@lucern/sdk 1.0.11 → 1.0.13

package/dist/accessControl.js

@@ -1,1463 +1,235 @@
-import { createTelemetryExporterFromEnv, emitTelemetrySignal } from '@lucern/transport-core';
-import { redactDiagnosticValue } from '@lucern/transport-core/redaction';
-import { classifyRetry } from '@lucern/transport-core/transport';
-import { Effect, Exit, Cause } from 'effect';
-
-// src/authContext.ts
-var LucernSdkAuthContextError = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.name = "LucernSdkAuthContextError";
-    this.reason = reason;
-  }
-};
+import { LucernSdkAuthContextError, normalizeCanonicalLucernAuthContext, } from "./authContext.js";
+import { createIdentityClient, } from "./identityClient.js";
+export class LucernAccessControlError extends LucernSdkAuthContextError {
+    policyDecision;
+    constructor(reason, message, policyDecision) {
+        super(reason, message);
+        this.name = "LucernAccessControlError";
+        this.policyDecision = policyDecision;
+    }
+}
 function cleanString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
+    const normalized = value?.trim();
+    return normalized ? normalized : undefined;
 }
 function cleanStringList(values) {
-  if (!values) {
-    return [];
-  }
-  return values.map((value) => value.trim()).filter(
-    (value, index, list) => value.length > 0 && list.indexOf(value) === index
-  );
+    if (!values) {
+        return [];
+    }
+    return [
+        ...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0)),
+    ];
 }
 function requireString(value, reason, label) {
-  const normalized = cleanString(value);
-  if (!normalized) {
-    throw new LucernSdkAuthContextError(
-      reason,
-      `Canonical Lucern SDK auth context is missing ${label}.`
-    );
-  }
-  return normalized;
-}
-function requirePrincipalType(principalType2) {
-  if (!principalType2) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is missing principalType."
-    );
-  }
-  return principalType2;
-}
-function requireAuthMode(authMode) {
-  if (!authMode) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is missing authMode."
-    );
-  }
-  return authMode;
-}
-function ensurePermitMatch(args) {
-  const actual = cleanString(args.actual);
-  if (actual && actual !== args.expected) {
-    throw new LucernSdkAuthContextError(
-      "policy_denied",
-      `Canonical Lucern SDK auth context has conflicting Permit ${args.field}.`
-    );
-  }
-}
-function normalizeCanonicalLucernAuthContext(input) {
-  if (!input) {
-    throw new LucernSdkAuthContextError(
-      "principal_missing",
-      "Canonical Lucern SDK auth context is required."
-    );
-  }
-  if (input.policyDecision === "deny") {
-    throw new LucernSdkAuthContextError(
-      "policy_denied",
-      "Canonical Lucern SDK auth context carries a denied policy decision."
-    );
-  }
-  const principalId = requireString(
-    input.principalId,
-    "principal_missing",
-    "principalId"
-  );
-  const tenantId = requireString(input.tenantId, "tenant_missing", "tenantId");
-  const workspaceId = requireString(
-    input.workspaceId,
-    "workspace_missing",
-    "workspaceId"
-  );
-  const roles = cleanStringList(input.roles);
-  const scopes = cleanStringList(input.scopes);
-  const principalType2 = requirePrincipalType(input.principalType);
-  const authMode = requireAuthMode(input.authMode);
-  const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
-  if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
-    throw new LucernSdkAuthContextError(
-      "membership_missing",
-      "Canonical Lucern SDK auth context requires non-empty roles and scopes."
-    );
-  }
-  const subject = cleanString(input.permit?.subject) ?? principalId;
-  const tenant = cleanString(input.permit?.tenant) ?? tenantId;
-  const workspace = cleanString(input.permit?.workspace) ?? workspaceId;
-  ensurePermitMatch({
-    field: "subject",
-    expected: principalId,
-    actual: subject
-  });
-  ensurePermitMatch({ field: "tenant", expected: tenantId, actual: tenant });
-  ensurePermitMatch({
-    field: "workspace",
-    expected: workspaceId,
-    actual: workspace
-  });
-  const context = input.permit?.context ? { ...input.permit.context } : void 0;
-  return {
-    clerkId: cleanString(input.clerkId),
-    principalId,
-    tenantId,
-    workspaceId,
-    principalType: principalType2,
-    authMode,
-    roles,
-    scopes,
-    delegationChain: input.delegationChain ? [...input.delegationChain] : [],
-    policyTraceId: cleanString(input.policyTraceId),
-    correlationId: cleanString(input.correlationId),
-    membershipId: cleanString(input.membershipId),
-    permit: {
-      subject,
-      tenant,
-      workspace,
-      resource: cleanString(input.permit?.resource),
-      action: cleanString(input.permit?.action),
-      relation: cleanString(input.permit?.relation),
-      context
+    const normalized = cleanString(value);
+    if (!normalized) {
+        throw new LucernAccessControlError(reason, `Lucern SDK access control requires ${label}.`);
     }
-  };
-}
-function createCanonicalAuthHeaders(authContext) {
-  const headers = {
-    "x-lucern-principal-id": authContext.principalId,
-    "x-lucern-principal-type": authContext.principalType,
-    "x-lucern-tenant": authContext.tenantId,
-    "x-lucern-tenant-id": authContext.tenantId,
-    "x-lucern-workspace": authContext.workspaceId,
-    "x-lucern-workspace-id": authContext.workspaceId,
-    "x-lucern-auth-mode": authContext.authMode,
-    "x-lucern-roles": authContext.roles.join(","),
-    "x-lucern-scopes": authContext.scopes.join(","),
-    "x-lucern-permit-context": JSON.stringify(authContext.permit)
-  };
-  if (authContext.clerkId) {
-    headers["x-lucern-clerk-id"] = authContext.clerkId;
-    headers["x-lucern-user-id"] = authContext.clerkId;
-  }
-  if (authContext.delegationChain.length > 0) {
-    headers["x-lucern-delegation-chain"] = JSON.stringify(
-      authContext.delegationChain
-    );
-  }
-  if (authContext.policyTraceId) {
-    headers["x-lucern-policy-trace-id"] = authContext.policyTraceId;
-  }
-  if (authContext.correlationId) {
-    headers["x-correlation-id"] = authContext.correlationId;
-    headers["x-lucern-correlation-id"] = authContext.correlationId;
-  }
-  if (authContext.membershipId) {
-    headers["x-lucern-membership-id"] = authContext.membershipId;
-  }
-  return headers;
+    return normalized;
 }
-var DEFAULT_GATEWAY_TIMEOUT_MS = 15e3;
-var DEFAULT_GATEWAY_MAX_RETRIES = 2;
-var DEFAULT_ENV_TIMEOUT_MS = "LUCERN_REQUEST_TIMEOUT_MS";
-var DEFAULT_ENV_MAX_RETRIES = "LUCERN_GATEWAY_MAX_RETRIES";
-var ENV_TIMEOUT_BY_METHOD_PREFIX = "LUCERN_REQUEST_TIMEOUT_MS_";
-var GatewayTimeoutError = class extends Error {
-  retryable = true;
-  timeoutMs;
-  constructor(timeoutMs) {
-    super(`Request timed out after ${timeoutMs}ms`);
-    this.name = "AbortError";
-    this.timeoutMs = timeoutMs;
-  }
-};
-var GatewayTransportError = class extends Error {
-  retryable;
-  cause;
-  constructor(message, options) {
-    super(message);
-    this.name = "GatewayTransportError";
-    this.retryable = options?.retryable ?? true;
-    this.cause = options?.cause;
-  }
-};
-function isGatewayRetryableError(error) {
-  return error instanceof GatewayTimeoutError && error.retryable || error instanceof GatewayTransportError && error.retryable || false;
-}
-var LucernApiError = class extends Error {
-  code;
-  status;
-  invariant;
-  suggestion;
-  details;
-  requestId;
-  correlationId;
-  policyTraceId;
-  constructor(args) {
-    super(args.message);
-    this.name = "LucernApiError";
-    this.code = args.code;
-    this.status = args.status;
-    this.invariant = args.invariant;
-    this.suggestion = args.suggestion;
-    this.details = args.details;
-    this.requestId = args.requestId;
-    this.correlationId = args.correlationId;
-    this.policyTraceId = args.policyTraceId;
-  }
-};
-function toQueryString(scope) {
-  const params = new URLSearchParams();
-  if (scope.tenantId) {
-    params.set("tenantId", scope.tenantId);
-  }
-  if (scope.workspaceId) {
-    params.set("workspaceId", scope.workspaceId);
-  }
-  for (const [key, value] of Object.entries(scope)) {
-    if (key === "tenantId" || key === "workspaceId") {
-      continue;
+function normalizePrincipalType(principalType) {
+    if (principalType === "agent") {
+        return "agent";
     }
-    if (value === void 0) {
-      continue;
+    if (principalType === "service") {
+        return "service";
     }
-    params.set(key, String(value));
-  }
-  const serialized = params.toString();
-  return serialized.length > 0 ? `?${serialized}` : "";
-}
-function fillRandomBytes(length) {
-  const bytes = new Uint8Array(length);
-  if (typeof globalThis.crypto?.getRandomValues === "function") {
-    globalThis.crypto.getRandomValues(bytes);
-    return bytes;
-  }
-  for (let index = 0; index < length; index += 1) {
-    bytes[index] = Math.floor(Math.random() * 256);
-  }
-  return bytes;
-}
-function generatePortableRequestId() {
-  if (typeof globalThis.crypto?.randomUUID === "function") {
-    return globalThis.crypto.randomUUID();
-  }
-  const bytes = fillRandomBytes(16);
-  bytes[6] = bytes[6] & 15 | 64;
-  bytes[8] = bytes[8] & 63 | 128;
-  const hex = Array.from(bytes, (value) => value.toString(16).padStart(2, "0"));
-  return `${hex.slice(0, 4).join("")}-${hex.slice(4, 6).join("")}-${hex.slice(
-    6,
-    8
-  ).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
-}
-function resolveEnvironment() {
-  const processEnv = typeof globalThis === "object" && globalThis !== null && "process" in globalThis ? globalThis.process : void 0;
-  const env = processEnv !== void 0 && typeof processEnv === "object" && processEnv !== null && typeof processEnv.env === "object" ? processEnv.env : void 0;
-  return {
-    get: (name) => {
-      const value = env?.[name];
-      return typeof value === "string" && value.length > 0 ? value : void 0;
-    }
-  };
-}
-function telemetryEnvironmentRecord(environment) {
-  const names = [
-    "LUCERN_TELEMETRY_ENABLED",
-    "AXIOM_TELEMETRY_ENABLED",
-    "LUCERN_AXIOM_TOKEN",
-    "AXIOM_TOKEN",
-    "LUCERN_AXIOM_EVENTS_DATASET",
-    "LUCERN_AXIOM_DATASET",
-    "AXIOM_EVENTS_DATASET",
-    "AXIOM_DATASET",
-    "LUCERN_AXIOM_API_URL",
-    "AXIOM_URL",
-    "LUCERN_ENVIRONMENT",
-    "NODE_ENV",
-    "LUCERN_RELEASE",
-    "SENTRY_RELEASE",
-    "VERCEL_GIT_COMMIT_SHA"
-  ];
-  return Object.fromEntries(
-    names.map((name) => [name, environment.get(name)])
-  );
-}
-function resolveRequestProfile(config, environment) {
-  const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
-  const parsedMaxRetries = parseIntegerFromString(
-    config.maxRetries,
-    environment.get(DEFAULT_ENV_MAX_RETRIES)
-  );
-  const parsedTimeoutMs = parseIntegerFromString(
-    config.timeoutMs,
-    environment.get(DEFAULT_ENV_TIMEOUT_MS)
-  );
-  const methodTimeouts = {
-    ...config.timeoutMsByMethod
-  };
-  for (const method of ["GET", "POST", "PUT", "PATCH", "DELETE"]) {
-    const envKey = `${ENV_TIMEOUT_BY_METHOD_PREFIX}${method}`;
-    const raw = environment.get(envKey);
-    if (!raw || methodTimeouts[method] !== void 0) {
-      continue;
+    if (principalType === "group") {
+        return "group";
     }
-    const parsed = parseIntegerFromString(void 0, raw);
-    if (typeof parsed === "number") {
-      methodTimeouts[method] = parsed;
-    }
-  }
-  return {
-    maxRetries: parsedMaxRetries ?? DEFAULT_GATEWAY_MAX_RETRIES,
-    timeoutMs: parsedTimeoutMs ?? DEFAULT_GATEWAY_TIMEOUT_MS,
-    timeoutMsByMethod: methodTimeouts,
-    requestIdFactory
-  };
-}
-function createGatewayRuntime(config, environment) {
-  return {
-    fetch: config.fetchImpl ?? fetch,
-    now: () => Date.now(),
-    sleep: (ms) => delay(ms),
-    env: environment,
-    redaction: resolveRequestRedactionValue,
-    profile: resolveRequestProfile(config, environment)
-  };
-}
-function parseIntegerFromString(value, rawValue) {
-  if (typeof value === "number" && Number.isInteger(value) && value >= 0) {
-    return value;
-  }
-  if (typeof rawValue !== "string" || !rawValue.trim()) {
-    return void 0;
-  }
-  const parsed = Number.parseInt(rawValue, 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : void 0;
-}
-function resolveRequestRedactionValue(value) {
-  return redactDiagnosticValue(value);
-}
-function resolveGatewayBaseUrl(configBaseUrl, environment) {
-  const envBaseUrl = environment.get("LUCERN_API_URL") ?? environment.get("LUCERN_BASE_URL") ?? environment.get("LUCERN_GATEWAY_BASE_URL");
-  return (configBaseUrl ?? envBaseUrl ?? "").replace(/\/+$/, "");
-}
-function normalizeGatewayEnvironment(value) {
-  return value === "sandbox" || value === "production" ? value : void 0;
-}
-var randomIdempotencyKey = generatePortableRequestId;
-function fallbackErrorCode(status) {
-  if (status === 401) {
-    return "AUTHENTICATION_REQUIRED";
-  }
-  if (status === 403) {
-    return "FORBIDDEN";
-  }
-  if (status === 404) {
-    return "NOT_FOUND";
-  }
-  if (status === 408) {
-    return "UPSTREAM_ERROR";
-  }
-  if (status === 409) {
-    return "CONFLICT";
-  }
-  if (status === 429) {
-    return "RATE_LIMIT_EXCEEDED";
-  }
-  if (status >= 500) {
-    return "UPSTREAM_ERROR";
-  }
-  return "INTERNAL_ERROR";
-}
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function computeRetryDelayMs(args) {
-  const baseDelay = args.status === 429 ? Math.max(
-    args.retryAfterMs ?? 0,
-    Math.min(1e3 * 2 ** args.attempt, 1e4)
-  ) : Math.min(1e3 * 2 ** args.attempt, 4e3);
-  if (args.status !== 429) {
-    return baseDelay;
-  }
-  const jitterWindow = Math.max(250, Math.round(baseDelay * 0.25));
-  return baseDelay + Math.round(Math.random() * jitterWindow);
-}
-function classifyGatewayErrorForRetry(error) {
-  return isGatewayRetryableError(error) || classifyRetry({ error }).retryable;
-}
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function readPolicySummaryFromDetails(details) {
-  if (!isRecord(details)) {
-    return null;
-  }
-  const directSummary = details.summary;
-  if (typeof directSummary === "string" && directSummary.trim().length > 0) {
-    return directSummary.trim();
-  }
-  const policy = details.policy;
-  if (!isRecord(policy)) {
-    return null;
-  }
-  const explanation = policy.explanation;
-  if (!isRecord(explanation)) {
-    return null;
-  }
-  const nestedSummary = explanation.summary;
-  if (typeof nestedSummary === "string" && nestedSummary.trim().length > 0) {
-    return nestedSummary.trim();
-  }
-  return null;
-}
-function redactJsonDiagnosticValue(value) {
-  return value === void 0 ? void 0 : redactDiagnosticValue(value);
-}
-async function resolveConfiguredAuthContext(authContext) {
-  if (typeof authContext === "function") {
-    return await authContext();
-  }
-  return authContext;
-}
-function mergeHeaderRecord(base, addition) {
-  const headers = new Headers(base);
-  for (const [key, value] of Object.entries(addition)) {
-    const existing = headers.get(key);
-    if (existing !== null && existing !== value) {
-      throw new LucernSdkAuthContextError(
-        "policy_denied",
-        `Canonical Lucern SDK auth context conflicts with existing ${key} header.`
-      );
+    if (principalType === "external_viewer") {
+        return "external_viewer";
     }
-    headers.set(key, value);
-  }
-  return Object.fromEntries(headers.entries());
+    return "human";
 }
-function cleanHeaderValue(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
+function aliasKey(alias) {
+    return `${alias.provider}:${alias.providerProjectId ?? ""}:${alias.externalSubjectId}`;
 }
-function createGatewayRequestClient(config = {}) {
-  const env = resolveEnvironment();
-  const runtime = createGatewayRuntime(config, env);
-  const baseUrl = resolveGatewayBaseUrl(config.baseUrl, env);
-  const maxRetries = runtime.profile.maxRetries;
-  const requestIdFactory = runtime.profile.requestIdFactory;
-  const requestTimeoutByMethod = runtime.profile.timeoutMsByMethod;
-  const defaultRequestTimeoutMs = runtime.profile.timeoutMs;
-  const normalizedEnvironment = normalizeGatewayEnvironment(config.environment);
-  const telemetryExporter = config.telemetryEnabled === false ? null : config.telemetryExporter ?? createTelemetryExporterFromEnv(telemetryEnvironmentRecord(env), {
-    service: "lucern-sdk",
-    environment: normalizedEnvironment
-  });
-  async function resolveAuthHeaders() {
-    const provided = config.getAuthHeaders ? await config.getAuthHeaders() : {};
-    const headers = new Headers(provided);
-    const setIfAbsent = (name, value) => {
-      const normalized = cleanHeaderValue(value);
-      if (normalized && !headers.has(name)) {
-        headers.set(name, normalized);
-      }
-    };
-    setIfAbsent("x-lucern-key", config.apiKey);
-    setIfAbsent("x-lucern-session-token", config.userToken);
-    setIfAbsent("x-lucern-environment", normalizedEnvironment);
-    setIfAbsent("x-lucern-clerk-id", config.clerkId);
-    setIfAbsent("x-lucern-user-id", config.userId ?? config.clerkId);
-    setIfAbsent("x-lucern-deployment-host", config.deploymentHost);
-    const base = Object.fromEntries(headers.entries());
-    const authContextInput = await resolveConfiguredAuthContext(
-      config.authContext
-    );
-    if (!authContextInput && !config.requireCanonicalAuthContext) {
-      return base;
-    }
-    const authContext = normalizeCanonicalLucernAuthContext(authContextInput);
-    return mergeHeaderRecord(base, createCanonicalAuthHeaders(authContext));
-  }
-  async function fetchWithTimeout(url, init, timeoutMs) {
-    const normalizeTransportError = (error, isTimeout) => {
-      if (isTimeout) {
-        return new GatewayTimeoutError(timeoutMs);
-      }
-      return error instanceof GatewayTimeoutError || error instanceof GatewayTransportError ? error : new GatewayTransportError(
-        error instanceof Error ? error.message : "Gateway transport error",
-        {
-          cause: error,
-          retryable: classifyGatewayErrorForRetry(error)
-        }
-      );
-    };
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    const requestEffect = Effect.tryPromise({
-      try: () => runtime.fetch(url, { ...init, signal: controller.signal }),
-      catch: (error) => normalizeTransportError(error, controller.signal.aborted)
-    });
-    try {
-      const exit = await Effect.runPromiseExit(requestEffect);
-      if (Exit.isSuccess(exit)) {
-        return exit.value;
-      }
-      const failure = Array.from(Cause.failures(exit.cause))[0];
-      if (failure !== void 0) {
-        throw failure;
-      }
-      throw Cause.squash(exit.cause);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  async function emitSdkResponseTelemetry(context) {
-    const retry = classifyRetry({
-      status: context.status,
-      error: context.error,
-      retryAfter: context.retryAfterMs !== null && context.retryAfterMs !== void 0 ? String(context.retryAfterMs / 1e3) : void 0
-    });
-    await emitTelemetrySignal(telemetryExporter, {
-      signalType: "trace",
-      surface: "sdk-retry",
-      eventName: context.willRetry ? "sdk.retry" : context.error ? "sdk.request.error" : "sdk.request.complete",
-      severity: context.error ? context.willRetry ? "warn" : "error" : "info",
-      durationMs: context.durationMs,
-      metricName: "sdk.request.duration_ms",
-      metricValue: context.durationMs,
-      correlationId: context.correlationId ?? context.requestId,
-      policyTraceId: context.policyTraceId ?? null,
-      tenantId: context.headers.get("x-lucern-tenant-id") ?? context.headers.get("x-lucern-tenant") ?? void 0,
-      workspaceId: context.headers.get("x-lucern-workspace-id") ?? context.headers.get("x-lucern-workspace") ?? void 0,
-      attributes: {
-        service: "lucern-sdk",
-        operation: "gateway.request",
-        path: context.path,
-        httpMethod: context.method,
-        httpStatus: context.status,
-        attempt: context.attempt,
-        maxRetries: context.maxRetries,
-        retryReason: retry.reason,
-        retryAfterMs: context.retryAfterMs ?? retry.retryAfterMs,
-        willRetry: context.willRetry,
-        retryable: retry.retryable,
-        errorName: context.error instanceof Error ? context.error.name : void 0,
-        errorMessage: context.error instanceof Error ? context.error.message : void 0
-      }
-    });
-  }
-  async function parsePayload(response) {
-    const text = await response.text();
-    if (!text) {
-      return null;
-    }
-    const parsed = tryParseGatewayEnvelopeJson(text);
-    if (!parsed.ok) {
-      return null;
-    }
-    return isRecord(parsed.value) ? parsed.value : null;
-  }
-  function resolveTimeoutMs(method, requestTimeoutMs) {
-    if (typeof requestTimeoutMs === "number") {
-      return requestTimeoutMs;
-    }
-    const methodTimeoutMs = requestTimeoutByMethod?.[method];
-    if (typeof methodTimeoutMs === "number") {
-      return methodTimeoutMs;
-    }
-    return defaultRequestTimeoutMs;
-  }
-  function tryParseGatewayEnvelopeJson(text) {
-    const trimmed = text.trim();
-    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
-      return { ok: false, reason: "non-json" };
-    }
-    try {
-      return { ok: true, value: JSON.parse(trimmed) };
-    } catch (error) {
-      if (error instanceof SyntaxError) {
-        return { ok: false, reason: "invalid-json", error };
-      }
-      throw error;
-    }
-  }
-  function buildApiError(args) {
-    const failure = args.failure;
-    const legacyError = failure && isRecord(failure.error) ? failure.error : failure?.legacyError;
-    const correlationId = failure?.correlationId ?? args.response.headers.get("x-lucern-correlation-id")?.trim() ?? args.requestId;
-    const policyTraceId = failure?.policyTraceId ?? args.response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null;
-    const details = runtime.redaction(
-      redactJsonDiagnosticValue(failure?.details ?? legacyError?.details)
-    );
-    const policySummary = readPolicySummaryFromDetails(details);
-    const failureMessage = typeof failure?.error === "string" ? failure.error : legacyError?.message;
-    return new LucernApiError({
-      code: failure?.code ?? legacyError?.code ?? fallbackErrorCode(args.response.status),
-      message: policySummary ?? failureMessage ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed."),
-      status: args.response.status,
-      invariant: failure?.invariant,
-      suggestion: failure?.suggestion,
-      details,
-      requestId: args.requestId,
-      correlationId,
-      policyTraceId
-    });
-  }
-  async function request(args) {
-    const authHeaders = await resolveAuthHeaders();
-    const method = args.method ?? "GET";
-    const timeoutMs = resolveTimeoutMs(method, args.timeoutMs);
-    const headers = new Headers({
-      "content-type": "application/json",
-      ...authHeaders
-    });
-    if (args.idempotencyKey) {
-      headers.set("idempotency-key", args.idempotencyKey);
-    }
-    const requestId = headers.get("x-correlation-id")?.trim() || headers.get("x-request-id")?.trim() || args.requestId || requestIdFactory();
-    if (!headers.has("x-correlation-id") && !headers.has("x-request-id")) {
-      headers.set("x-correlation-id", requestId);
-    }
-    const url = `${baseUrl}${args.path}`;
-    const serializedBody = args.body ? JSON.stringify(args.body) : void 0;
-    const init = {
-      method,
-      headers,
-      body: serializedBody
-    };
-    let lastError;
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-      const hookRequestContext = {
-        requestId,
-        attempt,
-        maxRetries,
-        method,
-        path: args.path,
-        url,
-        headers: new Headers(headers),
-        body: serializedBody,
-        timeoutMs
-      };
-      await config.onRequest?.(hookRequestContext);
-      const startedAt = Date.now();
-      try {
-        const response = await fetchWithTimeout(url, init, timeoutMs);
-        const responseClone = response.clone();
-        const payload = await parsePayload(response);
-        const retry = classifyRetry({
-          status: response.status,
-          retryAfter: response.headers.get("Retry-After")
-        });
-        const retryAfterMs = retry.retryAfterMs ?? null;
-        if (!response.ok || !payload?.success) {
-          const failure = payload && !payload.success ? payload : null;
-          const apiError = buildApiError({
-            requestId,
-            response,
-            failure
-          });
-          const willRetry = attempt < maxRetries && retry.retryable;
-          const responseContext2 = {
-            ...hookRequestContext,
-            durationMs: Date.now() - startedAt,
-            status: response.status,
-            response: responseClone,
-            error: apiError,
-            correlationId: apiError.correlationId ?? requestId,
-            policyTraceId: apiError.policyTraceId ?? null,
-            retryAfterMs,
-            willRetry
-          };
-          await config.onResponse?.(responseContext2);
-          await emitSdkResponseTelemetry(responseContext2);
-          if (willRetry) {
-            lastError = apiError;
-            await delay(
-              computeRetryDelayMs({
-                attempt,
-                status: response.status,
-                retryAfterMs
-              })
-            );
+function normalizeAliases(input, canonicalClerkUserId) {
+    const aliases = new Map();
+    for (const alias of input ?? []) {
+        const externalSubjectId = cleanString(alias.externalSubjectId);
+        if (!externalSubjectId) {
             continue;
-          }
-          throw apiError;
-        }
-        const successPayload = payload;
-        const responseContext = {
-          ...hookRequestContext,
-          durationMs: Date.now() - startedAt,
-          status: response.status,
-          response: responseClone,
-          correlationId: successPayload.correlationId ?? response.headers.get("x-lucern-correlation-id")?.trim() ?? requestId,
-          policyTraceId: successPayload.policyTraceId ?? response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null,
-          idempotentReplay: successPayload.idempotentReplay,
-          retryAfterMs,
-          willRetry: false
-        };
-        await config.onResponse?.(responseContext);
-        await emitSdkResponseTelemetry(responseContext);
-        return successPayload;
-      } catch (fetchError) {
-        if (fetchError instanceof LucernApiError) {
-          throw fetchError;
         }
-        const willRetry = attempt < maxRetries && classifyGatewayErrorForRetry(fetchError);
-        const responseContext = {
-          ...hookRequestContext,
-          durationMs: Date.now() - startedAt,
-          error: fetchError,
-          correlationId: requestId,
-          policyTraceId: null,
-          willRetry
+        const normalized = {
+            provider: cleanString(alias.provider) ?? "clerk",
+            providerProjectId: cleanString(alias.providerProjectId),
+            externalSubjectId,
+            status: cleanString(alias.status),
         };
-        await config.onResponse?.(responseContext);
-        await emitSdkResponseTelemetry(responseContext);
-        lastError = fetchError;
-        if (willRetry) {
-          await delay(computeRetryDelayMs({ attempt }));
-        }
-      }
+        aliases.set(aliasKey(normalized), normalized);
     }
-    throw lastError instanceof Error ? lastError : new Error("Platform API request failed after retries.");
-  }
-  return {
-    request
-  };
-}
-
-// src/sdkSurface.ts
-function createListResult(items, legacyKey) {
-  const result = {
-    items,
-    total: items.length
-  };
-  if (legacyKey) {
-    return {
-      ...result,
-      [legacyKey]: items
-    };
-  }
-  return result;
-}
-function mapGatewayData(response, mapper) {
-  return {
-    ...response,
-    data: mapper(response.data)
-  };
-}
-
-// src/boundaryClientSurface.ts
-function cleanOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function isRecord2(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function cleanRequiredString(value, label) {
-  const normalized = cleanOptionalString(value);
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
-  return normalized;
-}
-function assertKnownKeys(input, allowed, operation) {
-  const allowedSet = new Set(allowed);
-  const unknownKeys = Object.keys(input).filter((key) => !allowedSet.has(key));
-  if (unknownKeys.length > 0) {
-    throw new Error(
-      `${operation} received unsupported field(s): ${unknownKeys.join(", ")}`
-    );
-  }
-}
-function knownPayload(input, allowed, operation) {
-  assertKnownKeys(input, allowed, operation);
-  return { ...input };
-}
-function listResultFromEnvelope(data, legacyKey) {
-  const record = isRecord2(data) ? data : {};
-  const legacyItems = record[legacyKey];
-  return createListResult(
-    Array.isArray(legacyItems) ? legacyItems : Array.isArray(data) ? data : [],
-    legacyKey
-  );
-}
-
-// src/control-plane.ts
-var LucernControlPlaneIdentityError = class extends Error {
-  reason;
-  principalStatus;
-  tenantStatus;
-  workspaceStatus;
-  details;
-  constructor(failure) {
-    super(failure.message);
-    this.name = "LucernControlPlaneIdentityError";
-    this.reason = failure.reason;
-    this.principalStatus = failure.principalStatus;
-    this.tenantStatus = failure.tenantStatus;
-    this.workspaceStatus = failure.workspaceStatus;
-    this.details = failure.details;
-  }
-};
-function cleanString2(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
-function stringList(value) {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-  return [
-    ...new Set(
-      value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean)
-    )
-  ];
-}
-function principalType(value) {
-  switch (value) {
-    case "service":
-    case "service_principal":
-      return "service";
-    case "agent":
-      return "agent";
-    case "group":
-      return "group";
-    case "external_viewer":
-    case "external_stakeholder":
-      return "external_viewer";
-    default:
-      return "human";
-  }
-}
-function adminFlags(roles) {
-  const normalized = roles.map((role) => role.toLowerCase());
-  const isPlatformAdmin = normalized.includes("platform_admin");
-  const isTenantAdmin = isPlatformAdmin || normalized.includes("tenant_admin");
-  const isWorkspaceAdmin = isTenantAdmin || normalized.includes("workspace_admin") || normalized.includes("workspace_owner");
-  return { isPlatformAdmin, isTenantAdmin, isWorkspaceAdmin };
-}
-function normalizeResolvedInteractivePrincipal(payload) {
-  if ("ok" in payload && payload.ok === false) {
-    throw new LucernControlPlaneIdentityError(payload);
-  }
-  const principalId = cleanString2(payload.principalId);
-  const clerkId = cleanString2(payload.clerkId);
-  const tenantId = cleanString2(payload.tenantId);
-  if (!principalId || !clerkId || !tenantId) {
-    throw new LucernControlPlaneIdentityError({
-      ok: false,
-      reason: "resolver_unavailable",
-      message: "Control-plane principal resolver returned an incomplete principal context.",
-      principalStatus: payload.principalStatus ?? "missing",
-      tenantStatus: payload.tenantStatus,
-      workspaceStatus: payload.workspaceStatus
-    });
-  }
-  const roles = stringList(payload.roles);
-  const scopes = stringList(payload.scopes);
-  const workspaceId = cleanString2(payload.workspaceId) ?? null;
-  const flags = adminFlags(roles);
-  return {
-    principalId,
-    principalType: principalType(payload.principalType),
-    clerkId,
-    tenantId,
-    workspaceId,
-    roles,
-    scopes,
-    groupIds: stringList(payload.groupIds),
-    permittedToolNames: stringList(payload.permittedToolNames),
-    permittedPackKeys: stringList(payload.permittedPackKeys),
-    principalStatus: cleanString2(payload.principalStatus) ?? "active",
-    tenantStatus: cleanString2(payload.tenantStatus) ?? "active",
-    workspaceStatus: cleanString2(payload.workspaceStatus) ?? (workspaceId ? "active" : "none"),
-    isPlatformAdmin: typeof payload.isPlatformAdmin === "boolean" ? payload.isPlatformAdmin : flags.isPlatformAdmin,
-    isTenantAdmin: typeof payload.isTenantAdmin === "boolean" ? payload.isTenantAdmin : flags.isTenantAdmin,
-    isWorkspaceAdmin: typeof payload.isWorkspaceAdmin === "boolean" ? payload.isWorkspaceAdmin : flags.isWorkspaceAdmin,
-    permit: {
-      subject: cleanString2(payload.permit?.subject) ?? principalId,
-      tenant: cleanString2(payload.permit?.tenant) ?? tenantId,
-      ...workspaceId ? { workspace: cleanString2(payload.permit?.workspace) ?? workspaceId } : {}
-    },
-    authMode: "interactive_user",
-    sessionId: payload.sessionId,
-    delegatedBy: payload.delegatedBy,
-    expiresAt: payload.expiresAt
-  };
-}
-
-// src/identityClient.ts
-function createIdentityWhoamiClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  return {
-    async whoami() {
-      return gateway.request({
-        path: "/api/platform/v1/identity/whoami"
-      });
-    }
-  };
-}
-var TENANT_IDENTITY_FIELDS = [
-  "tenantId",
-  "workspaceId",
-  "principalId",
-  "integrationKey",
-  "secretRef",
-  "policySubject",
-  "policyAction",
-  "policyResource",
-  "decision",
-  "config",
-  "configKey",
-  "configValue",
-  "provider",
-  "status",
-  "metadata",
-  "limit",
-  "cursor"
-];
-function tenantIdentityQuery(input) {
-  return {
-    tenantId: cleanRequiredString(input.tenantId, "tenantId"),
-    workspaceId: input.workspaceId,
-    principalId: input.principalId,
-    limit: input.limit,
-    cursor: input.cursor
-  };
-}
-function tenantIdentityBody(input, operation) {
-  return knownPayload(input, TENANT_IDENTITY_FIELDS, operation);
-}
-function createIdentityClient(config = {}) {
-  const gateway = createGatewayRequestClient(config);
-  const whoamiClient = createIdentityWhoamiClient(config);
-  const requestPrincipalWrite = (method, input, idempotencyKey) => gateway.request({
-    path: "/api/platform/v1/identity/principals",
-    method,
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  const updatePrincipal = (input, idempotencyKey) => requestPrincipalWrite("PATCH", input, idempotencyKey);
-  const deleteKey = (keyId, input = {}, idempotencyKey) => gateway.request({
-    path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/revoke`,
-    method: "POST",
-    body: input,
-    idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-  });
-  return {
-    /**
-     * Resolve the current authenticated identity summary.
-     */
-    async whoami() {
-      return whoamiClient.whoami().then(
-        (response) => mapGatewayData(response, (data) => ({
-          principalId: data.principalId,
-          principalType: data.principalType,
-          clerkId: data.clerkId,
-          tenantId: data.tenantId ?? null,
-          workspaceId: data.workspaceId ?? null,
-          scopes: Array.isArray(data.scopes) ? data.scopes : [],
-          roles: Array.isArray(data.roles) ? data.roles : [],
-          groupIds: Array.isArray(data.groupIds) ? data.groupIds : [],
-          permittedToolNames: Array.isArray(data.permittedToolNames) ? data.permittedToolNames : [],
-          permittedPackKeys: Array.isArray(data.permittedPackKeys) ? data.permittedPackKeys : [],
-          principalStatus: data.principalStatus,
-          tenantStatus: data.tenantStatus,
-          workspaceStatus: data.workspaceStatus,
-          isPlatformAdmin: data.isPlatformAdmin === true,
-          isTenantAdmin: data.isTenantAdmin === true,
-          isWorkspaceAdmin: data.isWorkspaceAdmin === true,
-          permit: data.permit ?? (data.tenantId ? {
-            subject: data.principalId,
-            tenant: data.tenantId,
-            ...data.workspaceId ? { workspace: data.workspaceId } : {}
-          } : void 0),
-          authMode: data.authMode,
-          sessionId: data.sessionId,
-          delegatedBy: data.delegatedBy,
-          expiresAt: data.expiresAt
-        }))
-      );
-    },
-    /**
-     * Resolve a Clerk subject through the tenant control-plane Permit projection.
-     * @deprecated Prefer lucern.controlPlane.identity.resolveInteractivePrincipal().
-     */
-    async resolveInteractivePrincipal(input) {
-      return gateway.request({
-        path: "/api/platform/v1/control-plane/identity/resolve-interactive-principal",
-        method: "POST",
-        body: input
-      }).then(
-        (response) => mapGatewayData(response, normalizeResolvedInteractivePrincipal)
-      );
-    },
-    /**
-     * List principals in the current identity scope.
-     */
-    async listPrincipals(query = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/principals${toQueryString(query)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(
-            Array.isArray(data) ? data : [],
-            "principals"
-          )
-        )
-      );
-    },
-    /**
-     * Create a principal.
-     */
-    async createPrincipal(input, idempotencyKey) {
-      return requestPrincipalWrite("POST", input, idempotencyKey);
-    },
-    /**
-     * Update a principal.
-     */
-    updatePrincipal,
-    /**
-     * @deprecated Use createPrincipal or updatePrincipal.
-     */
-    upsertPrincipal: updatePrincipal,
-    /**
-     * List keys in the current identity scope.
-     */
-    async listKeys(query = {}) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/keys${toQueryString(query)}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => createListResult(Array.isArray(data) ? data : [], "keys")
-        )
-      );
-    },
-    /**
-     * Create an API key.
-     */
-    async createKey(input, idempotencyKey) {
-      return gateway.request({
-        path: "/api/platform/v1/identity/keys",
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Rotate an API key.
-     */
-    async rotateKey(keyId, input = {}, idempotencyKey) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/keys/${encodeURIComponent(keyId)}/rotate`,
-        method: "POST",
-        body: input,
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    /**
-     * Delete an API key by revoking it.
-     */
-    deleteKey,
-    /**
-     * @deprecated Use deleteKey.
-     */
-    revokeKey: deleteKey,
-    /**
-     * Search Clerk users by email or display attributes.
-     */
-    async searchClerkUsers(q) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/clerk-users${toQueryString({ q })}`
-      });
-    },
-    async getTenantConfig(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/tenant-config${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      });
-    },
-    async updateTenantConfig(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      return gateway.request({
-        path: "/api/platform/v1/identity/tenant-config",
-        method: "PATCH",
-        body: tenantIdentityBody(
-          input,
-          "identity.updateTenantConfig"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async listIntegrations(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/integrations${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "integrations"
-          )
-        )
-      );
-    },
-    async upsertIntegration(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.integrationKey, "integrationKey");
-      return gateway.request({
-        path: "/api/platform/v1/identity/integrations",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.upsertIntegration"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async listSecrets(input) {
-      return gateway.request({
-        path: `/api/platform/v1/identity/secrets${toQueryString(
-          tenantIdentityQuery(input)
-        )}`
-      }).then(
-        (response) => mapGatewayData(
-          response,
-          (data) => listResultFromEnvelope(
-            data,
-            "secrets"
-          )
-        )
-      );
-    },
-    async putSecretReference(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.secretRef, "secretRef");
-      return gateway.request({
-        path: "/api/platform/v1/identity/secrets",
-        method: "PUT",
-        body: tenantIdentityBody(
-          input,
-          "identity.putSecretReference"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async evaluatePolicy(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.policySubject, "policySubject");
-      cleanRequiredString(input.policyAction, "policyAction");
-      cleanRequiredString(input.policyResource, "policyResource");
-      return gateway.request({
-        path: "/api/platform/v1/identity/policy/evaluate",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.evaluatePolicy"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
-    },
-    async recordPolicyDecision(input, idempotencyKey) {
-      cleanRequiredString(input.tenantId, "tenantId");
-      cleanRequiredString(input.decision, "decision");
-      return gateway.request({
-        path: "/api/platform/v1/identity/policy/decisions",
-        method: "POST",
-        body: tenantIdentityBody(
-          input,
-          "identity.recordPolicyDecision"
-        ),
-        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
-      });
+    if (canonicalClerkUserId) {
+        const canonicalAlias = {
+            provider: "clerk",
+            externalSubjectId: canonicalClerkUserId,
+            status: "active",
+        };
+        aliases.set(aliasKey(canonicalAlias), canonicalAlias);
     }
-  };
-}
-
-// src/accessControl.ts
-var LucernAccessControlError = class extends LucernSdkAuthContextError {
-  policyDecision;
-  constructor(reason, message, policyDecision) {
-    super(reason, message);
-    this.name = "LucernAccessControlError";
-    this.policyDecision = policyDecision;
-  }
-};
-function cleanString3(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : void 0;
-}
-function cleanStringList2(values) {
-  if (!values) {
-    return [];
-  }
-  return [
-    ...new Set(
-      values.map((value) => value.trim()).filter((value) => value.length > 0)
-    )
-  ];
-}
-function requireString2(value, reason, label) {
-  const normalized = cleanString3(value);
-  if (!normalized) {
-    throw new LucernAccessControlError(
-      reason,
-      `Lucern SDK access control requires ${label}.`
-    );
-  }
-  return normalized;
-}
-function normalizePrincipalType(principalType2) {
-  if (principalType2 === "agent") {
-    return "agent";
-  }
-  if (principalType2 === "service") {
-    return "service";
-  }
-  if (principalType2 === "group") {
-    return "group";
-  }
-  if (principalType2 === "external_viewer") {
-    return "external_viewer";
-  }
-  return "human";
-}
-function aliasKey(alias) {
-  return `${alias.provider}:${alias.providerProjectId ?? ""}:${alias.externalSubjectId}`;
-}
-function normalizeAliases(input, canonicalClerkUserId) {
-  const aliases = /* @__PURE__ */ new Map();
-  for (const alias of input ?? []) {
-    const externalSubjectId = cleanString3(alias.externalSubjectId);
-    if (!externalSubjectId) {
-      continue;
-    }
-    const normalized = {
-      provider: cleanString3(alias.provider) ?? "clerk",
-      providerProjectId: cleanString3(alias.providerProjectId),
-      externalSubjectId,
-      status: cleanString3(alias.status)
-    };
-    aliases.set(aliasKey(normalized), normalized);
-  }
-  if (canonicalClerkUserId) {
-    const canonicalAlias = {
-      provider: "clerk",
-      externalSubjectId: canonicalClerkUserId,
-      status: "active"
-    };
-    aliases.set(aliasKey(canonicalAlias), canonicalAlias);
-  }
-  return [...aliases.values()];
+    return [...aliases.values()];
 }
 function isKnownClerkSubject(args) {
-  if (args.clerkId === args.canonicalClerkUserId) {
-    return true;
-  }
-  return args.aliases.some(
-    (alias) => alias.provider === "clerk" && alias.externalSubjectId === args.clerkId
-  );
+    if (args.clerkId === args.canonicalClerkUserId) {
+        return true;
+    }
+    return args.aliases.some((alias) => alias.provider === "clerk" && alias.externalSubjectId === args.clerkId);
 }
 function authContextToPrincipalInput(input) {
-  const normalized = normalizeCanonicalLucernAuthContext(input);
-  return {
-    principalId: normalized.principalId,
-    principalType: normalized.principalType,
-    canonicalClerkUserId: normalized.clerkId,
-    clerkId: normalized.clerkId,
-    tenantId: normalized.tenantId,
-    workspaceId: normalized.workspaceId,
-    roles: normalized.roles,
-    scopes: normalized.scopes
-  };
+    const normalized = normalizeCanonicalLucernAuthContext(input);
+    return {
+        principalId: normalized.principalId,
+        principalType: normalized.principalType,
+        canonicalClerkUserId: normalized.clerkId,
+        clerkId: normalized.clerkId,
+        tenantId: normalized.tenantId,
+        workspaceId: normalized.workspaceId,
+        roles: normalized.roles,
+        scopes: normalized.scopes,
+    };
 }
 function isAuthContextInput(input) {
-  return "authMode" in input || "permit" in input || "delegationChain" in input;
-}
-function normalizeCanonicalPrincipalIdentity(input, options = {}) {
-  const principalInput = isAuthContextInput(input) ? authContextToPrincipalInput(input) : input;
-  const principalId = requireString2(
-    principalInput.principalId,
-    "principal_missing",
-    "principalId"
-  );
-  const principalType2 = normalizePrincipalType(principalInput.principalType);
-  const observedClerkId = cleanString3(options.observedClerkId);
-  const canonicalClerkUserId = cleanString3(principalInput.canonicalClerkUserId) ?? cleanString3(principalInput.clerkId);
-  if (principalType2 === "human" && !canonicalClerkUserId) {
-    throw new LucernAccessControlError(
-      "clerk_alias_missing",
-      "Human principals require one canonical Clerk user id."
-    );
-  }
-  const aliases = normalizeAliases(
-    principalInput.clerkIdentityAliases,
-    canonicalClerkUserId
-  );
-  if (observedClerkId && !isKnownClerkSubject({
-    clerkId: observedClerkId,
-    canonicalClerkUserId,
-    aliases
-  })) {
-    throw new LucernAccessControlError(
-      "clerk_alias_unrecognized",
-      "Observed Clerk user id does not match the canonical human principal id."
-    );
-  }
-  return {
-    principalId,
-    principalType: principalType2,
-    canonicalClerkUserId,
-    clerkIdentityAliases: aliases,
-    tenantId: cleanString3(principalInput.tenantId),
-    workspaceId: cleanString3(principalInput.workspaceId),
-    roles: cleanStringList2(principalInput.roles),
-    scopes: cleanStringList2(principalInput.scopes)
-  };
+    return "authMode" in input || "permit" in input || "delegationChain" in input;
+}
+export function normalizeCanonicalPrincipalIdentity(input, options = {}) {
+    const principalInput = isAuthContextInput(input)
+        ? authContextToPrincipalInput(input)
+        : input;
+    const principalId = requireString(principalInput.principalId, "principal_missing", "principalId");
+    const principalType = normalizePrincipalType(principalInput.principalType);
+    const observedClerkId = cleanString(options.observedClerkId);
+    const canonicalClerkUserId = cleanString(principalInput.canonicalClerkUserId) ??
+        cleanString(principalInput.clerkId);
+    if (principalType === "human" && !canonicalClerkUserId) {
+        throw new LucernAccessControlError("clerk_alias_missing", "Human principals require one canonical Clerk user id.");
+    }
+    const aliases = normalizeAliases(principalInput.clerkIdentityAliases, canonicalClerkUserId);
+    if (observedClerkId &&
+        !isKnownClerkSubject({
+            clerkId: observedClerkId,
+            canonicalClerkUserId,
+            aliases,
+        })) {
+        throw new LucernAccessControlError("clerk_alias_unrecognized", "Observed Clerk user id does not match the canonical human principal id.");
+    }
+    return {
+        principalId,
+        principalType,
+        canonicalClerkUserId,
+        clerkIdentityAliases: aliases,
+        tenantId: cleanString(principalInput.tenantId),
+        workspaceId: cleanString(principalInput.workspaceId),
+        roles: cleanStringList(principalInput.roles),
+        scopes: cleanStringList(principalInput.scopes),
+    };
 }
-function formatPermitResource(resource) {
-  if (typeof resource === "string") {
-    return requireString2(resource, "policy_denied", "policyResource");
-  }
-  const type = requireString2(resource.type, "policy_denied", "resource.type");
-  const key = requireString2(resource.key, "policy_denied", "resource.key");
-  return key.startsWith(`${type}:`) ? key : `${type}:${key}`;
+export function formatPermitResource(resource) {
+    if (typeof resource === "string") {
+        return requireString(resource, "policy_denied", "policyResource");
+    }
+    const type = requireString(resource.type, "policy_denied", "resource.type");
+    const key = requireString(resource.key, "policy_denied", "resource.key");
+    return key.startsWith(`${type}:`) ? key : `${type}:${key}`;
 }
 function resourceRequiresWorkspace(resource) {
-  if (typeof resource === "string") {
-    return !resource.startsWith("tenant:");
-  }
-  return resource.type !== "tenant";
+    if (typeof resource === "string") {
+        return !resource.startsWith("tenant:");
+    }
+    return resource.type !== "tenant";
 }
 function rejectConflictingScopeOverride(args) {
-  if (args.identityValue && args.requestedValue && args.identityValue !== args.requestedValue) {
-    throw new LucernAccessControlError(
-      "policy_denied",
-      `Lucern SDK access control rejects conflicting ${args.field} scope.`
-    );
-  }
+    if (args.identityValue &&
+        args.requestedValue &&
+        args.identityValue !== args.requestedValue) {
+        throw new LucernAccessControlError("policy_denied", `Lucern SDK access control rejects conflicting ${args.field} scope.`);
+    }
 }
 function buildPolicyInput(identity, input) {
-  rejectConflictingScopeOverride({
-    field: "tenantId",
-    identityValue: identity.tenantId,
-    requestedValue: cleanString3(input.tenantId)
-  });
-  rejectConflictingScopeOverride({
-    field: "workspaceId",
-    identityValue: identity.workspaceId,
-    requestedValue: cleanString3(input.workspaceId)
-  });
-  const tenantId = requireString2(
-    input.tenantId ?? identity.tenantId,
-    "tenant_missing",
-    "tenantId"
-  );
-  const workspaceId = cleanString3(input.workspaceId ?? identity.workspaceId);
-  if (resourceRequiresWorkspace(input.resource) && !workspaceId) {
-    throw new LucernAccessControlError(
-      "workspace_missing",
-      "Workspace-scoped Permit checks require workspaceId."
-    );
-  }
-  return {
-    tenantId,
-    workspaceId,
-    principalId: identity.principalId,
-    policySubject: identity.principalId,
-    policyAction: requireString2(input.action, "policy_denied", "policyAction"),
-    policyResource: formatPermitResource(input.resource),
-    metadata: input.context
-  };
+    rejectConflictingScopeOverride({
+        field: "tenantId",
+        identityValue: identity.tenantId,
+        requestedValue: cleanString(input.tenantId),
+    });
+    rejectConflictingScopeOverride({
+        field: "workspaceId",
+        identityValue: identity.workspaceId,
+        requestedValue: cleanString(input.workspaceId),
+    });
+    const tenantId = requireString(input.tenantId ?? identity.tenantId, "tenant_missing", "tenantId");
+    const workspaceId = cleanString(input.workspaceId ?? identity.workspaceId);
+    if (resourceRequiresWorkspace(input.resource) && !workspaceId) {
+        throw new LucernAccessControlError("workspace_missing", "Workspace-scoped Permit checks require workspaceId.");
+    }
+    return {
+        tenantId,
+        workspaceId,
+        principalId: identity.principalId,
+        policySubject: identity.principalId,
+        policyAction: requireString(input.action, "policy_denied", "policyAction"),
+        policyResource: formatPermitResource(input.resource),
+        metadata: input.context,
+    };
 }
 async function resolveConfiguredPrincipalInput(authContext) {
-  if (typeof authContext === "function") {
-    return await authContext();
-  }
-  return authContext;
+    if (typeof authContext === "function") {
+        return await authContext();
+    }
+    return authContext;
 }
-function assertPermitAllowed(decision) {
-  if (decision.decision !== "allow") {
-    throw new LucernAccessControlError(
-      decision.decision === "deny" ? "policy_denied" : "policy_unknown",
-      `Permit denied ${decision.policyAction} on ${decision.policyResource}.`,
-      decision
-    );
-  }
+export function assertPermitAllowed(decision) {
+    if (decision.decision !== "allow") {
+        throw new LucernAccessControlError(decision.decision === "deny" ? "policy_denied" : "policy_unknown", `Permit denied ${decision.policyAction} on ${decision.policyResource}.`, decision);
+    }
 }
-function createAccessControlClient(config = {}) {
-  const identityClient = createIdentityClient(config);
-  async function resolveIdentity(input, observedClerkId) {
-    const identityInput = input ?? await resolveConfiguredPrincipalInput(config.authContext);
-    if (!identityInput) {
-      throw new LucernAccessControlError(
-        "principal_missing",
-        "Lucern SDK access control requires a canonical principal identity."
-      );
+export function createAccessControlClient(config = {}) {
+    const identityClient = createIdentityClient(config);
+    async function resolveIdentity(input, observedClerkId) {
+        const identityInput = input ?? (await resolveConfiguredPrincipalInput(config.authContext));
+        if (!identityInput) {
+            throw new LucernAccessControlError("principal_missing", "Lucern SDK access control requires a canonical principal identity.");
+        }
+        return normalizeCanonicalPrincipalIdentity(identityInput, {
+            observedClerkId,
+        });
     }
-    return normalizeCanonicalPrincipalIdentity(identityInput, {
-      observedClerkId
-    });
-  }
-  async function checkAccess(input, idempotencyKey) {
-    const identity = await resolveIdentity(input.identity, input.observedClerkId);
-    const policyInput = buildPolicyInput(identity, input);
-    try {
-      const response = await identityClient.evaluatePolicy(
-        policyInput,
-        idempotencyKey
-      );
-      return {
-        identity,
-        policyInput,
-        decision: response.data
-      };
-    } catch (error) {
-      if (error instanceof LucernSdkAuthContextError) {
-        throw error;
-      }
-      throw new LucernAccessControlError(
-        "policy_unavailable",
-        "Permit policy check failed closed before an allow decision was returned."
-      );
+    async function checkAccess(input, idempotencyKey) {
+        const identity = await resolveIdentity(input.identity, input.observedClerkId);
+        const policyInput = buildPolicyInput(identity, input);
+        try {
+            const response = await identityClient.evaluatePolicy(policyInput, idempotencyKey);
+            return {
+                identity,
+                policyInput,
+                decision: response.data,
+            };
+        }
+        catch (error) {
+            if (error instanceof LucernSdkAuthContextError) {
+                throw error;
+            }
+            throw new LucernAccessControlError("policy_unavailable", "Permit policy check failed closed before an allow decision was returned.");
+        }
     }
-  }
-  async function requireAccess(input, idempotencyKey) {
-    const result = await checkAccess(input, idempotencyKey);
-    assertPermitAllowed(result.decision);
-    return result;
-  }
-  async function canAccess(input, idempotencyKey) {
-    try {
-      await requireAccess(input, idempotencyKey);
-      return true;
-    } catch {
-      return false;
+    async function requireAccess(input, idempotencyKey) {
+        const result = await checkAccess(input, idempotencyKey);
+        assertPermitAllowed(result.decision);
+        return result;
     }
-  }
-  return {
-    normalizePrincipal: normalizeCanonicalPrincipalIdentity,
-    checkAccess,
-    requireAccess,
-    canAccess
-  };
+    async function canAccess(input, idempotencyKey) {
+        try {
+            await requireAccess(input, idempotencyKey);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    return {
+        normalizePrincipal: normalizeCanonicalPrincipalIdentity,
+        checkAccess,
+        requireAccess,
+        canAccess,
+    };
 }
-
-export { LucernAccessControlError, assertPermitAllowed, createAccessControlClient, formatPermitResource, normalizeCanonicalPrincipalIdentity };
-//# sourceMappingURL=accessControl.js.map
 //# sourceMappingURL=accessControl.js.map