@lucern/sdk 0.3.0-alpha.10 → 0.3.0-alpha.12

package/README.md

@@ -24,7 +24,7 @@ Common direct installs:
 | Programmatic Lucern API calls | `@lucern/sdk` |
 | Tool access checks | `@lucern/access-control` |
 | React hooks/components | `@lucern/react @lucern/sdk` |
-| Convex component binding | `@lucern/identity @lucern/reasoning-kernel` |
+| Convex component binding | `@lucern/control-plane @lucern/reasoning-kernel` |
 | Bootstrap, auth, doctor, and operator commands | `@lucern/cli` |
 | Agent-facing MCP server/runtime | `@lucern/mcp` |
 | Full design-partner/package-suite pin | all packages from `TENANT_CLIENT_INSTALLABLE_PACKAGES` in `@lucern/contracts` |

package/dist/accessControl.d.ts

@@ -0,0 +1,78 @@
+import { LucernSdkAuthContextError, LucernSdkAuthFailureReason, LucernSdkAuthContextInput } from './authContext.js';
+import { GatewayClientConfig } from './coreClient.js';
+import { PolicyEvaluationInput, PolicyDecisionRecord } from './identityClient.js';
+import { SessionPrincipalType } from './contracts/auth-session.contract.js';
+import { JsonObject } from './types.js';
+import './contracts/workflow-runtime.contract.js';
+import './contracts/lens-workflow.contract.js';
+import './contracts/lens-filter.contract.js';
+
+type ClerkIdentityAliasInput = {
+    provider?: "clerk" | string;
+    providerProjectId?: string | null;
+    externalSubjectId: string;
+    status?: "active" | "pending" | "revoked" | string;
+};
+type CanonicalPrincipalIdentityInput = {
+    principalId?: string | null;
+    principalType?: SessionPrincipalType | "user" | "external_viewer" | null;
+    canonicalClerkUserId?: string | null;
+    clerkId?: string | null;
+    clerkIdentityAliases?: readonly ClerkIdentityAliasInput[];
+    tenantId?: string | null;
+    workspaceId?: string | null;
+    roles?: readonly string[];
+    scopes?: readonly string[];
+};
+type CanonicalPrincipalIdentityAlias = {
+    provider: string;
+    providerProjectId?: string;
+    externalSubjectId: string;
+    status?: string;
+};
+type CanonicalPrincipalIdentity = {
+    principalId: string;
+    principalType: SessionPrincipalType;
+    canonicalClerkUserId?: string;
+    clerkIdentityAliases: CanonicalPrincipalIdentityAlias[];
+    tenantId?: string;
+    workspaceId?: string;
+    roles: string[];
+    scopes: string[];
+};
+type AccessResourceType = "tenant" | "workspace" | "deployment" | "convex_table" | "secret_scope" | "agent_session" | (string & {});
+type AccessResourceDescriptor = {
+    type: AccessResourceType;
+    key: string;
+};
+type RequireAccessInput = {
+    identity?: CanonicalPrincipalIdentityInput | LucernSdkAuthContextInput;
+    observedClerkId?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    action: string;
+    resource: AccessResourceDescriptor | string;
+    context?: JsonObject;
+};
+type AccessCheckResult = {
+    identity: CanonicalPrincipalIdentity;
+    policyInput: PolicyEvaluationInput;
+    decision: PolicyDecisionRecord;
+};
+declare class LucernAccessControlError extends LucernSdkAuthContextError {
+    readonly policyDecision?: PolicyDecisionRecord;
+    constructor(reason: LucernSdkAuthFailureReason, message: string, policyDecision?: PolicyDecisionRecord);
+}
+declare function normalizeCanonicalPrincipalIdentity(input: CanonicalPrincipalIdentityInput | LucernSdkAuthContextInput, options?: {
+    observedClerkId?: string;
+}): CanonicalPrincipalIdentity;
+declare function formatPermitResource(resource: AccessResourceDescriptor | string): string;
+declare function assertPermitAllowed(decision: PolicyDecisionRecord): void;
+declare function createAccessControlClient(config?: GatewayClientConfig): {
+    normalizePrincipal: typeof normalizeCanonicalPrincipalIdentity;
+    checkAccess: (input: RequireAccessInput, idempotencyKey?: string) => Promise<AccessCheckResult>;
+    requireAccess: (input: RequireAccessInput, idempotencyKey?: string) => Promise<AccessCheckResult>;
+    canAccess: (input: RequireAccessInput, idempotencyKey?: string) => Promise<boolean>;
+};
+
+export { type AccessCheckResult, type AccessResourceDescriptor, type AccessResourceType, type CanonicalPrincipalIdentity, type CanonicalPrincipalIdentityAlias, type CanonicalPrincipalIdentityInput, type ClerkIdentityAliasInput, LucernAccessControlError, type RequireAccessInput, assertPermitAllowed, createAccessControlClient, formatPermitResource, normalizeCanonicalPrincipalIdentity };