@lucern/contracts 0.3.0-alpha.16 → 0.3.0-alpha.17

package/dist/manifests/infisical-runtime-manifest.d.ts

@@ -162,6 +162,18 @@ declare const INFISICAL_RUNTIME_MANIFEST: {
             readonly public: false;
             readonly description: "Optional web-issued CLI login session lifetime override in milliseconds.";
         }];
+    }, {
+        readonly id: "platform-operator-credentials";
+        readonly secretPath: "/platform/runtime";
+        readonly description: "Lucern-owned operator credential material for local CLI, MCP, and SDK sessions.";
+        readonly variables: readonly [{
+            readonly name: "LUCERN_API_KEY";
+            readonly required: false;
+            readonly secret: true;
+            readonly public: false;
+            readonly aliases: readonly ["LUCERN_KEY"];
+            readonly description: "Lucern-owned operator API key for gateway calls from trusted local tooling.";
+        }];
     }, {
         readonly id: "tenant-shared-install";
         readonly secretPath: "tenants/shared";
@@ -191,7 +203,7 @@ declare const INFISICAL_RUNTIME_MANIFEST: {
         readonly id: "lucern-sdk";
         readonly packageName: "@lucern/sdk";
         readonly delivery: "runtime_fetch";
-        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
         readonly consumer: "server-side SDK operator contexts with a scoped Infisical identity";
         readonly description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials.";
     }, {
@@ -199,7 +211,7 @@ declare const INFISICAL_RUNTIME_MANIFEST: {
         readonly packageName: "@lucern/cli";
         readonly delivery: "runtime_fetch";
         readonly fallback: "device_auth";
-        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
         readonly consumer: "developer/operator CLI processes";
         readonly description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login.";
     }, {
@@ -207,7 +219,7 @@ declare const INFISICAL_RUNTIME_MANIFEST: {
         readonly packageName: "@lucern/mcp";
         readonly delivery: "runtime_fetch";
         readonly fallback: "device_auth";
-        readonly sourcePathIds: readonly ["platform-runtime"];
+        readonly sourcePathIds: readonly ["platform-runtime", "platform-operator-credentials"];
         readonly consumer: "MCP server/client processes";
         readonly description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner.";
     }, {
@@ -1354,6 +1366,32 @@ declare const INFISICAL_RUNTIME_MANIFEST: {
             readonly environmentPolicy: "environment_specific";
         }];
         readonly description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead.";
+    }, {
+        readonly id: "platform.operator.api-key";
+        readonly canonicalName: "LUCERN_API_KEY";
+        readonly aliases: readonly ["LUCERN_KEY"];
+        readonly owner: "lucern_platform";
+        readonly scope: "environment";
+        readonly sourcePath: "/platform/runtime";
+        readonly environmentPolicy: "environment_specific";
+        readonly required: false;
+        readonly secret: true;
+        readonly public: false;
+        readonly consumers: readonly ["lucern-cli", "lucern-mcp", "lucern-repo-ci"];
+        readonly destinations: readonly [{
+            readonly kind: "runtime_fetch";
+            readonly target: "lucern-cli-mcp-sdk";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "operator_local";
+            readonly target: "lucern-repo";
+            readonly environmentPolicy: "environment_specific";
+        }, {
+            readonly kind: "github_actions";
+            readonly target: "LucernAI/lucern";
+            readonly environmentPolicy: "environment_specific";
+        }];
+        readonly description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files.";
     }, {
         readonly id: "platform.graph-sync.proxy";
         readonly canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL";

package/dist/manifests/infisical-runtime-manifest.js

@@ -357,6 +357,21 @@ var INFISICAL_RUNTIME_PATHS = [
       }
     ]
   },
+  {
+    id: "platform-operator-credentials",
+    secretPath: "/platform/runtime",
+    description: "Lucern-owned operator credential material for local CLI, MCP, and SDK sessions.",
+    variables: [
+      {
+        name: "LUCERN_API_KEY",
+        required: false,
+        secret: true,
+        public: false,
+        aliases: ["LUCERN_KEY"],
+        description: "Lucern-owned operator API key for gateway calls from trusted local tooling."
+      }
+    ]
+  },
   {
     id: "tenant-shared-install",
     secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
@@ -392,7 +407,7 @@ var INFISICAL_RUNTIME_SURFACES = [
     id: "lucern-sdk",
     packageName: "@lucern/sdk",
     delivery: "runtime_fetch",
-    sourcePathIds: ["platform-runtime"],
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
     consumer: "server-side SDK operator contexts with a scoped Infisical identity",
     description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials."
   },
@@ -401,7 +416,7 @@ var INFISICAL_RUNTIME_SURFACES = [
     packageName: "@lucern/cli",
     delivery: "runtime_fetch",
     fallback: "device_auth",
-    sourcePathIds: ["platform-runtime"],
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
     consumer: "developer/operator CLI processes",
     description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login."
   },
@@ -410,7 +425,7 @@ var INFISICAL_RUNTIME_SURFACES = [
     packageName: "@lucern/mcp",
     delivery: "runtime_fetch",
     fallback: "device_auth",
-    sourcePathIds: ["platform-runtime"],
+    sourcePathIds: ["platform-runtime", "platform-operator-credentials"],
     consumer: "MCP server/client processes",
     description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner."
   },
@@ -1899,6 +1914,37 @@ var PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS = [
     ],
     description: "Local/hosted MCP auth token material. Tenant apps must use MC/API-key sessions instead."
   },
+  {
+    id: "platform.operator.api-key",
+    canonicalName: "LUCERN_API_KEY",
+    aliases: ["LUCERN_KEY"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/runtime",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-cli", "lucern-mcp", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+  },
   {
     id: "platform.graph-sync.proxy",
     canonicalName: "LUCERN_GRAPH_SYNC_QUERY_BASE_URL",