@lucern/sdk 1.0.27 → 1.0.29

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to `@lucern/sdk` will be documented in this file.
 ## [Unreleased]
 - No unreleased changes yet.
 
+## [1.0.29] - 2026-06-15
+- Coherent with `@lucern/reasoning-kernel` 1.0.29: access-control consolidation
+  (FR.12e/g singular write gateway + CQ.11 gate de-duplication) plus
+  structured-error hardening (FR.13 `create_topic` out-of-enum 400, FR.60
+  structured-error-contract enforcement). Function/runtime-contract line, not a
+  schema line; component table manifests are unchanged from 1.0.28.
+
+## [1.0.28] - 2026-06-14
+- Coherent with `@lucern/reasoning-kernel` 1.0.28: FR.12d access-control
+  completion — the definitive creator-grant 403 cure (#1361). The project
+  overlay now accepts epistemicNode-backed topics (node-only UUIDv7 self-key
+  and dual-backed `t17` doc-id shapes) and `tenant_api_key` service principals
+  resolve through the same grant-evaluation path, so a real non-admin
+  granted principal can `create_question` (and the rest of the project-scoped
+  write surface) without a spurious `PROJECT_ACCESS_DENIED` 403.
+  Function/runtime-contract line, not a schema line.
+
 ## [1.0.27] - 2026-06-14
 - FR.12c access-control completion. Coherent with `@lucern/reasoning-kernel`
   1.0.27: the kernel default `getProject` is now a real overlay materializer

package/dist/proof-attestation.json

@@ -41,5 +41,5 @@
     "convex-validators",
     "proof-attestation"
   ],
-  "signedAt": 1781409932489
+  "signedAt": 1781580937826
 }

package/dist/realtime/refs.js

@@ -9,5 +9,13 @@ import { anyApi } from "convex/server";
  *
  * Client consumers should continue importing from `@lucern/sdk/realtime`.
  */
+// TODO(FR.11-structural): `AnyApi`/`anyApi` is the SDK's public, consumer-facing
+// escape hatch for referencing deployed functions — it is NOT a mechanical swap
+// to a generated typed surface. Eliminating it requires the SDK to ship a
+// published typed platform-API `.d.ts` (a typed function-reference manifest)
+// that consumers import in place of `anyApi`. Until that typed surface is
+// generated and bundled into the package, this remains the only typed way for
+// SDK consumers to reference platform functions. Deferred to the FR.11 closing
+// pass (needs a new generated artifact + public-API contract change).
 export const platformApi = anyApi;
 //# sourceMappingURL=refs.js.map

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 /** Current SDK package version. */
-export declare const LUCERN_SDK_VERSION = "1.0.27";
+export declare const LUCERN_SDK_VERSION = "1.0.29";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 /** Current SDK package version. */
-export const LUCERN_SDK_VERSION = "1.0.27";
+export const LUCERN_SDK_VERSION = "1.0.29";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucern/sdk",
-  "version": "1.0.27",
+  "version": "1.0.29",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -113,10 +113,10 @@
     "typecheck": "tsc --project tsconfig.typecheck.json --noEmit"
   },
   "dependencies": {
-    "@lucern/contracts": "1.0.27",
-    "@lucern/reasoning-kernel": "1.0.27",
-    "@lucern/secrets": "1.0.27",
-    "@lucern/transport-core": "1.0.27",
+    "@lucern/contracts": "1.0.29",
+    "@lucern/reasoning-kernel": "1.0.29",
+    "@lucern/secrets": "1.0.29",
+    "@lucern/transport-core": "1.0.29",
     "effect": "^3.21.2",
     "zod": "^3.25.76"
   },