@lucern/sdk 0.2.0-alpha.4 → 0.2.0-alpha.5

package/dist/lib/platform/auth/credentials.d.ts

@@ -0,0 +1,5 @@
+export declare function parseAuthorizationBearer(value: string | null | undefined): string | null;
+export declare function isTenantApiKey(value: string): boolean;
+export declare function isServicePrincipalKey(value: string): boolean;
+export declare function buildPlatformAuthHeadersFromApiKey(apiKey: string): Record<string, string>;
+export declare function buildPlatformAuthHeadersFromSessionToken(sessionToken: string): Record<string, string>;

package/dist/lib/platform/auth/credentials.js

@@ -0,0 +1,40 @@
+const TENANT_API_KEY_PREFIXES = ["luc_", "stk_"];
+const SERVICE_PRINCIPAL_KEY_PREFIXES = ["lk_", "lsk_"];
+export function parseAuthorizationBearer(value) {
+    if (!value) {
+        return null;
+    }
+    const [scheme, token] = value.trim().split(/\s+/, 2);
+    if (!scheme || !token) {
+        return null;
+    }
+    if (scheme.toLowerCase() !== "bearer") {
+        return null;
+    }
+    return token.trim() || null;
+}
+export function isTenantApiKey(value) {
+    const normalized = value.trim();
+    return TENANT_API_KEY_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+export function isServicePrincipalKey(value) {
+    const normalized = value.trim();
+    return SERVICE_PRINCIPAL_KEY_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+export function buildPlatformAuthHeadersFromApiKey(apiKey) {
+    const normalized = apiKey.trim();
+    if (!normalized) {
+        return {};
+    }
+    if (isTenantApiKey(normalized)) {
+        return { "x-lucern-key": normalized };
+    }
+    return { Authorization: `Bearer ${normalized}` };
+}
+export function buildPlatformAuthHeadersFromSessionToken(sessionToken) {
+    const normalized = sessionToken.trim();
+    if (!normalized) {
+        return {};
+    }
+    return { Authorization: `Bearer ${normalized}` };
+}

package/dist/lib/platform/sdk/adminClient.d.ts

@@ -0,0 +1,404 @@
+import { type GatewayClientConfig, type GatewayScope, LucernApiError } from "./coreClient";
+import type { ControlObjectOwnershipContract } from "./controlObjectOwnership";
+import type { JsonObject } from "./types";
+export { LucernApiError };
+export type { GatewayScope, PlatformGatewaySuccess } from "./coreClient";
+/** Configuration for the admin client. */
+export type AdminClientConfig = GatewayClientConfig;
+export type TenantApiKeyRecord = {
+    id?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    label?: string;
+    keyPrefix?: string;
+    hashedKey?: string;
+    scopes?: string[];
+    status?: string;
+    expiresAt?: number;
+    lastUsedAt?: number;
+    revokedAt?: number;
+    revokedBy?: string;
+    createdBy?: string;
+    createdAt?: number;
+    updatedAt?: number;
+};
+export type TenantVaultSecretRecord = {
+    id?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    name?: string;
+    description?: string;
+    lastRotated?: number;
+    createdBy?: string;
+    updatedBy?: string;
+    createdAt?: number;
+    updatedAt?: number;
+};
+export type TenantAuthPolicyMode = "open" | "invite_only" | "sso_required";
+export type TenantTopicVisibility = "private" | "tenant" | "public";
+export type TenantFeatureFlags = Record<string, boolean>;
+export type TenantModelSlotOverrides = Record<string, string>;
+export type TenantConfigRecord = {
+    tenantId: string;
+    authPolicyMode: TenantAuthPolicyMode;
+    defaultSessionTTL: number;
+    defaultTopicVisibility: TenantTopicVisibility;
+    featureFlags: TenantFeatureFlags;
+    maxWorkspaceCount: number;
+    defaultModelSlotOverrides: TenantModelSlotOverrides;
+    updatedAt?: number;
+    updatedBy?: string;
+};
+export type TenantModelRoutingSlotRecord = {
+    slot: string;
+    category?: string;
+    description?: string;
+    modelKey: string;
+    promptName?: string;
+    temperature?: number;
+    maxTokens?: number;
+    enabled?: boolean;
+};
+export type TenantModelRoutingModelRecord = {
+    key: string;
+    name?: string;
+    modelId?: string;
+    provider?: string;
+    enabled?: boolean;
+    recommended?: boolean;
+    notes?: string;
+};
+export type TenantModelRoutingBindingRecord = {
+    slot: string;
+    providerId: string;
+    secretRef: string;
+    label?: string;
+    keyHint?: string;
+};
+export type TenantModelRouteOverrideStatus = "inherit" | "active" | "blocked_missing_model" | "blocked_missing_binding";
+export type TenantModelRouteBindingState = "ready" | "missing";
+export type TenantModelRouteSource = "platform_default" | "tenant_override";
+export type TenantModelRouteRow = {
+    slot: string;
+    category: string;
+    description?: string;
+    promptName?: string;
+    slotEnabled: boolean;
+    platformModelKey: string;
+    platformModelName?: string;
+    platformProviderId?: string;
+    overrideModelKey?: string;
+    overrideModelName?: string;
+    overrideProviderId?: string;
+    effectiveModelKey: string;
+    effectiveModelName?: string;
+    effectiveProviderId?: string;
+    effectiveSource: TenantModelRouteSource;
+    overrideStatus: TenantModelRouteOverrideStatus;
+    bindingState: TenantModelRouteBindingState;
+    bindingLabel?: string;
+    bindingKeyHint?: string;
+    bindingSecretRef?: string;
+};
+export type TenantModelRoutingSummary = {
+    totalSlots: number;
+    promptBoundSlots: number;
+    activeOverrides: number;
+    blockedOverrides: number;
+    readyBindings: number;
+};
+export type TenantModelRoutingSnapshot = {
+    tenantId: string;
+    defaultModelSlotOverrides: Record<string, string>;
+    slots: TenantModelRoutingSlotRecord[];
+    models: TenantModelRoutingModelRecord[];
+    bindings: TenantModelRoutingBindingRecord[];
+    rows: TenantModelRouteRow[];
+    summary: TenantModelRoutingSummary;
+    notes: string[];
+};
+/**
+ * Create the admin client for tenant, workspace, and membership administration.
+ * @param config - Gateway transport configuration.
+ * @returns An object with methods to manage tenants, workspaces, and memberships.
+ */
+export declare function createAdminClient(config?: AdminClientConfig): {
+    /**
+     * List tenants visible to the current principal.
+     */
+    listTenants(query?: {
+        status?: "active" | "disabled" | "archived";
+        limit?: number;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<import("./types").ListResult<any, "tenants">>>;
+    /**
+     * Create a tenant.
+     */
+    createTenant(input: {
+        key: string;
+        slug?: string;
+        name: string;
+        status?: "active" | "disabled" | "archived";
+        metadata?: JsonObject;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Get the control-object ownership contract.
+     */
+    getControlObjectOwnership(): Promise<import("./coreClient").PlatformGatewaySuccess<ControlObjectOwnershipContract>>;
+    /**
+     * @deprecated Use getControlObjectOwnership.
+     */
+    getControlObjectOwnershipContract(): Promise<import("./coreClient").PlatformGatewaySuccess<ControlObjectOwnershipContract>>;
+    /**
+     * List workspaces for the current admin scope.
+     */
+    listWorkspaces(query?: GatewayScope & {
+        status?: "active" | "archived";
+        limit?: number;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<import("./types").ListResult<any, "workspaces">>>;
+    /**
+     * Create a workspace.
+     */
+    createWorkspace(input: GatewayScope & {
+        workspaceId?: string;
+        key?: string;
+        slug?: string;
+        name?: string;
+        status?: "active" | "archived";
+        defaultProjectVisibility?: "private" | "team" | "firm" | "external" | "public";
+        restore?: boolean;
+        metadata?: JsonObject;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * List memberships for the current admin scope.
+     */
+    listMemberships(query?: GatewayScope & {
+        principalId?: string;
+        status?: "active" | "revoked" | "expired";
+        limit?: number;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<import("./types").ListResult<any, "memberships">>>;
+    /**
+     * Create a membership.
+     */
+    createMembership(input: GatewayScope & {
+        membershipId?: string;
+        principalId: string;
+        role: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
+        status?: "active" | "revoked" | "expired";
+        source?: "bootstrap" | "manual" | "sync" | "invitation";
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Update a membership.
+     */
+    updateMembership(input: GatewayScope & {
+        membershipId?: string;
+        principalId: string;
+        role: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
+        status?: "active" | "revoked" | "expired";
+        source?: "bootstrap" | "manual" | "sync" | "invitation";
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * @deprecated Use createMembership or updateMembership.
+     */
+    upsertMembership(input: GatewayScope & {
+        membershipId?: string;
+        principalId: string;
+        role: "platform_admin" | "tenant_admin" | "workspace_admin" | "editor" | "viewer" | "auditor" | "service_agent";
+        status?: "active" | "revoked" | "expired";
+        source?: "bootstrap" | "manual" | "sync" | "invitation";
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * List tenant API keys in the current admin scope.
+     */
+    listTenantApiKeys(scope: GatewayScope & {
+        status?: "active" | "revoked" | "expired";
+    }): Promise<{
+        data: {
+            keys: TenantApiKeyRecord[];
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Create a tenant API key.
+     */
+    createTenantApiKey(input: GatewayScope & {
+        label?: string;
+        scopes: string[];
+        expiresAt?: number;
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            key: TenantApiKeyRecord | null;
+            plaintextKey: string | undefined;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Revoke a tenant API key.
+     */
+    revokeTenantApiKey(keyId: string, input?: GatewayScope & {
+        reason?: string;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * List tenant vault secrets.
+     */
+    listTenantVaultSecrets(scope: GatewayScope): Promise<{
+        data: {
+            secrets: TenantVaultSecretRecord[];
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Create a tenant vault secret.
+     */
+    createTenantVaultSecret(input: GatewayScope & {
+        name: string;
+        description?: string;
+        value: string;
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            secret: TenantVaultSecretRecord | null;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Update a tenant vault secret.
+     */
+    updateTenantVaultSecret(secretId: string, input: GatewayScope & {
+        name: string;
+        description?: string;
+        value?: string;
+    }, idempotencyKey?: string): Promise<{
+        data: {
+            secret: TenantVaultSecretRecord | null;
+        };
+        success: true;
+        correlationId: string;
+        policyTraceId: string | null;
+        idempotentReplay: boolean;
+    }>;
+    /**
+     * Delete a tenant vault secret.
+     */
+    deleteTenantVaultSecret(secretId: string, scope: GatewayScope, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * List tenant provider secrets.
+     */
+    listTenantSecrets(scope: GatewayScope & {
+        providerId?: string;
+        status?: "active" | "revoked";
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Upsert a tenant provider secret.
+     */
+    upsertTenantSecret(input: GatewayScope & {
+        providerId: string;
+        apiKey: string;
+        label?: string;
+        modelSlotIds?: string[];
+        passThroughOnly?: boolean;
+        metadata?: JsonObject;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Revoke a tenant provider secret.
+     */
+    revokeTenantSecret(secretRef: string, input: GatewayScope & {
+        reason?: string;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Get tenant configuration.
+     */
+    getTenantConfig(scope: GatewayScope & {
+        tenantId: string;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<TenantConfigRecord>>;
+    /**
+     * Get tenant model routing.
+     */
+    getTenantModelRouting(scope: GatewayScope & {
+        tenantId: string;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<TenantModelRoutingSnapshot>>;
+    /**
+     * Upsert tenant configuration.
+     */
+    upsertTenantConfig(input: GatewayScope & Omit<TenantConfigRecord, "updatedAt" | "updatedBy">, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<TenantConfigRecord>>;
+    /**
+     * List groups.
+     */
+    listGroups(scope?: GatewayScope & {
+        limit?: number;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Create a group.
+     */
+    createGroup(input: GatewayScope & {
+        name: string;
+        groupKey?: string;
+        groupType?: string;
+        description?: string;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Update a group.
+     */
+    updateGroup(groupId: string, input: GatewayScope & {
+        name?: string;
+        description?: string;
+        workspaceId?: string;
+        clearWorkspaceId?: boolean;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Delete a group.
+     */
+    deleteGroup(groupId: string, input?: GatewayScope, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * List group members.
+     */
+    listGroupMembers(query: GatewayScope & {
+        groupId: string;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Add a group member.
+     */
+    addGroupMember(input: GatewayScope & {
+        groupId: string;
+        principalId: string;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Remove a group member.
+     */
+    removeGroupMember(input: GatewayScope & {
+        groupId: string;
+        principalId: string;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * List pack-to-group assignments.
+     */
+    listPackGroupAssignments(query?: GatewayScope & {
+        groupId?: string;
+        status?: string;
+    }): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Assign a pack to a group.
+     */
+    assignPackToGroup(input: GatewayScope & {
+        groupId: string;
+        packKey: string;
+        packVersion?: string;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+    /**
+     * Remove a pack from a group.
+     */
+    removePackFromGroup(input: GatewayScope & {
+        groupId: string;
+        packKey: string;
+    }, idempotencyKey?: string): Promise<import("./coreClient").PlatformGatewaySuccess<unknown>>;
+};