@lucern/sdk 0.2.0-alpha.1 → 0.2.0-alpha.10

package/dist/adminClient.d.ts

@@ -0,0 +1,409 @@
+import { GatewayClientConfig, PlatformGatewaySuccess, GatewayScope } from './coreClient.js';
+export { LucernApiError } from './coreClient.js';
+import { ListResult, JsonObject } from './types.js';
+import { ControlObjectOwnershipContract } from './controlObjectOwnership.js';
+import './contracts/workflow-runtime.contract.js';
+import './contracts/lens-workflow.contract.js';
+import './contracts/lens-filter.contract.js';
+
+/** Configuration for the admin client. */
+type AdminClientConfig = GatewayClientConfig;
+type TenantApiKeyRecord = {
+    id?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    label?: string;
+    keyPrefix?: string;
+    hashedKey?: string;
+    scopes?: string[];
+    status?: string;
+    expiresAt?: number;
+    lastUsedAt?: number;
+    revokedAt?: number;
+    revokedBy?: string;
+    createdBy?: string;
+    createdAt?: number;
+    updatedAt?: number;
+};
+type TenantVaultSecretRecord = {
+    id?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    name?: string;
+    description?: string;
+    lastRotated?: number;
+    createdBy?: string;
+    updatedBy?: string;
+    createdAt?: number;
+    updatedAt?: number;
+};
+type TenantAuthPolicyMode = "open" | "invite_only" | "sso_required";
+type TenantTopicVisibility = "private" | "tenant" | "public";
+type TenantFeatureFlags = Record<string, boolean>;
+type TenantModelSlotOverrides = Record<string, string>;
+type TenantConfigRecord = {
+    tenantId: string;
+    authPolicyMode: TenantAuthPolicyMode;
+    defaultSessionTTL: number;
+    defaultTopicVisibility: TenantTopicVisibility;
+    featureFlags: TenantFeatureFlags;
+    maxWorkspaceCount: number;
+    defaultModelSlotOverrides: TenantModelSlotOverrides;
+    updatedAt?: number;
+    updatedBy?: string;
+};
+type TenantModelRoutingSlotRecord = {
+    slot: string;
+    category?: string;
+    description?: string;
+    modelKey: string;
+    promptName?: string;
+    temperature?: number;
+    maxTokens?: number;
+    enabled?: boolean;
+};
+type TenantModelRoutingModelRecord = {
+    key: string;
+    name?: string;
+    modelId?: string;
+    provider?: string;
+    enabled?: boolean;
+    recommended?: boolean;
+    notes?: string;
+};
+type TenantModelRoutingBindingRecord = {
+    slot: string;
+    providerId: string;
+    secretRef: string;
+    label?: string;
+    keyHint?: string;
+};
+type TenantModelRouteOverrideStatus = "inherit" | "active" | "blocked_missing_model" | "blocked_missing_binding";
+type TenantModelRouteBindingState = "ready" | "missing";
+type TenantModelRouteSource = "platform_default" | "tenant_override";
+type TenantModelRouteRow = {
+    slot: string;
+    category: string;
+    description?: string;
+    promptName?: string;
+    slotEnabled: boolean;
+    platformModelKey: string;
+    platformModelName?: string;
+    platformProviderId?: string;
+    overrideModelKey?: string;
+    overrideModelName?: string;
+    overrideProviderId?: string;
+    effectiveModelKey: string;
+    effectiveModelName?: string;
+    effectiveProviderId?: string;
+    effectiveSource: TenantModelRouteSource;
+    overrideStatus: TenantModelRouteOverrideStatus;
+    bindingState: TenantModelRouteBindingState;
+    bindingLabel?: string;
+    bindingKeyHint?: string;
+    bindingSecretRef?: string;
+};
+type TenantModelRoutingSummary = {
+    totalSlots: number;
+    promptBoundSlots: number;
+    activeOverrides: number;
+    blockedOverrides: number;
+    readyBindings: number;
+};
+type TenantModelRoutingSnapshot = {
+    tenantId: string;
+    defaultModelSlotOverrides: Record<string, string>;
+    slots: TenantModelRoutingSlotRecord[];
+    models: TenantModelRoutingModelRecord[];
+    bindings: TenantModelRoutingBindingRecord[];
+    rows: TenantModelRouteRow[];
+    summary: TenantModelRoutingSummary;
+    notes: string[];
+};
+/**
+ * Create the admin client for tenant, workspace, and membership administration.
+ * @param config - Gateway transport configuration.
+ * @returns An object with methods to manage tenants, workspaces, and memberships.
+ */
+declare function createAdminClient(config?: AdminClientConfig): {
+    /**
+     * List tenants visible to the current principal.
+     */
+    listTenants(query?: {
+        status?: "active" | "disabled" | "archived";
+        limit?: number;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "tenants">>>;
+    /**
+     * Create a tenant.
+     */
+    createTenant(input: {
+        key: string;
+        slug?: string;
+        name: string;
+        status?: "active" | "disabled" | "archived";
+        metadata?: JsonObject;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Get the control-object ownership contract.
+     */
+    getControlObjectOwnership(): Promise<PlatformGatewaySuccess<ControlObjectOwnershipContract>>;
+    /**
+     * @deprecated Use getControlObjectOwnership.
+     */
+    getControlObjectOwnershipContract(): Promise<PlatformGatewaySuccess<ControlObjectOwnershipContract>>;
+    /**
+     * List workspaces for the current admin scope.
+     */
+    listWorkspaces(query?: GatewayScope & {
+        status?: "active" | "archived";
+        limit?: number;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "workspaces">>>;
+    /**
+     * Create a workspace.
+     */
+    createWorkspace(input: GatewayScope & {
+        workspaceId?: string;
+        key?: string;
+        slug?: string;
+        name?: string;
+        status?: "active" | "archived";
+        defaultProjectVisibility?: "private" | "team" | "firm" | "external" | "public";
+        restore?: boolean;
+        metadata?: JsonObject;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * List memberships for the current admin scope.
+     */
+    listMemberships(query?: GatewayScope & {
+        principalId?: string;
+        status?: "active" | "revoked" | "expired";
+        limit?: number;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "memberships">>>;
+    /**
+     * Create a membership.
+     */
+    createMembership(input: GatewayScope & {
+        membershipId?: string;
+        principalId: string;
+        role: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
+        status?: "active" | "revoked" | "expired";
+        source?: "bootstrap" | "manual" | "sync" | "invitation";
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Update a membership.
+     */
+    updateMembership(input: GatewayScope & {
+        membershipId?: string;
+        principalId: string;
+        role: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
+        status?: "active" | "revoked" | "expired";
+        source?: "bootstrap" | "manual" | "sync" | "invitation";
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * @deprecated Use createMembership or updateMembership.
+     */
+    upsertMembership(input: GatewayScope & {
+        membershipId?: string;
+        principalId: string;
+        role: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
+        status?: "active" | "revoked" | "expired";
+        source?: "bootstrap" | "manual" | "sync" | "invitation";
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * List tenant API keys in the current admin scope.
+     */
+    listTenantApiKeys(scope: GatewayScope & {
+        status?: "active" | "revoked" | "expired";
+    }): Promise<{
+        data: {
+            keys: TenantApiKeyRecord[];
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Create a tenant API key.
+     */
+    createTenantApiKey(input: GatewayScope & {
+        label?: string;
+        scopes: string[];
+        expiresAt?: number;
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            key: TenantApiKeyRecord | null;
+            plaintextKey: string | undefined;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Revoke a tenant API key.
+     */
+    revokeTenantApiKey(keyId: string, input?: GatewayScope & {
+        reason?: string;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * List tenant vault secrets.
+     */
+    listTenantVaultSecrets(scope: GatewayScope): Promise<{
+        data: {
+            secrets: TenantVaultSecretRecord[];
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Create a tenant vault secret.
+     */
+    createTenantVaultSecret(input: GatewayScope & {
+        name: string;
+        description?: string;
+        value: string;
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            secret: TenantVaultSecretRecord | null;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Update a tenant vault secret.
+     */
+    updateTenantVaultSecret(secretId: string, input: GatewayScope & {
+        name: string;
+        description?: string;
+        value?: string;
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            secret: TenantVaultSecretRecord | null;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Delete a tenant vault secret.
+     */
+    deleteTenantVaultSecret(secretId: string, scope: GatewayScope, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * List tenant provider secrets.
+     */
+    listTenantSecrets(scope: GatewayScope & {
+        providerId?: string;
+        status?: "active" | "revoked";
+    }): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Upsert a tenant provider secret.
+     */
+    upsertTenantSecret(input: GatewayScope & {
+        providerId: string;
+        apiKey: string;
+        label?: string;
+        modelSlotIds?: string[];
+        passThroughOnly?: boolean;
+        metadata?: JsonObject;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Revoke a tenant provider secret.
+     */
+    revokeTenantSecret(secretRef: string, input: GatewayScope & {
+        reason?: string;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Get tenant configuration.
+     */
+    getTenantConfig(scope: GatewayScope & {
+        tenantId: string;
+    }): Promise<PlatformGatewaySuccess<TenantConfigRecord>>;
+    /**
+     * Get tenant model routing.
+     */
+    getTenantModelRouting(scope: GatewayScope & {
+        tenantId: string;
+    }): Promise<PlatformGatewaySuccess<TenantModelRoutingSnapshot>>;
+    /**
+     * Upsert tenant configuration.
+     */
+    upsertTenantConfig(input: GatewayScope & Omit<TenantConfigRecord, "updatedAt" | "updatedBy">, idempotencyKey?: string): Promise<PlatformGatewaySuccess<TenantConfigRecord>>;
+    /**
+     * List groups.
+     */
+    listGroups(scope?: GatewayScope & {
+        limit?: number;
+    }): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Create a group.
+     */
+    createGroup(input: GatewayScope & {
+        name: string;
+        groupKey?: string;
+        groupType?: string;
+        description?: string;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Update a group.
+     */
+    updateGroup(groupId: string, input: GatewayScope & {
+        name?: string;
+        description?: string;
+        workspaceId?: string;
+        clearWorkspaceId?: boolean;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Delete a group.
+     */
+    deleteGroup(groupId: string, input?: GatewayScope, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * List group members.
+     */
+    listGroupMembers(query: GatewayScope & {
+        groupId: string;
+    }): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Add a group member.
+     */
+    addGroupMember(input: GatewayScope & {
+        groupId: string;
+        principalId: string;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Remove a group member.
+     */
+    removeGroupMember(input: GatewayScope & {
+        groupId: string;
+        principalId: string;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * List pack-to-group assignments.
+     */
+    listPackGroupAssignments(query?: GatewayScope & {
+        groupId?: string;
+        status?: string;
+    }): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Assign a pack to a group.
+     */
+    assignPackToGroup(input: GatewayScope & {
+        groupId: string;
+        packKey: string;
+        packVersion?: string;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * Remove a pack from a group.
+     */
+    removePackFromGroup(input: GatewayScope & {
+        groupId: string;
+        packKey: string;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+};
+
+export { type AdminClientConfig, GatewayScope, PlatformGatewaySuccess, type TenantApiKeyRecord, type TenantAuthPolicyMode, type TenantConfigRecord, type TenantFeatureFlags, type TenantModelRouteBindingState, type TenantModelRouteOverrideStatus, type TenantModelRouteRow, type TenantModelRouteSource, type TenantModelRoutingBindingRecord, type TenantModelRoutingModelRecord, type TenantModelRoutingSlotRecord, type TenantModelRoutingSnapshot, type TenantModelRoutingSummary, type TenantModelSlotOverrides, type TenantTopicVisibility, type TenantVaultSecretRecord, createAdminClient };