@lucern/sdk 0.2.0-alpha.1 → 0.2.0-alpha.11

package/dist/{packages/sdk/src/policyClient.d.ts → policyClient.d.ts}

@@ -1,9 +1,16 @@
-import { type GatewayClientConfig, type GatewayScope, LucernApiError } from "./coreClient";
-export { LucernApiError };
-export type { GatewayScope, PlatformGatewaySuccess } from "./coreClient";
-export type PolicyClientConfig = GatewayClientConfig;
-export type PermissionKind = "read" | "write";
-export type WritePolicyPermission = "allow" | "deny" | "review_required";
+import { GatewayClientConfig, GatewayScope, PlatformGatewaySuccess } from './coreClient.js';
+export { LucernApiError } from './coreClient.js';
+import { ListResult } from './types.js';
+import './contracts/workflow-runtime.contract.js';
+import './contracts/lens-workflow.contract.js';
+import './contracts/lens-filter.contract.js';
+
+/** Configuration for the policy client. */
+type PolicyClientConfig = GatewayClientConfig;
+/** Permission direction: read access or write access. */
+type PermissionKind = "read" | "write";
+/** Permission level for a write policy rule. */
+type WritePolicyPermission = "allow" | "deny" | "review_required";
 type TopicRecord = {
     topicId?: string;
     name?: string;
@@ -11,7 +18,8 @@ type TopicRecord = {
     isOwner?: boolean;
     [key: string]: unknown;
 };
-export type PolicyDecisionExplanation = {
+/** Structured explanation of how a policy decision was derived. */
+type PolicyDecisionExplanation = {
     summary?: string;
     matchedReasonCode?: string;
     steps?: Array<{
@@ -22,7 +30,8 @@ export type PolicyDecisionExplanation = {
     }>;
     [key: string]: unknown;
 };
-export type PermissionDecision = {
+/** Result of a permission check against the policy engine. */
+type PermissionDecision = {
     allowed?: boolean;
     decision?: string;
     reasonCode?: string;
@@ -33,7 +42,8 @@ export type PermissionDecision = {
     traceId?: string | null;
     explanation?: PolicyDecisionExplanation;
 };
-export type WritePolicyRecord = {
+/** A persisted write policy rule controlling mutation access. */
+type WritePolicyRecord = {
     id?: string;
     topicId?: string;
     role?: string;
@@ -48,7 +58,8 @@ export type WritePolicyRecord = {
     resolution?: string;
     [key: string]: unknown;
 };
-export type WritePolicyCreateInput = GatewayScope & {
+/** Input for creating a write policy rule. */
+type WritePolicyCreateInput = GatewayScope & {
     topicId?: string;
     role: string;
     toolCategory: string;
@@ -58,7 +69,8 @@ export type WritePolicyCreateInput = GatewayScope & {
     rationale?: string;
     createdBy?: string;
 };
-export type WritePolicyUpdateInput = GatewayScope & {
+/** Input for partially updating an existing write policy rule. */
+type WritePolicyUpdateInput = GatewayScope & {
     topicId?: string;
     clearTopicId?: boolean;
     role?: string;
@@ -70,10 +82,29 @@ export type WritePolicyUpdateInput = GatewayScope & {
     rationale?: string;
     clearRationale?: boolean;
 };
+type TenantPolicyPermission = {
+    resource: string;
+    actions: string[];
+};
+type TenantPolicyRecord = {
+    id?: string;
+    tenantId: string;
+    workspaceId?: string;
+    roleName: string;
+    description?: string;
+    permissions: TenantPolicyPermission[];
+    groupBindings: string[];
+    createdAt?: number;
+    updatedAt?: number;
+    createdBy?: string;
+    updatedBy?: string;
+};
 /**
- * Create the policy client for permission checks and grants.
+ * Create the policy client for permission checks, grants, and write policies.
+ * @param config - Gateway transport configuration.
+ * @returns An object with methods to check permissions, manage grants, and manage write policies.
  */
-export declare function createPolicyClient(config?: PolicyClientConfig): {
+declare function createPolicyClient(config?: PolicyClientConfig): {
     /**
      * List policy decisions in the current scope.
      */
@@ -84,7 +115,7 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         principalId?: string;
         topicId?: string;
         limit?: number;
-    }): Promise<import("./coreClient").PlatformGatewaySuccess<import("./types").ListResult<any, "decisions">>>;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "decisions">>>;
     /**
      * Create a permission grant.
      */
@@ -96,7 +127,7 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         groupId?: string;
         beliefClusterId?: string;
         expiresAt?: number;
-    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * Delete a permission grant by revoking it.
      */
@@ -106,7 +137,10 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         principalId?: string;
         groupId?: string;
         beliefClusterId?: string;
-    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    }, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
+    /**
+     * List write policy rules for the current scope.
+     */
     listWritePolicies(query?: GatewayScope & {
         topicId?: string;
         role?: string;
@@ -121,6 +155,9 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         policyTraceId: string | null;
         idempotentReplay: boolean;
     }>;
+    /**
+     * Create a write policy rule.
+     */
     createWritePolicy(input: WritePolicyCreateInput, idempotencyKey?: string): Promise<{
         data: {
             id: string | undefined;
@@ -132,6 +169,9 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         policyTraceId: string | null;
         idempotentReplay: boolean;
     }>;
+    /**
+     * Update an existing write policy rule by identifier.
+     */
     updateWritePolicy(id: string, input: WritePolicyUpdateInput, idempotencyKey?: string): Promise<{
         data: {
             id: string | undefined;
@@ -143,10 +183,63 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         policyTraceId: string | null;
         idempotentReplay: boolean;
     }>;
-    deleteWritePolicy(id: string, scope?: GatewayScope, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<{
+    /**
+     * Delete a write policy rule by identifier.
+     */
+    deleteWritePolicy(id: string, scope?: GatewayScope, idempotencyKey?: string): Promise<PlatformGatewaySuccess<{
         id?: string;
         deleted?: boolean;
     }>>;
+    /**
+     * List tenant role policies for the current scope.
+     */
+    listRolePolicies(query?: GatewayScope): Promise<{
+        data: {
+            policies: TenantPolicyRecord[];
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Create a tenant role policy.
+     */
+    createRolePolicy(input: GatewayScope & {
+        roleName: string;
+        description?: string;
+        permissions: TenantPolicyPermission[];
+        groupBindings?: string[];
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            policy: TenantPolicyRecord | null;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Update a tenant role policy by identifier.
+     */
+    updateRolePolicy(id: string, input: GatewayScope & {
+        roleName: string;
+        description?: string;
+        permissions: TenantPolicyPermission[];
+        groupBindings?: string[];
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            policy: TenantPolicyRecord | null;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Delete a tenant role policy by identifier.
+     */
+    deleteRolePolicy(id: string, scope?: GatewayScope, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * Check a permission decision for a topic or project scope.
      */
@@ -156,7 +249,7 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         principal?: string;
         principalId?: string;
         beliefClusterId?: string;
-    }): Promise<import("./coreClient").PlatformGatewaySuccess<PermissionDecision>>;
+    }): Promise<PlatformGatewaySuccess<PermissionDecision>>;
     /**
      * List accessible topics for a principal.
      */
@@ -202,3 +295,5 @@ export declare function createPolicyClient(config?: PolicyClientConfig): {
         };
     }>;
 };
+
+export { GatewayScope, type PermissionDecision, type PermissionKind, PlatformGatewaySuccess, type PolicyClientConfig, type PolicyDecisionExplanation, type TenantPolicyPermission, type TenantPolicyRecord, type WritePolicyCreateInput, type WritePolicyPermission, type WritePolicyRecord, type WritePolicyUpdateInput, createPolicyClient };