@lucern/sdk 1.0.26 → 1.0.28

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@lucern/sdk` will be documented in this file.
 ## [Unreleased]
 - No unreleased changes yet.
 
+## [1.0.28] - 2026-06-14
+- Coherent with `@lucern/reasoning-kernel` 1.0.28: FR.12d access-control
+  completion — the definitive creator-grant 403 cure (#1361). The project
+  overlay now accepts epistemicNode-backed topics (node-only UUIDv7 self-key
+  and dual-backed `t17` doc-id shapes) and `tenant_api_key` service principals
+  resolve through the same grant-evaluation path, so a real non-admin
+  granted principal can `create_question` (and the rest of the project-scoped
+  write surface) without a spurious `PROJECT_ACCESS_DENIED` 403.
+  Function/runtime-contract line, not a schema line.
+
+## [1.0.27] - 2026-06-14
+- FR.12c access-control completion. Coherent with `@lucern/reasoning-kernel`
+  1.0.27: the kernel default `getProject` is now a real overlay materializer
+  rather than a `() => null` stub, so the FR.12 creator-grant read is actually
+  reached. This makes `create_question`, `create_evidence`, `create_task`, and
+  `archive_belief` succeed again for granted principals — the prior 1.0.25/1.0.26
+  grant-read fix sat behind unreachable code. SDK surface is unchanged; this line
+  moves the coherent `@lucern/*` set forward and carries the kernel runtime cure.
+
 ## [1.0.26] - 2026-06-13
 - Release notes pending.
 

package/dist/proof-attestation.json

@@ -41,5 +41,5 @@
     "convex-validators",
     "proof-attestation"
   ],
-  "signedAt": 1781392072815
+  "signedAt": 1781457107488
 }

package/dist/realtime/refs.js

@@ -9,5 +9,13 @@ import { anyApi } from "convex/server";
  *
  * Client consumers should continue importing from `@lucern/sdk/realtime`.
  */
+// TODO(FR.11-structural): `AnyApi`/`anyApi` is the SDK's public, consumer-facing
+// escape hatch for referencing deployed functions — it is NOT a mechanical swap
+// to a generated typed surface. Eliminating it requires the SDK to ship a
+// published typed platform-API `.d.ts` (a typed function-reference manifest)
+// that consumers import in place of `anyApi`. Until that typed surface is
+// generated and bundled into the package, this remains the only typed way for
+// SDK consumers to reference platform functions. Deferred to the FR.11 closing
+// pass (needs a new generated artifact + public-API contract change).
 export const platformApi = anyApi;
 //# sourceMappingURL=refs.js.map

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 /** Current SDK package version. */
-export declare const LUCERN_SDK_VERSION = "1.0.26";
+export declare const LUCERN_SDK_VERSION = "1.0.28";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 /** Current SDK package version. */
-export const LUCERN_SDK_VERSION = "1.0.26";
+export const LUCERN_SDK_VERSION = "1.0.28";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucern/sdk",
-  "version": "1.0.26",
+  "version": "1.0.28",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -113,10 +113,10 @@
     "typecheck": "tsc --project tsconfig.typecheck.json --noEmit"
   },
   "dependencies": {
-    "@lucern/contracts": "1.0.26",
-    "@lucern/reasoning-kernel": "1.0.26",
-    "@lucern/secrets": "1.0.26",
-    "@lucern/transport-core": "1.0.26",
+    "@lucern/contracts": "1.0.28",
+    "@lucern/reasoning-kernel": "1.0.28",
+    "@lucern/secrets": "1.0.28",
+    "@lucern/transport-core": "1.0.28",
     "effect": "^3.21.2",
     "zod": "^3.25.76"
   },