@lucern/sdk 0.3.0-alpha.17 → 0.3.0-alpha.2

package/dist/audiencesClient.d.ts

@@ -1,7 +1,5 @@
-import { GatewayScope, GatewayClientConfig, PlatformGatewaySuccess } from './coreClient.js';
+import { GatewayClientConfig, GatewayScope, PlatformGatewaySuccess } from './coreClient.js';
 import { JsonObject, ListResult } from './types.js';
-import './authContext.js';
-import './contracts/auth-session.contract.js';
 import './contracts/workflow-runtime.contract.js';
 import './contracts/lens-workflow.contract.js';
 import './contracts/lens-filter.contract.js';
@@ -39,63 +37,63 @@ declare function createAudiencesClient(config?: AudiencesClientConfig): {
     /**
      * List audience registry entries.
      */
-    listRegistry: (query?: GatewayScope & {
+    listRegistry(query?: GatewayScope & {
         effective?: boolean;
         status?: "active" | "disabled" | "archived";
-    }) => Promise<PlatformGatewaySuccess<ListResult<any, "registryEntries">>>;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "registryEntries">>>;
     /**
      * @deprecated Use listRegistry.
      */
-    getRegistry: (query?: GatewayScope & {
+    getRegistry(query?: GatewayScope & {
         effective?: boolean;
         status?: "active" | "disabled" | "archived";
-    }) => Promise<PlatformGatewaySuccess<ListResult<any, "registryEntries">>>;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "registryEntries">>>;
     /**
      * Create an audience registry entry.
      */
-    createRegistryEntry: (input: AudienceRegistryInput, idempotencyKey?: string) => Promise<PlatformGatewaySuccess<unknown>>;
+    createRegistryEntry(input: AudienceRegistryInput, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * Update an audience registry entry.
      */
-    updateRegistryEntry: (input: AudienceRegistryInput, idempotencyKey?: string) => Promise<PlatformGatewaySuccess<unknown>>;
+    updateRegistryEntry(input: AudienceRegistryInput, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * @deprecated Use createRegistryEntry or updateRegistryEntry.
      */
-    upsertRegistry: (input: AudienceRegistryInput, idempotencyKey?: string) => Promise<PlatformGatewaySuccess<unknown>>;
+    upsertRegistry(input: AudienceRegistryInput, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * List audience grants.
      */
-    listGrants: (query?: GatewayScope & {
+    listGrants(query?: GatewayScope & {
         audienceKey?: string;
         principalId?: string;
         groupId?: string;
         status?: "active" | "revoked" | "expired";
-    }) => Promise<PlatformGatewaySuccess<ListResult<any, "grants">>>;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "grants">>>;
     /**
      * @deprecated Use listGrants.
      */
-    getGrants: (query?: GatewayScope & {
+    getGrants(query?: GatewayScope & {
         audienceKey?: string;
         principalId?: string;
         groupId?: string;
         status?: "active" | "revoked" | "expired";
-    }) => Promise<PlatformGatewaySuccess<ListResult<any, "grants">>>;
+    }): Promise<PlatformGatewaySuccess<ListResult<any, "grants">>>;
     /**
      * Create an audience grant.
      */
-    createGrant: (input: AudienceGrantInput, idempotencyKey?: string) => Promise<PlatformGatewaySuccess<unknown>>;
+    createGrant(input: AudienceGrantInput, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * @deprecated Use createGrant.
      */
-    grant: (input: AudienceGrantInput, idempotencyKey?: string) => Promise<PlatformGatewaySuccess<unknown>>;
+    grant(input: AudienceGrantInput, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * Delete an audience grant by revoking it.
      */
-    deleteGrant: (input: AudienceGrantRevokeInput, idempotencyKey?: string) => Promise<PlatformGatewaySuccess<unknown>>;
+    deleteGrant(input: AudienceGrantRevokeInput, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
     /**
      * @deprecated Use deleteGrant.
      */
-    revokeGrant: (input: AudienceGrantRevokeInput, idempotencyKey?: string) => Promise<PlatformGatewaySuccess<unknown>>;
+    revokeGrant(input: AudienceGrantRevokeInput, idempotencyKey?: string): Promise<PlatformGatewaySuccess<unknown>>;
 };
 
 export { type AudienceGrantInput, type AudienceGrantRevokeInput, type AudienceRegistryInput, type AudiencesClientConfig, createAudiencesClient };

package/dist/audiencesClient.js

@@ -1,170 +1,3 @@
-// src/authContext.ts
-var LucernSdkAuthContextError = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.name = "LucernSdkAuthContextError";
-    this.reason = reason;
-  }
-};
-function cleanString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function cleanStringList(values) {
-  if (!values) {
-    return [];
-  }
-  return values.map((value) => value.trim()).filter(
-    (value, index, list) => value.length > 0 && list.indexOf(value) === index
-  );
-}
-function requireString(value, reason, label) {
-  const normalized = cleanString(value);
-  if (!normalized) {
-    throw new LucernSdkAuthContextError(
-      reason,
-      `Canonical Lucern SDK auth context is missing ${label}.`
-    );
-  }
-  return normalized;
-}
-function requirePrincipalType(principalType) {
-  if (!principalType) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is missing principalType."
-    );
-  }
-  return principalType;
-}
-function requireAuthMode(authMode) {
-  if (!authMode) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is missing authMode."
-    );
-  }
-  return authMode;
-}
-function ensurePermitMatch(args) {
-  const actual = cleanString(args.actual);
-  if (actual && actual !== args.expected) {
-    throw new LucernSdkAuthContextError(
-      "policy_denied",
-      `Canonical Lucern SDK auth context has conflicting Permit ${args.field}.`
-    );
-  }
-}
-function normalizeCanonicalLucernAuthContext(input) {
-  if (!input) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is required."
-    );
-  }
-  if (input.policyDecision === "deny") {
-    throw new LucernSdkAuthContextError(
-      "policy_denied",
-      "Canonical Lucern SDK auth context carries a denied policy decision."
-    );
-  }
-  const principalId = requireString(
-    input.principalId,
-    "principal_missing",
-    "principalId"
-  );
-  const tenantId = requireString(input.tenantId, "tenant_missing", "tenantId");
-  const workspaceId = requireString(
-    input.workspaceId,
-    "workspace_missing",
-    "workspaceId"
-  );
-  const roles = cleanStringList(input.roles);
-  const scopes = cleanStringList(input.scopes);
-  const principalType = requirePrincipalType(input.principalType);
-  const authMode = requireAuthMode(input.authMode);
-  const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
-  if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
-    throw new LucernSdkAuthContextError(
-      "membership_missing",
-      "Canonical Lucern SDK auth context requires non-empty roles and scopes."
-    );
-  }
-  const subject = cleanString(input.permit?.subject) ?? principalId;
-  const tenant = cleanString(input.permit?.tenant) ?? tenantId;
-  const workspace = cleanString(input.permit?.workspace) ?? workspaceId;
-  ensurePermitMatch({
-    field: "subject",
-    expected: principalId,
-    actual: subject
-  });
-  ensurePermitMatch({ field: "tenant", expected: tenantId, actual: tenant });
-  ensurePermitMatch({
-    field: "workspace",
-    expected: workspaceId,
-    actual: workspace
-  });
-  const context = input.permit?.context ? { ...input.permit.context } : void 0;
-  return {
-    clerkId: cleanString(input.clerkId),
-    principalId,
-    tenantId,
-    workspaceId,
-    principalType,
-    authMode,
-    roles,
-    scopes,
-    delegationChain: input.delegationChain ? [...input.delegationChain] : [],
-    policyTraceId: cleanString(input.policyTraceId),
-    correlationId: cleanString(input.correlationId),
-    membershipId: cleanString(input.membershipId),
-    permit: {
-      subject,
-      tenant,
-      workspace,
-      resource: cleanString(input.permit?.resource),
-      action: cleanString(input.permit?.action),
-      relation: cleanString(input.permit?.relation),
-      context
-    }
-  };
-}
-function createCanonicalAuthHeaders(authContext) {
-  const headers = {
-    "x-lucern-principal-id": authContext.principalId,
-    "x-lucern-principal-type": authContext.principalType,
-    "x-lucern-tenant": authContext.tenantId,
-    "x-lucern-tenant-id": authContext.tenantId,
-    "x-lucern-workspace": authContext.workspaceId,
-    "x-lucern-workspace-id": authContext.workspaceId,
-    "x-lucern-auth-mode": authContext.authMode,
-    "x-lucern-roles": authContext.roles.join(","),
-    "x-lucern-scopes": authContext.scopes.join(","),
-    "x-lucern-permit-context": JSON.stringify(authContext.permit)
-  };
-  if (authContext.clerkId) {
-    headers["x-lucern-clerk-id"] = authContext.clerkId;
-    headers["x-lucern-user-id"] = authContext.clerkId;
-  }
-  if (authContext.delegationChain.length > 0) {
-    headers["x-lucern-delegation-chain"] = JSON.stringify(
-      authContext.delegationChain
-    );
-  }
-  if (authContext.policyTraceId) {
-    headers["x-lucern-policy-trace-id"] = authContext.policyTraceId;
-  }
-  if (authContext.correlationId) {
-    headers["x-correlation-id"] = authContext.correlationId;
-    headers["x-lucern-correlation-id"] = authContext.correlationId;
-  }
-  if (authContext.membershipId) {
-    headers["x-lucern-membership-id"] = authContext.membershipId;
-  }
-  return headers;
-}
-
 // src/coreClient.ts
 var LucernApiError = class extends Error {
   code;
@@ -232,7 +65,9 @@ function generatePortableRequestId() {
     8
   ).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
 }
-var randomIdempotencyKey = generatePortableRequestId;
+function randomIdempotencyKey() {
+  return generatePortableRequestId();
+}
 function isRetryableStatus(status) {
   return status >= 500 || status === 408 || status === 429;
 }
@@ -297,11 +132,8 @@ function timeoutError(timeoutMs) {
   error.name = "AbortError";
   return error;
 }
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function readPolicySummaryFromDetails(details) {
-  if (!isRecord(details)) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
     return null;
   }
   const directSummary = details.summary;
@@ -309,11 +141,11 @@ function readPolicySummaryFromDetails(details) {
     return directSummary.trim();
   }
   const policy = details.policy;
-  if (!isRecord(policy)) {
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
     return null;
   }
   const explanation = policy.explanation;
-  if (!isRecord(explanation)) {
+  if (!explanation || typeof explanation !== "object" || Array.isArray(explanation)) {
     return null;
   }
   const nestedSummary = explanation.summary;
@@ -322,59 +154,16 @@ function readPolicySummaryFromDetails(details) {
   }
   return null;
 }
-async function resolveConfiguredAuthContext(authContext) {
-  if (typeof authContext === "function") {
-    return await authContext();
-  }
-  return authContext;
-}
-function mergeHeaderRecord(base, addition) {
-  const headers = new Headers(base);
-  for (const [key, value] of Object.entries(addition)) {
-    const existing = headers.get(key);
-    if (existing !== null && existing !== value) {
-      throw new LucernSdkAuthContextError(
-        "policy_denied",
-        `Canonical Lucern SDK auth context conflicts with existing ${key} header.`
-      );
-    }
-    headers.set(key, value);
-  }
-  return Object.fromEntries(headers.entries());
-}
-function cleanHeaderValue(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
 function createGatewayRequestClient(config = {}) {
   const fetchImpl = config.fetchImpl ?? fetch;
   const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
   const maxRetries = config.maxRetries ?? 2;
   const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
   async function resolveAuthHeaders() {
-    const provided = config.getAuthHeaders ? await config.getAuthHeaders() : {};
-    const headers = new Headers(provided);
-    const setIfAbsent = (name, value) => {
-      const normalized = cleanHeaderValue(value);
-      if (normalized && !headers.has(name)) {
-        headers.set(name, normalized);
-      }
-    };
-    setIfAbsent("x-lucern-key", config.apiKey);
-    setIfAbsent("x-lucern-session-token", config.userToken);
-    setIfAbsent("x-lucern-environment", config.environment);
-    setIfAbsent("x-lucern-clerk-id", config.clerkId);
-    setIfAbsent("x-lucern-user-id", config.userId ?? config.clerkId);
-    setIfAbsent("x-lucern-deployment-host", config.deploymentHost);
-    const base = Object.fromEntries(headers.entries());
-    const authContextInput = await resolveConfiguredAuthContext(
-      config.authContext
-    );
-    if (!authContextInput && !config.requireCanonicalAuthContext) {
-      return base;
+    if (!config.getAuthHeaders) {
+      return {};
     }
-    const authContext = normalizeCanonicalLucernAuthContext(authContextInput);
-    return mergeHeaderRecord(base, createCanonicalAuthHeaders(authContext));
+    return await config.getAuthHeaders();
   }
   async function fetchWithTimeout(url, init, timeoutMs) {
     const controller = new AbortController();
@@ -395,11 +184,11 @@ function createGatewayRequestClient(config = {}) {
     if (!text) {
       return null;
     }
-    const parsed = tryParseGatewayEnvelopeJson(text);
-    if (!parsed.ok) {
+    try {
+      return JSON.parse(text);
+    } catch {
       return null;
     }
-    return isRecord(parsed.value) ? parsed.value : null;
   }
   function resolveTimeoutMs(method, requestTimeoutMs) {
     if (typeof requestTimeoutMs === "number") {
@@ -411,31 +200,16 @@ function createGatewayRequestClient(config = {}) {
     }
     return config.timeoutMs ?? 15e3;
   }
-  function tryParseGatewayEnvelopeJson(text) {
-    const trimmed = text.trim();
-    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
-      return { ok: false, reason: "non-json" };
-    }
-    try {
-      return { ok: true, value: JSON.parse(trimmed) };
-    } catch (error) {
-      if (error instanceof SyntaxError) {
-        return { ok: false, reason: "invalid-json", error };
-      }
-      throw error;
-    }
-  }
   function buildApiError(args) {
     const failure = args.failure;
-    const legacyError = failure && isRecord(failure.error) ? failure.error : failure?.legacyError;
+    const legacyError = failure && typeof failure.error === "object" && failure.error !== null ? failure.error : failure?.legacyError;
     const correlationId = failure?.correlationId ?? args.response.headers.get("x-lucern-correlation-id")?.trim() ?? args.requestId;
     const policyTraceId = failure?.policyTraceId ?? args.response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null;
     const details = failure?.details ?? legacyError?.details;
     const policySummary = readPolicySummaryFromDetails(details);
-    const failureMessage = typeof failure?.error === "string" ? failure.error : legacyError?.message;
     return new LucernApiError({
       code: failure?.code ?? legacyError?.code ?? fallbackErrorCode(args.response.status),
-      message: policySummary ?? failureMessage ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed."),
+      message: policySummary ?? (typeof failure?.error === "string" ? failure.error : legacyError?.message ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed.")),
       status: args.response.status,
       invariant: failure?.invariant,
       suggestion: failure?.suggestion,
@@ -567,10 +341,7 @@ function createListResult(items, legacyKey) {
     total: items.length
   };
   if (legacyKey) {
-    return {
-      ...result,
-      [legacyKey]: items
-    };
+    result[legacyKey] = items;
   }
   return result;
 }
@@ -584,111 +355,115 @@ function mapGatewayData(response, mapper) {
 // src/audiencesClient.ts
 function createAudiencesClient(config = {}) {
   const gateway = createGatewayRequestClient(config);
-  const listRegistry = async (query = {}) => {
-    return gateway.request({
-      path: `/api/platform/v1/audiences/registry${toQueryString({
-        ...query,
-        effective: typeof query.effective === "boolean" ? query.effective ? "true" : "false" : void 0,
-        status: query.status
-      })}`
-    }).then(
-      (response) => mapGatewayData(
-        response,
-        (data) => createListResult(Array.isArray(data) ? data : [], "registryEntries")
-      )
-    );
-  };
-  const createRegistryEntry = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/registry",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-    });
-  };
-  const updateRegistryEntry = createRegistryEntry;
-  const upsertRegistry = createRegistryEntry;
-  const getRegistry = listRegistry;
-  const listGrants = async (query = {}) => {
-    return gateway.request({
-      path: `/api/platform/v1/audiences/grants${toQueryString({
-        ...query,
-        audienceKey: query.audienceKey,
-        principalId: query.principalId,
-        groupId: query.groupId,
-        status: query.status
-      })}`
-    }).then(
-      (response) => mapGatewayData(
-        response,
-        (data) => createListResult(Array.isArray(data) ? data : [], "grants")
-      )
-    );
-  };
-  const createGrant = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/grants",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-    });
-  };
-  const getGrants = listGrants;
-  const grant = createGrant;
-  const deleteGrant = async (input, idempotencyKey) => {
-    return gateway.request({
-      path: "/api/platform/v1/audiences/grants/revoke",
-      method: "POST",
-      body: input,
-      idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-    });
-  };
-  const revokeGrant = deleteGrant;
   return {
     /**
      * List audience registry entries.
      */
-    listRegistry,
+    async listRegistry(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/audiences/registry${toQueryString({
+          ...query,
+          effective: typeof query.effective === "boolean" ? query.effective ? "true" : "false" : void 0,
+          status: query.status
+        })}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "registryEntries"
+          )
+        )
+      );
+    },
     /**
      * @deprecated Use listRegistry.
      */
-    getRegistry,
+    async getRegistry(query = {}) {
+      return this.listRegistry(query);
+    },
     /**
      * Create an audience registry entry.
      */
-    createRegistryEntry,
+    async createRegistryEntry(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/audiences/registry",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
     /**
      * Update an audience registry entry.
      */
-    updateRegistryEntry,
+    async updateRegistryEntry(input, idempotencyKey) {
+      return this.createRegistryEntry(input, idempotencyKey);
+    },
     /**
      * @deprecated Use createRegistryEntry or updateRegistryEntry.
      */
-    upsertRegistry,
+    async upsertRegistry(input, idempotencyKey) {
+      return this.createRegistryEntry(input, idempotencyKey);
+    },
     /**
      * List audience grants.
      */
-    listGrants,
+    async listGrants(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/audiences/grants${toQueryString({
+          ...query,
+          audienceKey: query.audienceKey,
+          principalId: query.principalId,
+          groupId: query.groupId,
+          status: query.status
+        })}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "grants")
+        )
+      );
+    },
     /**
      * @deprecated Use listGrants.
      */
-    getGrants,
+    async getGrants(query = {}) {
+      return this.listGrants(query);
+    },
     /**
      * Create an audience grant.
      */
-    createGrant,
+    async createGrant(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/audiences/grants",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
     /**
      * @deprecated Use createGrant.
      */
-    grant,
+    async grant(input, idempotencyKey) {
+      return this.createGrant(input, idempotencyKey);
+    },
     /**
      * Delete an audience grant by revoking it.
      */
-    deleteGrant,
+    async deleteGrant(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/audiences/grants/revoke",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
     /**
      * @deprecated Use deleteGrant.
      */
-    revokeGrant
+    async revokeGrant(input, idempotencyKey) {
+      return this.deleteGrant(input, idempotencyKey);
+    }
   };
 }