@lucern/contracts 1.0.0 → 1.0.1

package/dist/infisical-runtime.platform-ops-secrets.js

@@ -0,0 +1,962 @@
+// src/infisical-runtime.platform-ops-secrets.ts
+var PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS = [
+  {
+    id: "platform.neo4j.uri",
+    canonicalName: "NEO4J_URI",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j URI for platform graph-sync surfaces."
+  },
+  {
+    id: "platform.neo4j.user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_USERNAME"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j username for platform graph-sync surfaces."
+  },
+  {
+    id: "platform.neo4j.password",
+    canonicalName: "NEO4J_PASSWORD",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j password for platform graph-sync surfaces."
+  },
+  {
+    id: "platform.neo4j.sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls."
+  },
+  {
+    id: "platform.neo4j.database",
+    canonicalName: "NEO4J_DATABASE",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces."
+  }
+];
+var PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS = [
+  {
+    id: "platform.pinecone.api-key",
+    canonicalName: "PINECONE_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone API key for platform vector search."
+  },
+  {
+    id: "platform.pinecone.index-name",
+    canonicalName: "PINECONE_INDEX_NAME",
+    aliases: ["PINECONE_INDEX"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone index name."
+  },
+  {
+    id: "platform.pinecone.host",
+    canonicalName: "PINECONE_HOST",
+    aliases: ["PINECONE_INDEX_HOST"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone host/index host."
+  }
+];
+var PLATFORM_SENTRY_SECRET_DEFINITIONS = [
+  {
+    id: "platform.sentry.dsn",
+    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
+    aliases: ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN_NEXTJS"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Sentry DSN for browser/server error telemetry."
+  },
+  {
+    id: "platform.sentry.auth-token",
+    canonicalName: "SENTRY_AUTH_TOKEN",
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci", "lucern-observability"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Sentry release-upload token. Runtime services must not use it for authorization."
+  },
+  {
+    id: "platform.sentry.org",
+    canonicalName: "SENTRY_ORG",
+    aliases: ["SENTRY_ORG_SLUG"],
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci", "lucern-observability"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Sentry organization slug for Lucern release uploads."
+  },
+  {
+    id: "platform.sentry.project",
+    canonicalName: "SENTRY_PROJECT",
+    aliases: ["SENTRY_PROJECT_NEXTJS"],
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci", "lucern-observability"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Sentry project slug for Lucern release uploads."
+  },
+  {
+    id: "platform.sentry.environment",
+    canonicalName: "SENTRY_ENVIRONMENT",
+    aliases: ["NEXT_PUBLIC_SENTRY_ENVIRONMENT"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific",
+        writeNames: ["SENTRY_ENVIRONMENT", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"]
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Sentry environment label."
+  },
+  {
+    id: "platform.sentry.release",
+    canonicalName: "SENTRY_RELEASE",
+    aliases: ["NEXT_PUBLIC_SENTRY_RELEASE"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability/sentry",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-web", "lucern-gateway", "lucern-observability"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern",
+        environmentPolicy: "environment_specific",
+        writeNames: ["SENTRY_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"]
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Sentry release name."
+  }
+];
+var PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS = [
+  {
+    id: "platform.deploy.vercel-token",
+    canonicalName: "VERCEL_TOKEN",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps."
+  },
+  {
+    id: "platform.deploy.vercel-token.stack",
+    canonicalName: "STACK_VERCEL_TOKEN",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Stack Vercel API token for manifest-scoped Stack tenant Vercel secret sync. Never copy into tenant apps."
+  },
+  {
+    id: "platform.deploy.vercel-token.lucern",
+    canonicalName: "LUCERN_VERCEL_TOKEN",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Lucern Vercel API token for manifest-scoped Lucern tenant Vercel secret sync. Never copy into tenant apps."
+  },
+  {
+    id: "platform.deploy.vercel-org-id",
+    canonicalName: "VERCEL_ORG_ID",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Vercel team/org id used by deployment and sync automation."
+  },
+  {
+    id: "platform.deploy.socket-api-key",
+    canonicalName: "SOCKET_API_KEY",
+    aliases: [
+      "socket_token",
+      "SOCKET_SECURITY_API_KEY",
+      "SOCKET_SECURITY_API_TOKEN"
+    ],
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments",
+        writeNames: [
+          "SOCKET_API_KEY",
+          "SOCKET_SECURITY_API_KEY",
+          "SOCKET_SECURITY_API_TOKEN"
+        ]
+      },
+      {
+        kind: "operator_local",
+        target: "socket-firewall-wrapper",
+        environmentPolicy: "same_all_environments",
+        writeNames: [
+          "SOCKET_API_KEY",
+          "SOCKET_SECURITY_API_KEY",
+          "SOCKET_SECURITY_API_TOKEN"
+        ]
+      }
+    ],
+    description: "Socket API token for authenticated Socket Firewall wrapper, CLI, and CI policy checks."
+  },
+  {
+    id: "platform.deploy.socket-token-hash",
+    canonicalName: "SOCKET_TOKEN_HASH",
+    aliases: ["socket_token_hash", "SOCKET_API_KEY_HASH"],
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "socket-token-audit",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Socket token fingerprint retained for rotation evidence; not consumed by Socket tooling."
+  }
+];
+var PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS = [
+  {
+    id: "platform.docs.gap-audit-api-key",
+    canonicalName: "DOC_GAP_AUDIT_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/docs",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional model key for docs gap audits."
+  },
+  {
+    id: "platform.docs.gap-audit-provider",
+    canonicalName: "DOC_GAP_AUDIT_PROVIDER",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/docs",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional docs gap audit provider selector."
+  },
+  {
+    id: "platform.docs.gap-audit-model",
+    canonicalName: "DOC_GAP_AUDIT_MODEL",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/docs",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional docs gap audit model selector."
+  },
+  {
+    id: "platform.infisical.local-cli",
+    canonicalName: "INFISICAL_BIN",
+    aliases: ["INFISICAL_API_URL", "INFISICAL_URL"],
+    owner: "lucern_platform",
+    scope: "global",
+    sourcePath: "/platform/infisical",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Operator-only Infisical CLI/API location knobs. Machine credentials are handled by the bootstrap contract."
+  },
+  {
+    id: "platform.gateway.device-verification-base-url",
+    canonicalName: "LUCERN_DEVICE_VERIFICATION_BASE_URL",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Base URL shown during Lucern CLI/device authentication."
+  },
+  {
+    id: "platform.gateway.mode",
+    canonicalName: "LUCERN_GATEWAY_MODE",
+    aliases: ["LUCERN_GATEWAY_ENV"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Gateway runtime mode/environment label."
+  },
+  {
+    id: "platform.mcp.runtime",
+    canonicalName: "LUCERN_MCP_URL",
+    aliases: [
+      "LUCERN_AGENT_IDENTITY",
+      "LUCERN_HTTP_HOST",
+      "LUCERN_HTTP_PORT",
+      "LUCERN_MCP_ALLOW_API_KEY_PASSTHROUGH",
+      "LUCERN_MCP_DEBUG",
+      "LUCERN_MCP_DIAGNOSTICS_FILE",
+      "LUCERN_MCP_HEALTH_PATH",
+      "LUCERN_MCP_HEALTH_URL",
+      "LUCERN_MCP_HOST",
+      "LUCERN_MCP_PATH",
+      "LUCERN_MCP_PORT",
+      "LUCERN_MCP_QUIET",
+      "LUCERN_MCP_TRANSPORT",
+      "LUCERN_PROFILE",
+      "LUCERN_PUBLIC_URL",
+      "MCP_SERVER_URL"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-mcp", "lucern-cli", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern MCP/CLI runtime knobs. Aliases are compatibility names and not Vercel write names."
+  },
+  {
+    id: "platform.mcp.auth-token",
+    canonicalName: "LUCERN_MCP_SERVER_AUTH_TOKEN",
+    aliases: ["LUCERN_USER_TOKEN", "MCP_SERVER_TOKEN"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-mcp", "lucern-cli", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead."
+  },
+  {
+    id: "platform.operator.api-key",
+    canonicalName: "LUCERN_API_KEY",
+    aliases: ["LUCERN_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-cli", "lucern-mcp", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+  },
+  {
+    id: "platform.graph-sync.proxy",
+    canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL",
+    aliases: [
+      "LUCERN_DEFAULT_TENANT_ID",
+      "LUCERN_GRAPH_SYNC_ALLOWED_PROXY_HOSTS"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Graph-sync proxy URL, tenant filter, and allowed host list."
+  },
+  {
+    id: "platform.package-smoke.local",
+    canonicalName: "LUCERN_SDK_NPM_TOKEN",
+    aliases: [
+      "LUCERN_KERNEL_INSTALL_SPEC",
+      "LUCERN_KERNEL_KEEP_CLEANROOM",
+      "LUCERN_KERNEL_LOCAL_TARBALL",
+      "LUCERN_KERNEL_NPM_TOKEN",
+      "LUCERN_KERNEL_SCOPE_REGISTRY",
+      "LUCERN_KERNEL_SKIP_CONVEX",
+      "LUCERN_SDK_INSTALL_SPEC",
+      "LUCERN_SDK_KEEP_CLEANROOM",
+      "LUCERN_SDK_LOCAL_TARBALL",
+      "LUCERN_SDK_SCOPE_REGISTRY",
+      "LUCERN_SDK_SKIP_LIVE"
+    ],
+    owner: "lucern_platform",
+    scope: "global",
+    sourcePath: "/platform/package-publish",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Private package install smoke-test knobs. Values are not tenant runtime variables."
+  },
+  {
+    id: "platform.convex-deploy.local-names",
+    canonicalName: "LUCERN_CONVEX_DEPLOYMENT_NAME",
+    aliases: [
+      "CONVEX_DEPLOYMENT",
+      "CONVEX_DEV_DEPLOYMENT_NAME",
+      "CONVEX_PROD_DEPLOYMENT_NAME"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/deploy/convex",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["mc-operator-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Operator-only Convex deployment name hints. Deploy keys and URLs remain separately scoped."
+  },
+  {
+    id: "platform.sdk.local-context",
+    canonicalName: "LUCERN_TENANT_ID",
+    aliases: [
+      "LUCERN_AGENT_DISPLAY_NAME",
+      "LUCERN_AGENT_ID",
+      "LUCERN_API_ENVIRONMENT",
+      "LUCERN_PACK_KEY",
+      "LUCERN_PROJECT_ID",
+      "LUCERN_TOPIC_ID",
+      "LUCERN_WORKSPACE_ID",
+      "LUCERN_WORKTREE_ID"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-cli", "lucern-mcp", "tenant-agent-runtime"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves."
+  },
+  {
+    id: "platform.debug.local-flags",
+    canonicalName: "LUCERN_FUNCTIONAL_DEBUG",
+    aliases: [
+      "LUCERN_CONTRACTS_SKIP_DTS",
+      "LUCERN_DEPLOY_RECONCILIATION_DEBUG",
+      "LUCERN_ENABLE_ADAPTIVE_LEARNING",
+      "LUCERN_ENV_FILE",
+      "LUCERN_EXAMPLE_DEBUG",
+      "LUCERN_HTTP_SMOKE_DEBUG",
+      "LUCERN_MULTI_TENANT",
+      "LUCERN_PACK_ACTION_DEBUG",
+      "LUCERN_RUN_LIVE_MCP"
+    ],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime/debug",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-repo-ci", "mc-operator-tooling"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Local or CI debug toggles. They are manifest-known but not tenant runtime secrets."
+  },
+  {
+    id: "tenant.stackos.deploy-guard.local",
+    canonicalName: "STACKOS_DEPLOY_TARGET",
+    aliases: [
+      "STACKOS_DEPLOY_ENTRYPOINT",
+      "STACKOS_EXPECTED_STAGING_COMMIT",
+      "STACKOS_PROD_CUTOVER_APPROVED",
+      "STACKOS_REPO_PATH",
+      "STACKOS_REQUIRE_CHAT_RUNTIME",
+      "STACKOS_SLOP_SCAN_BASELINE",
+      "STACKOS_STAGING_API_KEY",
+      "STACKOS_STAGING_BASE_URL",
+      "STACK_DEPLOY_RECONCILIATION_SCHEMA_JSON"
+    ],
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: "/tenants/stack",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "stackos-deploy-guard",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "stack-vc/stackos",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "StackOS deploy/test guard variables. These are not written into the StackOS Vercel runtime."
+  }
+];
+
+export { PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS, PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS, PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS, PLATFORM_SENTRY_SECRET_DEFINITIONS, PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS };
+//# sourceMappingURL=infisical-runtime.platform-ops-secrets.js.map
+//# sourceMappingURL=infisical-runtime.platform-ops-secrets.js.map