@lucern/contracts 0.3.0-alpha.17 → 0.3.0-alpha.2

package/dist/infisical-runtime.contract.js

@@ -1,3235 +0,0 @@
-// src/tenant-client.contract.ts
-var TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH = "tenants/shared";
-var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
-  {
-    packageName: "@lucern/access-control",
-    role: "runtime_entrypoint",
-    directTenantImport: true
-  },
-  {
-    packageName: "@lucern/agent",
-    role: "platform_runtime",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/auth",
-    role: "sdk_dependency",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/cli",
-    role: "developer_tool",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/client-core",
-    role: "sdk_dependency",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/confidence",
-    role: "sdk_dependency",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/config",
-    role: "configuration",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/contracts",
-    role: "contract_entrypoint",
-    directTenantImport: true
-  },
-  {
-    packageName: "@lucern/control-plane",
-    role: "component_runtime",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/developer-kit",
-    role: "developer_tool",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/events",
-    role: "sdk_dependency",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/graph-primitives",
-    role: "sdk_dependency",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/graph-sync",
-    role: "host_addon_runtime",
-    directTenantImport: true
-  },
-  {
-    packageName: "@lucern/mcp",
-    role: "runtime_entrypoint",
-    directTenantImport: true
-  },
-  {
-    packageName: "@lucern/pack-host",
-    role: "platform_runtime",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/pack-installer",
-    role: "developer_tool",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/proof-compiler",
-    role: "developer_tool",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/react",
-    role: "runtime_entrypoint",
-    directTenantImport: true
-  },
-  {
-    packageName: "@lucern/reasoning-kernel",
-    role: "component_runtime",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/sdk",
-    role: "runtime_entrypoint",
-    directTenantImport: true
-  },
-  {
-    packageName: "@lucern/secrets",
-    role: "sdk_dependency",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/server-core",
-    role: "platform_runtime",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/testing",
-    role: "test_support",
-    directTenantImport: false
-  },
-  {
-    packageName: "@lucern/types",
-    role: "contract_entrypoint",
-    directTenantImport: true
-  }
-];
-TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
-  (entry) => entry.packageName
-);
-
-// src/infisical-runtime.contract.ts
-var INFISICAL_RUNTIME_CONTRACT_VERSION = "2026-05-06";
-var INFISICAL_RUNTIME_DEFAULT_API_URL = "https://app.infisical.com";
-var INFISICAL_RUNTIME_DEFAULT_PROJECT_ID = "344b0526-90df-4606-ba50-22c647a36c65";
-var INFISICAL_RUNTIME_ENVIRONMENTS = [
-  "dev",
-  "staging",
-  "prod"
-];
-var INFISICAL_RUNTIME_DELIVERY_MODES = [
-  "vercel_sync",
-  "runtime_fetch",
-  "device_auth"
-];
-var INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS = [
-  "development",
-  "preview",
-  "staging",
-  "production"
-];
-var INFISICAL_VERCEL_TARGETS = [
-  "development",
-  "preview",
-  "production"
-];
-var INFISICAL_CONVEX_TIERS = ["preprod", "prod"];
-var INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT = {
-  development: "preprod",
-  preview: "preprod",
-  staging: "preprod",
-  production: "prod"
-};
-var INFISICAL_VERCEL_SYNC_RECONCILIATION = {
-  sourceOfTruth: "infisical",
-  writer: "vercel_api",
-  disableSecretDeletion: false,
-  pruneDestinationKeys: true
-};
-var INFISICAL_VERCEL_SYNC_DESTINATIONS = [
-  {
-    environment: "development",
-    vercelTarget: "development",
-    convexTier: "preprod"
-  },
-  {
-    environment: "preview",
-    vercelTarget: "preview",
-    convexTier: "preprod"
-  },
-  {
-    environment: "staging",
-    vercelTarget: "preview",
-    convexTier: "preprod",
-    customEnvironmentSlug: "staging",
-    customEnvironmentIdsByProjectName: {
-      stackos: "env_RbS0TYRRvWISTje8qR4u2lRg7TC8"
-    },
-    domainsByProjectName: {
-      stackos: "staging.stack.vc"
-    }
-  },
-  {
-    environment: "production",
-    vercelTarget: "production",
-    convexTier: "prod"
-  }
-];
-var INFISICAL_RUNTIME_SURFACE_IDS = [
-  "lucern-web",
-  "lucern-gateway",
-  "lucern-sdk",
-  "lucern-cli",
-  "lucern-mcp",
-  "tenant-client"
-];
-var INFISICAL_RUNTIME_BOOTSTRAP_ENV = {
-  apiUrl: ["INFISICAL_API_URL", "INFISICAL_URL"],
-  projectId: ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"],
-  clientId: [
-    "INFISICAL_CLIENT_ID",
-    "INFISICAL_MACHINE_CLIENT_ID",
-    "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"
-  ],
-  clientSecret: [
-    "INFISICAL_CLIENT_SECRET",
-    "INFISICAL_MACHINE_CLIENT_SECRET",
-    "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"
-  ],
-  environment: ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"],
-  organizationSlug: ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"],
-  disabled: ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"]
-};
-var INFISICAL_RUNTIME_CONTROL_ENV = [
-  {
-    name: "NODE_ENV",
-    category: "framework",
-    description: "Node/Next runtime mode. Framework-owned, not written by Infisical."
-  },
-  {
-    name: "CI",
-    category: "ci",
-    description: "CI execution signal. Workflow-owned, not written by Infisical."
-  },
-  {
-    name: "VERCEL",
-    category: "vercel",
-    description: "Vercel runtime signal. Platform-owned, not written by Infisical."
-  },
-  {
-    name: "VERCEL_ENV",
-    category: "vercel",
-    description: "Vercel environment label used for build/runtime selection."
-  },
-  {
-    name: "VERCEL_URL",
-    category: "vercel",
-    description: "Vercel deployment URL supplied by Vercel for previews and builds."
-  },
-  {
-    name: "VERCEL_GIT_COMMIT_SHA",
-    category: "vercel",
-    description: "Vercel git metadata used for release labels. Platform-owned, not written by Infisical."
-  },
-  {
-    name: "NEXT_RUNTIME",
-    category: "nextjs",
-    description: "Next.js runtime selector for node/edge instrumentation modules."
-  },
-  {
-    name: "PORT",
-    category: "framework",
-    description: "Local/server port supplied by the runtime process manager."
-  },
-  {
-    name: "HOST",
-    category: "framework",
-    description: "Local/server host supplied by the runtime process manager."
-  },
-  {
-    name: "APP_URL",
-    category: "compatibility",
-    description: "Legacy local app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL."
-  },
-  {
-    name: "NEXT_PUBLIC_APP_URL",
-    category: "compatibility",
-    description: "Legacy public app URL fallback. Prefer LUCERN_LOGIN_BASE_URL or LUCERN_API_URL."
-  },
-  {
-    name: "CLAUDE_PROJECT_DIR",
-    category: "agent_local",
-    description: "Local agent workspace hint. Agent-runtime-owned, not written by Infisical."
-  },
-  {
-    name: "HOME",
-    category: "os",
-    description: "Operating-system home directory used only for local credential discovery."
-  },
-  {
-    name: "USERPROFILE",
-    category: "os",
-    description: "Windows home directory used only for local credential discovery."
-  }
-];
-var INFISICAL_RUNTIME_PATHS = [
-  {
-    id: "platform-auth",
-    secretPath: "/platform/auth",
-    description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.",
-    variables: [
-      {
-        name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
-        required: true,
-        secret: false,
-        public: true,
-        description: "Clerk publishable key for the Lucern web origin."
-      },
-      {
-        name: "CLERK_SECRET_KEY",
-        required: true,
-        secret: true,
-        public: false,
-        description: "Clerk backend secret key for Lucern server runtimes."
-      },
-      {
-        name: "CLERK_JWT_ISSUER_DOMAIN",
-        required: false,
-        secret: false,
-        public: false,
-        description: "Expected Clerk issuer/JWKS domain for JWT verification."
-      },
-      {
-        name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
-        required: false,
-        secret: false,
-        public: true,
-        description: "Public sign-in URL for Lucern-owned web flows."
-      },
-      {
-        name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
-        required: false,
-        secret: false,
-        public: true,
-        description: "Public sign-up URL for Lucern-owned web flows."
-      }
-    ]
-  },
-  {
-    id: "platform-runtime",
-    secretPath: "/platform/runtime",
-    description: "Runtime defaults shared by server-side Lucern clients and operator tooling.",
-    variables: [
-      {
-        name: "LUCERN_API_URL",
-        required: true,
-        secret: false,
-        public: false,
-        aliases: ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"],
-        description: "Canonical Lucern API gateway URL."
-      },
-      {
-        name: "LUCERN_LOGIN_BASE_URL",
-        required: false,
-        secret: false,
-        public: false,
-        aliases: ["LUCERN_AUTH_BASE_URL"],
-        description: "Browser login origin used when it differs from the API."
-      },
-      {
-        name: "LUCERN_ENVIRONMENT",
-        required: false,
-        secret: false,
-        public: false,
-        aliases: ["LUCERN_ENV"],
-        description: "Lucern environment label consumed by CLI profiles."
-      },
-      {
-        name: "LUCERN_CLI_SESSION_TTL_MS",
-        required: false,
-        secret: false,
-        public: false,
-        description: "Optional web-issued CLI login session lifetime override in milliseconds."
-      }
-    ]
-  },
-  {
-    id: "platform-operator-credentials",
-    secretPath: "/platform/runtime",
-    description: "Lucern-owned operator credential material for local CLI, MCP, and SDK sessions.",
-    variables: [
-      {
-        name: "LUCERN_API_KEY",
-        required: false,
-        secret: true,
-        public: false,
-        aliases: ["LUCERN_KEY"],
-        description: "Lucern-owned operator API key for gateway calls from trusted local tooling."
-      }
-    ]
-  },
-  {
-    id: "tenant-shared-install",
-    secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
-    description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.",
-    variables: [
-      {
-        name: "INSTALL_LUCERN_NPM",
-        required: true,
-        secret: true,
-        public: false,
-        description: "Read-only install token for the published @lucern/* suite."
-      }
-    ]
-  }
-];
-var INFISICAL_RUNTIME_SURFACES = [
-  {
-    id: "lucern-web",
-    delivery: "vercel_sync",
-    sourcePathIds: ["platform-auth", "platform-runtime"],
-    consumer: "apps/web on Vercel project lucern",
-    description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs."
-  },
-  {
-    id: "lucern-gateway",
-    delivery: "vercel_sync",
-    fallback: "runtime_fetch",
-    sourcePathIds: ["platform-auth", "platform-runtime"],
-    consumer: "apps/gateway on Vercel project lucern-gateway",
-    description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs and may self-hydrate from Infisical when the host environment has scoped bootstrap credentials."
-  },
-  {
-    id: "lucern-sdk",
-    packageName: "@lucern/sdk",
-    delivery: "runtime_fetch",
-    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
-    consumer: "server-side SDK operator contexts with a scoped Infisical identity",
-    description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials."
-  },
-  {
-    id: "lucern-cli",
-    packageName: "@lucern/cli",
-    delivery: "runtime_fetch",
-    fallback: "device_auth",
-    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
-    consumer: "developer/operator CLI processes",
-    description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login."
-  },
-  {
-    id: "lucern-mcp",
-    packageName: "@lucern/mcp",
-    delivery: "runtime_fetch",
-    fallback: "device_auth",
-    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
-    consumer: "MCP server/client processes",
-    description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner."
-  },
-  {
-    id: "tenant-client",
-    delivery: "device_auth",
-    sourcePathIds: ["tenant-shared-install"],
-    consumer: "tenant-owned apps and coding agents",
-    description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces."
-  }
-];
-var INFISICAL_TENANT_SOFTWARE_SYSTEMS = [
-  {
-    id: "stack-frontend",
-    tenantKey: "stack",
-    workspaceKey: "frontend",
-    vercelProjectName: "ai-chatbot-diao",
-    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
-    vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517",
-    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
-    repository: {
-      owner: "stack-vc",
-      name: "front-end"
-    },
-    sharedSourcePath: "/tenants/stack",
-    sharedVariablePolicy: "tenant_shared_all_systems",
-    convex: {
-      urlEnv: "CONVEX_FRONTEND_URL",
-      deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY",
-      preprodDeployment: "rugged-lobster-664",
-      prodDeployment: "wonderful-toucan-0"
-    }
-  },
-  {
-    id: "stackos",
-    tenantKey: "stack",
-    workspaceKey: "stackos",
-    vercelProjectName: "stackos",
-    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
-    vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau",
-    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
-    repository: {
-      owner: "stack-vc",
-      name: "stackos"
-    },
-    sharedSourcePath: "/tenants/stack",
-    sharedVariablePolicy: "tenant_shared_all_systems",
-    convex: {
-      urlEnv: "CONVEX_STACKOS_URL",
-      deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY",
-      preprodDeployment: "giant-mandrill-761",
-      prodDeployment: "good-snake-515"
-    }
-  },
-  {
-    id: "stack-eng",
-    tenantKey: "stack",
-    workspaceKey: "engineering",
-    vercelProjectName: "stackos-engineering-graph",
-    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
-    vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ",
-    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
-    repository: {
-      owner: "stack-vc",
-      name: "stackos-engineering-graph"
-    },
-    sharedSourcePath: "/tenants/stack/engineering",
-    sharedVariablePolicy: "tenant_shared_all_systems",
-    convex: {
-      urlEnv: "CONVEX_STACK_ENG_URL",
-      deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY",
-      preprodDeployment: "small-oyster-270",
-      prodDeployment: "bold-cuttlefish-804"
-    }
-  },
-  {
-    id: "lucern-graph",
-    tenantKey: "lucern",
-    workspaceKey: "lucern",
-    vercelProjectName: "lucern-graph",
-    vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY",
-    vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ",
-    vercelWriterTokenEnv: "LUCERN_VERCEL_TOKEN",
-    repository: {
-      owner: "LucernAI",
-      name: "lucern-graph"
-    },
-    sharedSourcePath: "/tenants/lucern/shared",
-    sharedVariablePolicy: "tenant_shared_all_systems",
-    convex: {
-      urlEnv: "CONVEX_LUCERN_URL",
-      deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY",
-      preprodDeployment: "good-blackbird-774",
-      prodDeployment: "precious-dog-365"
-    }
-  }
-];
-function findInfisicalTenantSoftwareSystem(systemId) {
-  return INFISICAL_TENANT_SOFTWARE_SYSTEMS.find(
-    (system) => system.id === systemId
-  );
-}
-function tenantSoftwareSystemConvexEnvNames(systemId) {
-  const system = findInfisicalTenantSoftwareSystem(systemId);
-  if (!system) {
-    throw new Error(`Unknown tenant software system: ${systemId}.`);
-  }
-  return [system.convex.urlEnv, system.convex.deployKeyEnv];
-}
-function tenantSoftwareSystemOwnsConvexEnvName(systemId, envName) {
-  return tenantSoftwareSystemConvexEnvNames(systemId).includes(envName);
-}
-function convexTierForVercelDestinationEnvironment(environment) {
-  return INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT[environment];
-}
-function findInfisicalVercelSyncDestination(environment) {
-  return INFISICAL_VERCEL_SYNC_DESTINATIONS.find(
-    (destination) => destination.environment === environment
-  );
-}
-function vercelCustomEnvironmentIdForTenantSoftwareSystem(systemId, environment) {
-  const system = findInfisicalTenantSoftwareSystem(systemId);
-  const destination = findInfisicalVercelSyncDestination(environment);
-  if (!system || !destination) {
-    return void 0;
-  }
-  return destination.customEnvironmentIdsByProjectName?.[system.vercelProjectName];
-}
-function expectedTenantConvexDeploymentForVercelEnvironment(systemId, environment) {
-  const system = findInfisicalTenantSoftwareSystem(systemId);
-  if (!system) {
-    throw new Error(`Unknown tenant software system: ${systemId}.`);
-  }
-  return convexTierForVercelDestinationEnvironment(environment) === "prod" ? system.convex.prodDeployment : system.convex.preprodDeployment;
-}
-function findInfisicalRuntimePath(pathId) {
-  return INFISICAL_RUNTIME_PATHS.find((path) => path.id === pathId);
-}
-function findInfisicalRuntimeSurface(surfaceId) {
-  return INFISICAL_RUNTIME_SURFACES.find((surface) => surface.id === surfaceId);
-}
-var INFISICAL_SECRET_OWNERS = [
-  "lucern_platform",
-  "tenant",
-  "provider",
-  "operator_local"
-];
-var INFISICAL_SECRET_SCOPES = [
-  "global",
-  "environment",
-  "tenant",
-  "workspace",
-  "software_system",
-  "deployment",
-  "local"
-];
-var INFISICAL_SECRET_ENVIRONMENT_POLICIES = [
-  "same_all_environments",
-  "environment_specific",
-  "preprod_staging_prod_prod",
-  "local_only"
-];
-var INFISICAL_SECRET_CONSUMERS = [
-  "lucern-web",
-  "lucern-gateway",
-  "lucern-mcp",
-  "lucern-cli",
-  "lucern-ai-runtime",
-  "lucern-graph-sync",
-  "lucern-observability",
-  "lucern-repo-ci",
-  "mc-convex",
-  "mc-operator-tooling",
-  "tenant-vercel-app",
-  "tenant-convex-deployment",
-  "tenant-ai-runtime",
-  "tenant-graph-sync",
-  "tenant-observability",
-  "tenant-vector-store",
-  "tenant-deploy-tooling",
-  "tenant-agent-runtime"
-];
-var INFISICAL_SECRET_DESTINATION_KINDS = [
-  "vercel",
-  "convex",
-  "github_actions",
-  "runtime_fetch",
-  "operator_local"
-];
-var PLATFORM_SECRET_DEFINITIONS = [
-  {
-    id: "platform.clerk.publishable",
-    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
-    aliases: ["CLERK_PUBLISHABLE_KEY"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/auth",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: false,
-    public: true,
-    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "hosted-mcp-oauth",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Clerk browser key for platform web, gateway, and hosted MCP OAuth flows."
-  },
-  {
-    id: "platform.clerk.secret",
-    canonicalName: "CLERK_SECRET_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/auth",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "hosted-mcp-oauth",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Clerk backend secret. Never route to tenant-owned apps unless that tenant is Lucern itself."
-  },
-  {
-    id: "platform.clerk.project",
-    canonicalName: "CLERK_PROJECT_ID",
-    aliases: ["LUCERN_CLERK_PROJECT_ID"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/auth",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: false,
-    public: false,
-    consumers: ["lucern-gateway", "mc-convex"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "convex",
-        target: "master-control",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities."
-  },
-  {
-    id: "platform.clerk.webhook-secret",
-    canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET",
-    aliases: ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/auth",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["lucern-gateway"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit."
-  },
-  {
-    id: "platform.clerk.jwks",
-    canonicalName: "CLERK_JWKS_URL",
-    aliases: ["CLERK_JWT_ISSUER_DOMAIN"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/auth",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-mcp", "lucern-gateway"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-mcp",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional Clerk JWKS/issuer override for server-side token verification."
-  },
-  {
-    id: "platform.runtime.api-base-url",
-    canonicalName: "LUCERN_API_URL",
-    aliases: ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: false,
-    public: false,
-    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "lucern-cli-mcp-sdk",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Canonical Lucern API gateway base URL. Older names remain aliases only."
-  },
-  {
-    id: "platform.runtime.login-base-url",
-    canonicalName: "LUCERN_LOGIN_BASE_URL",
-    aliases: ["LUCERN_AUTH_BASE_URL", "LUCERN_WEB_BASE_URL"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-gateway", "lucern-mcp", "lucern-cli"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "lucern-cli-mcp-sdk",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Browser login origin used when device/OAuth login is not served by the API base URL."
-  },
-  {
-    id: "platform.runtime.environment",
-    canonicalName: "LUCERN_ENVIRONMENT",
-    aliases: ["LUCERN_ENV"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "lucern-cli-mcp-sdk",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern runtime environment label."
-  },
-  {
-    id: "platform.runtime.require-deployment-host-registry",
-    canonicalName: "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-gateway"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Fail-closed gateway toggle that requires MC deployment host registry resolution before routing."
-  },
-  {
-    id: "platform.mc.convex-url",
-    canonicalName: "CONVEX_MC_URL",
-    aliases: [
-      "CONVEX_MC_PROD_URL",
-      "LUCERN_ADMIN_CONVEX_URL",
-      "LUCERN_CONVEX_URL",
-      "MC_CONVEX_URL"
-    ],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/mc",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: false,
-    public: false,
-    consumers: ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Master Control Convex URL. Prod must point to successful-clam-833; dev/staging to utmost-ox-403."
-  },
-  {
-    id: "platform.mc.convex-deploy-key",
-    canonicalName: "CONVEX_MC_DEPLOY_KEY",
-    aliases: [
-      "CONVEX_MC_PROD_DEPLOY_KEY",
-      "LUCERN_ADMIN_DEPLOY_KEY",
-      "LUCERN_DEPLOY_KEY",
-      "MC_DEPLOY_KEY",
-      "MC_PROD_DEPLOY_KEY"
-    ],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/mc",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Master Control deploy/admin key. Never route to tenant Vercel projects or tenant Convex deployments."
-  },
-  {
-    id: "platform.mc.session-token-secret",
-    canonicalName: "LUCERN_SESSION_TOKEN_SECRET",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/mc",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["lucern-mcp", "mc-convex", "lucern-gateway"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "master-control",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "hosted-mcp-oauth",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Signs Lucern platform session/delegation tokens. This is platform-owned, not tenant-owned."
-  },
-  {
-    id: "platform.mc.tenant-secret-encryption-key",
-    canonicalName: "LUCERN_TENANT_SECRET_ENCRYPTION_KEY",
-    aliases: ["LUCERN_SESSION_TOKEN_SECRET"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/mc",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["mc-convex", "mc-operator-tooling"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "master-control",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "mc-credential-maintenance",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Encrypts tenant deployment credentials stored in MC. Session-token fallback is legacy only."
-  },
-  {
-    id: "platform.permit.api-key",
-    canonicalName: "LUCERN_PERMIT_API_KEY",
-    aliases: ["PERMIT_API_KEY"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/permit",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "master-control",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "hosted-mcp-oauth",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing."
-  },
-  {
-    id: "platform.permit.webhook-secret",
-    canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET",
-    aliases: ["PERMIT_WEBHOOK_SECRET"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/permit",
-    environmentPolicy: "environment_specific",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["mc-convex", "lucern-gateway", "mc-operator-tooling"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "master-control",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "mc-credential-maintenance",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing."
-  },
-  {
-    id: "platform.permit.pdp-url",
-    canonicalName: "LUCERN_PERMIT_PDP_URL",
-    aliases: ["PERMIT_PDP_URL"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/permit",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "master-control",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "hosted-mcp-oauth",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional Permit PDP URL override."
-  },
-  {
-    id: "platform.permit.api-url",
-    canonicalName: "LUCERN_PERMIT_API_URL",
-    aliases: ["PERMIT_API_URL"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/permit",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["mc-convex", "lucern-mcp", "lucern-gateway"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "master-control",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "runtime_fetch",
-        target: "hosted-mcp-oauth",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional Permit API URL override."
-  },
-  {
-    id: "platform.ci.infisical-bootstrap-client-id",
-    canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_ID",
-    aliases: ["INFISICAL_CI_CLIENT_ID"],
-    owner: "provider",
-    scope: "environment",
-    sourcePath: "/platform/ci",
-    environmentPolicy: "same_all_environments",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Machine identity client id used by CI to reconcile Infisical desired state."
-  },
-  {
-    id: "platform.ci.infisical-bootstrap-client-secret",
-    canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_SECRET",
-    aliases: ["INFISICAL_CI_CLIENT_SECRET"],
-    owner: "provider",
-    scope: "environment",
-    sourcePath: "/platform/ci",
-    environmentPolicy: "same_all_environments",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Machine identity client secret used by CI to reconcile Infisical desired state."
-  },
-  {
-    id: "platform.publish.npm-token",
-    canonicalName: "NPM_TOKEN",
-    aliases: ["NODE_AUTH_TOKEN"],
-    owner: "provider",
-    scope: "environment",
-    sourcePath: "/platform/publish",
-    environmentPolicy: "same_all_environments",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Package publish/install token for @lucern/* release automation."
-  }
-];
-var PLATFORM_AI_SECRET_DEFINITIONS = [
-  {
-    id: "platform.ai.openai-api-key",
-    canonicalName: "OPENAI_API_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/ai",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation."
-  },
-  {
-    id: "platform.ai.anthropic-api-key",
-    canonicalName: "ANTHROPIC_API_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/ai",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Anthropic key for platform AI jobs, benchmarks, and controlled operator automation."
-  },
-  {
-    id: "platform.ai.gemini-api-key",
-    canonicalName: "GEMINI_API_KEY",
-    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/ai",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Google/Gemini key. Google alias names are read compatibility only."
-  }
-];
-var PLATFORM_LANGFUSE_SECRET_DEFINITIONS = [
-  {
-    id: "platform.langfuse.secret-key",
-    canonicalName: "LANGFUSE_SECRET_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/observability/langfuse",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing."
-  },
-  {
-    id: "platform.langfuse.public-key",
-    canonicalName: "LANGFUSE_PUBLIC_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/observability/langfuse",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY."
-  },
-  {
-    id: "platform.langfuse.base-url",
-    canonicalName: "LANGFUSE_BASE_URL",
-    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/observability/langfuse",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases."
-  }
-];
-var PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS = [
-  {
-    id: "platform.neo4j.uri",
-    canonicalName: "NEO4J_URI",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Neo4j URI for platform graph-sync surfaces."
-  },
-  {
-    id: "platform.neo4j.user",
-    canonicalName: "NEO4J_USER",
-    aliases: ["NEO4J_USERNAME"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Neo4j username for platform graph-sync surfaces."
-  },
-  {
-    id: "platform.neo4j.password",
-    canonicalName: "NEO4J_PASSWORD",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Neo4j password for platform graph-sync surfaces."
-  },
-  {
-    id: "platform.neo4j.sync-secret",
-    canonicalName: "NEO4J_SYNC_SECRET",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls."
-  },
-  {
-    id: "platform.neo4j.database",
-    canonicalName: "NEO4J_DATABASE",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces."
-  }
-];
-var PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS = [
-  {
-    id: "platform.pinecone.api-key",
-    canonicalName: "PINECONE_API_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/vector/pinecone",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Pinecone API key for platform vector search."
-  },
-  {
-    id: "platform.pinecone.index-name",
-    canonicalName: "PINECONE_INDEX_NAME",
-    aliases: ["PINECONE_INDEX"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/vector/pinecone",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Pinecone index name."
-  },
-  {
-    id: "platform.pinecone.host",
-    canonicalName: "PINECONE_HOST",
-    aliases: ["PINECONE_INDEX_HOST"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/vector/pinecone",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Pinecone host/index host."
-  }
-];
-var PLATFORM_SENTRY_SECRET_DEFINITIONS = [
-  {
-    id: "platform.sentry.dsn",
-    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
-    aliases: ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN_NEXTJS"],
-    owner: "provider",
-    scope: "environment",
-    sourcePath: "/platform/observability/sentry",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: true,
-    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Sentry DSN for browser/server error telemetry."
-  },
-  {
-    id: "platform.sentry.auth-token",
-    canonicalName: "SENTRY_AUTH_TOKEN",
-    owner: "provider",
-    scope: "environment",
-    sourcePath: "/platform/observability/sentry",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci", "lucern-observability"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      },
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Sentry release-upload token. Runtime services must not use it for authorization."
-  },
-  {
-    id: "platform.sentry.org",
-    canonicalName: "SENTRY_ORG",
-    aliases: ["SENTRY_ORG_SLUG"],
-    owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/observability/sentry",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-repo-ci", "lucern-observability"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      },
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Sentry organization slug for Lucern release uploads."
-  },
-  {
-    id: "platform.sentry.project",
-    canonicalName: "SENTRY_PROJECT",
-    aliases: ["SENTRY_PROJECT_NEXTJS"],
-    owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/observability/sentry",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-repo-ci", "lucern-observability"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      },
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Sentry project slug for Lucern release uploads."
-  },
-  {
-    id: "platform.sentry.environment",
-    canonicalName: "SENTRY_ENVIRONMENT",
-    aliases: ["NEXT_PUBLIC_SENTRY_ENVIRONMENT"],
-    owner: "provider",
-    scope: "environment",
-    sourcePath: "/platform/observability/sentry",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "environment_specific",
-        writeNames: ["SENTRY_ENVIRONMENT", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"]
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Sentry environment label."
-  },
-  {
-    id: "platform.sentry.release",
-    canonicalName: "SENTRY_RELEASE",
-    aliases: ["NEXT_PUBLIC_SENTRY_RELEASE"],
-    owner: "provider",
-    scope: "environment",
-    sourcePath: "/platform/observability/sentry",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern",
-        environmentPolicy: "environment_specific",
-        writeNames: ["SENTRY_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"]
-      },
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Sentry release name."
-  }
-];
-var PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS = [
-  {
-    id: "platform.deploy.vercel-token",
-    canonicalName: "VERCEL_TOKEN",
-    owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/deploy/vercel",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      },
-      {
-        kind: "operator_local",
-        target: "secret-sync-writer",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps."
-  },
-  {
-    id: "platform.deploy.vercel-token.stack",
-    canonicalName: "STACK_VERCEL_TOKEN",
-    owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/deploy/vercel",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "operator_local",
-        target: "secret-sync-writer",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Stack Vercel API token for manifest-scoped Stack tenant Vercel secret sync. Never copy into tenant apps."
-  },
-  {
-    id: "platform.deploy.vercel-token.lucern",
-    canonicalName: "LUCERN_VERCEL_TOKEN",
-    owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/deploy/vercel",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "operator_local",
-        target: "secret-sync-writer",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Lucern Vercel API token for manifest-scoped Lucern tenant Vercel secret sync. Never copy into tenant apps."
-  },
-  {
-    id: "platform.deploy.vercel-org-id",
-    canonicalName: "VERCEL_ORG_ID",
-    owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/deploy/vercel",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      },
-      {
-        kind: "operator_local",
-        target: "secret-sync-writer",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Vercel team/org id used by deployment and sync automation."
-  }
-];
-var PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS = [
-  {
-    id: "platform.docs.gap-audit-api-key",
-    canonicalName: "DOC_GAP_AUDIT_API_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/docs",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional model key for docs gap audits."
-  },
-  {
-    id: "platform.docs.gap-audit-provider",
-    canonicalName: "DOC_GAP_AUDIT_PROVIDER",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/docs",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional docs gap audit provider selector."
-  },
-  {
-    id: "platform.docs.gap-audit-model",
-    canonicalName: "DOC_GAP_AUDIT_MODEL",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/docs",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional docs gap audit model selector."
-  },
-  {
-    id: "platform.infisical.local-cli",
-    canonicalName: "INFISICAL_BIN",
-    aliases: ["INFISICAL_API_URL", "INFISICAL_URL"],
-    owner: "lucern_platform",
-    scope: "global",
-    sourcePath: "/platform/infisical",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["mc-operator-tooling", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Operator-only Infisical CLI/API location knobs. Machine credentials are handled by the bootstrap contract."
-  },
-  {
-    id: "platform.gateway.device-verification-base-url",
-    canonicalName: "LUCERN_DEVICE_VERIFICATION_BASE_URL",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-gateway"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Base URL shown during Lucern CLI/device authentication."
-  },
-  {
-    id: "platform.gateway.mode",
-    canonicalName: "LUCERN_GATEWAY_MODE",
-    aliases: ["LUCERN_GATEWAY_ENV"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-gateway", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: "lucern-gateway",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Gateway runtime mode/environment label."
-  },
-  {
-    id: "platform.mcp.runtime",
-    canonicalName: "LUCERN_MCP_URL",
-    aliases: [
-      "LUCERN_AGENT_IDENTITY",
-      "LUCERN_HTTP_HOST",
-      "LUCERN_HTTP_PORT",
-      "LUCERN_MCP_ALLOW_API_KEY_PASSTHROUGH",
-      "LUCERN_MCP_DEBUG",
-      "LUCERN_MCP_DIAGNOSTICS_FILE",
-      "LUCERN_MCP_HEALTH_PATH",
-      "LUCERN_MCP_HEALTH_URL",
-      "LUCERN_MCP_HOST",
-      "LUCERN_MCP_PATH",
-      "LUCERN_MCP_PORT",
-      "LUCERN_MCP_QUIET",
-      "LUCERN_MCP_TRANSPORT",
-      "LUCERN_PROFILE",
-      "LUCERN_PUBLIC_URL",
-      "MCP_SERVER_URL"
-    ],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-mcp", "lucern-cli", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-cli-mcp-sdk",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern MCP/CLI runtime knobs. Aliases are compatibility names and not Vercel write names."
-  },
-  {
-    id: "platform.mcp.auth-token",
-    canonicalName: "LUCERN_MCP_SERVER_AUTH_TOKEN",
-    aliases: ["LUCERN_USER_TOKEN", "MCP_SERVER_TOKEN"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-mcp", "lucern-cli", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-cli-mcp-sdk",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead."
-  },
-  {
-    id: "platform.operator.api-key",
-    canonicalName: "LUCERN_API_KEY",
-    aliases: ["LUCERN_KEY"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-cli", "lucern-mcp", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-cli-mcp-sdk",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
-  },
-  {
-    id: "platform.graph-sync.proxy",
-    canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL",
-    aliases: [
-      "LUCERN_DEFAULT_TENANT_ID",
-      "LUCERN_GRAPH_SYNC_ALLOWED_PROXY_HOSTS"
-    ],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Graph-sync proxy URL, tenant filter, and allowed host list."
-  },
-  {
-    id: "platform.package-smoke.local",
-    canonicalName: "LUCERN_SDK_NPM_TOKEN",
-    aliases: [
-      "LUCERN_KERNEL_INSTALL_SPEC",
-      "LUCERN_KERNEL_KEEP_CLEANROOM",
-      "LUCERN_KERNEL_LOCAL_TARBALL",
-      "LUCERN_KERNEL_NPM_TOKEN",
-      "LUCERN_KERNEL_SCOPE_REGISTRY",
-      "LUCERN_KERNEL_SKIP_CONVEX",
-      "LUCERN_SDK_INSTALL_SPEC",
-      "LUCERN_SDK_KEEP_CLEANROOM",
-      "LUCERN_SDK_LOCAL_TARBALL",
-      "LUCERN_SDK_SCOPE_REGISTRY",
-      "LUCERN_SDK_SKIP_LIVE"
-    ],
-    owner: "lucern_platform",
-    scope: "global",
-    sourcePath: "/platform/package-publish",
-    environmentPolicy: "same_all_environments",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: "Private package install smoke-test knobs. Values are not tenant runtime variables."
-  },
-  {
-    id: "platform.convex-deploy.local-names",
-    canonicalName: "LUCERN_CONVEX_DEPLOYMENT_NAME",
-    aliases: [
-      "CONVEX_DEPLOYMENT",
-      "CONVEX_DEV_DEPLOYMENT_NAME",
-      "CONVEX_PROD_DEPLOYMENT_NAME"
-    ],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/deploy/convex",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["mc-operator-tooling", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Operator-only Convex deployment name hints. Deploy keys and URLs remain separately scoped."
-  },
-  {
-    id: "platform.sdk.local-context",
-    canonicalName: "LUCERN_TENANT_ID",
-    aliases: [
-      "LUCERN_AGENT_DISPLAY_NAME",
-      "LUCERN_AGENT_ID",
-      "LUCERN_API_ENVIRONMENT",
-      "LUCERN_PACK_KEY",
-      "LUCERN_PROJECT_ID",
-      "LUCERN_TOPIC_ID",
-      "LUCERN_WORKSPACE_ID",
-      "LUCERN_WORKTREE_ID"
-    ],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-cli", "lucern-mcp", "tenant-agent-runtime"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-cli-mcp-sdk",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves."
-  },
-  {
-    id: "platform.debug.local-flags",
-    canonicalName: "LUCERN_FUNCTIONAL_DEBUG",
-    aliases: [
-      "LUCERN_CONTRACTS_SKIP_DTS",
-      "LUCERN_DEPLOY_RECONCILIATION_DEBUG",
-      "LUCERN_ENABLE_ADAPTIVE_LEARNING",
-      "LUCERN_ENV_FILE",
-      "LUCERN_EXAMPLE_DEBUG",
-      "LUCERN_HTTP_SMOKE_DEBUG",
-      "LUCERN_MULTI_TENANT",
-      "LUCERN_PACK_ACTION_DEBUG",
-      "LUCERN_RUN_LIVE_MCP"
-    ],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/runtime/debug",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-repo-ci", "mc-operator-tooling"],
-    destinations: [
-      {
-        kind: "operator_local",
-        target: "lucern-repo",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Local or CI debug toggles. They are manifest-known but not tenant runtime secrets."
-  },
-  {
-    id: "tenant.stackos.deploy-guard.local",
-    canonicalName: "STACKOS_DEPLOY_TARGET",
-    aliases: [
-      "STACKOS_DEPLOY_ENTRYPOINT",
-      "STACKOS_EXPECTED_STAGING_COMMIT",
-      "STACKOS_PROD_CUTOVER_APPROVED",
-      "STACKOS_REPO_PATH",
-      "STACKOS_REQUIRE_CHAT_RUNTIME",
-      "STACKOS_SLOP_SCAN_BASELINE",
-      "STACKOS_STAGING_API_KEY",
-      "STACKOS_STAGING_BASE_URL",
-      "STACK_DEPLOY_RECONCILIATION_SCHEMA_JSON"
-    ],
-    owner: "tenant",
-    scope: "software_system",
-    sourcePath: "/tenants/stack",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-deploy-tooling", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "operator_local",
-        target: "stackos-deploy-guard",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "stack-vc/stackos",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "StackOS deploy/test guard variables. These are not written into the StackOS Vercel runtime."
-  }
-];
-var TENANT_SHARED_SECRET_DEFINITION_TEMPLATES = [
-  {
-    idSuffix: "clerk.publishable",
-    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
-    aliases: ["CLERK_PUBLISHABLE_KEY"],
-    required: true,
-    secret: false,
-    public: true,
-    description: "Tenant-owned Clerk browser key. For Stack this is the master clerk.stack.vc project shared by front-end, StackOS, and the engineering workspace."
-  },
-  {
-    idSuffix: "clerk.secret",
-    canonicalName: "CLERK_SECRET_KEY",
-    required: true,
-    secret: true,
-    public: false,
-    description: "Tenant-owned Clerk backend secret used only by that tenant's server runtimes."
-  },
-  {
-    idSuffix: "clerk.project",
-    canonicalName: "CLERK_PROJECT_ID",
-    required: true,
-    secret: false,
-    public: false,
-    description: "Tenant-owned Clerk project id used to resolve canonical Clerk aliases."
-  },
-  {
-    idSuffix: "clerk.jwks",
-    canonicalName: "CLERK_JWT_ISSUER_DOMAIN",
-    aliases: ["CLERK_ISSUER_URL", "CLERK_JWKS_URL"],
-    required: false,
-    secret: false,
-    public: false,
-    description: "Tenant Clerk issuer/JWKS URL consumed by Convex auth.config.ts."
-  },
-  {
-    idSuffix: "clerk.jwt-key",
-    canonicalName: "CLERK_JWT_KEY",
-    required: false,
-    secret: true,
-    public: false,
-    description: "Tenant Clerk JWT public verification key used by bearer-token API routes."
-  },
-  {
-    idSuffix: "clerk.authorized-parties",
-    canonicalName: "CLERK_AUTHORIZED_PARTIES",
-    aliases: ["CLERK_MOBILE_AUTHORIZED_PARTIES"],
-    required: false,
-    secret: false,
-    public: false,
-    description: "Comma-separated Clerk authorized parties for browser and mobile bearer-token validation."
-  },
-  {
-    idSuffix: "clerk.sign-in-url",
-    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
-    required: false,
-    secret: false,
-    public: true,
-    description: "Tenant Clerk sign-in route for custom app login surfaces."
-  },
-  {
-    idSuffix: "clerk.sign-up-url",
-    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
-    required: false,
-    secret: false,
-    public: true,
-    description: "Tenant Clerk sign-up route for custom app login surfaces."
-  }
-];
-var TENANT_SHARED_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
-  (system) => TENANT_SHARED_SECRET_DEFINITION_TEMPLATES.map(
-    (template) => ({
-      id: `tenant.${system.id}.${template.idSuffix}`,
-      canonicalName: template.canonicalName,
-      aliases: "aliases" in template ? template.aliases : void 0,
-      owner: "tenant",
-      scope: "tenant",
-      sourcePath: system.sharedSourcePath,
-      environmentPolicy: "environment_specific",
-      required: template.required,
-      secret: template.secret,
-      public: template.public,
-      consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
-      destinations: [
-        {
-          kind: "vercel",
-          target: system.vercelProjectName,
-          environmentPolicy: "preprod_staging_prod_prod"
-        },
-        {
-          kind: "convex",
-          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
-          environmentPolicy: "preprod_staging_prod_prod"
-        }
-      ],
-      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
-    })
-  )
-);
-var TENANT_INSTALL_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.map(
-  (system) => ({
-    id: `tenant.${system.id}.install-lucern-npm`,
-    canonicalName: "INSTALL_LUCERN_NPM",
-    owner: "provider",
-    scope: "global",
-    sourcePath: "/tenants/shared",
-    environmentPolicy: "same_all_environments",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
-    destinations: [
-      {
-        kind: "vercel",
-        target: system.vercelProjectName,
-        environmentPolicy: "same_all_environments"
-      },
-      {
-        kind: "github_actions",
-        target: `${system.repository.owner}/${system.repository.name}`,
-        environmentPolicy: "same_all_environments"
-      }
-    ],
-    description: `${system.tenantKey}/${system.workspaceKey}: read-only npm install token for published @lucern/* packages.`
-  })
-);
-var TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS = ["stack-frontend", "stackos"];
-var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES = [
-  {
-    idSuffix: "ai.openai-api-key",
-    canonicalName: "OPENAI_API_KEY",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
-    description: "Tenant-owned OpenAI key for product runtime LLM calls."
-  },
-  {
-    idSuffix: "ai.anthropic-api-key",
-    canonicalName: "ANTHROPIC_API_KEY",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
-    description: "Tenant-owned Anthropic key for product runtime LLM calls."
-  },
-  {
-    idSuffix: "ai.gemini-api-key",
-    canonicalName: "GEMINI_API_KEY",
-    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
-    description: "Tenant-owned Google/Gemini key for product runtime LLM calls."
-  },
-  {
-    idSuffix: "langfuse.secret-key",
-    canonicalName: "LANGFUSE_SECRET_KEY",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-observability"
-    ],
-    description: "Tenant-owned Langfuse secret key for product AI tracing."
-  },
-  {
-    idSuffix: "langfuse.public-key",
-    canonicalName: "LANGFUSE_PUBLIC_KEY",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-observability"
-    ],
-    description: "Tenant-owned Langfuse public key for product AI tracing."
-  },
-  {
-    idSuffix: "langfuse.base-url",
-    canonicalName: "LANGFUSE_BASE_URL",
-    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-observability"
-    ],
-    description: "Tenant-owned Langfuse API origin."
-  },
-  {
-    idSuffix: "graph.neo4j-uri",
-    canonicalName: "NEO4J_URI",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-graph-sync"
-    ],
-    description: "Tenant-owned Neo4j URI for product graph-sync."
-  },
-  {
-    idSuffix: "graph.neo4j-user",
-    canonicalName: "NEO4J_USER",
-    aliases: ["NEO4J_USERNAME"],
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-graph-sync"
-    ],
-    description: "Tenant-owned Neo4j user for product graph-sync."
-  },
-  {
-    idSuffix: "graph.neo4j-password",
-    canonicalName: "NEO4J_PASSWORD",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-graph-sync"
-    ],
-    description: "Tenant-owned Neo4j password for product graph-sync."
-  },
-  {
-    idSuffix: "graph.neo4j-sync-secret",
-    canonicalName: "NEO4J_SYNC_SECRET",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-graph-sync"
-    ],
-    description: "Tenant-owned shared secret for product Convex-to-HTTP graph-sync calls."
-  },
-  {
-    idSuffix: "graph.neo4j-database",
-    canonicalName: "NEO4J_DATABASE",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-graph-sync"
-    ],
-    description: "Tenant-owned Neo4j database name for product graph-sync."
-  },
-  {
-    idSuffix: "vector.pinecone-api-key",
-    canonicalName: "PINECONE_API_KEY",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-vector-store"
-    ],
-    description: "Tenant-owned Pinecone API key for product vector search."
-  },
-  {
-    idSuffix: "vector.pinecone-index-name",
-    canonicalName: "PINECONE_INDEX_NAME",
-    aliases: ["PINECONE_INDEX"],
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-vector-store"
-    ],
-    description: "Tenant-owned Pinecone index name for product vector search."
-  },
-  {
-    idSuffix: "vector.pinecone-host",
-    canonicalName: "PINECONE_HOST",
-    aliases: ["PINECONE_INDEX_HOST"],
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-vector-store"
-    ],
-    description: "Tenant-owned Pinecone host for product vector search."
-  },
-  {
-    idSuffix: "vector.pinecone-namespace",
-    canonicalName: "PINECONE_NAMESPACE",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-convex-deployment",
-      "tenant-vector-store"
-    ],
-    description: "Tenant-owned Pinecone namespace for product vector search isolation."
-  },
-  {
-    idSuffix: "storage.aws-access-key-id",
-    canonicalName: "AWS_ACCESS_KEY_ID",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
-    description: "Tenant-owned AWS access key id for document/file ingestion."
-  },
-  {
-    idSuffix: "storage.aws-secret-access-key",
-    canonicalName: "AWS_SECRET_ACCESS_KEY",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
-    description: "Tenant-owned AWS secret access key for document/file ingestion."
-  },
-  {
-    idSuffix: "storage.aws-region",
-    canonicalName: "AWS_REGION",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
-    description: "Tenant-owned AWS region for document/file ingestion."
-  },
-  {
-    idSuffix: "observability.sentry-dsn",
-    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
-    aliases: ["NEXT_PUBLIC_SENTRY_DSN_NEXTJS", "SENTRY_DSN"],
-    required: false,
-    secret: false,
-    public: true,
-    consumers: ["tenant-vercel-app", "tenant-observability"],
-    description: "Tenant-owned Sentry DSN for app telemetry."
-  },
-  {
-    idSuffix: "observability.sentry-auth-token",
-    canonicalName: "SENTRY_AUTH_TOKEN",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-deploy-tooling", "tenant-observability"],
-    description: "Tenant-owned Sentry release token for app deployments."
-  },
-  {
-    idSuffix: "observability.sentry-org",
-    canonicalName: "SENTRY_ORG",
-    aliases: ["SENTRY_ORG_SLUG"],
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["tenant-deploy-tooling", "tenant-observability"],
-    description: "Tenant-owned Sentry org slug for release uploads."
-  },
-  {
-    idSuffix: "observability.sentry-project",
-    canonicalName: "SENTRY_PROJECT",
-    aliases: ["SENTRY_PROJECT_NEXTJS"],
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["tenant-deploy-tooling", "tenant-observability"],
-    description: "Tenant-owned Sentry project slug for release uploads."
-  },
-  {
-    idSuffix: "observability.sentry-environment",
-    canonicalName: "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
-    aliases: ["SENTRY_ENVIRONMENT"],
-    required: false,
-    secret: false,
-    public: true,
-    consumers: ["tenant-vercel-app", "tenant-observability"],
-    description: "Tenant-owned Sentry environment label."
-  },
-  {
-    idSuffix: "observability.sentry-release",
-    canonicalName: "NEXT_PUBLIC_SENTRY_RELEASE",
-    aliases: ["SENTRY_RELEASE"],
-    required: false,
-    secret: false,
-    public: true,
-    consumers: ["tenant-vercel-app", "tenant-observability"],
-    description: "Tenant-owned Sentry release label."
-  },
-  {
-    idSuffix: "observability.sentry-client-options",
-    canonicalName: "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE",
-    aliases: [
-      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS",
-      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS_NEXTJS",
-      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS",
-      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS_NEXTJS",
-      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS",
-      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS_NEXTJS",
-      "NEXT_PUBLIC_SENTRY_ENABLE_LOGS",
-      "NEXT_PUBLIC_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE",
-      "NEXT_PUBLIC_SENTRY_REPLAYS_SESSION_SAMPLE_RATE",
-      "NEXT_PUBLIC_SENTRY_SEND_DEFAULT_PII",
-      "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE_NEXTJS"
-    ],
-    required: false,
-    secret: false,
-    public: true,
-    consumers: ["tenant-vercel-app", "tenant-observability"],
-    description: "Tenant-owned public Sentry tuning values for Next.js client instrumentation."
-  },
-  {
-    idSuffix: "observability.sentry-webhook-secret",
-    canonicalName: "SENTRY_WEBHOOK_SECRET",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-convex-deployment", "tenant-observability"],
-    description: "Tenant-owned Sentry webhook verification secret."
-  },
-  {
-    idSuffix: "lucern.gateway-api-key",
-    canonicalName: "LUCERN_API_KEY",
-    aliases: ["STACK_API_KEY"],
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
-    description: "Tenant-scoped Lucern/MC gateway API key for product front-door calls."
-  },
-  {
-    idSuffix: "lucern.gateway-base-url",
-    canonicalName: "LUCERN_BASE_URL",
-    aliases: ["LUCERN_API_BASE_URL", "LUCERN_GATEWAY_BASE_URL"],
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
-    description: "Lucern/MC gateway base URL used by tenant product apps."
-  },
-  {
-    idSuffix: "lucern.proxy-token-secret",
-    canonicalName: "LUCERN_PROXY_TOKEN_SECRET",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
-    description: "Tenant-owned secret for signing internal proxy/session tokens in product apps."
-  },
-  {
-    idSuffix: "tenant.integrations.linear-api-key",
-    canonicalName: "LINEAR_API_KEY",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
-    description: "Tenant-owned Linear API key for support/slash-command flows."
-  },
-  {
-    idSuffix: "tenant.vercel.bypass-token",
-    canonicalName: "VERCEL_AUTOMATION_BYPASS_SECRET",
-    aliases: ["NEXT_PUBLIC_VERCEL_BYPASS_TOKEN"],
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
-    description: "Tenant-owned Vercel automation bypass token. Public alias is legacy and should be removed from app code."
-  }
-];
-var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.filter(
-  (system) => TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS.includes(system.id)
-).flatMap(
-  (system) => TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES.map(
-    (template) => ({
-      id: `tenant.${system.id}.${template.idSuffix}`,
-      canonicalName: template.canonicalName,
-      aliases: "aliases" in template ? template.aliases : void 0,
-      owner: "tenant",
-      scope: "tenant",
-      sourcePath: system.sharedSourcePath,
-      environmentPolicy: "environment_specific",
-      required: template.required,
-      secret: template.secret,
-      public: template.public,
-      consumers: template.consumers,
-      destinations: [
-        {
-          kind: "vercel",
-          target: system.vercelProjectName,
-          environmentPolicy: "preprod_staging_prod_prod"
-        },
-        {
-          kind: "convex",
-          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
-          environmentPolicy: "preprod_staging_prod_prod"
-        },
-        {
-          kind: "github_actions",
-          target: `${system.repository.owner}/${system.repository.name}`,
-          environmentPolicy: "preprod_staging_prod_prod"
-        }
-      ],
-      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
-    })
-  )
-);
-function tenantVercelConvexUrlWriteNames(system) {
-  const names = [system.convex.urlEnv, "NEXT_PUBLIC_CONVEX_URL"];
-  if (system.id === "stack-eng") {
-    return [...names, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
-  }
-  return names;
-}
-function tenantRepositoryConvexUrlWriteNames(system) {
-  if (system.id === "stack-eng") {
-    return [system.convex.urlEnv, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
-  }
-  return [system.convex.urlEnv];
-}
-function tenantRepositoryConvexDeployKeyWriteNames(system) {
-  if (system.id === "stack-eng") {
-    return [system.convex.deployKeyEnv, "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
-  }
-  return [system.convex.deployKeyEnv];
-}
-function tenantConvexUrlAliases(system) {
-  if (system.id === "stack-frontend") {
-    return [
-      "CONVEX_PROD_URL",
-      "CONVEX_STACK_V2_PROD_URL",
-      "CONVEX_STACK_V2_STAGING_URL",
-      "STACK_CONVEX_URL"
-    ];
-  }
-  if (system.id === "stackos") {
-    return [
-      "CONVEX_CLOUD_URL",
-      "CONVEX_STACK_URL",
-      "CONVEX_URL",
-      "CONVEX_URL_DEVELOPMENT",
-      "CONVEX_URL_PRODUCTION",
-      "STACK_CONVEX_URL"
-    ];
-  }
-  if (system.id === "stack-eng") {
-    return ["STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
-  }
-  if (system.id === "lucern-graph") {
-    return [
-      "CONVEX_GRAPH_URL",
-      "LUCERN_PROD_URL",
-      "NEXT_PUBLIC_LUCERN_GRAPH_URL"
-    ];
-  }
-  return void 0;
-}
-function tenantConvexDeployKeyAliases(system) {
-  if (system.id === "stack-frontend") {
-    return [
-      "CONVEX_STACK_V2_PROD_DEPLOY_KEY",
-      "CONVEX_STACK_V2_STAGING_DEPLOY_KEY",
-      "STACK_DEPLOY_KEY"
-    ];
-  }
-  if (system.id === "stackos") {
-    return [
-      "CONVEX_DEPLOY_KEY",
-      "CONVEX_DEV_DEPLOY_KEY",
-      "CONVEX_PROD_DEPLOY_KEY",
-      "CONVEX_STACK_DEPLOY_KEY",
-      "STACK_DEPLOY_KEY"
-    ];
-  }
-  if (system.id === "stack-eng") {
-    return ["CONVEX_DEPLOY_KEY", "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
-  }
-  if (system.id === "lucern-graph") {
-    return [
-      "CONVEX_DEPLOY_KEY",
-      "CONVEX_GRAPH_DEPLOY_KEY",
-      "LUCERN_CONVEX_DEPLOY_KEY",
-      "LUCERN_DEV_DEPLOY_KEY",
-      "LUCERN_PROD_DEPLOY_KEY"
-    ];
-  }
-  return void 0;
-}
-var TENANT_GRAPH_PUBLIC_CONFIG_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
-  (system) => {
-    if (system.id === "lucern-graph") {
-      return [
-        {
-          id: "tenant.lucern-graph.public.tenant-id",
-          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_ID",
-          aliases: ["NEXT_PUBLIC_LUCERN_TENANT_ID"],
-          owner: "tenant",
-          scope: "workspace",
-          sourcePath: system.sharedSourcePath,
-          environmentPolicy: "environment_specific",
-          required: false,
-          secret: false,
-          public: true,
-          consumers: ["tenant-vercel-app"],
-          destinations: [
-            {
-              kind: "vercel",
-              target: system.vercelProjectName,
-              environmentPolicy: "preprod_staging_prod_prod"
-            }
-          ],
-          description: "Lucern graph public tenant id used by the standalone graph explorer."
-        },
-        {
-          id: "tenant.lucern-graph.public.tenant-label",
-          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_LABEL",
-          owner: "tenant",
-          scope: "workspace",
-          sourcePath: system.sharedSourcePath,
-          environmentPolicy: "environment_specific",
-          required: false,
-          secret: false,
-          public: true,
-          consumers: ["tenant-vercel-app"],
-          destinations: [
-            {
-              kind: "vercel",
-              target: system.vercelProjectName,
-              environmentPolicy: "preprod_staging_prod_prod"
-            }
-          ],
-          description: "Lucern graph public tenant label used by the standalone graph explorer."
-        }
-      ];
-    }
-    if (system.id === "stack-eng") {
-      return [
-        {
-          id: "tenant.stack-eng.public.tenant-id",
-          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_ID",
-          owner: "tenant",
-          scope: "workspace",
-          sourcePath: system.sharedSourcePath,
-          environmentPolicy: "environment_specific",
-          required: false,
-          secret: false,
-          public: true,
-          consumers: ["tenant-vercel-app"],
-          destinations: [
-            {
-              kind: "vercel",
-              target: system.vercelProjectName,
-              environmentPolicy: "preprod_staging_prod_prod"
-            }
-          ],
-          description: "Stack engineering graph public tenant id used by the graph explorer."
-        },
-        {
-          id: "tenant.stack-eng.public.tenant-label",
-          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_LABEL",
-          owner: "tenant",
-          scope: "workspace",
-          sourcePath: system.sharedSourcePath,
-          environmentPolicy: "environment_specific",
-          required: false,
-          secret: false,
-          public: true,
-          consumers: ["tenant-vercel-app"],
-          destinations: [
-            {
-              kind: "vercel",
-              target: system.vercelProjectName,
-              environmentPolicy: "preprod_staging_prod_prod"
-            }
-          ],
-          description: "Stack engineering graph public tenant label used by the graph explorer."
-        },
-        {
-          id: "tenant.stack-eng.public.environment",
-          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_ENV",
-          owner: "tenant",
-          scope: "workspace",
-          sourcePath: system.sharedSourcePath,
-          environmentPolicy: "environment_specific",
-          required: false,
-          secret: false,
-          public: true,
-          consumers: ["tenant-vercel-app"],
-          destinations: [
-            {
-              kind: "vercel",
-              target: system.vercelProjectName,
-              environmentPolicy: "preprod_staging_prod_prod"
-            }
-          ],
-          description: "Stack engineering graph public environment label used by the graph explorer."
-        }
-      ];
-    }
-    return [];
-  }
-);
-var STACK_ENG_GRAPH_STORE_SECRET_DEFINITIONS = [
-  {
-    id: "tenant.stack-eng.neo4j.uri",
-    canonicalName: "NEO4J_URI",
-    aliases: ["NEO4J_ENG_URI"],
-    owner: "tenant",
-    scope: "workspace",
-    sourcePath: "/tenants/stack/engineering",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "small-oyster-270|bold-cuttlefish-804",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "vercel",
-        target: "stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "github_actions",
-        target: "stack-vc/stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      }
-    ],
-    description: "Stack engineering graph Neo4j runtime URI. NEO4J_ENG_URI is the source alias used to avoid StackOS front-office collisions."
-  },
-  {
-    id: "tenant.stack-eng.neo4j.user",
-    canonicalName: "NEO4J_USER",
-    aliases: ["NEO4J_ENG_USER"],
-    owner: "tenant",
-    scope: "workspace",
-    sourcePath: "/tenants/stack/engineering",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "small-oyster-270|bold-cuttlefish-804",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "vercel",
-        target: "stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "github_actions",
-        target: "stack-vc/stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      }
-    ],
-    description: "Stack engineering graph Neo4j runtime user."
-  },
-  {
-    id: "tenant.stack-eng.neo4j.password",
-    canonicalName: "NEO4J_PASSWORD",
-    aliases: ["NEO4J_ENG_PASSWORD"],
-    owner: "tenant",
-    scope: "workspace",
-    sourcePath: "/tenants/stack/engineering",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "small-oyster-270|bold-cuttlefish-804",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "vercel",
-        target: "stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "github_actions",
-        target: "stack-vc/stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      }
-    ],
-    description: "Stack engineering graph Neo4j runtime password."
-  },
-  {
-    id: "tenant.stack-eng.neo4j.sync-secret",
-    canonicalName: "NEO4J_SYNC_SECRET",
-    owner: "tenant",
-    scope: "workspace",
-    sourcePath: "/tenants/stack/engineering",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["tenant-graph-sync", "tenant-convex-deployment"],
-    destinations: [
-      {
-        kind: "convex",
-        target: "small-oyster-270|bold-cuttlefish-804",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "vercel",
-        target: "stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "github_actions",
-        target: "stack-vc/stackos-engineering-graph",
-        environmentPolicy: "preprod_staging_prod_prod"
-      }
-    ],
-    description: "Stack engineering graph sync secret for Convex-to-HTTP graph query/sync calls."
-  }
-];
-var TENANT_CONVEX_SECRET_DEFINITIONS = INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap((system) => [
-  {
-    id: `tenant.${system.id}.convex.url`,
-    canonicalName: system.convex.urlEnv,
-    aliases: tenantConvexUrlAliases(system),
-    owner: "tenant",
-    scope: "software_system",
-    sourcePath: system.sharedSourcePath,
-    environmentPolicy: "preprod_staging_prod_prod",
-    required: true,
-    secret: false,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-agent-runtime",
-      "mc-operator-tooling"
-    ],
-    destinations: [
-      {
-        kind: "vercel",
-        target: system.vercelProjectName,
-        environmentPolicy: "preprod_staging_prod_prod",
-        writeNames: tenantVercelConvexUrlWriteNames(system)
-      },
-      {
-        kind: "github_actions",
-        target: `${system.repository.owner}/${system.repository.name}`,
-        environmentPolicy: "preprod_staging_prod_prod",
-        writeNames: tenantRepositoryConvexUrlWriteNames(system),
-        notes: "Only if that repository deploy/test workflow owns this software system."
-      }
-    ],
-    description: `${system.tenantKey}/${system.workspaceKey} Convex URL. Pre-prod resolves to ${system.convex.preprodDeployment}; prod resolves to ${system.convex.prodDeployment}.`
-  },
-  {
-    id: `tenant.${system.id}.convex.deploy-key`,
-    canonicalName: system.convex.deployKeyEnv,
-    aliases: tenantConvexDeployKeyAliases(system),
-    owner: "tenant",
-    scope: "software_system",
-    sourcePath: system.sharedSourcePath,
-    environmentPolicy: "preprod_staging_prod_prod",
-    required: true,
-    secret: true,
-    public: false,
-    consumers: [
-      "tenant-vercel-app",
-      "tenant-agent-runtime",
-      "mc-operator-tooling"
-    ],
-    destinations: [
-      {
-        kind: "vercel",
-        target: system.vercelProjectName,
-        environmentPolicy: "preprod_staging_prod_prod"
-      },
-      {
-        kind: "github_actions",
-        target: `${system.repository.owner}/${system.repository.name}`,
-        environmentPolicy: "preprod_staging_prod_prod",
-        writeNames: tenantRepositoryConvexDeployKeyWriteNames(system),
-        notes: "Only if that repository deploy/test workflow owns this software system."
-      }
-    ],
-    description: `${system.tenantKey}/${system.workspaceKey} Convex deploy/admin key. Never route to sibling workspaces.`
-  }
-]);
-var INFISICAL_SECRET_DEFINITIONS = [
-  ...PLATFORM_SECRET_DEFINITIONS,
-  ...PLATFORM_AI_SECRET_DEFINITIONS,
-  ...PLATFORM_LANGFUSE_SECRET_DEFINITIONS,
-  ...PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS,
-  ...PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS,
-  ...PLATFORM_SENTRY_SECRET_DEFINITIONS,
-  ...PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS,
-  ...PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS,
-  ...TENANT_SHARED_SECRET_DEFINITIONS,
-  ...TENANT_INSTALL_SECRET_DEFINITIONS,
-  ...TENANT_PRODUCT_RUNTIME_SECRET_DEFINITIONS,
-  ...TENANT_GRAPH_PUBLIC_CONFIG_SECRET_DEFINITIONS,
-  ...STACK_ENG_GRAPH_STORE_SECRET_DEFINITIONS,
-  ...TENANT_CONVEX_SECRET_DEFINITIONS
-];
-function findInfisicalSecretDefinition(secretId) {
-  return INFISICAL_SECRET_DEFINITIONS.find((secret) => secret.id === secretId);
-}
-function infisicalSecretDefinitionsForConsumer(consumer) {
-  return INFISICAL_SECRET_DEFINITIONS.filter(
-    (secret) => secret.consumers.includes(consumer)
-  );
-}
-function infisicalSecretDefinitionsForDestination(kind, target) {
-  return INFISICAL_SECRET_DEFINITIONS.filter(
-    (secret) => secret.destinations.some(
-      (destination) => destination.kind === kind && destination.target === target
-    )
-  );
-}
-function validateInfisicalSecretDefinitions(definitions = INFISICAL_SECRET_DEFINITIONS) {
-  const errors = [];
-  const ids = /* @__PURE__ */ new Set();
-  const platformOnlyNames = /* @__PURE__ */ new Set(["CONVEX_MC_URL", "CONVEX_MC_DEPLOY_KEY"]);
-  for (const definition of definitions) {
-    if (ids.has(definition.id)) {
-      errors.push(`Duplicate secret definition id: ${definition.id}`);
-    }
-    ids.add(definition.id);
-    if (!definition.canonicalName.startsWith("CONVEX_")) {
-      continue;
-    }
-    if (platformOnlyNames.has(definition.canonicalName)) {
-      if (definition.owner !== "lucern_platform") {
-        errors.push(`${definition.canonicalName} must be Lucern platform-owned.`);
-      }
-      for (const destination of definition.destinations) {
-        if (destination.kind === "vercel" && INFISICAL_TENANT_SOFTWARE_SYSTEMS.some(
-          (system) => system.vercelProjectName === destination.target
-        )) {
-          errors.push(
-            `${definition.canonicalName} must not route to tenant Vercel project ${destination.target}.`
-          );
-        }
-      }
-      continue;
-    }
-    const owner = INFISICAL_TENANT_SOFTWARE_SYSTEMS.find(
-      (system) => system.convex.urlEnv === definition.canonicalName || system.convex.deployKeyEnv === definition.canonicalName
-    );
-    if (!owner) {
-      errors.push(
-        `${definition.canonicalName} is a Convex variable without a tenant software owner.`
-      );
-      continue;
-    }
-    for (const destination of definition.destinations) {
-      if (destination.kind === "vercel" && destination.target !== owner.vercelProjectName) {
-        errors.push(
-          `${definition.canonicalName} routes to ${destination.target}; expected ${owner.vercelProjectName}.`
-        );
-      }
-    }
-  }
-  return errors;
-}
-
-export { INFISICAL_CONVEX_TIERS, INFISICAL_CONVEX_TIER_BY_VERCEL_ENVIRONMENT, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_CONTROL_ENV, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INFISICAL_SECRET_CONSUMERS, INFISICAL_SECRET_DEFINITIONS, INFISICAL_SECRET_DESTINATION_KINDS, INFISICAL_SECRET_ENVIRONMENT_POLICIES, INFISICAL_SECRET_OWNERS, INFISICAL_SECRET_SCOPES, INFISICAL_TENANT_SOFTWARE_SYSTEMS, INFISICAL_VERCEL_DESTINATION_ENVIRONMENTS, INFISICAL_VERCEL_SYNC_DESTINATIONS, INFISICAL_VERCEL_SYNC_RECONCILIATION, INFISICAL_VERCEL_TARGETS, convexTierForVercelDestinationEnvironment, expectedTenantConvexDeploymentForVercelEnvironment, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findInfisicalSecretDefinition, findInfisicalTenantSoftwareSystem, findInfisicalVercelSyncDestination, infisicalSecretDefinitionsForConsumer, infisicalSecretDefinitionsForDestination, tenantSoftwareSystemConvexEnvNames, tenantSoftwareSystemOwnsConvexEnvName, validateInfisicalSecretDefinitions, vercelCustomEnvironmentIdForTenantSoftwareSystem };
-//# sourceMappingURL=infisical-runtime.contract.js.map
-//# sourceMappingURL=infisical-runtime.contract.js.map