SDKs
Python, TypeScript and Go
Define Workers, States and Functions in the language your service is already written in. Typed clients, streaming responses, and local runs against the same runtime.
Build on Lemma.Any Surface. One Runtime.
SDKs for Python, TypeScript and Go, a REST API, a CLI, and a Terraform provider. Define Workers in code, promote them through environments, and keep the governance and evidence you get in the canvas.
From Visual Canvas to Code-First Control.
Move between the visual builder, a code-first SDK, the API, the CLI and Terraform without leaving governance or runtime evidence behind.
01# Define a Worker and its initial state.
02from sh.lemma.workers.worker import Worker
03from sh.lemma.states import SetState
04
05# Set the starting status
06worker = Worker(
07 name="My_Worker",
08 states=[
09 SetState(
10 name="Initialize",
11 set={"status": "started"},
12 ),
13 ],
14)
main.tf
01# Illustrative Terraform — replace with the published provider schema
02resource "lemma_worker" "incident_response" {
03
04 # A person before production
05 approval = { role = "operator" }
06
07 # Who may run it, down to the action
08 identity = { run = ["oncall"] }
09
10 # Checked on every call, from every surface
11 policy = lemma_policy.incident_response.id
12
13 # Credentials: grants resolved at run time
14 secrets = [lemma_secret.pagerduty.id]
15}
observe.py
01# Illustrative SDK pattern — replace with published syntax
02from lemma import runs
03run = runs.get("run_01J8K2")
04
05# The history: every State, in order
06for state in run.history():
07 print(state.name, state.status)
08
09# The evidence each decision was made on
10for artifact in run.evidence():
11 print(artifact.kind, artifact.ref)
12
13# What a person changed, and when
14handoff = run.handoffs()[0]
15print(handoff.actor, handoff.resumed_at)
16
17# The same trace, into your collector
18run.export(otlp="collector.internal:4317")
Four Surfaces. One Control Plane.
Everything the canvas can do, the API can do. The SDKs, the CLI and the Terraform provider are thin clients over it, so a Worker defined in any of them runs on the same runtime, under the same policy, with the same evidence.
REST API
Every Primitive, Over HTTP
Workers, runs, knowledge, tenants, webhooks and audit logs. Versioned endpoints with the same identity and policy checks the canvas applies.
CLI
Validate, Deploy, Promote
Run a Worker locally, validate its policy and connections, and promote it through environments from a shell or a CI job.
Terraform
Infrastructure as Code
Declare environments, Workers, connections, roles and approval policy in HCL. Plan and apply through the provider, review the diff, and keep it in the repo.
Fine-Grained Access.
Access is granted per workspace, per folder, per Worker and per action. Who can read a run, who can edit a State, who can approve a deploy, and which connections a Worker may resolve are separate grants, written as policy, and checked on every call from every surface.
policy grantsroles × actions
4 built-in roles 1 composed from run, approve, read evidence
policy grantsscopes × actions
attached at the folder inherits downward nothing above it
policy grantsconnections × Workers
12:04:07reviewresolve slackok
12:04:07reviewresolve postgres prodok
12:04:07reviewresolve secret api-keyok
12:04:08reviewresolve vertexdenied scope
Prove Every Decision.
When someone asks what a Worker did and why, the answer is already written: the input, each policy decision, each approval, and what the model returned, recorded as it happened. The same trace leaves through OpenTelemetry, so it lands in the collector, the SIEM and the dashboards you already run.
Runningrun_01J8K0 at Page On-Call
Runs Where You Run.
A Worker is the same object in every deployment model. Which one it lands in is a setting on the environment, not a fork of the code, so moving from our cloud to yours to no cloud at all is a plan and an apply.
Managed, Multi-Tenant
Start on our cloud. Logical isolation per tenant, continuous updates, and nothing of your own to operate.
Managed, Single-Tenant
Dedicated infrastructure we run for you, with your own upgrade window and configuration.
Your Cloud
Deploy into your own Google Cloud or Azure account through the marketplace listing. Data never leaves your boundary.
On-Premise and Airgapped
GovCloud, your data center, or no network at all. SOC 2 Type 2, HIPAA, GDPR and CJIS, with CMMC Level 2 in progress and FedRAMP next.
Procure it through the cloud marketplace you already buy from, and deploy from the same listing.
The Canvas Is Optional.The Governance Is Not.
Whatever surface you build on, every run carries the same identity, policy and evidence. Swap models, swap providers, move from a laptop to an airgapped site, and nothing about the Worker has to change.
Ready to Build?
Start with the quickstart.
Read the Docs