@lucern/sdk 0.3.0-alpha.12 → 0.3.0-alpha.13

package/dist/gatewayFacades.d.ts

@@ -486,28 +486,52 @@ declare function createGraphFacade(config?: GatewayClientConfig): {
 declare function createIdentityFacade(config?: GatewayClientConfig): {
     whoami(): Promise<PlatformGatewaySuccess<{
         principalId: string;
-        principalType: "human" | "service" | "agent" | "user" | "group" | "external_viewer";
+        principalType: "human" | "service" | "agent" | "group" | "external_viewer" | "user";
+        clerkId: string | undefined;
         tenantId: string | null;
         workspaceId: string | null;
         scopes: string[];
         roles: string[];
+        groupIds: string[];
+        permittedToolNames: string[];
+        permittedPackKeys: string[];
+        principalStatus: string | undefined;
+        tenantStatus: string | undefined;
+        workspaceStatus: string | undefined;
         isPlatformAdmin: boolean;
         isTenantAdmin: boolean;
         isWorkspaceAdmin: boolean;
+        permit: {
+            subject: string;
+            tenant: string;
+            workspace?: string;
+        } | undefined;
         authMode: string | undefined;
         sessionId: string | undefined;
         delegatedBy: string | undefined;
         expiresAt: number | undefined;
     }> & {
         principalId: string;
-        principalType: "human" | "service" | "agent" | "user" | "group" | "external_viewer";
+        principalType: "human" | "service" | "agent" | "group" | "external_viewer" | "user";
+        clerkId: string | undefined;
         tenantId: string | null;
         workspaceId: string | null;
         scopes: string[];
         roles: string[];
+        groupIds: string[];
+        permittedToolNames: string[];
+        permittedPackKeys: string[];
+        principalStatus: string | undefined;
+        tenantStatus: string | undefined;
+        workspaceStatus: string | undefined;
         isPlatformAdmin: boolean;
         isTenantAdmin: boolean;
         isWorkspaceAdmin: boolean;
+        permit: {
+            subject: string;
+            tenant: string;
+            workspace?: string;
+        } | undefined;
         authMode: string | undefined;
         sessionId: string | undefined;
         delegatedBy: string | undefined;

package/dist/gatewayFacades.js

@@ -29,14 +29,14 @@ function requireString(value, reason, label) {
   }
   return normalized;
 }
-function requirePrincipalType(principalType) {
-  if (!principalType) {
+function requirePrincipalType(principalType2) {
+  if (!principalType2) {
     throw new LucernSdkAuthContextError(
       "principal_missing",
       "Canonical Lucern SDK auth context is missing principalType."
     );
   }
-  return principalType;
+  return principalType2;
 }
 function requireAuthMode(authMode) {
   if (!authMode) {
@@ -82,7 +82,7 @@ function normalizeCanonicalLucernAuthContext(input) {
   );
   const roles = cleanStringList(input.roles);
   const scopes = cleanStringList(input.scopes);
-  const principalType = requirePrincipalType(input.principalType);
+  const principalType2 = requirePrincipalType(input.principalType);
   const authMode = requireAuthMode(input.authMode);
   const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
   if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
@@ -111,7 +111,7 @@ function normalizeCanonicalLucernAuthContext(input) {
     principalId,
     tenantId,
     workspaceId,
-    principalType,
+    principalType: principalType2,
     authMode,
     roles,
     scopes,
@@ -1073,6 +1073,109 @@ function listResultFromEnvelope(data, legacyKey) {
   );
 }
 
+// src/control-plane.ts
+var LucernControlPlaneIdentityError = class extends Error {
+  reason;
+  principalStatus;
+  tenantStatus;
+  workspaceStatus;
+  details;
+  constructor(failure) {
+    super(failure.message);
+    this.name = "LucernControlPlaneIdentityError";
+    this.reason = failure.reason;
+    this.principalStatus = failure.principalStatus;
+    this.tenantStatus = failure.tenantStatus;
+    this.workspaceStatus = failure.workspaceStatus;
+    this.details = failure.details;
+  }
+};
+function cleanString3(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function stringList(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return [
+    ...new Set(
+      value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean)
+    )
+  ];
+}
+function principalType(value) {
+  switch (value) {
+    case "service":
+    case "service_principal":
+      return "service";
+    case "agent":
+      return "agent";
+    case "group":
+      return "group";
+    case "external_viewer":
+    case "external_stakeholder":
+      return "external_viewer";
+    default:
+      return "human";
+  }
+}
+function adminFlags(roles) {
+  const normalized = roles.map((role) => role.toLowerCase());
+  const isPlatformAdmin = normalized.includes("platform_admin");
+  const isTenantAdmin = isPlatformAdmin || normalized.includes("tenant_admin");
+  const isWorkspaceAdmin = isTenantAdmin || normalized.includes("workspace_admin") || normalized.includes("workspace_owner");
+  return { isPlatformAdmin, isTenantAdmin, isWorkspaceAdmin };
+}
+function normalizeResolvedInteractivePrincipal(payload) {
+  if ("ok" in payload && payload.ok === false) {
+    throw new LucernControlPlaneIdentityError(payload);
+  }
+  const principalId = cleanString3(payload.principalId);
+  const clerkId = cleanString3(payload.clerkId);
+  const tenantId = cleanString3(payload.tenantId);
+  if (!principalId || !clerkId || !tenantId) {
+    throw new LucernControlPlaneIdentityError({
+      ok: false,
+      reason: "resolver_unavailable",
+      message: "Control-plane principal resolver returned an incomplete principal context.",
+      principalStatus: payload.principalStatus ?? "missing",
+      tenantStatus: payload.tenantStatus,
+      workspaceStatus: payload.workspaceStatus
+    });
+  }
+  const roles = stringList(payload.roles);
+  const scopes = stringList(payload.scopes);
+  const workspaceId = cleanString3(payload.workspaceId) ?? null;
+  const flags = adminFlags(roles);
+  return {
+    principalId,
+    principalType: principalType(payload.principalType),
+    clerkId,
+    tenantId,
+    workspaceId,
+    roles,
+    scopes,
+    groupIds: stringList(payload.groupIds),
+    permittedToolNames: stringList(payload.permittedToolNames),
+    permittedPackKeys: stringList(payload.permittedPackKeys),
+    principalStatus: cleanString3(payload.principalStatus) ?? "active",
+    tenantStatus: cleanString3(payload.tenantStatus) ?? "active",
+    workspaceStatus: cleanString3(payload.workspaceStatus) ?? (workspaceId ? "active" : "none"),
+    isPlatformAdmin: typeof payload.isPlatformAdmin === "boolean" ? payload.isPlatformAdmin : flags.isPlatformAdmin,
+    isTenantAdmin: typeof payload.isTenantAdmin === "boolean" ? payload.isTenantAdmin : flags.isTenantAdmin,
+    isWorkspaceAdmin: typeof payload.isWorkspaceAdmin === "boolean" ? payload.isWorkspaceAdmin : flags.isWorkspaceAdmin,
+    permit: {
+      subject: cleanString3(payload.permit?.subject) ?? principalId,
+      tenant: cleanString3(payload.permit?.tenant) ?? tenantId,
+      ...workspaceId ? { workspace: cleanString3(payload.permit?.workspace) ?? workspaceId } : {}
+    },
+    authMode: "interactive_user",
+    sessionId: payload.sessionId,
+    delegatedBy: payload.delegatedBy,
+    expiresAt: payload.expiresAt
+  };
+}
+
 // src/identityClient.ts
 function createIdentityWhoamiClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
@@ -1140,13 +1243,25 @@ function createIdentityClient(config = {}) {
         (response) => mapGatewayData(response, (data) => ({
           principalId: data.principalId,
           principalType: data.principalType,
+          clerkId: data.clerkId,
           tenantId: data.tenantId ?? null,
           workspaceId: data.workspaceId ?? null,
           scopes: Array.isArray(data.scopes) ? data.scopes : [],
           roles: Array.isArray(data.roles) ? data.roles : [],
+          groupIds: Array.isArray(data.groupIds) ? data.groupIds : [],
+          permittedToolNames: Array.isArray(data.permittedToolNames) ? data.permittedToolNames : [],
+          permittedPackKeys: Array.isArray(data.permittedPackKeys) ? data.permittedPackKeys : [],
+          principalStatus: data.principalStatus,
+          tenantStatus: data.tenantStatus,
+          workspaceStatus: data.workspaceStatus,
           isPlatformAdmin: data.isPlatformAdmin === true,
           isTenantAdmin: data.isTenantAdmin === true,
           isWorkspaceAdmin: data.isWorkspaceAdmin === true,
+          permit: data.permit ?? (data.tenantId ? {
+            subject: data.principalId,
+            tenant: data.tenantId,
+            ...data.workspaceId ? { workspace: data.workspaceId } : {}
+          } : void 0),
           authMode: data.authMode,
           sessionId: data.sessionId,
           delegatedBy: data.delegatedBy,
@@ -1154,6 +1269,19 @@ function createIdentityClient(config = {}) {
         }))
       );
     },
+    /**
+     * Resolve a Clerk subject through the tenant control-plane Permit projection.
+     * @deprecated Prefer lucern.controlPlane.identity.resolveInteractivePrincipal().
+     */
+    async resolveInteractivePrincipal(input) {
+      return gateway.request({
+        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
+        method: "POST",
+        body: input
+      }).then(
+        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
+      );
+    },
     /**
      * List principals in the current identity scope.
      */
@@ -1342,12 +1470,12 @@ function createIdentityClient(config = {}) {
 }
 
 // src/topicsClient.ts
-function cleanString3(value) {
+function cleanString4(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function normalizeTopicRecord(value) {
   const record = asRecord(value);
-  const topicId = cleanString3(record.topicId) ?? cleanString3(record.id) ?? cleanString3(record._id);
+  const topicId = cleanString4(record.topicId) ?? cleanString4(record.id) ?? cleanString4(record._id);
   return withTopicAlias({
     ...record,
     ...topicId ? { topicId } : {}