{
  "title": "FourIA Secrets Registry",
  "description": "Canonical registry of all secrets used across FourIA projects. The x-registry section defines every expected secret (name, type, permissions, environments). SECRETS.yaml stores the actual values. The validation script reads both to check local config and connectivity.",
  "comment": "To add a new secret: add an entry to x-registry below, then fill the value in SECRETS.yaml",
  "x-registry": {
    "LERMA_API_TOKEN": {
      "type": "token",
      "description": "Lerma provisioning token. Full-scope: DNS, Workers, Access, R2, AI Gateway, Analytics, Containers (incl. registry credentials), and Email Sending (used as the SMTP password for invitation emails). Requires the Containers Write permission so the dashboard can list registry versions (ImageRegistry) and pull the worker bundle (RegistryBundle) at provisioning time.",
      "scope": [
        "Workers Scripts Write",
        "DNS Write",
        "Access: Apps and Policies Write",
        "Access: Service Tokens Write",
        "R2 Storage Write",
        "AI Gateway Write",
        "Analytics Read",
        "Workers Containers Write",
        "Email Sending Write"
      ],
      "environments": ["local", "staging", "production"],
      "connectivity_environments": ["staging", "production"],
      "used_by": ["lerma", "iac-lerma", "iac-fouria", "ci-cd"],
      "github_secret_name": "LERMA_API_TOKEN",
      "wrangler_binding": null,
      "container_pass": false,
      "format": "Cloudflare API token (Bearer)",
      "connectivity_test": {
        "type": "cf_permission_check",
        "expected_permissions": [
          "Workers Scripts Write",
          "DNS Write",
          "Access: Apps and Policies Write",
          "Workers Containers Write",
          "Email Sending Write"
        ]
      },
      "notes": "Mapped to transient CLOUDFLARE_API_TOKEN env var in CI steps that call OpenTofu, since Tofu's Cloudflare provider reads that name. Regenerate with Containers Write (and the CF registry default registry configured) for the registry-credentials flow to succeed (403 Authentication error otherwise).",
      "dotenv_files": ["apps/lerma/.env", "apps/lerma/.env.staging", "apps/lerma/.env.production"]
    },
    "DEPLOY_WORKER_API_TOKEN": {
      "type": "token",
      "description": "Minimal-scope deploy token for wrangler commands (deploy, secret bulk, secret put). Used in CI/CD workflows only.",
      "scope": ["Workers Scripts Write"],
      "environments": ["staging", "production"],
      "connectivity_environments": ["staging", "production"],
      "used_by": ["ci-cd"],
      "github_secret_name": "DEPLOY_WORKER_API_TOKEN",
      "wrangler_binding": null,
      "container_pass": false,
      "format": "Cloudflare API token (Bearer)",
      "connectivity_test": {
        "type": "cf_permission_check",
        "expected_permissions": ["Workers Scripts Write"]
      },
      "notes": "Mapped to transient CLOUDFLARE_API_TOKEN env var in CI steps that call wrangler. Replaces former DEPLOY_CLOUDFLARE_API_TOKEN.",
      "dotenv_files": []
    },
    "CF_ACCESS_API_TOKEN": {
      "type": "token",
      "description": "Dispatch worker token for Cloudflare Access API lookups. Needs Access apps + groups read (user- or account-owned token).",
      "scope": ["Access: Apps and Policies Read", "Access: Groups Read"],
      "environments": ["staging", "production"],
      "connectivity_environments": ["staging", "production"],
      "used_by": ["dispatch", "ci-cd"],
      "github_secret_name": "CF_ACCESS_API_TOKEN",
      "wrangler_binding": "secrets",
      "container_pass": false,
      "format": "Cloudflare API token (Bearer)",
      "connectivity_test": {
        "type": "cf_permission_check",
        "expected_permissions": ["Access: Apps and Policies Read"]
      },
      "notes": "May be a user-owned (cfut_) or account-owned (cfat_) API token; the validator verifies the matching scope endpoint. Mapped to transient CLOUDFLARE_API_TOKEN env var in the CI step that uploads secrets to the dispatch worker. Replaces former CLOUDFLARE_API_TOKEN and CF_API_TOKEN.",
      "dotenv_files": [
        "workers/fouria-dispatch/.dev.vars",
        "workers/fouria-dispatch/.dev.vars.staging",
        "workers/fouria-dispatch/.dev.vars.production"
      ]
    },
    "CF_ACCESS_CLIENT_AUD": {
      "type": "aud",
      "description": "Per-tenant Access AUD for this User Worker. Optional — the platform AUD is always sufficient for authentication. Provisioned by lerma when a tenant has a dedicated Access application.",
      "environments": ["staging", "production"],
      "used_by": ["fouria"],
      "container_pass": false,
      "connectivity_test": {
        "type": "none"
      },
      "notes": "Optional per-tenant AUD. Set by lerma provisioner when provisioning per-tenant Access applications.",
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.staging",
        "apps/fouria/.dev.vars.production"
      ]
    },
    "CF_ACCESS_PLATFORM_AUD": {
      "type": "aud",
      "description": "Production platform-level Access AUD for JWT verification. Used by both the dispatch worker (as upstream) and tenant User Workers (as platformAud fallback).",
      "environments": ["production"],
      "used_by": ["dispatch", "fouria", "lerma"],
      "github_secret_name": "CF_ACCESS_PLATFORM_AUD",
      "wrangler_binding": "secrets",
      "container_pass": false,
      "connectivity_test": {
        "type": "none"
      },
      "notes": "From: tofu -chdir=apps/fouria/iac workspace select production && tofu output -raw platform_access_aud. Compiled to CF_ACCESS_PLATFORM_AUD on dispatch, user workers, and lerma dashboard.",
      "dotenv_files": [
        "workers/fouria-dispatch/.dev.vars",
        "workers/fouria-dispatch/.dev.vars.production",
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.production",
        "apps/lerma/.env",
        "apps/lerma/.env.production"
      ]
    },
    "STAGING_CF_ACCESS_PLATFORM_AUD": {
      "type": "aud",
      "description": "Staging platform-level Access AUD for JWT verification. Used by both the staging dispatch worker and staging User Workers.",
      "environments": ["staging"],
      "used_by": ["dispatch", "fouria", "lerma"],
      "github_secret_name": "STAGING_CF_ACCESS_PLATFORM_AUD",
      "wrangler_binding": "secrets",
      "container_pass": false,
      "connectivity_test": {
        "type": "none"
      },
      "notes": "Same value as CF_ACCESS_PLATFORM_AUD (shared *.fouria.io wildcard). Compiles to CF_ACCESS_PLATFORM_AUD.",
      "dotenv_files": [
        {
          "file": "workers/fouria-dispatch/.dev.vars.staging",
          "as": "CF_ACCESS_PLATFORM_AUD"
        },
        {
          "file": "apps/fouria/.dev.vars.staging",
          "as": "CF_ACCESS_PLATFORM_AUD"
        },
        {
          "file": "apps/lerma/.env.staging",
          "as": "CF_ACCESS_PLATFORM_AUD"
        }
      ]
    },
    "CF_ACCESS_LERMA_AUD": {
      "type": "aud",
      "description": "Production Lerma dashboard Access audience tag for JWT verification.",
      "environments": ["production"],
      "used_by": ["lerma"],
      "github_secret_name": "CF_ACCESS_LERMA_AUD",
      "wrangler_binding": null,
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "notes": "From: tofu -chdir=apps/lerma/iac/tf workspace select default && tofu output -raw dashboard_access_aud. Compiles to CF_ACCESS_AUD in the production container.",
      "dotenv_files": ["apps/lerma/.env", "apps/lerma/.env.production"]
    },
    "STAGING_CF_ACCESS_LERMA_AUD": {
      "type": "aud",
      "description": "Staging Lerma dashboard Access audience tag for JWT verification.",
      "environments": ["staging"],
      "used_by": ["lerma"],
      "github_secret_name": "STAGING_CF_ACCESS_LERMA_AUD",
      "wrangler_binding": null,
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "notes": "From: tofu -chdir=apps/lerma/iac/tf workspace select staging && tofu output -raw dashboard_access_aud. Compiles to CF_ACCESS_AUD in the staging container.",
      "dotenv_files": [
        {
          "file": "apps/lerma/.env.staging",
          "as": "CF_ACCESS_LERMA_AUD"
        }
      ]
    },
    "E2E_CF_ACCESS_TEAM_DOMAIN": {
      "type": "url",
      "description": "Cloudflare Access team domain for JWT issuer construction. Value: paso4.cloudflareaccess.com",
      "environments": ["local", "staging", "production"],
      "used_by": ["lerma", "fouria", "dispatch"],
      "github_secret_name": "E2E_CF_ACCESS_TEAM_DOMAIN",
      "wrangler_binding": "vars",
      "container_pass": false,
      "connectivity_test": {
        "type": "dns_resolve",
        "endpoint": "{value}.cloudflareaccess.com"
      },
      "notes": "Hardcoded in wrangler.jsonc vars for staging and production.",
      "mapped_to": "CF_ACCESS_TEAM_DOMAIN",
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.staging",
        "apps/fouria/.dev.vars.production",
        "apps/lerma/.env",
        "apps/lerma/.env.staging",
        "apps/lerma/.env.production"
      ]
    },
    "CF_ACCESS_SERVICE_TOKEN_ID": {
      "type": "id",
      "description": "CF Access service token Client ID for local CI/CD non-interactive authentication.",
      "environments": ["local"],
      "used_by": ["lerma"],
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": []
    },
    "CF_ACCESS_SERVICE_TOKEN_SECRET": {
      "type": "secret",
      "description": "CF Access service token Client Secret for local CI/CD non-interactive authentication.",
      "environments": ["local"],
      "used_by": ["lerma"],
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": []
    },
    "CLOUDFLARE_AI_GATEWAY_API_KEY": {
      "type": "key",
      "description": "AI-scoped Cloudflare credential used by Lerma provisioning and FourIA's native and REST AI Gateway transports.",
      "environments": ["local", "staging", "production"],
      "used_by": ["lerma", "fouria", "plugin-ub"],
      "container_pass": true,
      "github_secret_name": "E2E_CLOUDFLARE_AI_GATEWAY_API_KEY",
      "connectivity_test": {
        "type": "ai_gateway_infer",
        "depends_on": ["CF_AI_GATEWAY_ACCOUNT_ID", "CF_AI_GATEWAY_GATEWAY_ID"]
      },
      "notes": "Read from Lerma's environment and copied to every tenant as a platform secret. Never generate this value randomly: it must be a real AI-scoped Cloudflare credential.",
      "dotenv_files": [
        "apps/lerma/.env",
        "apps/lerma/.env.staging",
        "apps/lerma/.env.production",
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.staging",
        "apps/fouria/.dev.vars.production",
        "packages/plugins/cloudflare-unified-billing/.dev.vars"
      ]
    },
    "CF_AI_GATEWAY_ACCOUNT_ID": {
      "type": "id",
      "description": "Cloudflare account ID for AI Gateway URL construction. Value: 35afea16440634aa2350331d2a736eec",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria", "plugin-ub"],
      "container_pass": true,
      "wrangler_binding": "vars",
      "github_secret_name": "E2E_CF_AI_GATEWAY_ACCOUNT_ID",
      "connectivity_test": {
        "type": "none"
      },
      "notes": "Same as CLOUDFLARE_ACCOUNT_ID \u2014 passed separately for AI Gateway routing.",
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.staging",
        "apps/fouria/.dev.vars.production",
        "packages/plugins/cloudflare-unified-billing/.dev.vars"
      ]
    },
    "CF_AI_GATEWAY_GATEWAY_ID": {
      "type": "id",
      "description": "AI Gateway ID for URL construction. Value: moltworker",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria", "plugin-ub"],
      "container_pass": true,
      "wrangler_binding": "vars",
      "github_secret_name": "E2E_CF_AI_GATEWAY_GATEWAY_ID",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.staging",
        "apps/fouria/.dev.vars.production",
        "packages/plugins/cloudflare-unified-billing/.dev.vars"
      ]
    },
    "CF_AI_GATEWAY_CUSTOM_DOMAIN": {
      "type": "id",
      "description": "Optional AI Gateway custom domain (e.g. ai.example.com). Routes unified billing through https://<domain>/compat and enables Cloudflare Access identity-aware controls for User Insights.",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria", "plugin-ub"],
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "packages/plugins/cloudflare-unified-billing/.dev.vars"
      ]
    },
    "CF_ACCESS_TOKEN": {
      "type": "token",
      "description": "Cloudflare Access user JWT (from `cloudflared access login`) forwarded as cf-access-token on an Access-protected AI Gateway custom domain. AI Gateway records cf.user_id for per-user User Insights attribution.",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria", "plugin-ub"],
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "packages/plugins/cloudflare-unified-billing/.dev.vars"
      ]
    },
    "CF_ACCESS_CLIENT_ID": {
      "type": "id",
      "description": "Cloudflare Access service-token client ID (headless alternative to CF_ACCESS_TOKEN; service tokens do not produce cf.user_id).",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria", "plugin-ub"],
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "packages/plugins/cloudflare-unified-billing/.dev.vars"
      ]
    },
    "CF_ACCESS_CLIENT_SECRET": {
      "type": "secret",
      "description": "Cloudflare Access service-token client secret (used with CF_ACCESS_CLIENT_ID).",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria", "plugin-ub"],
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "packages/plugins/cloudflare-unified-billing/.dev.vars"
      ]
    },
    "CLOUDFLARE_TUNNEL_TOKEN": {
      "type": "token",
      "description": "cloudflared tunnel token for exposing Obsidian sync (port 18790) via Cloudflare Tunnel.",
      "environments": ["staging", "production"],
      "used_by": ["fouria"],
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/fouria/.dev.vars"]
    },
    "MOLTBOT_GATEWAY_TOKEN": {
      "type": "secret",
      "description": "Gateway token for authenticating CLI commands against the OpenClaw gateway inside the container. Mapped to OPENCLAW_GATEWAY_TOKEN by buildEnvVars(). Auto-generated per tenant by the lerma provisioner.",
      "environments": ["staging", "production"],
      "used_by": ["fouria"],
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "notes": "Auto-generated crypto token in tenant_provisioner. Maps to OPENCLAW_GATEWAY_TOKEN in container env. The start-openclaw.sh script unsets the original name in the container to prevent leakage.",
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.staging",
        "apps/fouria/.dev.vars.production"
      ]
    },
    "CLOUDFLARED_TUNNEL_TOKEN": {
      "type": "token",
      "description": "Separate tunnel token for lerma dashboard local dev (routes to port 4001 via cloudflared).",
      "environments": ["local"],
      "used_by": ["lerma"],
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": []
    },
    "R2_ACCESS_KEY_ID": {
      "type": "key",
      "description": "R2 access key for Sandbox SDK backup/restore (R2 presigned URL signing on the User Worker) and for container-side s3fs mount. Deployed by the lerma provisioner as a platform secret_text binding.",
      "environments": ["staging", "production"],
      "used_by": ["fouria"],
      "container_pass": true,
      "mapped_to": "R2_ACCESS_KEY_ID",
      "github_secret_name": "E2E_R2_ACCESS_KEY_ID",
      "connectivity_test": {
        "type": "none"
      },
      "notes": "Required by the Sandbox SDK presigned-URL backup path together with R2_SECRET_ACCESS_KEY, CLOUDFLARE_ACCOUNT_ID and BACKUP_BUCKET_NAME. When missing, tenants cannot run backups (provisioner warns). One account-scoped token serves all tenants and E2E. Mint new credentials via `mix lerma.r2_token` (parent token needs User → API Tokens Write; see apps/lerma/README.md).",
      "dotenv_files": ["apps/fouria/.dev.vars"]
    },
    "R2_SECRET_ACCESS_KEY": {
      "type": "secret",
      "description": "R2 secret key for Sandbox SDK backup/restore (R2 presigned URL signing on the User Worker) and for container-side s3fs mount. Deployed by the lerma provisioner as a platform secret_text binding.",
      "environments": ["staging", "production"],
      "used_by": ["fouria"],
      "container_pass": true,
      "mapped_to": "R2_SECRET_ACCESS_KEY",
      "github_secret_name": "E2E_R2_SECRET_ACCESS_KEY",
      "connectivity_test": {
        "type": "none"
      },
      "notes": "Required by the Sandbox SDK presigned-URL backup path together with R2_ACCESS_KEY_ID, CLOUDFLARE_ACCOUNT_ID and BACKUP_BUCKET_NAME. Equal to the SHA-256 hash of the minted token value.",
      "dotenv_files": ["apps/fouria/.dev.vars"]
    },
    "BACKUP_BUCKET_NAME": {
      "type": "bucket",
      "description": "R2 backup bucket name (staging: fouria-data-staging, production: fouria-data). Required as a plain_text binding on the User Worker: the Sandbox SDK presigned-URL backup path signs URLs against this name in addition to the BACKUP_BUCKET binding. Mapped to R2_BUCKET_NAME for container-side reference.",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria"],
      "container_pass": true,
      "mapped_to": "R2_BUCKET_NAME",
      "wrangler_binding": "r2_buckets",
      "connectivity_test": {
        "type": "none"
      },
      "notes": "E2E fixture deploys set BACKUP_BUCKET_NAME to the per-run terraform bucket so backup/restore never touches the platform bucket.",
      "dotenv_files": []
    },
    "BACKUP_ENCRYPTION_KEY": {
      "type": "secret",
      "description": "Base64 32-byte AES-256 master key for client-side encryption of R2 backup snapshots and config versions (F4E1 format). Worker-side only, never passed to the container. Generate: openssl rand -base64 32. Backups created before the key is set remain plaintext and stay restorable.",
      "environments": ["local", "staging", "production"],
      "used_by": ["fouria"],
      "container_pass": false,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/fouria/.dev.vars"]
    },
    "CLOUDFLARE_ACCOUNT_ID": {
      "type": "id",
      "description": "Paso4 Cloudflare account ID. Value: 35afea16440634aa2350331d2a736eec",
      "environments": ["local", "staging", "production"],
      "used_by": ["lerma", "fouria", "dispatch", "iac-lerma", "iac-fouria"],
      "wrangler_binding": "vars",
      "container_pass": true,
      "connectivity_test": {
        "type": "none"
      },
      "notes": "Canonical runtime name everywhere. Required on the fouria User Worker (plain_text binding or wrangler var): the Sandbox SDK reads it for R2 presigned URL signing (backup/restore). Legacy alias CF_ACCOUNT_ID is deprecated — fixture scripts still accept it as a fallback but emit no new uses.",
      "dotenv_files": [
        "apps/fouria/.dev.vars",
        "apps/fouria/.dev.vars.staging",
        "apps/fouria/.dev.vars.production",
        "apps/lerma/.env",
        "apps/lerma/.env.staging",
        "apps/lerma/.env.production"
      ]
    },
    "PASO4_ZONE_ID": {
      "type": "zone",
      "description": "Cloudflare zone ID for paso4.io. Value: 6ce23f544f57a1909578032abcda18dd",
      "environments": ["local", "staging", "production"],
      "used_by": ["iac-lerma", "iac-fouria"],
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": []
    },
    "FOURIA_ZONE_ID": {
      "type": "zone",
      "description": "Cloudflare zone ID for fouria.io. Value: 0788c1abfe5b9d58bdf41052ccaaa765",
      "environments": ["staging", "production"],
      "used_by": ["iac-fouria", "dispatch"],
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": []
    },
    "WORKERS_SUBDOMAIN": {
      "type": "url",
      "description": "Cloudflare Workers subdomain for E2E test routing.",
      "environments": ["staging", "production"],
      "used_by": ["ci-cd"],
      "github_secret_name": "E2E_WORKERS_SUBDOMAIN",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/fouria/.dev.vars.staging", "apps/fouria/.dev.vars.production"]
    },
    "SUPABASE_URL": {
      "type": "url",
      "description": "Supabase project URL for the shared PostgreSQL database. Different per environment.",
      "environments": ["staging", "production"],
      "used_by": ["dispatch", "lerma", "ci-cd"],
      "github_secret_name": "SUPABASE_URL",
      "connectivity_test": {
        "type": "supabase_query",
        "endpoint": "/rest/v1/"
      },
      "dotenv_files": [
        "apps/lerma/.env",
        "apps/lerma/.env.production",
        "workers/fouria-dispatch/.dev.vars",
        "workers/fouria-dispatch/.dev.vars.production"
      ]
    },
    "SUPABASE_SERVICE_ROLE_KEY": {
      "type": "key",
      "description": "Supabase service role key (bypasses RLS). Used by dispatch worker and CI.",
      "environments": ["staging", "production"],
      "used_by": ["dispatch", "ci-cd"],
      "github_secret_name": "SUPABASE_SERVICE_ROLE_KEY",
      "connectivity_test": {
        "type": "supabase_query",
        "endpoint": "/rest/v1/clients?limit=1"
      },
      "dotenv_files": [
        "apps/lerma/.env",
        "apps/lerma/.env.production",
        "workers/fouria-dispatch/.dev.vars",
        "workers/fouria-dispatch/.dev.vars.production"
      ]
    },
    "GH_PAT": {
      "type": "token",
      "description": "GitHub personal access token used by deploy-dashboard workflow for GHCR auth (docker login ghcr.io). Requires the read:packages scope to pull private container images like ghcr.io/0xcab0/lerma.",
      "environments": ["staging", "production"],
      "connectivity_environments": ["staging", "production"],
      "used_by": ["ci-cd"],
      "github_secret_name": "GH_PAT",
      "connectivity_test": [
        {
          "type": "ghcr_pull",
          "username": "0xCAB0",
          "repo": "0xcab0/lerma",
          "tag": "latest-pre"
        }
      ],
      "dotenv_files": ["apps/lerma/.env"]
    },
    "HCLOUD_TOKEN": {
      "type": "token",
      "description": "Hetzner Cloud API token for OpenTofu VM provisioning.",
      "environments": ["staging", "production"],
      "used_by": ["iac-lerma"],
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/lerma/.env", "apps/lerma/.env.staging", "apps/lerma/.env.production"]
    },
    "SUPABASE_ACCESS_TOKEN": {
      "type": "token",
      "description": "Supabase management API token for Tofu provisioning.",
      "environments": ["staging", "production"],
      "used_by": ["iac-lerma"],
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/lerma/.env", "apps/lerma/.env.staging", "apps/lerma/.env.production"]
    },
    "DATABASE_URL": {
      "type": "url",
      "description": "PostgreSQL database URL for production deployment (Ansible).",
      "environments": ["production"],
      "used_by": ["ci-cd"],
      "github_secret_name": "DATABASE_URL",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/lerma/.env.production"]
    },
    "STAGING_DATABASE_URL": {
      "type": "url",
      "description": "PostgreSQL database URL for staging deployment (Ansible).",
      "environments": ["staging"],
      "used_by": ["ci-cd"],
      "github_secret_name": "STAGING_DATABASE_URL",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        {
          "file": "apps/lerma/.env.staging",
          "as": "DATABASE_URL"
        }
      ]
    },
    "SECRET_KEY_BASE": {
      "type": "secret",
      "description": "Phoenix secret key base for production.",
      "environments": ["production"],
      "used_by": ["lerma", "ci-cd"],
      "github_secret_name": "SECRET_KEY_BASE",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/lerma/.env.production"]
    },
    "STAGING_SECRET_KEY_BASE": {
      "type": "secret",
      "description": "Phoenix secret key base for staging.",
      "environments": ["staging"],
      "used_by": ["ci-cd"],
      "github_secret_name": "STAGING_SECRET_KEY_BASE",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        {
          "file": "apps/lerma/.env.staging",
          "as": "SECRET_KEY_BASE"
        }
      ]
    },
    "SERVER_IP": {
      "type": "id",
      "description": "Production Hetzner VM IP address (Ansible).",
      "environments": ["production"],
      "used_by": ["ci-cd"],
      "github_secret_name": "SERVER_IP",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/lerma/.env.production"]
    },
    "STAGING_SERVER_IP": {
      "type": "id",
      "description": "Staging Hetzner VM IP address (Ansible).",
      "environments": ["staging"],
      "used_by": ["ci-cd"],
      "github_secret_name": "STAGING_SERVER_IP",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        {
          "file": "apps/lerma/.env.staging",
          "as": "SERVER_IP"
        }
      ]
    },
    "SSH_PRIVATE_KEY": {
      "type": "secret",
      "description": "SSH private key for production server access.",
      "environments": ["production"],
      "used_by": ["ci-cd"],
      "github_secret_name": "SSH_PRIVATE_KEY",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/lerma/.env.production"]
    },
    "STAGING_SSH_PRIVATE_KEY": {
      "type": "secret",
      "description": "SSH private key for staging server access.",
      "environments": ["staging"],
      "used_by": ["ci-cd"],
      "github_secret_name": "STAGING_SSH_PRIVATE_KEY",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        {
          "file": "apps/lerma/.env.staging",
          "as": "SSH_PRIVATE_KEY"
        }
      ]
    },
    "SECRETS_STORE_ID": {
      "type": "id",
      "description": "Shared Cloudflare Secrets Store ID for dynamic/user secrets. Managed by OpenTofu.",
      "environments": ["staging", "production"],
      "used_by": ["lerma"],
      "github_secret_name": "SECRETS_STORE_ID",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": ["apps/lerma/.env", "apps/lerma/.env.staging", "apps/lerma/.env.production"]
    },
    "SUPABASE_STAGING_URL": {
      "type": "url",
      "description": "Supabase project URL for staging environment.",
      "environments": ["staging"],
      "used_by": ["ci-cd"],
      "github_secret_name": "SUPABASE_STAGING_URL",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        {
          "file": "apps/lerma/.env.staging",
          "as": "SUPABASE_URL"
        },
        {
          "file": "workers/fouria-dispatch/.dev.vars.staging",
          "as": "SUPABASE_URL"
        },
        {
          "file": "workers/fouria-dispatch/.dev.vars.production",
          "as": "STAGING_SUPABASE_URL"
        }
      ]
    },
    "SUPABASE_STAGING_KEY": {
      "type": "key",
      "description": "Supabase service role key for staging environment.",
      "environments": ["staging"],
      "used_by": ["ci-cd"],
      "github_secret_name": "SUPABASE_STAGING_KEY",
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        {
          "file": "apps/lerma/.env.staging",
          "as": "SUPABASE_SERVICE_ROLE_KEY"
        },
        {
          "file": "workers/fouria-dispatch/.dev.vars.staging",
          "as": "SUPABASE_SERVICE_ROLE_KEY"
        },
        {
          "file": "workers/fouria-dispatch/.dev.vars.production",
          "as": "STAGING_SUPABASE_SERVICE_ROLE_KEY"
        }
      ]
    },
    "FOURIA_TAIL_SECRET": {
      "type": "secret",
      "description": "Shared Bearer token between fouria-tail worker and lerma ingestion endpoint. Set as a Worker secret on fouria-tail; also set as FOURIA_TAIL_SECRET env var on the lerma container.",
      "environments": ["staging", "production"],
      "used_by": ["fouria-tail", "lerma"],
      "github_secret_name": "FOURIA_TAIL_SECRET",
      "wrangler_binding": "secrets",
      "container_pass": false,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [
        {
          "file": "workers/fouria-tail/.dev.vars",
          "as": "FOURIA_TAIL_SECRET"
        },
        {
          "file": "workers/fouria-tail/.dev.vars.staging",
          "as": "FOURIA_TAIL_SECRET"
        },
        "apps/lerma/.env",
        "apps/lerma/.env.staging",
        "apps/lerma/.env.production"
      ]
    },
    "R2_LOGPUSH_ACCESS_KEY_ID": {
      "type": "key",
      "description": "R2 access key for Logpush destination (account-level). Passed as r2_logpush_access_key_id in iac-fouria tfvars.",
      "environments": ["staging", "production"],
      "used_by": ["iac-fouria"],
      "github_secret_name": "R2_LOGPUSH_ACCESS_KEY_ID",
      "wrangler_binding": null,
      "container_pass": false,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [],
      "notes": "Provisioned via R2 API token in Cloudflare dashboard. Used by the Logpush R2 destination_conf in observability.tf."
    },
    "R2_LOGPUSH_SECRET_ACCESS_KEY": {
      "type": "secret",
      "description": "R2 secret key for Logpush destination (account-level). Passed as r2_logpush_secret_access_key in iac-fouria tfvars.",
      "environments": ["staging", "production"],
      "used_by": ["iac-fouria"],
      "github_secret_name": "R2_LOGPUSH_SECRET_ACCESS_KEY",
      "wrangler_binding": null,
      "container_pass": false,
      "connectivity_test": {
        "type": "none"
      },
      "dotenv_files": [],
      "notes": "SECURITY: this value WILL be stored in the OpenTofu state file embedded in the Logpush destination_conf URL. Restrict access to terraform.tfstate.d/"
    }
  },
  "type": "object",
  "required": ["values"],
  "properties": {
    "values": {
      "type": "object",
      "description": "Secret name \u2192 value pairs. Copy the template above, fill in your real values.",
      "required": [],
      "additionalProperties": {
        "type": "string"
      }
    }
  },
  "additionalProperties": false,
  "x-env-templates": {
    "apps/fouria/.dev.vars": {
      "project": "fouria",
      "header": "# Generated by secrets-generate.ts \u2014 edit SECRETS.yaml instead\n# Copy the matching .env or .dev.vars file to your target.\n# Use the manual variables section (below) for env vars not tracked in SECRETS.yaml.\n"
    },
    "apps/fouria/.dev.vars.staging": {
      "project": "fouria",
      "header": "# Generated by secrets-generate.ts \u2014 staging vars\n# Copy to .dev.vars for wrangler dev --env staging\n"
    },
    "apps/fouria/.dev.vars.production": {
      "project": "fouria",
      "header": "# Generated by secrets-generate.ts \u2014 production vars\n"
    },
    "apps/lerma/.env": {
      "project": "lerma",
      "header": "# Generated by secrets-generate.ts \u2014 edit SECRETS.yaml instead\n# Source this file: set +a && source apps/lerma/.env && set +a\n\nTF_VAR_deploy_environment=production\n",
      "footer": "# ---\n# Add any missing secrets below:\n# DATABASE_URL=postgresql://...\n# SECRET_KEY_BASE=...\n# CF_ACCESS_SERVICE_TOKEN_ID=\n# CF_ACCESS_SERVICE_TOKEN_SECRET=\n# SKIP_AUTH=true\n"
    },
    "apps/lerma/.env.staging": {
      "project": "lerma",
      "header": "# Generated by secrets-generate.ts \u2014 staging env\n# Source: set +a && source apps/lerma/.env.staging && set +a\n\nTF_VAR_deploy_environment=staging\n"
    },
    "apps/lerma/.env.production": {
      "project": "lerma",
      "header": "# Generated by secrets-generate.ts \u2014 production env\n\nTF_VAR_deploy_environment=production\n"
    },
    "workers/fouria-dispatch/.dev.vars": {
      "project": "dispatch",
      "header": "# Generated by secrets-generate.ts \u2014 edit SECRETS.yaml instead\n# Use the manual variables section (below) for env vars not tracked in SECRETS.yaml.\n"
    },
    "workers/fouria-dispatch/.dev.vars.staging": {
      "project": "dispatch",
      "header": "# Generated by secrets-generate.ts \u2014 staging vars\n"
    },
    "workers/fouria-dispatch/.dev.vars.production": {
      "project": "dispatch",
      "header": "# Generated by secrets-generate.ts \u2014 production vars\n"
    },
    "workers/fouria-tail/.dev.vars": {
      "project": "fouria-tail",
      "header": "# Generated by secrets-generate.ts \u2014 edit SECRETS.yaml instead\n"
    },
    "workers/fouria-tail/.dev.vars.staging": {
      "project": "fouria-tail",
      "header": "# Generated by secrets-generate.ts \u2014 staging vars\n"
    }
  }
}