@lucern/contracts 1.0.0 → 1.0.1

package/dist/infisical-runtime.platform-ops-secrets.d.ts

@@ -0,0 +1,743 @@
+declare const PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.neo4j.uri";
+    readonly canonicalName: "NEO4J_URI";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Neo4j URI for platform graph-sync surfaces.";
+}, {
+    readonly id: "platform.neo4j.user";
+    readonly canonicalName: "NEO4J_USER";
+    readonly aliases: readonly ["NEO4J_USERNAME"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Neo4j username for platform graph-sync surfaces.";
+}, {
+    readonly id: "platform.neo4j.password";
+    readonly canonicalName: "NEO4J_PASSWORD";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Neo4j password for platform graph-sync surfaces.";
+}, {
+    readonly id: "platform.neo4j.sync-secret";
+    readonly canonicalName: "NEO4J_SYNC_SECRET";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls.";
+}, {
+    readonly id: "platform.neo4j.database";
+    readonly canonicalName: "NEO4J_DATABASE";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces.";
+}];
+declare const PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.pinecone.api-key";
+    readonly canonicalName: "PINECONE_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/vector/pinecone";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Pinecone API key for platform vector search.";
+}, {
+    readonly id: "platform.pinecone.index-name";
+    readonly canonicalName: "PINECONE_INDEX_NAME";
+    readonly aliases: readonly ["PINECONE_INDEX"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/vector/pinecone";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Pinecone index name.";
+}, {
+    readonly id: "platform.pinecone.host";
+    readonly canonicalName: "PINECONE_HOST";
+    readonly aliases: readonly ["PINECONE_INDEX_HOST"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/vector/pinecone";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Pinecone host/index host.";
+}];
+declare const PLATFORM_SENTRY_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.sentry.dsn";
+    readonly canonicalName: "NEXT_PUBLIC_SENTRY_DSN";
+    readonly aliases: readonly ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN_NEXTJS"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: true;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Sentry DSN for browser/server error telemetry.";
+}, {
+    readonly id: "platform.sentry.auth-token";
+    readonly canonicalName: "SENTRY_AUTH_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Sentry release-upload token. Runtime services must not use it for authorization.";
+}, {
+    readonly id: "platform.sentry.org";
+    readonly canonicalName: "SENTRY_ORG";
+    readonly aliases: readonly ["SENTRY_ORG_SLUG"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Sentry organization slug for Lucern release uploads.";
+}, {
+    readonly id: "platform.sentry.project";
+    readonly canonicalName: "SENTRY_PROJECT";
+    readonly aliases: readonly ["SENTRY_PROJECT_NEXTJS"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Sentry project slug for Lucern release uploads.";
+}, {
+    readonly id: "platform.sentry.environment";
+    readonly canonicalName: "SENTRY_ENVIRONMENT";
+    readonly aliases: readonly ["NEXT_PUBLIC_SENTRY_ENVIRONMENT"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+        readonly writeNames: readonly ["SENTRY_ENVIRONMENT", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"];
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Sentry environment label.";
+}, {
+    readonly id: "platform.sentry.release";
+    readonly canonicalName: "SENTRY_RELEASE";
+    readonly aliases: readonly ["NEXT_PUBLIC_SENTRY_RELEASE"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/sentry";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-observability"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+        readonly writeNames: readonly ["SENTRY_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"];
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Sentry release name.";
+}];
+declare const PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.deploy.vercel-token";
+    readonly canonicalName: "VERCEL_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps.";
+}, {
+    readonly id: "platform.deploy.vercel-token.stack";
+    readonly canonicalName: "STACK_VERCEL_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Stack Vercel API token for manifest-scoped Stack tenant Vercel secret sync. Never copy into tenant apps.";
+}, {
+    readonly id: "platform.deploy.vercel-token.lucern";
+    readonly canonicalName: "LUCERN_VERCEL_TOKEN";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Lucern Vercel API token for manifest-scoped Lucern tenant Vercel secret sync. Never copy into tenant apps.";
+}, {
+    readonly id: "platform.deploy.vercel-org-id";
+    readonly canonicalName: "VERCEL_ORG_ID";
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy/vercel";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "secret-sync-writer";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Vercel team/org id used by deployment and sync automation.";
+}, {
+    readonly id: "platform.deploy.socket-api-key";
+    readonly canonicalName: "SOCKET_API_KEY";
+    readonly aliases: readonly ["socket_token", "SOCKET_SECURITY_API_KEY", "SOCKET_SECURITY_API_TOKEN"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+        readonly writeNames: readonly ["SOCKET_API_KEY", "SOCKET_SECURITY_API_KEY", "SOCKET_SECURITY_API_TOKEN"];
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "socket-firewall-wrapper";
+        readonly environmentPolicy: "same_all_environments";
+        readonly writeNames: readonly ["SOCKET_API_KEY", "SOCKET_SECURITY_API_KEY", "SOCKET_SECURITY_API_TOKEN"];
+    }];
+    readonly description: "Socket API token for authenticated Socket Firewall wrapper, CLI, and CI policy checks.";
+}, {
+    readonly id: "platform.deploy.socket-token-hash";
+    readonly canonicalName: "SOCKET_TOKEN_HASH";
+    readonly aliases: readonly ["socket_token_hash", "SOCKET_API_KEY_HASH"];
+    readonly owner: "provider";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/deploy";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "socket-token-audit";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Socket token fingerprint retained for rotation evidence; not consumed by Socket tooling.";
+}];
+declare const PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.docs.gap-audit-api-key";
+    readonly canonicalName: "DOC_GAP_AUDIT_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional model key for docs gap audits.";
+}, {
+    readonly id: "platform.docs.gap-audit-provider";
+    readonly canonicalName: "DOC_GAP_AUDIT_PROVIDER";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional docs gap audit provider selector.";
+}, {
+    readonly id: "platform.docs.gap-audit-model";
+    readonly canonicalName: "DOC_GAP_AUDIT_MODEL";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/docs";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional docs gap audit model selector.";
+}, {
+    readonly id: "platform.infisical.local-cli";
+    readonly canonicalName: "INFISICAL_BIN";
+    readonly aliases: readonly ["INFISICAL_API_URL", "INFISICAL_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/infisical";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Operator-only Infisical CLI/API location knobs. Machine credentials are handled by the bootstrap contract.";
+}, {
+    readonly id: "platform.gateway.device-verification-base-url";
+    readonly canonicalName: "LUCERN_DEVICE_VERIFICATION_BASE_URL";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Base URL shown during Lucern CLI/device authentication.";
+}, {
+    readonly id: "platform.gateway.mode";
+    readonly canonicalName: "LUCERN_GATEWAY_MODE";
+    readonly aliases: readonly ["LUCERN_GATEWAY_ENV"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Gateway runtime mode/environment label.";
+}, {
+    readonly id: "platform.mcp.runtime";
+    readonly canonicalName: "LUCERN_MCP_URL";
+    readonly aliases: readonly ["LUCERN_AGENT_IDENTITY", "LUCERN_HTTP_HOST", "LUCERN_HTTP_PORT", "LUCERN_MCP_ALLOW_API_KEY_PASSTHROUGH", "LUCERN_MCP_DEBUG", "LUCERN_MCP_DIAGNOSTICS_FILE", "LUCERN_MCP_HEALTH_PATH", "LUCERN_MCP_HEALTH_URL", "LUCERN_MCP_HOST", "LUCERN_MCP_PATH", "LUCERN_MCP_PORT", "LUCERN_MCP_QUIET", "LUCERN_MCP_TRANSPORT", "LUCERN_PROFILE", "LUCERN_PUBLIC_URL", "MCP_SERVER_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern MCP/CLI runtime knobs. Aliases are compatibility names and not Vercel write names.";
+}, {
+    readonly id: "platform.mcp.auth-token";
+    readonly canonicalName: "LUCERN_MCP_SERVER_AUTH_TOKEN";
+    readonly aliases: readonly ["LUCERN_USER_TOKEN", "MCP_SERVER_TOKEN"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-cli", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead.";
+}, {
+    readonly id: "platform.operator.api-key";
+    readonly canonicalName: "LUCERN_API_KEY";
+    readonly aliases: readonly ["LUCERN_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-cli", "lucern-mcp", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files.";
+}, {
+    readonly id: "platform.graph-sync.proxy";
+    readonly canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL";
+    readonly aliases: readonly ["LUCERN_DEFAULT_TENANT_ID", "LUCERN_GRAPH_SYNC_ALLOWED_PROXY_HOSTS"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/graph/neo4j";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-graph-sync", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-graph-sync";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Graph-sync proxy URL, tenant filter, and allowed host list.";
+}, {
+    readonly id: "platform.package-smoke.local";
+    readonly canonicalName: "LUCERN_SDK_NPM_TOKEN";
+    readonly aliases: readonly ["LUCERN_KERNEL_INSTALL_SPEC", "LUCERN_KERNEL_KEEP_CLEANROOM", "LUCERN_KERNEL_LOCAL_TARBALL", "LUCERN_KERNEL_NPM_TOKEN", "LUCERN_KERNEL_SCOPE_REGISTRY", "LUCERN_KERNEL_SKIP_CONVEX", "LUCERN_SDK_INSTALL_SPEC", "LUCERN_SDK_KEEP_CLEANROOM", "LUCERN_SDK_LOCAL_TARBALL", "LUCERN_SDK_SCOPE_REGISTRY", "LUCERN_SDK_SKIP_LIVE"];
+    readonly owner: "lucern_platform";
+    readonly scope: "global";
+    readonly sourcePath: "/platform/package-publish";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Private package install smoke-test knobs. Values are not tenant runtime variables.";
+}, {
+    readonly id: "platform.convex-deploy.local-names";
+    readonly canonicalName: "LUCERN_CONVEX_DEPLOYMENT_NAME";
+    readonly aliases: readonly ["CONVEX_DEPLOYMENT", "CONVEX_DEV_DEPLOYMENT_NAME", "CONVEX_PROD_DEPLOYMENT_NAME"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/deploy/convex";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Operator-only Convex deployment name hints. Deploy keys and URLs remain separately scoped.";
+}, {
+    readonly id: "platform.sdk.local-context";
+    readonly canonicalName: "LUCERN_TENANT_ID";
+    readonly aliases: readonly ["LUCERN_AGENT_DISPLAY_NAME", "LUCERN_AGENT_ID", "LUCERN_API_ENVIRONMENT", "LUCERN_PACK_KEY", "LUCERN_PROJECT_ID", "LUCERN_TOPIC_ID", "LUCERN_WORKSPACE_ID", "LUCERN_WORKTREE_ID"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-cli", "lucern-mcp", "tenant-agent-runtime"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves.";
+}, {
+    readonly id: "platform.debug.local-flags";
+    readonly canonicalName: "LUCERN_FUNCTIONAL_DEBUG";
+    readonly aliases: readonly ["LUCERN_CONTRACTS_SKIP_DTS", "LUCERN_DEPLOY_RECONCILIATION_DEBUG", "LUCERN_ENABLE_ADAPTIVE_LEARNING", "LUCERN_ENV_FILE", "LUCERN_EXAMPLE_DEBUG", "LUCERN_HTTP_SMOKE_DEBUG", "LUCERN_MULTI_TENANT", "LUCERN_PACK_ACTION_DEBUG", "LUCERN_RUN_LIVE_MCP"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime/debug";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Local or CI debug toggles. They are manifest-known but not tenant runtime secrets.";
+}, {
+    readonly id: "tenant.stackos.deploy-guard.local";
+    readonly canonicalName: "STACKOS_DEPLOY_TARGET";
+    readonly aliases: readonly ["STACKOS_DEPLOY_ENTRYPOINT", "STACKOS_EXPECTED_STAGING_COMMIT", "STACKOS_PROD_CUTOVER_APPROVED", "STACKOS_REPO_PATH", "STACKOS_REQUIRE_CHAT_RUNTIME", "STACKOS_SLOP_SCAN_BASELINE", "STACKOS_STAGING_API_KEY", "STACKOS_STAGING_BASE_URL", "STACK_DEPLOY_RECONCILIATION_SCHEMA_JSON"];
+    readonly owner: "tenant";
+    readonly scope: "software_system";
+    readonly sourcePath: "/tenants/stack";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["tenant-deploy-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "operator_local";
+        readonly target: "stackos-deploy-guard";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "stack-vc/stackos";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "StackOS deploy/test guard variables. These are not written into the StackOS Vercel runtime.";
+}];
+
+export { PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS, PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS, PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS, PLATFORM_SENTRY_SECRET_DEFINITIONS, PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS };