@lucern/contracts 0.3.0-alpha.16 → 0.3.0-alpha.17

package/dist/infisical-runtime.contract.d.ts

@@ -216,6 +216,18 @@ declare const INFISICAL_RUNTIME_PATHS: readonly [{
         readonly public: false;
         readonly description: "Optional web-issued CLI login session lifetime override in milliseconds.";
     }];
+}, {
+    readonly id: "platform-operator-credentials";
+    readonly secretPath: "/platform/runtime";
+    readonly description: "Lucern-owned operator credential material for local CLI, MCP, and SDK sessions.";
+    readonly variables: readonly [{
+        readonly name: "LUCERN_API_KEY";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly aliases: readonly ["LUCERN_KEY"];
+        readonly description: "Lucern-owned operator API key for gateway calls from trusted local tooling.";
+    }];
 }, {
     readonly id: "tenant-shared-install";
     readonly secretPath: "tenants/shared";
@@ -256,7 +268,7 @@ declare const INFISICAL_RUNTIME_SURFACES: readonly [{
     readonly id: "lucern-sdk";
     readonly packageName: "@lucern/sdk";
     readonly delivery: "runtime_fetch";
-    readonly sourcePathIds: readonly ["platform-runtime"];
+    readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
     readonly consumer: "server-side SDK operator contexts with a scoped Infisical identity";
     readonly description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.";
 }, {
@@ -264,7 +276,7 @@ declare const INFISICAL_RUNTIME_SURFACES: readonly [{
     readonly packageName: "@lucern/cli";
     readonly delivery: "runtime_fetch";
     readonly fallback: "device_auth";
-    readonly sourcePathIds: readonly ["platform-runtime"];
+    readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
     readonly consumer: "developer/operator CLI processes";
     readonly description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.";
 }, {
@@ -272,7 +284,7 @@ declare const INFISICAL_RUNTIME_SURFACES: readonly [{
     readonly packageName: "@lucern/mcp";
     readonly delivery: "runtime_fetch";
     readonly fallback: "device_auth";
-    readonly sourcePathIds: readonly ["platform-runtime"];
+    readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
     readonly consumer: "MCP server/client processes";
     readonly description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.";
 }, {
@@ -1565,6 +1577,32 @@ declare const INFISICAL_SECRET_DEFINITIONS: readonly [{
         readonly environmentPolicy: "environment_specific";
     }];
     readonly description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead.";
+}, {
+    readonly id: "platform.operator.api-key";
+    readonly canonicalName: "LUCERN_API_KEY";
+    readonly aliases: readonly ["LUCERN_KEY"];
+    readonly owner: "lucern_platform";
+    readonly scope: "environment";
+    readonly sourcePath: "/platform/runtime";
+    readonly environmentPolicy: "environment_specific";
+    readonly required: false;
+    readonly secret: true;
+    readonly public: false;
+    readonly consumers: readonly ["lucern-cli", "lucern-mcp", "lucern-repo-ci"];
+    readonly destinations: readonly [{
+        readonly kind: "runtime_fetch";
+        readonly target: "lucern-cli-mcp-sdk";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "operator_local";
+        readonly target: "lucern-repo";
+        readonly environmentPolicy: "environment_specific";
+    }, {
+        readonly kind: "github_actions";
+        readonly target: "LucernAI/lucern";
+        readonly environmentPolicy: "environment_specific";
+    }];
+    readonly description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files.";
 }, {
     readonly id: "platform.graph-sync.proxy";
     readonly canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL";

package/dist/infisical-runtime.contract.js

@@ -371,6 +371,21 @@ var INFISICAL_RUNTIME_PATHS = [
       }
     ]
   },
+  {
+    id: "platform-operator-credentials",
+    secretPath: "/platform/runtime",
+    description: "Lucern-owned operator credential material for local CLI, MCP, and SDK sessions.",
+    variables: [
+      {
+        name: "LUCERN_API_KEY",
+        required: false,
+        secret: true,
+        public: false,
+        aliases: ["LUCERN_KEY"],
+        description: "Lucern-owned operator API key for gateway calls from trusted local tooling."
+      }
+    ]
+  },
   {
     id: "tenant-shared-install",
     secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
@@ -406,7 +421,7 @@ var INFISICAL_RUNTIME_SURFACES = [
     id: "lucern-sdk",
     packageName: "@lucern/sdk",
     delivery: "runtime_fetch",
-    sourcePathIds: ["platform-runtime"],
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
     consumer: "server-side SDK operator contexts with a scoped Infisical identity",
     description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials."
   },
@@ -415,7 +430,7 @@ var INFISICAL_RUNTIME_SURFACES = [
     packageName: "@lucern/cli",
     delivery: "runtime_fetch",
     fallback: "device_auth",
-    sourcePathIds: ["platform-runtime"],
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
     consumer: "developer/operator CLI processes",
     description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login."
   },
@@ -424,7 +439,7 @@ var INFISICAL_RUNTIME_SURFACES = [
     packageName: "@lucern/mcp",
     delivery: "runtime_fetch",
     fallback: "device_auth",
-    sourcePathIds: ["platform-runtime"],
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
     consumer: "MCP server/client processes",
     description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner."
   },
@@ -2005,6 +2020,37 @@ var PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS = [
     ],
     description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead."
   },
+  {
+    id: "platform.operator.api-key",
+    canonicalName: "LUCERN_API_KEY",
+    aliases: ["LUCERN_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-cli", "lucern-mcp", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+  },
   {
     id: "platform.graph-sync.proxy",
     canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL",