@lucern/sdk 0.3.0-alpha.9 → 1.0.0

package/dist/accessControl.js

@@ -0,0 +1,1270 @@
+// src/authContext.ts
+var LucernSdkAuthContextError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "LucernSdkAuthContextError";
+    this.reason = reason;
+  }
+};
+function cleanString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function cleanStringList(values) {
+  if (!values) {
+    return [];
+  }
+  return values.map((value) => value.trim()).filter(
+    (value, index, list) => value.length > 0 && list.indexOf(value) === index
+  );
+}
+function requireString(value, reason, label) {
+  const normalized = cleanString(value);
+  if (!normalized) {
+    throw new LucernSdkAuthContextError(
+      reason,
+      `Canonical Lucern SDK auth context is missing ${label}.`
+    );
+  }
+  return normalized;
+}
+function requirePrincipalType(principalType2) {
+  if (!principalType2) {
+    throw new LucernSdkAuthContextError(
+      "principal_missing",
+      "Canonical Lucern SDK auth context is missing principalType."
+    );
+  }
+  return principalType2;
+}
+function requireAuthMode(authMode) {
+  if (!authMode) {
+    throw new LucernSdkAuthContextError(
+      "principal_missing",
+      "Canonical Lucern SDK auth context is missing authMode."
+    );
+  }
+  return authMode;
+}
+function ensurePermitMatch(args) {
+  const actual = cleanString(args.actual);
+  if (actual && actual !== args.expected) {
+    throw new LucernSdkAuthContextError(
+      "policy_denied",
+      `Canonical Lucern SDK auth context has conflicting Permit ${args.field}.`
+    );
+  }
+}
+function normalizeCanonicalLucernAuthContext(input) {
+  if (!input) {
+    throw new LucernSdkAuthContextError(
+      "principal_missing",
+      "Canonical Lucern SDK auth context is required."
+    );
+  }
+  if (input.policyDecision === "deny") {
+    throw new LucernSdkAuthContextError(
+      "policy_denied",
+      "Canonical Lucern SDK auth context carries a denied policy decision."
+    );
+  }
+  const principalId = requireString(
+    input.principalId,
+    "principal_missing",
+    "principalId"
+  );
+  const tenantId = requireString(input.tenantId, "tenant_missing", "tenantId");
+  const workspaceId = requireString(
+    input.workspaceId,
+    "workspace_missing",
+    "workspaceId"
+  );
+  const roles = cleanStringList(input.roles);
+  const scopes = cleanStringList(input.scopes);
+  const principalType2 = requirePrincipalType(input.principalType);
+  const authMode = requireAuthMode(input.authMode);
+  const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
+  if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
+    throw new LucernSdkAuthContextError(
+      "membership_missing",
+      "Canonical Lucern SDK auth context requires non-empty roles and scopes."
+    );
+  }
+  const subject = cleanString(input.permit?.subject) ?? principalId;
+  const tenant = cleanString(input.permit?.tenant) ?? tenantId;
+  const workspace = cleanString(input.permit?.workspace) ?? workspaceId;
+  ensurePermitMatch({
+    field: "subject",
+    expected: principalId,
+    actual: subject
+  });
+  ensurePermitMatch({ field: "tenant", expected: tenantId, actual: tenant });
+  ensurePermitMatch({
+    field: "workspace",
+    expected: workspaceId,
+    actual: workspace
+  });
+  const context = input.permit?.context ? { ...input.permit.context } : void 0;
+  return {
+    clerkId: cleanString(input.clerkId),
+    principalId,
+    tenantId,
+    workspaceId,
+    principalType: principalType2,
+    authMode,
+    roles,
+    scopes,
+    delegationChain: input.delegationChain ? [...input.delegationChain] : [],
+    policyTraceId: cleanString(input.policyTraceId),
+    correlationId: cleanString(input.correlationId),
+    membershipId: cleanString(input.membershipId),
+    permit: {
+      subject,
+      tenant,
+      workspace,
+      resource: cleanString(input.permit?.resource),
+      action: cleanString(input.permit?.action),
+      relation: cleanString(input.permit?.relation),
+      context
+    }
+  };
+}
+function createCanonicalAuthHeaders(authContext) {
+  const headers = {
+    "x-lucern-principal-id": authContext.principalId,
+    "x-lucern-principal-type": authContext.principalType,
+    "x-lucern-tenant": authContext.tenantId,
+    "x-lucern-tenant-id": authContext.tenantId,
+    "x-lucern-workspace": authContext.workspaceId,
+    "x-lucern-workspace-id": authContext.workspaceId,
+    "x-lucern-auth-mode": authContext.authMode,
+    "x-lucern-roles": authContext.roles.join(","),
+    "x-lucern-scopes": authContext.scopes.join(","),
+    "x-lucern-permit-context": JSON.stringify(authContext.permit)
+  };
+  if (authContext.clerkId) {
+    headers["x-lucern-clerk-id"] = authContext.clerkId;
+    headers["x-lucern-user-id"] = authContext.clerkId;
+  }
+  if (authContext.delegationChain.length > 0) {
+    headers["x-lucern-delegation-chain"] = JSON.stringify(
+      authContext.delegationChain
+    );
+  }
+  if (authContext.policyTraceId) {
+    headers["x-lucern-policy-trace-id"] = authContext.policyTraceId;
+  }
+  if (authContext.correlationId) {
+    headers["x-correlation-id"] = authContext.correlationId;
+    headers["x-lucern-correlation-id"] = authContext.correlationId;
+  }
+  if (authContext.membershipId) {
+    headers["x-lucern-membership-id"] = authContext.membershipId;
+  }
+  return headers;
+}
+
+// src/coreClient.ts
+var LucernApiError = class extends Error {
+  code;
+  status;
+  invariant;
+  suggestion;
+  details;
+  requestId;
+  correlationId;
+  policyTraceId;
+  constructor(args) {
+    super(args.message);
+    this.name = "LucernApiError";
+    this.code = args.code;
+    this.status = args.status;
+    this.invariant = args.invariant;
+    this.suggestion = args.suggestion;
+    this.details = args.details;
+    this.requestId = args.requestId;
+    this.correlationId = args.correlationId;
+    this.policyTraceId = args.policyTraceId;
+  }
+};
+function toQueryString(scope) {
+  const params = new URLSearchParams();
+  if (scope.tenantId) {
+    params.set("tenantId", scope.tenantId);
+  }
+  if (scope.workspaceId) {
+    params.set("workspaceId", scope.workspaceId);
+  }
+  for (const [key, value] of Object.entries(scope)) {
+    if (key === "tenantId" || key === "workspaceId") {
+      continue;
+    }
+    if (value === void 0) {
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  const serialized = params.toString();
+  return serialized.length > 0 ? `?${serialized}` : "";
+}
+function fillRandomBytes(length) {
+  const bytes = new Uint8Array(length);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+  }
+  for (let index = 0; index < length; index += 1) {
+    bytes[index] = Math.floor(Math.random() * 256);
+  }
+  return bytes;
+}
+function generatePortableRequestId() {
+  if (typeof globalThis.crypto?.randomUUID === "function") {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = fillRandomBytes(16);
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (value) => value.toString(16).padStart(2, "0"));
+  return `${hex.slice(0, 4).join("")}-${hex.slice(4, 6).join("")}-${hex.slice(
+    6,
+    8
+  ).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
+}
+var randomIdempotencyKey = generatePortableRequestId;
+function isRetryableStatus(status) {
+  return status >= 500 || status === 408 || status === 429;
+}
+function fallbackErrorCode(status) {
+  if (status === 401) {
+    return "AUTHENTICATION_REQUIRED";
+  }
+  if (status === 403) {
+    return "FORBIDDEN";
+  }
+  if (status === 404) {
+    return "NOT_FOUND";
+  }
+  if (status === 408) {
+    return "UPSTREAM_ERROR";
+  }
+  if (status === 409) {
+    return "CONFLICT";
+  }
+  if (status === 429) {
+    return "RATE_LIMIT_EXCEEDED";
+  }
+  if (status >= 500) {
+    return "UPSTREAM_ERROR";
+  }
+  return "INTERNAL_ERROR";
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function parseRetryAfterMs(value) {
+  if (!value) {
+    return null;
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return null;
+  }
+  const numeric = Number(trimmed);
+  if (Number.isFinite(numeric)) {
+    return Math.max(0, Math.round(numeric * 1e3));
+  }
+  const parsedDate = Date.parse(trimmed);
+  if (Number.isFinite(parsedDate)) {
+    return Math.max(0, parsedDate - Date.now());
+  }
+  return null;
+}
+function computeRetryDelayMs(args) {
+  const baseDelay = args.status === 429 ? Math.max(
+    args.retryAfterMs ?? 0,
+    Math.min(1e3 * 2 ** args.attempt, 1e4)
+  ) : Math.min(1e3 * 2 ** args.attempt, 4e3);
+  if (args.status !== 429) {
+    return baseDelay;
+  }
+  const jitterWindow = Math.max(250, Math.round(baseDelay * 0.25));
+  return baseDelay + Math.round(Math.random() * jitterWindow);
+}
+function timeoutError(timeoutMs) {
+  const error = new Error(`Request timed out after ${timeoutMs}ms`);
+  error.name = "AbortError";
+  return error;
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readPolicySummaryFromDetails(details) {
+  if (!isRecord(details)) {
+    return null;
+  }
+  const directSummary = details.summary;
+  if (typeof directSummary === "string" && directSummary.trim().length > 0) {
+    return directSummary.trim();
+  }
+  const policy = details.policy;
+  if (!isRecord(policy)) {
+    return null;
+  }
+  const explanation = policy.explanation;
+  if (!isRecord(explanation)) {
+    return null;
+  }
+  const nestedSummary = explanation.summary;
+  if (typeof nestedSummary === "string" && nestedSummary.trim().length > 0) {
+    return nestedSummary.trim();
+  }
+  return null;
+}
+async function resolveConfiguredAuthContext(authContext) {
+  if (typeof authContext === "function") {
+    return await authContext();
+  }
+  return authContext;
+}
+function mergeHeaderRecord(base, addition) {
+  const headers = new Headers(base);
+  for (const [key, value] of Object.entries(addition)) {
+    const existing = headers.get(key);
+    if (existing !== null && existing !== value) {
+      throw new LucernSdkAuthContextError(
+        "policy_denied",
+        `Canonical Lucern SDK auth context conflicts with existing ${key} header.`
+      );
+    }
+    headers.set(key, value);
+  }
+  return Object.fromEntries(headers.entries());
+}
+function cleanHeaderValue(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function createGatewayRequestClient(config = {}) {
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
+  const maxRetries = config.maxRetries ?? 2;
+  const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
+  async function resolveAuthHeaders() {
+    const provided = config.getAuthHeaders ? await config.getAuthHeaders() : {};
+    const headers = new Headers(provided);
+    const setIfAbsent = (name, value) => {
+      const normalized = cleanHeaderValue(value);
+      if (normalized && !headers.has(name)) {
+        headers.set(name, normalized);
+      }
+    };
+    setIfAbsent("x-lucern-key", config.apiKey);
+    setIfAbsent("x-lucern-session-token", config.userToken);
+    setIfAbsent("x-lucern-environment", config.environment);
+    setIfAbsent("x-lucern-clerk-id", config.clerkId);
+    setIfAbsent("x-lucern-user-id", config.userId ?? config.clerkId);
+    setIfAbsent("x-lucern-deployment-host", config.deploymentHost);
+    const base = Object.fromEntries(headers.entries());
+    const authContextInput = await resolveConfiguredAuthContext(
+      config.authContext
+    );
+    if (!authContextInput && !config.requireCanonicalAuthContext) {
+      return base;
+    }
+    const authContext = normalizeCanonicalLucernAuthContext(authContextInput);
+    return mergeHeaderRecord(base, createCanonicalAuthHeaders(authContext));
+  }
+  async function fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      return await fetchImpl(url, { ...init, signal: controller.signal });
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw timeoutError(timeoutMs);
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function parsePayload(response) {
+    const text = await response.text();
+    if (!text) {
+      return null;
+    }
+    const parsed = tryParseGatewayEnvelopeJson(text);
+    if (!parsed.ok) {
+      return null;
+    }
+    return isRecord(parsed.value) ? parsed.value : null;
+  }
+  function resolveTimeoutMs(method, requestTimeoutMs) {
+    if (typeof requestTimeoutMs === "number") {
+      return requestTimeoutMs;
+    }
+    const methodTimeoutMs = config.timeoutMsByMethod?.[method];
+    if (typeof methodTimeoutMs === "number") {
+      return methodTimeoutMs;
+    }
+    return config.timeoutMs ?? 15e3;
+  }
+  function tryParseGatewayEnvelopeJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
+      return { ok: false, reason: "non-json" };
+    }
+    try {
+      return { ok: true, value: JSON.parse(trimmed) };
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        return { ok: false, reason: "invalid-json", error };
+      }
+      throw error;
+    }
+  }
+  function buildApiError(args) {
+    const failure = args.failure;
+    const legacyError = failure && isRecord(failure.error) ? failure.error : failure?.legacyError;
+    const correlationId = failure?.correlationId ?? args.response.headers.get("x-lucern-correlation-id")?.trim() ?? args.requestId;
+    const policyTraceId = failure?.policyTraceId ?? args.response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null;
+    const details = failure?.details ?? legacyError?.details;
+    const policySummary = readPolicySummaryFromDetails(details);
+    const failureMessage = typeof failure?.error === "string" ? failure.error : legacyError?.message;
+    return new LucernApiError({
+      code: failure?.code ?? legacyError?.code ?? fallbackErrorCode(args.response.status),
+      message: policySummary ?? failureMessage ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed."),
+      status: args.response.status,
+      invariant: failure?.invariant,
+      suggestion: failure?.suggestion,
+      details,
+      requestId: args.requestId,
+      correlationId,
+      policyTraceId
+    });
+  }
+  async function request(args) {
+    const authHeaders = await resolveAuthHeaders();
+    const method = args.method ?? "GET";
+    const timeoutMs = resolveTimeoutMs(method, args.timeoutMs);
+    const headers = new Headers({
+      "content-type": "application/json",
+      ...authHeaders
+    });
+    if (args.idempotencyKey) {
+      headers.set("idempotency-key", args.idempotencyKey);
+    }
+    const requestId = headers.get("x-correlation-id")?.trim() || headers.get("x-request-id")?.trim() || args.requestId || requestIdFactory();
+    if (!headers.has("x-correlation-id") && !headers.has("x-request-id")) {
+      headers.set("x-correlation-id", requestId);
+    }
+    const url = `${baseUrl}${args.path}`;
+    const serializedBody = args.body ? JSON.stringify(args.body) : void 0;
+    const init = {
+      method,
+      headers,
+      body: serializedBody
+    };
+    let lastError;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      const hookRequestContext = {
+        requestId,
+        attempt,
+        maxRetries,
+        method,
+        path: args.path,
+        url,
+        headers: new Headers(headers),
+        body: serializedBody,
+        timeoutMs
+      };
+      await config.onRequest?.(hookRequestContext);
+      const startedAt = Date.now();
+      try {
+        const response = await fetchWithTimeout(url, init, timeoutMs);
+        const responseClone = response.clone();
+        const payload = await parsePayload(response);
+        const retryAfterMs = parseRetryAfterMs(
+          response.headers.get("Retry-After")
+        );
+        if (!response.ok || !payload?.success) {
+          const failure = payload && !payload.success ? payload : null;
+          const apiError = buildApiError({
+            requestId,
+            response,
+            failure
+          });
+          const willRetry = attempt < maxRetries && isRetryableStatus(response.status);
+          await config.onResponse?.({
+            ...hookRequestContext,
+            durationMs: Date.now() - startedAt,
+            status: response.status,
+            response: responseClone,
+            error: apiError,
+            correlationId: apiError.correlationId ?? requestId,
+            policyTraceId: apiError.policyTraceId ?? null,
+            retryAfterMs,
+            willRetry
+          });
+          if (willRetry) {
+            lastError = apiError;
+            await delay(
+              computeRetryDelayMs({
+                attempt,
+                status: response.status,
+                retryAfterMs
+              })
+            );
+            continue;
+          }
+          throw apiError;
+        }
+        const successPayload = payload;
+        await config.onResponse?.({
+          ...hookRequestContext,
+          durationMs: Date.now() - startedAt,
+          status: response.status,
+          response: responseClone,
+          correlationId: successPayload.correlationId ?? response.headers.get("x-lucern-correlation-id")?.trim() ?? requestId,
+          policyTraceId: successPayload.policyTraceId ?? response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null,
+          idempotentReplay: successPayload.idempotentReplay,
+          retryAfterMs,
+          willRetry: false
+        });
+        return successPayload;
+      } catch (fetchError) {
+        if (fetchError instanceof LucernApiError) {
+          throw fetchError;
+        }
+        const willRetry = attempt < maxRetries;
+        await config.onResponse?.({
+          ...hookRequestContext,
+          durationMs: Date.now() - startedAt,
+          error: fetchError,
+          correlationId: requestId,
+          policyTraceId: null,
+          willRetry
+        });
+        lastError = fetchError;
+        if (willRetry) {
+          await delay(computeRetryDelayMs({ attempt }));
+        }
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Platform API request failed after retries.");
+  }
+  return {
+    request
+  };
+}
+
+// src/sdkSurface.ts
+function createListResult(items, legacyKey) {
+  const result = {
+    items,
+    total: items.length
+  };
+  if (legacyKey) {
+    return {
+      ...result,
+      [legacyKey]: items
+    };
+  }
+  return result;
+}
+function mapGatewayData(response, mapper) {
+  return {
+    ...response,
+    data: mapper(response.data)
+  };
+}
+
+// src/boundaryClientSurface.ts
+function cleanOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function cleanRequiredString(value, label) {
+  const normalized = cleanOptionalString(value);
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function assertKnownKeys(input, allowed, operation) {
+  const allowedSet = new Set(allowed);
+  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
+    );
+  }
+}
+function knownPayload(input, allowed, operation) {
+  assertKnownKeys(input, allowed, operation);
+  return { ...input };
+}
+function listResultFromEnvelope(data, legacyKey) {
+  const record = isRecord2(data) ? data : {};
+  const legacyItems = record[legacyKey];
+  return createListResult(
+    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
+    legacyKey
+  );
+}
+
+// src/control-plane.ts
+var LucernControlPlaneIdentityError = class extends Error {
+  reason;
+  principalStatus;
+  tenantStatus;
+  workspaceStatus;
+  details;
+  constructor(failure) {
+    super(failure.message);
+    this.name = "LucernControlPlaneIdentityError";
+    this.reason = failure.reason;
+    this.principalStatus = failure.principalStatus;
+    this.tenantStatus = failure.tenantStatus;
+    this.workspaceStatus = failure.workspaceStatus;
+    this.details = failure.details;
+  }
+};
+function cleanString2(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function stringList(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return [
+    ...new Set(
+      value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean)
+    )
+  ];
+}
+function principalType(value) {
+  switch (value) {
+    case "service":
+    case "service_principal":
+      return "service";
+    case "agent":
+      return "agent";
+    case "group":
+      return "group";
+    case "external_viewer":
+    case "external_stakeholder":
+      return "external_viewer";
+    default:
+      return "human";
+  }
+}
+function adminFlags(roles) {
+  const normalized = roles.map((role) => role.toLowerCase());
+  const isPlatformAdmin = normalized.includes("platform_admin");
+  const isTenantAdmin = isPlatformAdmin || normalized.includes("tenant_admin");
+  const isWorkspaceAdmin = isTenantAdmin || normalized.includes("workspace_admin") || normalized.includes("workspace_owner");
+  return { isPlatformAdmin, isTenantAdmin, isWorkspaceAdmin };
+}
+function normalizeResolvedInteractivePrincipal(payload) {
+  if ("ok" in payload && payload.ok === false) {
+    throw new LucernControlPlaneIdentityError(payload);
+  }
+  const principalId = cleanString2(payload.principalId);
+  const clerkId = cleanString2(payload.clerkId);
+  const tenantId = cleanString2(payload.tenantId);
+  if (!principalId || !clerkId || !tenantId) {
+    throw new LucernControlPlaneIdentityError({
+      ok: false,
+      reason: "resolver_unavailable",
+      message: "Control-plane principal resolver returned an incomplete principal context.",
+      principalStatus: payload.principalStatus ?? "missing",
+      tenantStatus: payload.tenantStatus,
+      workspaceStatus: payload.workspaceStatus
+    });
+  }
+  const roles = stringList(payload.roles);
+  const scopes = stringList(payload.scopes);
+  const workspaceId = cleanString2(payload.workspaceId) ?? null;
+  const flags = adminFlags(roles);
+  return {
+    principalId,
+    principalType: principalType(payload.principalType),
+    clerkId,
+    tenantId,
+    workspaceId,
+    roles,
+    scopes,
+    groupIds: stringList(payload.groupIds),
+    permittedToolNames: stringList(payload.permittedToolNames),
+    permittedPackKeys: stringList(payload.permittedPackKeys),
+    principalStatus: cleanString2(payload.principalStatus) ?? "active",
+    tenantStatus: cleanString2(payload.tenantStatus) ?? "active",
+    workspaceStatus: cleanString2(payload.workspaceStatus) ?? (workspaceId ? "active" : "none"),
+    isPlatformAdmin: typeof payload.isPlatformAdmin === "boolean" ? payload.isPlatformAdmin : flags.isPlatformAdmin,
+    isTenantAdmin: typeof payload.isTenantAdmin === "boolean" ? payload.isTenantAdmin : flags.isTenantAdmin,
+    isWorkspaceAdmin: typeof payload.isWorkspaceAdmin === "boolean" ? payload.isWorkspaceAdmin : flags.isWorkspaceAdmin,
+    permit: {
+      subject: cleanString2(payload.permit?.subject) ?? principalId,
+      tenant: cleanString2(payload.permit?.tenant) ?? tenantId,
+      ...workspaceId ? { workspace: cleanString2(payload.permit?.workspace) ?? workspaceId } : {}
+    },
+    authMode: "interactive_user",
+    sessionId: payload.sessionId,
+    delegatedBy: payload.delegatedBy,
+    expiresAt: payload.expiresAt
+  };
+}
+
+// src/identityClient.ts
+function createIdentityWhoamiClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    async whoami() {
+      return gateway.request({
+        path: "/api/platform/v1/identity/whoami"
+      });
+    }
+  };
+}
+var TENANT_IDENTITY_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "integrationKey",
+  "secretRef",
+  "policySubject",
+  "policyAction",
+  "policyResource",
+  "decision",
+  "config",
+  "configKey",
+  "configValue",
+  "provider",
+  "status",
+  "metadata",
+  "limit",
+  "cursor"
+];
+function tenantIdentityQuery(input) {
+  return {
+    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
+    workspaceId: input.workspaceId,
+    principalId: input.principalId,
+    limit: input.limit,
+    cursor: input.cursor
+  };
+}
+function tenantIdentityBody(input, operation) {
+  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
+}
+function createIdentityClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  const whoamiClient = createIdentityWhoamiClient(config);
+  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
+    path: "/api/platform/v1/identity/principals",
+    method,
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
+  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
+    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
+    method: "POST",
+    body: input,
+    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+  });
+  return {
+    /**
+     * Resolve the current authenticated identity summary.
+     */
+    async whoami() {
+      return whoamiClient.whoami().then(
+        (response) => mapGatewayData(response, (data) => ({
+          principalId: data.principalId,
+          principalType: data.principalType,
+          clerkId: data.clerkId,
+          tenantId: data.tenantId ?? null,
+          workspaceId: data.workspaceId ?? null,
+          scopes: Array.isArray(data.scopes) ? data.scopes : [],
+          roles: Array.isArray(data.roles) ? data.roles : [],
+          groupIds: Array.isArray(data.groupIds) ? data.groupIds : [],
+          permittedToolNames: Array.isArray(data.permittedToolNames) ? data.permittedToolNames : [],
+          permittedPackKeys: Array.isArray(data.permittedPackKeys) ? data.permittedPackKeys : [],
+          principalStatus: data.principalStatus,
+          tenantStatus: data.tenantStatus,
+          workspaceStatus: data.workspaceStatus,
+          isPlatformAdmin: data.isPlatformAdmin === true,
+          isTenantAdmin: data.isTenantAdmin === true,
+          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
+          permit: data.permit ?? (data.tenantId ? {
+            subject: data.principalId,
+            tenant: data.tenantId,
+            ...data.workspaceId ? { workspace: data.workspaceId } : {}
+          } : void 0),
+          authMode: data.authMode,
+          sessionId: data.sessionId,
+          delegatedBy: data.delegatedBy,
+          expiresAt: data.expiresAt
+        }))
+      );
+    },
+    /**
+     * Resolve a Clerk subject through the tenant control-plane Permit projection.
+     * @deprecated Prefer lucern.controlPlane.identity.resolveInteractivePrincipal().
+     */
+    async resolveInteractivePrincipal(input) {
+      return gateway.request({
+        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
+        method: "POST",
+        body: input
+      }).then(
+        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
+      );
+    },
+    /**
+     * List principals in the current identity scope.
+     */
+    async listPrincipals(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/principals${toQueryString(query)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(
+            Array.isArray(data) ? data : [],
+            "principals"
+          )
+        )
+      );
+    },
+    /**
+     * Create a principal.
+     */
+    async createPrincipal(input, idempotencyKey) {
+      return requestPrincipalWrite("POST", input, idempotencyKey);
+    },
+    /**
+     * Update a principal.
+     */
+    updatePrincipal,
+    /**
+     * @deprecated Use createPrincipal or updatePrincipal.
+     */
+    upsertPrincipal: updatePrincipal,
+    /**
+     * List keys in the current identity scope.
+     */
+    async listKeys(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys${toQueryString(query)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
+        )
+      );
+    },
+    /**
+     * Create an API key.
+     */
+    async createKey(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/identity/keys",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Rotate an API key.
+     */
+    async rotateKey(keyId, input = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Delete an API key by revoking it.
+     */
+    deleteKey,
+    /**
+     * @deprecated Use deleteKey.
+     */
+    revokeKey: deleteKey,
+    /**
+     * Search Clerk users by email or display attributes.
+     */
+    async searchClerkUsers(q) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
+      });
+    },
+    async getTenantConfig(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/tenant-config${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      });
+    },
+    async updateTenantConfig(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      return gateway.request({
+        path: "/api/platform/v1/identity/tenant-config",
+        method: "PATCH",
+        body: tenantIdentityBody(
+          input,
+          "identity.updateTenantConfig"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listIntegrations(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/integrations${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "integrations"
+          )
+        )
+      );
+    },
+    async upsertIntegration(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.integrationKey, "integrationKey");
+      return gateway.request({
+        path: "/api/platform/v1/identity/integrations",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.upsertIntegration"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async listSecrets(input) {
+      return gateway.request({
+        path: `/api/platform/v1/identity/secrets${toQueryString(
+          tenantIdentityQuery(input)
+        )}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => listResultFromEnvelope(
+            data,
+            "secrets"
+          )
+        )
+      );
+    },
+    async putSecretReference(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.secretRef, "secretRef");
+      return gateway.request({
+        path: "/api/platform/v1/identity/secrets",
+        method: "PUT",
+        body: tenantIdentityBody(
+          input,
+          "identity.putSecretReference"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async evaluatePolicy(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.policySubject, "policySubject");
+      cleanRequiredString(input.policyAction, "policyAction");
+      cleanRequiredString(input.policyResource, "policyResource");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/evaluate",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.evaluatePolicy"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    async recordPolicyDecision(input, idempotencyKey) {
+      cleanRequiredString(input.tenantId, "tenantId");
+      cleanRequiredString(input.decision, "decision");
+      return gateway.request({
+        path: "/api/platform/v1/identity/policy/decisions",
+        method: "POST",
+        body: tenantIdentityBody(
+          input,
+          "identity.recordPolicyDecision"
+        ),
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    }
+  };
+}
+
+// src/accessControl.ts
+var LucernAccessControlError = class extends LucernSdkAuthContextError {
+  policyDecision;
+  constructor(reason, message, policyDecision) {
+    super(reason, message);
+    this.name = "LucernAccessControlError";
+    this.policyDecision = policyDecision;
+  }
+};
+function cleanString3(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
+function cleanStringList2(values) {
+  if (!values) {
+    return [];
+  }
+  return [
+    ...new Set(
+      values.map((value) => value.trim()).filter((value) => value.length > 0)
+    )
+  ];
+}
+function requireString2(value, reason, label) {
+  const normalized = cleanString3(value);
+  if (!normalized) {
+    throw new LucernAccessControlError(
+      reason,
+      `Lucern SDK access control requires ${label}.`
+    );
+  }
+  return normalized;
+}
+function normalizePrincipalType(principalType2) {
+  if (principalType2 === "agent") {
+    return "agent";
+  }
+  if (principalType2 === "service") {
+    return "service";
+  }
+  if (principalType2 === "group") {
+    return "group";
+  }
+  if (principalType2 === "external_viewer") {
+    return "external_viewer";
+  }
+  return "human";
+}
+function aliasKey(alias) {
+  return `${alias.provider}:${alias.providerProjectId ?? ""}:${alias.externalSubjectId}`;
+}
+function normalizeAliases(input, canonicalClerkUserId) {
+  const aliases = /* @__PURE__ */ new Map();
+  for (const alias of input ?? []) {
+    const externalSubjectId = cleanString3(alias.externalSubjectId);
+    if (!externalSubjectId) {
+      continue;
+    }
+    const normalized = {
+      provider: cleanString3(alias.provider) ?? "clerk",
+      providerProjectId: cleanString3(alias.providerProjectId),
+      externalSubjectId,
+      status: cleanString3(alias.status)
+    };
+    aliases.set(aliasKey(normalized), normalized);
+  }
+  if (canonicalClerkUserId) {
+    const canonicalAlias = {
+      provider: "clerk",
+      externalSubjectId: canonicalClerkUserId,
+      status: "active"
+    };
+    aliases.set(aliasKey(canonicalAlias), canonicalAlias);
+  }
+  return [...aliases.values()];
+}
+function isKnownClerkSubject(args) {
+  if (args.clerkId === args.canonicalClerkUserId) {
+    return true;
+  }
+  return args.aliases.some(
+    (alias) => alias.provider === "clerk" && alias.externalSubjectId === args.clerkId
+  );
+}
+function authContextToPrincipalInput(input) {
+  const normalized = normalizeCanonicalLucernAuthContext(input);
+  return {
+    principalId: normalized.principalId,
+    principalType: normalized.principalType,
+    canonicalClerkUserId: normalized.clerkId,
+    clerkId: normalized.clerkId,
+    tenantId: normalized.tenantId,
+    workspaceId: normalized.workspaceId,
+    roles: normalized.roles,
+    scopes: normalized.scopes
+  };
+}
+function isAuthContextInput(input) {
+  return "authMode" in input || "permit" in input || "delegationChain" in input;
+}
+function normalizeCanonicalPrincipalIdentity(input, options = {}) {
+  const principalInput = isAuthContextInput(input) ? authContextToPrincipalInput(input) : input;
+  const principalId = requireString2(
+    principalInput.principalId,
+    "principal_missing",
+    "principalId"
+  );
+  const principalType2 = normalizePrincipalType(principalInput.principalType);
+  const observedClerkId = cleanString3(options.observedClerkId);
+  const canonicalClerkUserId = cleanString3(principalInput.canonicalClerkUserId) ?? cleanString3(principalInput.clerkId);
+  if (principalType2 === "human" && !canonicalClerkUserId) {
+    throw new LucernAccessControlError(
+      "clerk_alias_missing",
+      "Human principals require one canonical Clerk user id."
+    );
+  }
+  const aliases = normalizeAliases(
+    principalInput.clerkIdentityAliases,
+    canonicalClerkUserId
+  );
+  if (observedClerkId && !isKnownClerkSubject({
+    clerkId: observedClerkId,
+    canonicalClerkUserId,
+    aliases
+  })) {
+    throw new LucernAccessControlError(
+      "clerk_alias_unrecognized",
+      "Observed Clerk user id does not match the canonical human principal id."
+    );
+  }
+  return {
+    principalId,
+    principalType: principalType2,
+    canonicalClerkUserId,
+    clerkIdentityAliases: aliases,
+    tenantId: cleanString3(principalInput.tenantId),
+    workspaceId: cleanString3(principalInput.workspaceId),
+    roles: cleanStringList2(principalInput.roles),
+    scopes: cleanStringList2(principalInput.scopes)
+  };
+}
+function formatPermitResource(resource) {
+  if (typeof resource === "string") {
+    return requireString2(resource, "policy_denied", "policyResource");
+  }
+  const type = requireString2(resource.type, "policy_denied", "resource.type");
+  const key = requireString2(resource.key, "policy_denied", "resource.key");
+  return key.startsWith(`${type}:`) ? key : `${type}:${key}`;
+}
+function resourceRequiresWorkspace(resource) {
+  if (typeof resource === "string") {
+    return !resource.startsWith("tenant:");
+  }
+  return resource.type !== "tenant";
+}
+function buildPolicyInput(identity, input) {
+  const tenantId = requireString2(
+    input.tenantId ?? identity.tenantId,
+    "tenant_missing",
+    "tenantId"
+  );
+  const workspaceId = cleanString3(input.workspaceId ?? identity.workspaceId);
+  if (resourceRequiresWorkspace(input.resource) && !workspaceId) {
+    throw new LucernAccessControlError(
+      "workspace_missing",
+      "Workspace-scoped Permit checks require workspaceId."
+    );
+  }
+  return {
+    tenantId,
+    workspaceId,
+    principalId: identity.principalId,
+    policySubject: identity.principalId,
+    policyAction: requireString2(input.action, "policy_denied", "policyAction"),
+    policyResource: formatPermitResource(input.resource),
+    metadata: input.context
+  };
+}
+async function resolveConfiguredPrincipalInput(authContext) {
+  if (typeof authContext === "function") {
+    return await authContext();
+  }
+  return authContext;
+}
+function assertPermitAllowed(decision) {
+  if (decision.decision !== "allow") {
+    throw new LucernAccessControlError(
+      decision.decision === "deny" ? "policy_denied" : "policy_unknown",
+      `Permit denied ${decision.policyAction} on ${decision.policyResource}.`,
+      decision
+    );
+  }
+}
+function createAccessControlClient(config = {}) {
+  const identityClient = createIdentityClient(config);
+  async function resolveIdentity(input, observedClerkId) {
+    const identityInput = input ?? await resolveConfiguredPrincipalInput(config.authContext);
+    if (!identityInput) {
+      throw new LucernAccessControlError(
+        "principal_missing",
+        "Lucern SDK access control requires a canonical principal identity."
+      );
+    }
+    return normalizeCanonicalPrincipalIdentity(identityInput, {
+      observedClerkId
+    });
+  }
+  async function checkAccess(input, idempotencyKey) {
+    const identity = await resolveIdentity(input.identity, input.observedClerkId);
+    const policyInput = buildPolicyInput(identity, input);
+    try {
+      const response = await identityClient.evaluatePolicy(
+        policyInput,
+        idempotencyKey
+      );
+      return {
+        identity,
+        policyInput,
+        decision: response.data
+      };
+    } catch (error) {
+      if (error instanceof LucernSdkAuthContextError) {
+        throw error;
+      }
+      throw new LucernAccessControlError(
+        "policy_unavailable",
+        "Permit policy check failed closed before an allow decision was returned."
+      );
+    }
+  }
+  async function requireAccess(input, idempotencyKey) {
+    const result = await checkAccess(input, idempotencyKey);
+    assertPermitAllowed(result.decision);
+    return result;
+  }
+  async function canAccess(input, idempotencyKey) {
+    try {
+      await requireAccess(input, idempotencyKey);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return {
+    normalizePrincipal: normalizeCanonicalPrincipalIdentity,
+    checkAccess,
+    requireAccess,
+    canAccess
+  };
+}
+
+export { LucernAccessControlError, assertPermitAllowed, createAccessControlClient, formatPermitResource, normalizeCanonicalPrincipalIdentity };
+//# sourceMappingURL=accessControl.js.map
+//# sourceMappingURL=accessControl.js.map