@lucern/contracts 1.0.0 → 1.0.1

package/dist/infisical-runtime.platform-secrets.d.ts

@@ -0,0 +1,598 @@
+declare const PLATFORM_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.clerk.publishable";
+    readonly canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY";
+    readonly aliases: readonly ["CLERK_PUBLISHABLE_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: true;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Clerk browser key for platform web, gateway, and hosted MCP OAuth flows.";
+}, {
+    readonly id: "platform.clerk.secret";
+    readonly canonicalName: "CLERK_SECRET_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Clerk backend secret. Never route to tenant-owned apps unless that tenant is Lucern itself.";
+}, {
+    readonly id: "platform.clerk.project";
+    readonly canonicalName: "CLERK_PROJECT_ID";
+    readonly aliases: readonly ["LUCERN_CLERK_PROJECT_ID"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "mc-convex"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Canonical Lucern Clerk project identifier used when MC resolves Clerk identities.";
+}, {
+    readonly id: "platform.clerk.webhook-secret";
+    readonly canonicalName: "LUCERN_CLERK_WEBHOOK_SECRET";
+    readonly aliases: readonly ["CLERK_WEBHOOK_SECRET", "CLERK_WEBHOOK_SIGNING_SECRET"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Clerk/Svix webhook signing secret used by the gateway to verify Clerk identity and organization events before projecting them into Permit.";
+}, {
+    readonly id: "platform.clerk.jwks";
+    readonly canonicalName: "CLERK_JWKS_URL";
+    readonly aliases: readonly ["CLERK_JWT_ISSUER_DOMAIN"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/auth";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-mcp";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Clerk JWKS/issuer override for server-side token verification.";
+}, {
+    readonly id: "platform.runtime.api-base-url";
+    readonly canonicalName: "LUCERN_API_URL";
+    readonly aliases: readonly ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Canonical Lucern API gateway base URL. Older names remain aliases only.";
+}, {
+    readonly id: "platform.runtime.login-base-url";
+    readonly canonicalName: "LUCERN_LOGIN_BASE_URL";
+    readonly aliases: readonly ["LUCERN_AUTH_BASE_URL", "LUCERN_WEB_BASE_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "lucern-mcp", "lucern-cli"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Browser login origin used when device/OAuth login is not served by the API base URL.";
+}, {
+    readonly id: "platform.runtime.environment";
+    readonly canonicalName: "LUCERN_ENVIRONMENT";
+    readonly aliases: readonly ["LUCERN_ENV"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-web", "lucern-gateway", "lucern-mcp", "lucern-cli"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern runtime environment label.";
+}, {
+    readonly id: "platform.runtime.require-deployment-host-registry";
+    readonly canonicalName: "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Fail-closed gateway toggle that requires MC deployment host registry resolution before routing.";
+}, {
+    readonly id: "platform.mc.convex-url";
+    readonly canonicalName: "CONVEX_MC_URL";
+    readonly aliases: readonly ["CONVEX_MC_PROD_URL", "LUCERN_ADMIN_CONVEX_URL", "LUCERN_CONVEX_URL", "MC_CONVEX_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Master Control Convex URL. Prod must point to successful-clam-833; dev/staging to utmost-ox-403.";
+}, {
+    readonly id: "platform.mc.convex-deploy-key";
+    readonly canonicalName: "CONVEX_MC_DEPLOY_KEY";
+    readonly aliases: readonly ["CONVEX_MC_PROD_DEPLOY_KEY", "LUCERN_ADMIN_DEPLOY_KEY", "LUCERN_DEPLOY_KEY", "MC_DEPLOY_KEY", "MC_PROD_DEPLOY_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-gateway", "mc-operator-tooling", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Master Control deploy/admin key. Never route to tenant Vercel projects or tenant Convex deployments.";
+}, {
+    readonly id: "platform.mc.session-token-secret";
+    readonly canonicalName: "LUCERN_SESSION_TOKEN_SECRET";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-mcp", "mc-convex", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Signs Lucern platform session/delegation tokens. This is platform-owned, not tenant-owned.";
+}, {
+    readonly id: "platform.mc.tenant-secret-encryption-key";
+    readonly canonicalName: "LUCERN_TENANT_SECRET_ENCRYPTION_KEY";
+    readonly aliases: readonly ["LUCERN_SESSION_TOKEN_SECRET"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/mc";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "mc-credential-maintenance";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Encrypts tenant deployment credentials stored in MC. Session-token fallback is legacy only.";
+}, {
+    readonly id: "platform.permit.api-key";
+    readonly canonicalName: "LUCERN_PERMIT_API_KEY";
+    readonly aliases: readonly ["PERMIT_API_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Permit.io API key used for MC sync and policy checks. Must fail closed if missing.";
+}, {
+    readonly id: "platform.permit.webhook-secret";
+    readonly canonicalName: "LUCERN_PERMIT_WEBHOOK_SECRET";
+    readonly aliases: readonly ["PERMIT_WEBHOOK_SECRET"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-gateway", "mc-operator-tooling"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "mc-credential-maintenance";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Permit.io webhook secret used by gateway and MC webhook handlers. Must fail closed if missing.";
+}, {
+    readonly id: "platform.permit.pdp-url";
+    readonly canonicalName: "LUCERN_PERMIT_PDP_URL";
+    readonly aliases: readonly ["PERMIT_PDP_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Permit PDP URL override.";
+}, {
+    readonly id: "platform.permit.api-url";
+    readonly canonicalName: "LUCERN_PERMIT_API_URL";
+    readonly aliases: readonly ["PERMIT_API_URL"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/permit";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["mc-convex", "lucern-mcp", "lucern-gateway"];
+    readonly destinations: readonly [{
+        readonly kind: "convex";
+        readonly target: "master-control";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "runtime_fetch";
+        readonly target: "hosted-mcp-oauth";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "vercel";
+        readonly target: "lucern-gateway";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Optional Permit API URL override.";
+}, {
+    readonly id: "platform.ci.infisical-bootstrap-client-id";
+    readonly canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_ID";
+    readonly aliases: readonly ["INFISICAL_CI_CLIENT_ID"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ci";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Machine identity client id used by CI to reconcile Infisical desired state.";
+}, {
+    readonly id: "platform.ci.infisical-bootstrap-client-secret";
+    readonly canonicalName: "INFISICAL_BOOTSTRAP_CLIENT_SECRET";
+    readonly aliases: readonly ["INFISICAL_CI_CLIENT_SECRET"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ci";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Machine identity client secret used by CI to reconcile Infisical desired state.";
+}, {
+    readonly id: "platform.publish.npm-token";
+    readonly canonicalName: "NPM_TOKEN";
+    readonly aliases: readonly ["NODE_AUTH_TOKEN"];
+    readonly owner: "provider";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/publish";
+    readonly environmentPolicy: "same_all_environments";
+    readonly required: true;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "same_all_environments";
+    }];
+    readonly description: "Package publish/install token for @lucern/* release automation.";
+}];
+declare const PLATFORM_AI_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.ai.openai-api-key";
+    readonly canonicalName: "OPENAI_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ai";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation.";
+}, {
+    readonly id: "platform.ai.anthropic-api-key";
+    readonly canonicalName: "ANTHROPIC_API_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ai";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Anthropic key for platform AI jobs, benchmarks, and controlled operator automation.";
+}, {
+    readonly id: "platform.ai.gemini-api-key";
+    readonly canonicalName: "GEMINI_API_KEY";
+    readonly aliases: readonly ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/ai";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Google/Gemini key. Google alias names are read compatibility only.";
+}];
+declare const PLATFORM_LANGFUSE_SECRET_DEFINITIONS: readonly [{
+    readonly id: "platform.langfuse.secret-key";
+    readonly canonicalName: "LANGFUSE_SECRET_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/langfuse";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing.";
+}, {
+    readonly id: "platform.langfuse.public-key";
+    readonly canonicalName: "LANGFUSE_PUBLIC_KEY";
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/langfuse";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY.";
+}, {
+    readonly id: "platform.langfuse.base-url";
+    readonly canonicalName: "LANGFUSE_BASE_URL";
+    readonly aliases: readonly ["LANGFUSE_BASEURL", "LANGFUSE_HOST"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/observability/langfuse";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: false;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-ai-runtime", "lucern-observability", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-ai-runtime";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases.";
+}];
+
+export { PLATFORM_AI_SECRET_DEFINITIONS, PLATFORM_LANGFUSE_SECRET_DEFINITIONS, PLATFORM_SECRET_DEFINITIONS };