@lucern/sdk 0.3.0-alpha.14 → 0.3.0-alpha.16

package/CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to `@lucern/sdk` will be documented in this file.
 ## [Unreleased]
 - No unreleased changes yet.
 
+## [0.3.0-alpha.16] - 2026-05-14
+- Adds the exact-row reasoning-kernel migration surface required for tenant identity/scope repairs.
+- Keeps the coherent Lucern package line aligned for StackOS and reasoning-environment adoption.
+
+
 ## [0.3.0-alpha.7] - 2026-05-03
 - Rebuild the coherent Lucern package line after Campaign 1 SDK hardening fixes.
 

package/README.md

@@ -42,6 +42,9 @@ code should stay on `@lucern/sdk`, `@lucern/react`, `@lucern/mcp`,
 - Build applications, automations, and backend integrations against the SDK first.
 - Treat `/api/platform/v1/*` as the transport mirror of the SDK surface.
 - Treat MCP as an agent-facing client of the same surface, not as a privileged bypass around SDK or HTTP semantics.
+- Treat REST, SDK, CLI, and MCP as projections of the same manifest. New
+  control-plane operations must be added to the manifest first, then exposed
+  through the generated surfaces.
 
 IA-7 closes the remaining SDK surface gaps needed for SDK-first clients:
 
@@ -118,6 +121,11 @@ they must not call `components.controlPlane.migration` from application code.
 Provisioning and backfills can use migration APIs; runtime bootstrapping uses
 `controlPlane.identity.resolveInteractivePrincipal(...)`.
 
+StackOS, Lucern Graph, and Stack Engineering should use this bootstrap path
+before calling morning brief, graph session, MCP, or CLI-backed runtime flows.
+`/api/platform/v1/users/:clerkId` may be a profile facade, but it is not an
+authorization source.
+
 ## The Full Developer Journey
 
 This walkthrough mirrors what a developer building an AI-powered code review system would experience in a real coding session. Every API call is something you would actually use.

package/dist/accessControl.js

@@ -342,13 +342,31 @@ function mergeHeaderRecord(base, addition) {
   }
   return Object.fromEntries(headers.entries());
 }
+function cleanHeaderValue(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
 function createGatewayRequestClient(config = {}) {
   const fetchImpl = config.fetchImpl ?? fetch;
   const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
   const maxRetries = config.maxRetries ?? 2;
   const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
   async function resolveAuthHeaders() {
-    const base = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const provided = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const headers = new Headers(provided);
+    const setIfAbsent = (name, value) => {
+      const normalized = cleanHeaderValue(value);
+      if (normalized && !headers.has(name)) {
+        headers.set(name, normalized);
+      }
+    };
+    setIfAbsent("x-lucern-key", config.apiKey);
+    setIfAbsent("x-lucern-session-token", config.userToken);
+    setIfAbsent("x-lucern-environment", config.environment);
+    setIfAbsent("x-lucern-clerk-id", config.clerkId);
+    setIfAbsent("x-lucern-user-id", config.userId ?? config.clerkId);
+    setIfAbsent("x-lucern-deployment-host", config.deploymentHost);
+    const base = Object.fromEntries(headers.entries());
     const authContextInput = await resolveConfiguredAuthContext(
       config.authContext
     );