROFILE",
+    category: "os",
+    description: "Windows home directory used only for local credential discovery."
+  }
+];
 var INFISICAL_RUNTIME_PATHS = [
   {
     id: "platform-auth",
@@ -236,6 +361,13 @@ var INFISICAL_RUNTIME_PATHS = [
         public: false,
         aliases: ["LUCERN_ENV"],
         description: "Lucern environment label consumed by CLI profiles."
+      },
+      {
+        name: "LUCERN_CLI_SESSION_TTL_MS",
+        required: false,
+        secret: false,
+        public: false,
+        description: "Optional web-issued CLI login session lifetime override in milliseconds."
       }
     ]
   },
@@ -265,9 +397,10 @@ var INFISICAL_RUNTIME_SURFACES = [
   {
     id: "lucern-gateway",
     delivery: "vercel_sync",
+    fallback: "runtime_fetch",
     sourcePathIds: ["platform-auth", "platform-runtime"],
     consumer: "apps/gateway on Vercel project lucern-gateway",
-    description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs."
+    description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs and may self-hydrate from Infisical when the host environment has scoped bootstrap credentials."
   },
   {
     id: "lucern-sdk",
@@ -303,15 +436,2689 @@ var INFISICAL_RUNTIME_SURFACES = [
     description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces."
   }
 ];
+var INFISICAL_TENANT_SOFTWARE_SYSTEMS = [
+  {
+    id: "stack-frontend",
+    tenantKey: "stack",
+    workspaceKey: "frontend",
+    vercelProjectName: "ai-chatbot-diao",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517",
+    repository: {
+      owner: "stack-vc",
+      name: "front-end"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_FRONTEND_URL",
+      deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY",
+      preprodDeployment: "rugged-lobster-664",
+      prodDeployment: "wonderful-toucan-0"
+    }
+  },
+  {
+    id: "stackos",
+    tenantKey: "stack",
+    workspaceKey: "stackos",
+    vercelProjectName: "stackos",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACKOS_URL",
+      deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY",
+      preprodDeployment: "giant-mandrill-761",
+      prodDeployment: "good-snake-515"
+    }
+  },
+  {
+    id: "stack-eng",
+    tenantKey: "stack",
+    workspaceKey: "engineering",
+    vercelProjectName: "stackos-engineering-graph",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos-engineering-graph"
+    },
+    sharedSourcePath: "/tenants/stack/engineering",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACK_ENG_URL",
+      deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY",
+      preprodDeployment: "small-oyster-270",
+      prodDeployment: "bold-cuttlefish-804"
+    }
+  },
+  {
+    id: "lucern-graph",
+    tenantKey: "lucern",
+    workspaceKey: "lucern",
+    vercelProjectName: "lucern-graph",
+    vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY",
+    vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ",
+    repository: {
+      owner: "LucernAI",
+      name: "lucern-graph"
+    },
+    sharedSourcePath: "/tenants/lucern/shared",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_LUCERN_URL",
+      deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY",
+      preprodDeployment: "good-blackbird-774",
+      prodDeployment: "precious-dog-365"
+    }
+  }
+];
+function findInfisicalTenantSoftwareSystem(systemId) {
+  return INFISICAL_TENANT_SOFTWARE_SYSTEMS.find(
+    (system) => system.id === systemId
+  );
+}
+function tenantSoftwareSystemConvexEnvNames(systemId) {
+  const system = findInfisicalTenantSoftwareSystem(systemId);
+  if (!system) {
+    throw new Error(`Unknown tenant software system: ${systemId}.`);
+  }
+  return [system.convex.urlEnv, system.convex.deployKeyEnv];
+}
+function tenantSoftwareSystemOwnsConvexEnvName(systemId, envName) {
+  return tenantSoftwareSystemConvexEnvNames(systemId).includes(envName);
+}
+function convexTierForVercelDestinationEnvironment(environment) {
+  return INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT[environment];
+}
+function findInfisicalVercelSyncDestination(environment) {
+  return INFISICAL_VERCEL_SYNC_DESTINATIONS.find(
+    (destination) => destination.environment === environment
+  );
+}
+function vercelCustomEnvironmentIdForTenantSoftwareSystem(systemId, environment) {
+  const system = findInfisicalTenantSoftwareSystem(systemId);
+  const destination = findInfisicalVercelSyncDestination(environment);
+  if (!system || !destination) {
+    return void 0;
+  }
+  return destination.customEnvironmentIdsByProjectName?.[system.vercelProjectName];
+}
+function expectedTenantConvexDeploymentForVercelEnvironment(systemId, environment) {
+  const system = findInfisicalTenantSoftwareSystem(systemId);
+  if (!system) {
+    throw new Error(`Unknown tenant software system: ${systemId}.`);
+  }
+  return convexTierForVercelDestinationEnvironment(environment) === "prod" ? system.convex.prodDeployment : system.convex.preprodDeployment;
+}
 function findInfisicalRuntimePath(pathId) {
   return INFISICAL_RUNTIME_PATHS.find((path) => path.id === pathId);
 }
 function findInfisicalRuntimeSurface(surfaceId) {
-  return INFISICAL_RUNTIME_SURFACES.find(
-    (surface) => surface.id === surfaceId
-  );
+  return INFISICAL_RUNTIME_SURFACES.find((surface) => surface.id === surfaceId);
+}
+var INFISICAL_SECRET_OWNERS = [
+  "lucern_platform",
+  "tenant",
+  "provider",
+  "operator_local"
+];
+var INFISICAL_SECRET_SCOPES = [
+  "global",
+  "environment",
+  "tenant",
+  "workspace",
+  "software_system",
+  "deployment",
+  "local"
+];
+var INFISICAL_SECRET_ENVIRONMENT_POLICIES = [
+  "same_all_environments",
+  "environment_specific",
+  "preprod_staging_prod_prod",
+  "local_only"
+];
+var INFISICAL_SECRET_CONSUMERS = [
+  "lucern-web",
+  "lucern-gateway",
+  "lucern-mcp",
+  "lucern-cli",
+  "lucern-ai-runtime",
+  "lucern-graph-sync",
+  "lucern-observability",
+  "lucern-repo-ci",
+  "mc-convex",
+  "mc-operator-tooling",
+  "tenant-vercel-app",
+  "tenant-convex-deployment",
+  "tenant-ai-runtime",
+  "tenant-graph-sync",
+  "tenant-observability",
+  "tenant-vector-store",
+  "tenant-deploy-tooling",
+  "tenant-agent-runtime"
+];
+var INFISICAL_SECRET_DESTINATION_KINDS = [
+  "vercel",
+  "convex",
+  "github_actions",
+  "runtime_fetch",
+  "operator_local"
+];
+var PLATFORM_SECRET_DEFINITIONS = [
+  {
+    id: "platform.clerk.publishable",
+    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+    aliases: ["CLERK_PUBLISHABLE_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: true,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk browser key for platform web, gateway, and hosted MCP OAuth flows."
+  },
+  {
+    id: "platform.clerk.secret",
+    canonicalName: "CLERK_SECRET_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Clerk backend secret. Never route to tenant-owned apps unless that tenant is Lucern itself."
+  },
+  {
+    id: "platform.clerk.project",
+    canonicalName: "CLERK_PROJECT_ID",
+    aliases: ["LUCERN_CLERK_PROJECT_ID"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "mc-convex"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities."
+  },
+  {
+    id: "platform.clerk.jwks",
+    canonicalName: "CLERK_JWKS_URL",
+    aliases: ["CLERK_JWT_ISSUER_DOMAIN"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/auth",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-mcp",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Clerk JWKS/issuer override for server-side token verification."
+  },
+  {
+    id: "platform.runtime.api-base-url",
+    canonicalName: "LUCERN_API_URL",
+    aliases: ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Canonical Lucern API gateway base URL. Older names remain aliases only."
+  },
+  {
+    id: "platform.runtime.login-base-url",
+    canonicalName: "LUCERN_LOGIN_BASE_URL",
+    aliases: ["LUCERN_AUTH_BASE_URL", "LUCERN_WEB_BASE_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "lucern-mcp", "lucern-cli"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Browser login origin used when device/OAuth login is not served by the API base URL."
+  },
+  {
+    id: "platform.runtime.environment",
+    canonicalName: "LUCERN_ENVIRONMENT",
+    aliases: ["LUCERN_ENV"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern runtime environment label."
+  },
+  {
+    id: "platform.runtime.require-deployment-host-registry",
+    canonicalName: "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Fail-closed gateway toggle that requires MC deployment host registry resolution before routing."
+  },
+  {
+    id: "platform.mc.convex-url",
+    canonicalName: "CONVEX_MC_URL",
+    aliases: [
+      "CONVEX_MC_PROD_URL",
+      "LUCERN_ADMIN_CONVEX_URL",
+      "LUCERN_CONVEX_URL",
+      "MC_CONVEX_URL"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Master Control Convex URL. Prod must point to successful-clam-833; dev/staging to utmost-ox-403."
+  },
+  {
+    id: "platform.mc.convex-deploy-key",
+    canonicalName: "CONVEX_MC_DEPLOY_KEY",
+    aliases: [
+      "CONVEX_MC_PROD_DEPLOY_KEY",
+      "LUCERN_ADMIN_DEPLOY_KEY",
+      "LUCERN_DEPLOY_KEY",
+      "MC_DEPLOY_KEY",
+      "MC_PROD_DEPLOY_KEY"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Master Control deploy/admin key. Never route to tenant Vercel projects or tenant Convex deployments."
+  },
+  {
+    id: "platform.mc.session-token-secret",
+    canonicalName: "LUCERN_SESSION_TOKEN_SECRET",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-mcp", "mc-convex", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Signs Lucern platform session/delegation tokens. This is platform-owned, not tenant-owned."
+  },
+  {
+    id: "platform.mc.tenant-secret-encryption-key",
+    canonicalName: "LUCERN_TENANT_SECRET_ENCRYPTION_KEY",
+    aliases: ["LUCERN_SESSION_TOKEN_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/mc",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Encrypts tenant deployment credentials stored in MC. Session-token fallback is legacy only."
+  },
+  {
+    id: "platform.permit.api-key",
+    canonicalName: "LUCERN_PERMIT_API_KEY",
+    aliases: ["PERMIT_API_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing."
+  },
+  {
+    id: "platform.permit.webhook-secret",
+    canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET",
+    aliases: ["PERMIT_WEBHOOK_SECRET"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["mc-convex", "lucern-gateway", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "mc-credential-maintenance",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
+  },
+  {
+    id: "platform.permit.pdp-url",
+    canonicalName: "LUCERN_PERMIT_PDP_URL",
+    aliases: ["PERMIT_PDP_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Permit PDP URL override."
+  },
+  {
+    id: "platform.permit.api-url",
+    canonicalName: "LUCERN_PERMIT_API_URL",
+    aliases: ["PERMIT_API_URL"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/permit",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "master-control",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "runtime_fetch",
+        target: "hosted-mcp-oauth",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Permit API URL override."
+  },
+  {
+    id: "platform.ci.infisical-bootstrap-client-id",
+    canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_ID",
+    aliases: ["INFISICAL_CI_CLIENT_ID"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/ci",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Machine identity client id used by CI to reconcile Infisical desired state."
+  },
+  {
+    id: "platform.ci.infisical-bootstrap-client-secret",
+    canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_SECRET",
+    aliases: ["INFISICAL_CI_CLIENT_SECRET"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/ci",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Machine identity client secret used by CI to reconcile Infisical desired state."
+  },
+  {
+    id: "platform.publish.npm-token",
+    canonicalName: "NPM_TOKEN",
+    aliases: ["NODE_AUTH_TOKEN"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/publish",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Package publish/install token for @lucern/* release automation."
+  }
+];
+var PLATFORM_AI_SECRET_DEFINITIONS = [
+  {
+    id: "platform.ai.openai-api-key",
+    canonicalName: "OPENAI_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/ai",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation."
+  },
+  {
+    id: "platform.ai.anthropic-api-key",
+    canonicalName: "ANTHROPIC_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/ai",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Anthropic key for platform AI jobs, benchmarks, and controlled operator automation."
+  },
+  {
+    id: "platform.ai.gemini-api-key",
+    canonicalName: "GEMINI_API_KEY",
+    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/ai",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Google/Gemini key. Google alias names are read compatibility only."
+  }
+];
+var PLATFORM_LANGFUSE_SECRET_DEFINITIONS = [
+  {
+    id: "platform.langfuse.secret-key",
+    canonicalName: "LANGFUSE_SECRET_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/observability/langfuse",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing."
+  },
+  {
+    id: "platform.langfuse.public-key",
+    canonicalName: "LANGFUSE_PUBLIC_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/observability/langfuse",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY."
+  },
+  {
+    id: "platform.langfuse.base-url",
+    canonicalName: "LANGFUSE_BASE_URL",
+    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/observability/langfuse",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases."
+  }
+];
+var PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS = [
+  {
+    id: "platform.neo4j.uri",
+    canonicalName: "NEO4J_URI",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j URI for platform graph-sync surfaces."
+  },
+  {
+    id: "platform.neo4j.user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_USERNAME"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j username for platform graph-sync surfaces."
+  },
+  {
+    id: "platform.neo4j.password",
+    canonicalName: "NEO4J_PASSWORD",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j password for platform graph-sync surfaces."
+  },
+  {
+    id: "platform.neo4j.sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls."
+  },
+  {
+    id: "platform.neo4j.database",
+    canonicalName: "NEO4J_DATABASE",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces."
+  }
+];
+var PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS = [
+  {
+    id: "platform.pinecone.api-key",
+    canonicalName: "PINECONE_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone API key for platform vector search."
+  },
+  {
+    id: "platform.pinecone.index-name",
+    canonicalName: "PINECONE_INDEX_NAME",
+    aliases: ["PINECONE_INDEX"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone index name."
+  },
+  {
+    id: "platform.pinecone.host",
+    canonicalName: "PINECONE_HOST",
+    aliases: ["PINECONE_INDEX_HOST"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone host/index host."
+  }
+];
+var PLATFORM_SENTRY_SECRET_DEFINITIONS = [
+  {
+    id: "platform.sentry.dsn",
+    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
+    aliases: ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN_NEXTJS"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Sentry DSN for browser/server error telemetry."
+  },
+  {
+    id: "platform.sentry.auth-token",
+    canonicalName: "SENTRY_AUTH_TOKEN",
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci", "lucern-observability"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Sentry release-upload token. Runtime services must not use it for authorization."
+  },
+  {
+    id: "platform.sentry.org",
+    canonicalName: "SENTRY_ORG",
+    aliases: ["SENTRY_ORG_SLUG"],
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci", "lucern-observability"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Sentry organization slug for Lucern release uploads."
+  },
+  {
+    id: "platform.sentry.project",
+    canonicalName: "SENTRY_PROJECT",
+    aliases: ["SENTRY_PROJECT_NEXTJS"],
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci", "lucern-observability"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Sentry project slug for Lucern release uploads."
+  },
+  {
+    id: "platform.sentry.environment",
+    canonicalName: "SENTRY_ENVIRONMENT",
+    aliases: ["NEXT_PUBLIC_SENTRY_ENVIRONMENT"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific",
+        writeNames: ["SENTRY_ENVIRONMENT", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"]
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Sentry environment label."
+  },
+  {
+    id: "platform.sentry.release",
+    canonicalName: "SENTRY_RELEASE",
+    aliases: ["NEXT_PUBLIC_SENTRY_RELEASE"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific",
+        writeNames: ["SENTRY_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"]
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Sentry release name."
+  }
+];
+var PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS = [
+  {
+    id: "platform.deploy.vercel-token",
+    canonicalName: "VERCEL_TOKEN",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps."
+  },
+  {
+    id: "platform.deploy.vercel-org-id",
+    canonicalName: "VERCEL_ORG_ID",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Vercel team/org id used by deployment and sync automation."
+  }
+];
+var PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS = [
+  {
+    id: "platform.docs.gap-audit-api-key",
+    canonicalName: "DOC_GAP_AUDIT_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/docs",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional model key for docs gap audits."
+  },
+  {
+    id: "platform.docs.gap-audit-provider",
+    canonicalName: "DOC_GAP_AUDIT_PROVIDER",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/docs",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional docs gap audit provider selector."
+  },
+  {
+    id: "platform.docs.gap-audit-model",
+    canonicalName: "DOC_GAP_AUDIT_MODEL",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/docs",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional docs gap audit model selector."
+  },
+  {
+    id: "platform.infisical.local-cli",
+    canonicalName: "INFISICAL_BIN",
+    aliases: ["INFISICAL_API_URL", "INFISICAL_URL"],
+    owner: "lucern_platform",
+    scope: "global",
+    sourcePath: "/platform/infisical",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Operator-only Infisical CLI/API location knobs. Machine credentials are handled by the bootstrap contract."
+  },
+  {
+    id: "platform.gateway.device-verification-base-url",
+    canonicalName: "LUCERN_DEVICE_VERIFICATION_BASE_URL",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Base URL shown during Lucern CLI/device authentication."
+  },
+  {
+    id: "platform.gateway.mode",
+    canonicalName: "LUCERN_GATEWAY_MODE",
+    aliases: ["LUCERN_GATEWAY_ENV"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Gateway runtime mode/environment label."
+  },
+  {
+    id: "platform.mcp.runtime",
+    canonicalName: "LUCERN_MCP_URL",
+    aliases: [
+      "LUCERN_AGENT_IDENTITY",
+      "LUCERN_HTTP_HOST",
+      "LUCERN_HTTP_PORT",
+      "LUCERN_MCP_ALLOW_API_KEY_PASSTHROUGH",
+      "LUCERN_MCP_DEBUG",
+      "LUCERN_MCP_DIAGNOSTICS_FILE",
+      "LUCERN_MCP_HEALTH_PATH",
+      "LUCERN_MCP_HEALTH_URL",
+      "LUCERN_MCP_HOST",
+      "LUCERN_MCP_PATH",
+      "LUCERN_MCP_PORT",
+      "LUCERN_MCP_QUIET",
+      "LUCERN_MCP_TRANSPORT",
+      "LUCERN_PROFILE",
+      "LUCERN_PUBLIC_URL",
+      "MCP_SERVER_URL"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-mcp", "lucern-cli", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern MCP/CLI runtime knobs. Aliases are compatibility names and not Vercel write names."
+  },
+  {
+    id: "platform.mcp.auth-token",
+    canonicalName: "LUCERN_MCP_SERVER_AUTH_TOKEN",
+    aliases: ["LUCERN_USER_TOKEN", "MCP_SERVER_TOKEN"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-mcp", "lucern-cli", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead."
+  },
+  {
+    id: "platform.graph-sync.proxy",
+    canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL",
+    aliases: [
+      "LUCERN_DEFAULT_TENANT_ID",
+      "LUCERN_GRAPH_SYNC_ALLOWED_PROXY_HOSTS"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Graph-sync proxy URL, tenant filter, and allowed host list."
+  },
+  {
+    id: "platform.package-smoke.local",
+    canonicalName: "LUCERN_SDK_NPM_TOKEN",
+    aliases: [
+      "LUCERN_KERNEL_INSTALL_SPEC",
+      "LUCERN_KERNEL_KEEP_CLEANROOM",
+      "LUCERN_KERNEL_LOCAL_TARBALL",
+      "LUCERN_KERNEL_NPM_TOKEN",
+      "LUCERN_KERNEL_SCOPE_REGISTRY",
+      "LUCERN_KERNEL_SKIP_CONVEX",
+      "LUCERN_SDK_INSTALL_SPEC",
+      "LUCERN_SDK_KEEP_CLEANROOM",
+      "LUCERN_SDK_LOCAL_TARBALL",
+      "LUCERN_SDK_SCOPE_REGISTRY",
+      "LUCERN_SDK_SKIP_LIVE"
+    ],
+    owner: "lucern_platform",
+    scope: "global",
+    sourcePath: "/platform/package-publish",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Private package install smoke-test knobs. Values are not tenant runtime variables."
+  },
+  {
+    id: "platform.convex-deploy.local-names",
+    canonicalName: "LUCERN_CONVEX_DEPLOYMENT_NAME",
+    aliases: [
+      "CONVEX_DEPLOYMENT",
+      "CONVEX_DEV_DEPLOYMENT_NAME",
+      "CONVEX_PROD_DEPLOYMENT_NAME"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/deploy/convex",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Operator-only Convex deployment name hints. Deploy keys and URLs remain separately scoped."
+  },
+  {
+    id: "platform.sdk.local-context",
+    canonicalName: "LUCERN_TENANT_ID",
+    aliases: [
+      "LUCERN_AGENT_DISPLAY_NAME",
+      "LUCERN_AGENT_ID",
+      "LUCERN_API_ENVIRONMENT",
+      "LUCERN_PACK_KEY",
+      "LUCERN_PROJECT_ID",
+      "LUCERN_TOPIC_ID",
+      "LUCERN_WORKSPACE_ID",
+      "LUCERN_WORKTREE_ID"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-cli", "lucern-mcp", "tenant-agent-runtime"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves."
+  },
+  {
+    id: "platform.debug.local-flags",
+    canonicalName: "LUCERN_FUNCTIONAL_DEBUG",
+    aliases: [
+      "LUCERN_CONTRACTS_SKIP_DTS",
+      "LUCERN_DEPLOY_RECONCILIATION_DEBUG",
+      "LUCERN_ENABLE_ADAPTIVE_LEARNING",
+      "LUCERN_ENV_FILE",
+      "LUCERN_EXAMPLE_DEBUG",
+      "LUCERN_HTTP_SMOKE_DEBUG",
+      "LUCERN_MULTI_TENANT",
+      "LUCERN_PACK_ACTION_DEBUG",
+      "LUCERN_RUN_LIVE_MCP"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime/debug",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Local or CI debug toggles. They are manifest-known but not tenant runtime secrets."
+  },
+  {
+    id: "tenant.stackos.deploy-guard.local",
+    canonicalName: "STACKOS_DEPLOY_TARGET",
+    aliases: [
+      "STACKOS_DEPLOY_ENTRYPOINT",
+      "STACKOS_EXPECTED_STAGING_COMMIT",
+      "STACKOS_PROD_CUTOVER_APPROVED",
+      "STACKOS_REPO_PATH",
+      "STACKOS_REQUIRE_CHAT_RUNTIME",
+      "STACKOS_SLOP_SCAN_BASELINE",
+      "STACKOS_STAGING_API_KEY",
+      "STACKOS_STAGING_BASE_URL",
+      "STACK_DEPLOY_RECONCILIATION_SCHEMA_JSON"
+    ],
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: "/tenants/stack",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "stackos-deploy-guard",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "StackOS deploy/test guard variables. These are not written into the StackOS Vercel runtime."
+  }
+];
+var TENANT_SHARED_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "clerk.publishable",
+    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+    aliases: ["CLERK_PUBLISHABLE_KEY"],
+    required: true,
+    secret: false,
+    public: true,
+    description: "Tenant-owned Clerk browser key. For Stack this is the master clerk.stack.vc project shared by front-end, StackOS, and the engineering workspace."
+  },
+  {
+    idSuffix: "clerk.secret",
+    canonicalName: "CLERK_SECRET_KEY",
+    required: true,
+    secret: true,
+    public: false,
+    description: "Tenant-owned Clerk backend secret used only by that tenant's server runtimes."
+  },
+  {
+    idSuffix: "clerk.project",
+    canonicalName: "CLERK_PROJECT_ID",
+    required: true,
+    secret: false,
+    public: false,
+    description: "Tenant-owned Clerk project id used to resolve canonical Clerk aliases."
+  },
+  {
+    idSuffix: "clerk.jwks",
+    canonicalName: "CLERK_JWT_ISSUER_DOMAIN",
+    aliases: ["CLERK_ISSUER_URL", "CLERK_JWKS_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Tenant Clerk issuer/JWKS URL consumed by Convex auth.config.ts."
+  },
+  {
+    idSuffix: "clerk.jwt-key",
+    canonicalName: "CLERK_JWT_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    description: "Tenant Clerk JWT public verification key used by bearer-token API routes."
+  },
+  {
+    idSuffix: "clerk.authorized-parties",
+    canonicalName: "CLERK_AUTHORIZED_PARTIES",
+    aliases: ["CLERK_MOBILE_AUTHORIZED_PARTIES"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Comma-separated Clerk authorized parties for browser and mobile bearer-token validation."
+  },
+  {
+    idSuffix: "clerk.sign-in-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-in route for custom app login surfaces."
+  },
+  {
+    idSuffix: "clerk.sign-up-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-up route for custom app login surfaces."
+  }
+];
+var TENANT_SHARED_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => TENANT_SHARED_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+var TENANT_INSTALL_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.map(
+  (system) => ({
+    id: `tenant.${system.id}.install-lucern-npm`,
+    canonicalName: "INSTALL_LUCERN_NPM",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/tenants/shared",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey}: read-only npm install token for published @lucern/* packages.`
+  })
+);
+var TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS = ["stack-frontend", "stackos"];
+var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "ai.openai-api-key",
+    canonicalName: "OPENAI_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned OpenAI key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "ai.anthropic-api-key",
+    canonicalName: "ANTHROPIC_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Anthropic key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "ai.gemini-api-key",
+    canonicalName: "GEMINI_API_KEY",
+    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Google/Gemini key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "langfuse.secret-key",
+    canonicalName: "LANGFUSE_SECRET_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse secret key for product AI tracing."
+  },
+  {
+    idSuffix: "langfuse.public-key",
+    canonicalName: "LANGFUSE_PUBLIC_KEY",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse public key for product AI tracing."
+  },
+  {
+    idSuffix: "langfuse.base-url",
+    canonicalName: "LANGFUSE_BASE_URL",
+    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse API origin."
+  },
+  {
+    idSuffix: "graph.neo4j-uri",
+    canonicalName: "NEO4J_URI",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j URI for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_USERNAME"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j user for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-password",
+    canonicalName: "NEO4J_PASSWORD",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j password for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned shared secret for product Convex-to-HTTP graph-sync calls."
+  },
+  {
+    idSuffix: "graph.neo4j-database",
+    canonicalName: "NEO4J_DATABASE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j database name for product graph-sync."
+  },
+  {
+    idSuffix: "vector.pinecone-api-key",
+    canonicalName: "PINECONE_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone API key for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-index-name",
+    canonicalName: "PINECONE_INDEX_NAME",
+    aliases: ["PINECONE_INDEX"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone index name for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-host",
+    canonicalName: "PINECONE_HOST",
+    aliases: ["PINECONE_INDEX_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone host for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-namespace",
+    canonicalName: "PINECONE_NAMESPACE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone namespace for product vector search isolation."
+  },
+  {
+    idSuffix: "storage.aws-access-key-id",
+    canonicalName: "AWS_ACCESS_KEY_ID",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS access key id for document/file ingestion."
+  },
+  {
+    idSuffix: "storage.aws-secret-access-key",
+    canonicalName: "AWS_SECRET_ACCESS_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS secret access key for document/file ingestion."
+  },
+  {
+    idSuffix: "storage.aws-region",
+    canonicalName: "AWS_REGION",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS region for document/file ingestion."
+  },
+  {
+    idSuffix: "observability.sentry-dsn",
+    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
+    aliases: ["NEXT_PUBLIC_SENTRY_DSN_NEXTJS", "SENTRY_DSN"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry DSN for app telemetry."
+  },
+  {
+    idSuffix: "observability.sentry-auth-token",
+    canonicalName: "SENTRY_AUTH_TOKEN",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry release token for app deployments."
+  },
+  {
+    idSuffix: "observability.sentry-org",
+    canonicalName: "SENTRY_ORG",
+    aliases: ["SENTRY_ORG_SLUG"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry org slug for release uploads."
+  },
+  {
+    idSuffix: "observability.sentry-project",
+    canonicalName: "SENTRY_PROJECT",
+    aliases: ["SENTRY_PROJECT_NEXTJS"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry project slug for release uploads."
+  },
+  {
+    idSuffix: "observability.sentry-environment",
+    canonicalName: "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+    aliases: ["SENTRY_ENVIRONMENT"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry environment label."
+  },
+  {
+    idSuffix: "observability.sentry-release",
+    canonicalName: "NEXT_PUBLIC_SENTRY_RELEASE",
+    aliases: ["SENTRY_RELEASE"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry release label."
+  },
+  {
+    idSuffix: "observability.sentry-client-options",
+    canonicalName: "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE",
+    aliases: [
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_ENABLE_LOGS",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_SESSION_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_SEND_DEFAULT_PII",
+      "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE_NEXTJS"
+    ],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned public Sentry tuning values for Next.js client instrumentation."
+  },
+  {
+    idSuffix: "observability.sentry-webhook-secret",
+    canonicalName: "SENTRY_WEBHOOK_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-convex-deployment", "tenant-observability"],
+    description: "Tenant-owned Sentry webhook verification secret."
+  },
+  {
+    idSuffix: "lucern.gateway-api-key",
+    canonicalName: "LUCERN_API_KEY",
+    aliases: ["STACK_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-scoped Lucern/MC gateway API key for product front-door calls."
+  },
+  {
+    idSuffix: "lucern.gateway-base-url",
+    canonicalName: "LUCERN_BASE_URL",
+    aliases: ["LUCERN_API_BASE_URL", "LUCERN_GATEWAY_BASE_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Lucern/MC gateway base URL used by tenant product apps."
+  },
+  {
+    idSuffix: "lucern.proxy-token-secret",
+    canonicalName: "LUCERN_PROXY_TOKEN_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned secret for signing internal proxy/session tokens in product apps."
+  },
+  {
+    idSuffix: "tenant.integrations.linear-api-key",
+    canonicalName: "LINEAR_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned Linear API key for support/slash-command flows."
+  },
+  {
+    idSuffix: "tenant.vercel.bypass-token",
+    canonicalName: "VERCEL_AUTOMATION_BYPASS_SECRET",
+    aliases: ["NEXT_PUBLIC_VERCEL_BYPASS_TOKEN"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    description: "Tenant-owned Vercel automation bypass token. Public alias is legacy and should be removed from app code."
+  }
+];
+var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.filter(
+  (system) => TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS.includes(system.id)
+).flatMap(
+  (system) => TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: template.consumers,
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "github_actions",
+          target: `${system.repository.owner}/${system.repository.name}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+function tenantVercelConvexUrlWriteNames(system) {
+  const names = [system.convex.urlEnv, "NEXT_PUBLIC_CONVEX_URL"];
+  if (system.id === "stack-eng") {
+    return [...names, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return names;
+}
+function tenantRepositoryConvexUrlWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.urlEnv, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return [system.convex.urlEnv];
+}
+function tenantRepositoryConvexDeployKeyWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.deployKeyEnv, "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  return [system.convex.deployKeyEnv];
+}
+function tenantConvexUrlAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_PROD_URL",
+      "CONVEX_STACK_V2_PROD_URL",
+      "CONVEX_STACK_V2_STAGING_URL",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_CLOUD_URL",
+      "CONVEX_STACK_URL",
+      "CONVEX_URL",
+      "CONVEX_URL_DEVELOPMENT",
+      "CONVEX_URL_PRODUCTION",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_GRAPH_URL",
+      "LUCERN_PROD_URL",
+      "NEXT_PUBLIC_LUCERN_GRAPH_URL"
+    ];
+  }
+  return void 0;
+}
+function tenantConvexDeployKeyAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_STACK_V2_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_V2_STAGING_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_DEV_DEPLOY_KEY",
+      "CONVEX_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["CONVEX_DEPLOY_KEY", "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_GRAPH_DEPLOY_KEY",
+      "LUCERN_CONVEX_DEPLOY_KEY",
+      "LUCERN_DEV_DEPLOY_KEY",
+      "LUCERN_PROD_DEPLOY_KEY"
+    ];
+  }
+  return void 0;
+}
+var TENANT_GRAPH_PUBLIC_CONFIG_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => {
+    if (system.id === "lucern-graph") {
+      return [
+        {
+          id: "tenant.lucern-graph.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_ID",
+          aliases: ["NEXT_PUBLIC_LUCERN_TENANT_ID"],
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant id used by the standalone graph explorer."
+        },
+        {
+          id: "tenant.lucern-graph.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant label used by the standalone graph explorer."
+        }
+      ];
+    }
+    if (system.id === "stack-eng") {
+      return [
+        {
+          id: "tenant.stack-eng.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_ID",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant id used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant label used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.environment",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_ENV",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public environment label used by the graph explorer."
+        }
+      ];
+    }
+    return [];
+  }
+);
+var STACK_ENG_GRAPH_STORE_SECRET_DEFINITIONS = [
+  {
+    id: "tenant.stack-eng.neo4j.uri",
+    canonicalName: "NEO4J_URI",
+    aliases: ["NEO4J_ENG_URI"],
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph Neo4j runtime URI. NEO4J_ENG_URI is the source alias used to avoid StackOS front-office collisions."
+  },
+  {
+    id: "tenant.stack-eng.neo4j.user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_ENG_USER"],
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph Neo4j runtime user."
+  },
+  {
+    id: "tenant.stack-eng.neo4j.password",
+    canonicalName: "NEO4J_PASSWORD",
+    aliases: ["NEO4J_ENG_PASSWORD"],
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph Neo4j runtime password."
+  },
+  {
+    id: "tenant.stack-eng.neo4j.sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    owner: "tenant",
+    scope: "workspace",
+    sourcePath: "/tenants/stack/engineering",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
+    destinations: [
+      {
+        kind: "convex",
+        target: "small-oyster-270|bold-cuttlefish-804",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "vercel",
+        target: "stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos-engineering-graph",
+        environmentPolicy: "preprod_staging_prod_prod"
+      }
+    ],
+    description: "Stack engineering graph sync secret for Convex-to-HTTP graph query/sync calls."
+  }
+];
+var TENANT_CONVEX_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap((system) => [
+  {
+    id: `tenant.${system.id}.convex.url`,
+    canonicalName: system.convex.urlEnv,
+    aliases: tenantConvexUrlAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantVercelConvexUrlWriteNames(system)
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexUrlWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex URL. Pre-prod resolves to ${system.convex.preprodDeployment}; prod resolves to ${system.convex.prodDeployment}.`
+  },
+  {
+    id: `tenant.${system.id}.convex.deploy-key`,
+    canonicalName: system.convex.deployKeyEnv,
+    aliases: tenantConvexDeployKeyAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexDeployKeyWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex deploy/admin key. Never route to sibling workspaces.`
+  }
+]);
+var INFISICAL_SECRET_DEFINITIONS = [
+  ...PLATFORM_SECRET_DEFINITIONS,
+  ...PLATFORM_AI_SECRET_DEFINITIONS,
+  ...PLATFORM_LANGFUSE_SECRET_DEFINITIONS,
+  ...PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS,
+  ...PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS,
+  ...PLATFORM_SENTRY_SECRET_DEFINITIONS,
+  ...PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS,
+  ...PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS,
+  ...TENANT_SHARED_SECRET_DEFINITIONS,
+  ...TENANT_INSTALL_SECRET_DEFINITIONS,
+  ...TENANT_PRODUCT_RUNTIME_SECRET_DEFINITIONS,
+  ...TENANT_GRAPH_PUBLIC_CONFIG_SECRET_DEFINITIONS,
+  ...STACK_ENG_GRAPH_STORE_SECRET_DEFINITIONS,
+  ...TENANT_CONVEX_SECRET_DEFINITIONS
+];
+function findInfisicalSecretDefinition(secretId) {
+  return INFISICAL_SECRET_DEFINITIONS.find((secret) => secret.id === secretId);
+}
+function infisicalSecretDefinitionsForConsumer(consumer) {
+  return INFISICAL_SECRET_DEFINITIONS.filter(
+    (secret) => secret.consumers.includes(consumer)
+  );
+}
+function infisicalSecretDefinitionsForDestination(kind, target) {
+  return INFISICAL_SECRET_DEFINITIONS.filter(
+    (secret) => secret.destinations.some(
+      (destination) => destination.kind === kind && destination.target === target
+    )
+  );
+}
+function validateInfisicalSecretDefinitions(definitions = INFISICAL_SECRET_DEFINITIONS) {
+  const errors = [];
+  const ids = /* @__PURE__ */ new Set();
+  const platformOnlyNames = /* @__PURE__ */ new Set(["CONVEX_MC_URL", "CONVEX_MC_DEPLOY_KEY"]);
+  for (const definition of definitions) {
+    if (ids.has(definition.id)) {
+      errors.push(`Duplicate secret definition id: ${definition.id}`);
+    }
+    ids.add(definition.id);
+    if (!definition.canonicalName.startsWith("CONVEX_")) {
+      continue;
+    }
+    if (platformOnlyNames.has(definition.canonicalName)) {
+      if (definition.owner !== "lucern_platform") {
+        errors.push(`${definition.canonicalName} must be Lucern platform-owned.`);
+      }
+      for (const destination of definition.destinations) {
+        if (destination.kind === "vercel" && INFISICAL_TENANT_SOFTWARE_SYSTEMS.some(
+          (system) => system.vercelProjectName === destination.target
+        )) {
+          errors.push(
+            `${definition.canonicalName} must not route to tenant Vercel project ${destination.target}.`
+          );
+        }
+      }
+      continue;
+    }
+    const owner = INFISICAL_TENANT_SOFTWARE_SYSTEMS.find(
+      (system) => system.convex.urlEnv === definition.canonicalName || system.convex.deployKeyEnv === definition.canonicalName
+    );
+    if (!owner) {
+      errors.push(
+        `${definition.canonicalName} is a Convex variable without a tenant software owner.`
+      );
+      continue;
+    }
+    for (const destination of definition.destinations) {
+      if (destination.kind === "vercel" && destination.target !== owner.vercelProjectName) {
+        errors.push(
+          `${definition.canonicalName} routes to ${destination.target}; expected ${owner.vercelProjectName}.`
+        );
+      }
+    }
+  }
+  return errors;
 }
 
-export { INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, findInfisicalRuntimePath, findInfisicalRuntimeSurface };
+export { INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DEFINITIONS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, convexTierForVercelDestinationEnvironment, expectedTenantConvexDeploymentForVercelEnvironment, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalSecretDefinition, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, infisicalSecretDefinitionsForConsumer, infisicalSecretDefinitionsForDestination, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, validateInfisicalSecretDefinitions, vercelCustomEnvironmentIdForTenantSoftwareSystem };
 //# sourceMappingURL=infisical-runtime.contract.js.map
 //# sourceMappingURL=infisical-runtime.contract.js.map