@lucern/sdk 0.2.0-alpha.7 → 0.2.0-alpha.8

package/dist/adminClient.js

@@ -0,0 +1,755 @@
+// src/coreClient.ts
+var LucernApiError = class extends Error {
+  code;
+  status;
+  invariant;
+  suggestion;
+  details;
+  requestId;
+  correlationId;
+  policyTraceId;
+  constructor(args) {
+    super(args.message);
+    this.name = "LucernApiError";
+    this.code = args.code;
+    this.status = args.status;
+    this.invariant = args.invariant;
+    this.suggestion = args.suggestion;
+    this.details = args.details;
+    this.requestId = args.requestId;
+    this.correlationId = args.correlationId;
+    this.policyTraceId = args.policyTraceId;
+  }
+};
+function toQueryString(scope) {
+  const params = new URLSearchParams();
+  if (scope.tenantId) {
+    params.set("tenantId", scope.tenantId);
+  }
+  if (scope.workspaceId) {
+    params.set("workspaceId", scope.workspaceId);
+  }
+  for (const [key, value] of Object.entries(scope)) {
+    if (key === "tenantId" || key === "workspaceId") {
+      continue;
+    }
+    if (value === void 0) {
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  const serialized = params.toString();
+  return serialized.length > 0 ? `?${serialized}` : "";
+}
+function fillRandomBytes(length) {
+  const bytes = new Uint8Array(length);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+  }
+  for (let index = 0; index < length; index += 1) {
+    bytes[index] = Math.floor(Math.random() * 256);
+  }
+  return bytes;
+}
+function generatePortableRequestId() {
+  if (typeof globalThis.crypto?.randomUUID === "function") {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = fillRandomBytes(16);
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (value) => value.toString(16).padStart(2, "0"));
+  return `${hex.slice(0, 4).join("")}-${hex.slice(4, 6).join("")}-${hex.slice(
+    6,
+    8
+  ).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
+}
+function randomIdempotencyKey() {
+  return generatePortableRequestId();
+}
+function isRetryableStatus(status) {
+  return status >= 500 || status === 408 || status === 429;
+}
+function fallbackErrorCode(status) {
+  if (status === 401) {
+    return "AUTHENTICATION_REQUIRED";
+  }
+  if (status === 403) {
+    return "FORBIDDEN";
+  }
+  if (status === 404) {
+    return "NOT_FOUND";
+  }
+  if (status === 408) {
+    return "UPSTREAM_ERROR";
+  }
+  if (status === 409) {
+    return "CONFLICT";
+  }
+  if (status === 429) {
+    return "RATE_LIMIT_EXCEEDED";
+  }
+  if (status >= 500) {
+    return "UPSTREAM_ERROR";
+  }
+  return "INTERNAL_ERROR";
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function parseRetryAfterMs(value) {
+  if (!value) {
+    return null;
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return null;
+  }
+  const numeric = Number(trimmed);
+  if (Number.isFinite(numeric)) {
+    return Math.max(0, Math.round(numeric * 1e3));
+  }
+  const parsedDate = Date.parse(trimmed);
+  if (Number.isFinite(parsedDate)) {
+    return Math.max(0, parsedDate - Date.now());
+  }
+  return null;
+}
+function computeRetryDelayMs(args) {
+  const baseDelay = args.status === 429 ? Math.max(
+    args.retryAfterMs ?? 0,
+    Math.min(1e3 * 2 ** args.attempt, 1e4)
+  ) : Math.min(1e3 * 2 ** args.attempt, 4e3);
+  if (args.status !== 429) {
+    return baseDelay;
+  }
+  const jitterWindow = Math.max(250, Math.round(baseDelay * 0.25));
+  return baseDelay + Math.round(Math.random() * jitterWindow);
+}
+function timeoutError(timeoutMs) {
+  const error = new Error(`Request timed out after ${timeoutMs}ms`);
+  error.name = "AbortError";
+  return error;
+}
+function readPolicySummaryFromDetails(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    return null;
+  }
+  const directSummary = details.summary;
+  if (typeof directSummary === "string" && directSummary.trim().length > 0) {
+    return directSummary.trim();
+  }
+  const policy = details.policy;
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
+    return null;
+  }
+  const explanation = policy.explanation;
+  if (!explanation || typeof explanation !== "object" || Array.isArray(explanation)) {
+    return null;
+  }
+  const nestedSummary = explanation.summary;
+  if (typeof nestedSummary === "string" && nestedSummary.trim().length > 0) {
+    return nestedSummary.trim();
+  }
+  return null;
+}
+function createGatewayRequestClient(config = {}) {
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
+  const maxRetries = config.maxRetries ?? 2;
+  const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
+  async function resolveAuthHeaders() {
+    if (!config.getAuthHeaders) {
+      return {};
+    }
+    return await config.getAuthHeaders();
+  }
+  async function fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      return await fetchImpl(url, { ...init, signal: controller.signal });
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw timeoutError(timeoutMs);
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function parsePayload(response) {
+    const text = await response.text();
+    if (!text) {
+      return null;
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  }
+  function resolveTimeoutMs(method, requestTimeoutMs) {
+    if (typeof requestTimeoutMs === "number") {
+      return requestTimeoutMs;
+    }
+    const methodTimeoutMs = config.timeoutMsByMethod?.[method];
+    if (typeof methodTimeoutMs === "number") {
+      return methodTimeoutMs;
+    }
+    return config.timeoutMs ?? 15e3;
+  }
+  function buildApiError(args) {
+    const failure = args.failure;
+    const legacyError = failure && typeof failure.error === "object" && failure.error !== null ? failure.error : failure?.legacyError;
+    const correlationId = failure?.correlationId ?? args.response.headers.get("x-lucern-correlation-id")?.trim() ?? args.requestId;
+    const policyTraceId = failure?.policyTraceId ?? args.response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null;
+    const details = failure?.details ?? legacyError?.details;
+    const policySummary = readPolicySummaryFromDetails(details);
+    return new LucernApiError({
+      code: failure?.code ?? legacyError?.code ?? fallbackErrorCode(args.response.status),
+      message: policySummary ?? (typeof failure?.error === "string" ? failure.error : legacyError?.message ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed.")),
+      status: args.response.status,
+      invariant: failure?.invariant,
+      suggestion: failure?.suggestion,
+      details,
+      requestId: args.requestId,
+      correlationId,
+      policyTraceId
+    });
+  }
+  async function request(args) {
+    const authHeaders = await resolveAuthHeaders();
+    const method = args.method ?? "GET";
+    const timeoutMs = resolveTimeoutMs(method, args.timeoutMs);
+    const headers = new Headers({
+      "content-type": "application/json",
+      ...authHeaders
+    });
+    if (args.idempotencyKey) {
+      headers.set("idempotency-key", args.idempotencyKey);
+    }
+    const requestId = headers.get("x-correlation-id")?.trim() || headers.get("x-request-id")?.trim() || args.requestId || requestIdFactory();
+    if (!headers.has("x-correlation-id") && !headers.has("x-request-id")) {
+      headers.set("x-correlation-id", requestId);
+    }
+    const url = `${baseUrl}${args.path}`;
+    const serializedBody = args.body ? JSON.stringify(args.body) : void 0;
+    const init = {
+      method,
+      headers,
+      body: serializedBody
+    };
+    let lastError;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      const hookRequestContext = {
+        requestId,
+        attempt,
+        maxRetries,
+        method,
+        path: args.path,
+        url,
+        headers: new Headers(headers),
+        body: serializedBody,
+        timeoutMs
+      };
+      await config.onRequest?.(hookRequestContext);
+      const startedAt = Date.now();
+      try {
+        const response = await fetchWithTimeout(url, init, timeoutMs);
+        const responseClone = response.clone();
+        const payload = await parsePayload(response);
+        const retryAfterMs = parseRetryAfterMs(
+          response.headers.get("Retry-After")
+        );
+        if (!response.ok || !payload?.success) {
+          const failure = payload && !payload.success ? payload : null;
+          const apiError = buildApiError({
+            requestId,
+            response,
+            failure
+          });
+          const willRetry = attempt < maxRetries && isRetryableStatus(response.status);
+          await config.onResponse?.({
+            ...hookRequestContext,
+            durationMs: Date.now() - startedAt,
+            status: response.status,
+            response: responseClone,
+            error: apiError,
+            correlationId: apiError.correlationId ?? requestId,
+            policyTraceId: apiError.policyTraceId ?? null,
+            retryAfterMs,
+            willRetry
+          });
+          if (willRetry) {
+            lastError = apiError;
+            await delay(
+              computeRetryDelayMs({
+                attempt,
+                status: response.status,
+                retryAfterMs
+              })
+            );
+            continue;
+          }
+          throw apiError;
+        }
+        const successPayload = payload;
+        await config.onResponse?.({
+          ...hookRequestContext,
+          durationMs: Date.now() - startedAt,
+          status: response.status,
+          response: responseClone,
+          correlationId: successPayload.correlationId ?? response.headers.get("x-lucern-correlation-id")?.trim() ?? requestId,
+          policyTraceId: successPayload.policyTraceId ?? response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null,
+          idempotentReplay: successPayload.idempotentReplay,
+          retryAfterMs,
+          willRetry: false
+        });
+        return successPayload;
+      } catch (fetchError) {
+        if (fetchError instanceof LucernApiError) {
+          throw fetchError;
+        }
+        const willRetry = attempt < maxRetries;
+        await config.onResponse?.({
+          ...hookRequestContext,
+          durationMs: Date.now() - startedAt,
+          error: fetchError,
+          correlationId: requestId,
+          policyTraceId: null,
+          willRetry
+        });
+        lastError = fetchError;
+        if (willRetry) {
+          await delay(computeRetryDelayMs({ attempt }));
+        }
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Platform API request failed after retries.");
+  }
+  return {
+    request
+  };
+}
+
+// src/sdkSurface.ts
+function createListResult(items, legacyKey) {
+  const result = {
+    items,
+    total: items.length
+  };
+  if (legacyKey) {
+    result[legacyKey] = items;
+  }
+  return result;
+}
+function mapGatewayData(response, mapper) {
+  return {
+    ...response,
+    data: mapper(response.data)
+  };
+}
+
+// src/adminClient.ts
+function asTenantApiKeyRecord(data) {
+  if (!data || typeof data !== "object") {
+    return null;
+  }
+  return data;
+}
+function asTenantApiKeyArray(data) {
+  if (!Array.isArray(data)) {
+    return [];
+  }
+  return data.map(asTenantApiKeyRecord).filter((row) => Boolean(row));
+}
+function asTenantVaultSecretRecord(data) {
+  if (!data || typeof data !== "object") {
+    return null;
+  }
+  return data;
+}
+function asTenantVaultSecretArray(data) {
+  if (!Array.isArray(data)) {
+    return [];
+  }
+  return data.map(asTenantVaultSecretRecord).filter((row) => Boolean(row));
+}
+function createAdminClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    /**
+     * List tenants visible to the current principal.
+     */
+    async listTenants(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/tenants${toQueryString(query)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "tenants"
+          )
+        )
+      );
+    },
+    /**
+     * Create a tenant.
+     */
+    async createTenant(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/tenants",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Get the control-object ownership contract.
+     */
+    async getControlObjectOwnership() {
+      return gateway.request({
+        path: "/api/platform/v1/admin/control-ownership"
+      });
+    },
+    /**
+     * @deprecated Use getControlObjectOwnership.
+     */
+    async getControlObjectOwnershipContract() {
+      return gateway.request({
+        path: "/api/platform/v1/admin/control-ownership"
+      });
+    },
+    /**
+     * List workspaces for the current admin scope.
+     */
+    async listWorkspaces(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/workspaces${toQueryString(query)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "workspaces"
+          )
+        )
+      );
+    },
+    /**
+     * Create a workspace.
+     */
+    async createWorkspace(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/workspaces",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List memberships for the current admin scope.
+     */
+    async listMemberships(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/memberships${toQueryString(query)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "memberships"
+          )
+        )
+      );
+    },
+    /**
+     * Create a membership.
+     */
+    async createMembership(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/memberships",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Update a membership.
+     */
+    async updateMembership(input, idempotencyKey) {
+      return this.createMembership(input, idempotencyKey);
+    },
+    /**
+     * @deprecated Use createMembership or updateMembership.
+     */
+    async upsertMembership(input, idempotencyKey) {
+      return this.createMembership(input, idempotencyKey);
+    },
+    /**
+     * List tenant API keys in the current admin scope.
+     */
+    async listTenantApiKeys(scope) {
+      const response = await gateway.request({
+        path: `/api/platform/v1/tenant-api-keys${toQueryString(scope)}`
+      });
+      return {
+        ...response,
+        data: {
+          keys: asTenantApiKeyArray(response.data?.keys)
+        }
+      };
+    },
+    /**
+     * Create a tenant API key.
+     */
+    async createTenantApiKey(input, idempotencyKey) {
+      const response = await gateway.request({
+        path: "/api/platform/v1/tenant-api-keys",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+      return {
+        ...response,
+        data: {
+          key: asTenantApiKeyRecord(response.data?.key),
+          plaintextKey: typeof response.data?.plaintextKey === "string" ? response.data.plaintextKey : void 0
+        }
+      };
+    },
+    /**
+     * Revoke a tenant API key.
+     */
+    async revokeTenantApiKey(keyId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/tenant-api-keys/${encodeURIComponent(keyId)}/revoke`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List tenant vault secrets.
+     */
+    async listTenantVaultSecrets(scope) {
+      const response = await gateway.request({
+        path: `/api/platform/v1/tenant-vault-secrets${toQueryString(scope)}`
+      });
+      return {
+        ...response,
+        data: {
+          secrets: asTenantVaultSecretArray(response.data?.secrets)
+        }
+      };
+    },
+    /**
+     * Create a tenant vault secret.
+     */
+    async createTenantVaultSecret(input, idempotencyKey) {
+      const response = await gateway.request({
+        path: "/api/platform/v1/tenant-vault-secrets",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+      return {
+        ...response,
+        data: {
+          secret: asTenantVaultSecretRecord(response.data?.secret)
+        }
+      };
+    },
+    /**
+     * Update a tenant vault secret.
+     */
+    async updateTenantVaultSecret(secretId, input, idempotencyKey) {
+      const response = await gateway.request({
+        path: `/api/platform/v1/tenant-vault-secrets/${encodeURIComponent(secretId)}`,
+        method: "PATCH",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+      return {
+        ...response,
+        data: {
+          secret: asTenantVaultSecretRecord(response.data?.secret)
+        }
+      };
+    },
+    /**
+     * Delete a tenant vault secret.
+     */
+    async deleteTenantVaultSecret(secretId, scope, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/tenant-vault-secrets/${encodeURIComponent(
+          secretId
+        )}${toQueryString(scope)}`,
+        method: "DELETE",
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List tenant provider secrets.
+     */
+    async listTenantSecrets(scope) {
+      return gateway.request({
+        path: `/api/platform/v1/tenant-secrets${toQueryString(scope)}`
+      });
+    },
+    /**
+     * Upsert a tenant provider secret.
+     */
+    async upsertTenantSecret(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/tenant-secrets",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Revoke a tenant provider secret.
+     */
+    async revokeTenantSecret(secretRef, input, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/tenant-secrets/${encodeURIComponent(secretRef)}/revoke`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Get tenant configuration.
+     */
+    async getTenantConfig(scope) {
+      return gateway.request({
+        path: `/api/platform/v1/tenant-config${toQueryString(scope)}`
+      });
+    },
+    /**
+     * Get tenant model routing.
+     */
+    async getTenantModelRouting(scope) {
+      return gateway.request({
+        path: `/api/platform/v1/tenant-config/model-routing${toQueryString(scope)}`
+      });
+    },
+    /**
+     * Upsert tenant configuration.
+     */
+    async upsertTenantConfig(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/tenant-config",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List groups.
+     */
+    async listGroups(scope = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/groups${toQueryString(scope)}`
+      });
+    },
+    /**
+     * Create a group.
+     */
+    async createGroup(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/groups",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Update a group.
+     */
+    async updateGroup(groupId, input, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/groups/${encodeURIComponent(groupId)}`,
+        method: "PATCH",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Delete a group.
+     */
+    async deleteGroup(groupId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/groups/${encodeURIComponent(groupId)}${toQueryString(input)}`,
+        method: "DELETE",
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List group members.
+     */
+    async listGroupMembers(query) {
+      return gateway.request({
+        path: `/api/platform/v1/groups/members${toQueryString(query)}`
+      });
+    },
+    /**
+     * Add a group member.
+     */
+    async addGroupMember(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/groups/members",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Remove a group member.
+     */
+    async removeGroupMember(input, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/groups/members${toQueryString(input)}`,
+        method: "DELETE",
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List pack-to-group assignments.
+     */
+    async listPackGroupAssignments(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/groups/packs${toQueryString(query)}`
+      });
+    },
+    /**
+     * Assign a pack to a group.
+     */
+    async assignPackToGroup(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/groups/packs",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Remove a pack from a group.
+     */
+    async removePackFromGroup(input, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/groups/packs${toQueryString(input)}`,
+        method: "DELETE",
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
+  };
+}
+
+export { LucernApiError, createAdminClient };
+//# sourceMappingURL=adminClient.js.map
+//# sourceMappingURL=adminClient.js.map