@dashai/sdk 0.9.0 → 2.0.0

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { C as ClientConfig, a as Client, T as TokenResolver } from './types-DXsbCVkb.cjs';
-export { B as BaseInsert, b as BaseRow, c as BaseUpdate, d as DatahubClient, e as DatahubListResult, f as DatahubTableClient, D as Deps, F as FetchImpl, g as FileRef, h as FilterOps, i as FilterValue, L as ListOpts, P as Page, R as ReadOnlyTableClient, S as SlowQueryInfo, j as SortClause, k as SortDir, l as TableClient, W as Where } from './types-DXsbCVkb.cjs';
-export { C as ContractViolationError, a as DashwiseError, b as DashwiseErrorCode, D as DependencyContractError, F as ForbiddenError, J as JoinError, N as NetworkError, O as OperationNotAllowedByProviderError, P as ProviderTableMissingError, R as RowNotFoundError, T as TimeoutError, U as UnauthenticatedError, V as ValidationError, f as fromBackendEnvelope } from './errors-BV75u7b9.cjs';
+import { C as ClientConfig, a as Client, T as TokenResolver } from './types-CkAfiS4k.cjs';
+export { B as BaseInsert, b as BaseRow, c as BaseUpdate, d as DatahubClient, e as DatahubListOpts, f as DatahubListResult, g as DatahubTableClient, D as Deps, F as FetchImpl, h as FileRef, i as FilterOps, j as FilterValue, L as ListOpts, P as Page, R as ReadOnlyTableClient, S as SlowQueryInfo, k as SortClause, l as SortDir, m as TableClient, W as Where } from './types-CkAfiS4k.cjs';
+export { C as ContractFieldMissingError, c as ContractViolationError, d as DashwiseError, e as DashwiseErrorCode, D as DepUnboundError, a as DepUnboundReason, b as DependencyContractError, F as ForbiddenError, J as JoinError, N as NetworkError, O as OperationNotAllowedByProviderError, P as ProviderTableMissingError, R as RowNotFoundError, T as TimeoutError, U as UnauthenticatedError, f as UsesOpNotAllowedError, g as UsesUnboundError, h as UsesUnboundReason, V as ValidationError, i as fromBackendEnvelope } from './index-BsSFz58g.cjs';
 
 /**
  * `createClient()` — the public factory for talking to the DashWise
@@ -19,14 +19,16 @@ export { C as ContractViolationError, a as DashwiseError, b as DashwiseErrorCode
  *      `Record<string, unknown>` rows with the generic `db<Row>(slug)`
  *      shape.
  *
- * The HTTP path layout mirrors the existing runtime data plane in
- * `dashwise-backend/src/modules/modules/runtime/data/runtime-table.controller.ts`:
+ * The HTTP path layout targets the Phase 2 module-API plane. Every
+ * route is install-agnostic — the backend resolves the install from
+ * the bearer credential (a scoped `dwk_` key or a sandbox session
+ * token), so no installation id appears in the URL:
  *
- *   POST   /api/modules/<installation>/db/<table>/list
- *   GET    /api/modules/<installation>/db/<table>/<id>
- *   POST   /api/modules/<installation>/db/<table>
- *   PATCH  /api/modules/<installation>/db/<table>/<id>
- *   DELETE /api/modules/<installation>/db/<table>/<id>
+ *   POST   /api/module-api/db/<table>/list
+ *   GET    /api/module-api/db/<table>/<id>
+ *   POST   /api/module-api/db/<table>
+ *   PATCH  /api/module-api/db/<table>/<id>
+ *   DELETE /api/module-api/db/<table>/<id>
  */
 
 /**
@@ -35,9 +37,8 @@ export { C as ContractViolationError, a as DashwiseError, b as DashwiseErrorCode
  *
  * @example
  *   const client = createClient({
- *     baseUrl: 'https://api.dashwise.io',
- *     installationId: 'sandbox',
- *     getToken: () => process.env.DASHWISE_TOKEN ?? null,
+ *     baseUrl: 'https://api.dashwise.net',
+ *     apiKey: process.env.DASHWISE_API_KEY,
  *   });
  *
  *   const page = await client.db<TasksRow>('tasks').list({
@@ -50,35 +51,39 @@ declare function createClient(config: ClientConfig): Client;
 /**
  * `createDevClient()` — `createClient()`'s zero-config sibling for local dev.
  *
- * Resolves `baseUrl`, `installationId`, and `getToken` from a layered
- * config chain so a developer who has run `dashwise login` (and, for the
- * full local-dev experience, `dashwise init`) can do:
+ * Resolves `baseUrl` + `getToken` from a layered config chain so a
+ * developer who has run `dashwise login` (and, for the full local-dev
+ * experience, `dashwise init`) can do:
  *
  * ```ts
  * import { createDevClient } from '@dashai/sdk';
  * const client = createDevClient({ moduleSlug: 'my-tasks' });
  * ```
  *
- * …without copying tokens or installation ids around. The flow this
- * enables is the end-to-end "two-command bootstrap" the CLI's
- * `dashwise login` + `dashwise init` pair targets.
+ * …without copying tokens around. The flow this enables is the
+ * end-to-end "two-command bootstrap" the CLI's `dashwise login` +
+ * `dashwise init` pair targets.
+ *
+ * Phase 2 wire protocol: there is NO installation id anywhere in this
+ * resolver — the backend resolves the install from the credential
+ * (a scoped `dwk_` key or, in the AI builder sandbox, a session token),
+ * and every request hits the install-agnostic `/api/module-api`.
  *
  * ## Resolution chain
  *
  * For each field, the first non-empty source wins:
  *
  *   1. Explicit `overrides` argument (per-call escape hatch).
- *   2. Environment variables — `DASHWISE_API_URL` / `DASHWISE_API_TOKEN`
- *      / `DASHWISE_INSTALLATION_ID` / `DASHWISE_RUNTIME_TOKEN` (HH-CC-LDI-5).
- *      Standard for CI, Docker, prod-like setups; also the path
- *      `dashwise dev` uses to inject per-module credentials into the
- *      Next.js child process.
+ *   2. Environment variables — exactly `DASHWISE_API_URL` +
+ *      `DASHWISE_API_KEY` (the Phase 2 two-var contract). Standard for
+ *      CI, Docker, prod-like setups; also the path `dashwise dev` uses
+ *      to inject the module's scoped `dwk_` key into the Next.js child.
  *   3. The CLI's saved config at `$XDG_CONFIG_HOME/dashwise/auth.json`
  *      (or platform default) — written by `dashwise login` (top-level
- *      `apiUrl` + `token`) and `dashwise init` (per-module entry under
- *      `modules[slug]`).
+ *      `apiUrl` + `token`) and `dashwise init` / `register` (per-module
+ *      entry under `modules[slug]`).
  *
- * ## Per-module local-dev tokens (HH-CC-LDI-5)
+ * ## Per-module local-dev credential (P1-C)
  *
  * When `overrides.moduleSlug` is set, the SDK looks up the per-module
  * entry in `auth.json`:
@@ -89,26 +94,34 @@ declare function createClient(config: ClientConfig): Client;
  *   "token": "dwc_...",                // CLI bearer (login)
  *   "modules": {
  *     "my-tasks": {
- *       "runtimeToken": "<JWT>",       // long-lived runtime token (LDI-2)
- *       "installationId": 4242,        // numeric install id (LDI-2)
+ *       "apiKey": "dwk_...",           // scoped local-dev API key (P1-C)
+ *       "apiKeyId": 88,                // module_api_keys row id
+ *       "installationId": 4242,        // numeric install id (internal)
  *       "expiresAt": "2026-08-22T..."  // informational only
  *     }
  *   }
  * }
  * ```
  *
- * Per-module entries are written by `dashwise init` (HH-CC-LDI-6) when
- * a developer provisions a local-dev install. The SDK prefers the
- * `runtimeToken` over the legacy CLI bearer (`token`) when both
- * exist, and sets `installationId` to the literal `'sandbox'` — the
- * URL placeholder the backend's `RuntimeTokenGuard` accepts (the
- * token resolves to the actual install on the server side).
+ * Per-module entries are written by `dashwise init` / `dashwise module
+ * register` when a developer provisions a local-dev install. The SDK
+ * prefers the per-module `apiKey` over the CLI bearer (`token`) when
+ * both exist. The `installationId` on the entry is CLI-internal
+ * bookkeeping (used only for admin URLs like `dashwise api-keys`); the
+ * SDK never sends it — the key binds the install server-side.
+ *
+ * Back-compat: a pre-P1-C `auth.json` may carry a `runtimeToken` (90-day
+ * JWT) instead of `apiKey`. The SDK still reads it as a last-resort
+ * file fallback so old files keep working until `dashwise dev`
+ * self-heals the entry to a `dwk_` key. The `DASHWISE_RUNTIME_TOKEN` /
+ * `DASHWISE_API_TOKEN` / `DASHWISE_INSTALLATION_ID` env vars no longer
+ * exist in Phase 2 and are not read here.
  *
  * If `moduleSlug` is unset, OR the named module isn't in the
- * `modules` map, OR the entry lacks a `runtimeToken`, the resolver
- * falls back to the legacy chain (`token` field + `'local'` install
- * id, which the backend will reject — surfacing as a typed
- * `UnauthenticatedError` on the first request).
+ * `modules` map, OR the entry lacks a credential, the resolver
+ * falls back to the deploy `DASHWISE_API_KEY` env, then the CLI bearer
+ * (which the backend rejects on the module-API plane — surfacing as a
+ * typed `UnauthenticatedError` on the first request).
  *
  * ## Safety rails
  *
@@ -151,25 +164,25 @@ interface CreateDevClientOptions extends Partial<Omit<ClientConfig, 'getToken'>>
      */
     getToken?: TokenResolver;
     /**
-     * HH-CC-LDI-5 — module slug for per-module runtime-token lookup.
+     * P1-C — module slug for per-module API-key lookup.
      *
      * When set, `createDevClient` reads
-     * `~/.config/dashwise/auth.json#modules[<moduleSlug>]` looking for
-     * a `runtimeToken`. If found, that token is used as the bearer
-     * (overriding `DASHWISE_API_TOKEN` / file-level `token`) and the
-     * SDK sends `installationId='sandbox'` — the URL placeholder
-     * accepted by the backend's `RuntimeTokenGuard`. The runtime
-     * token itself binds to a specific install on the server side.
+     * `~/.config/dashwise/auth.json#modules[<moduleSlug>]` looking for a
+     * scoped `dwk_` `apiKey` (a legacy `runtimeToken` is also honoured
+     * for old files). If found, it is used as the bearer (overriding the
+     * deploy `DASHWISE_API_KEY` / file-level `token`); the key binds to a
+     * specific install server-side, so no installation id is sent.
      *
-     * If `moduleSlug` is unset or the entry is missing, the legacy
-     * resolution chain applies (CLI bearer + `'local'` installation
-     * id, which the backend will 401 — surfacing as a typed
-     * `UnauthenticatedError` on the first request).
+     * If `moduleSlug` is unset or the entry is missing, the resolution
+     * chain falls through to the deploy `DASHWISE_API_KEY` env, then the
+     * CLI bearer (which the backend 401s on the module-API plane —
+     * surfacing as a typed `UnauthenticatedError` on the first request).
      *
      * Typical usage: scaffolded modules read `module.json#module.slug`
-     * and pass it here. The CLI's `dashwise dev` command also exports
-     * it as the `DASHWISE_RUNTIME_TOKEN` env var so child processes
-     * (e.g. `next dev`) can authenticate without re-reading the file.
+     * and pass it here. The CLI's `dashwise dev` command instead exports
+     * the key as the `DASHWISE_API_KEY` env var so child processes (e.g.
+     * `next dev`) authenticate without re-reading the file or passing a
+     * slug.
      */
     moduleSlug?: string;
 }

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { C as ClientConfig, a as Client, T as TokenResolver } from './types-DXsbCVkb.js';
-export { B as BaseInsert, b as BaseRow, c as BaseUpdate, d as DatahubClient, e as DatahubListResult, f as DatahubTableClient, D as Deps, F as FetchImpl, g as FileRef, h as FilterOps, i as FilterValue, L as ListOpts, P as Page, R as ReadOnlyTableClient, S as SlowQueryInfo, j as SortClause, k as SortDir, l as TableClient, W as Where } from './types-DXsbCVkb.js';
-export { C as ContractViolationError, a as DashwiseError, b as DashwiseErrorCode, D as DependencyContractError, F as ForbiddenError, J as JoinError, N as NetworkError, O as OperationNotAllowedByProviderError, P as ProviderTableMissingError, R as RowNotFoundError, T as TimeoutError, U as UnauthenticatedError, V as ValidationError, f as fromBackendEnvelope } from './errors-BV75u7b9.js';
+import { C as ClientConfig, a as Client, T as TokenResolver } from './types-CkAfiS4k.js';
+export { B as BaseInsert, b as BaseRow, c as BaseUpdate, d as DatahubClient, e as DatahubListOpts, f as DatahubListResult, g as DatahubTableClient, D as Deps, F as FetchImpl, h as FileRef, i as FilterOps, j as FilterValue, L as ListOpts, P as Page, R as ReadOnlyTableClient, S as SlowQueryInfo, k as SortClause, l as SortDir, m as TableClient, W as Where } from './types-CkAfiS4k.js';
+export { C as ContractFieldMissingError, c as ContractViolationError, d as DashwiseError, e as DashwiseErrorCode, D as DepUnboundError, a as DepUnboundReason, b as DependencyContractError, F as ForbiddenError, J as JoinError, N as NetworkError, O as OperationNotAllowedByProviderError, P as ProviderTableMissingError, R as RowNotFoundError, T as TimeoutError, U as UnauthenticatedError, f as UsesOpNotAllowedError, g as UsesUnboundError, h as UsesUnboundReason, V as ValidationError, i as fromBackendEnvelope } from './index-BsSFz58g.js';
 
 /**
  * `createClient()` — the public factory for talking to the DashWise
@@ -19,14 +19,16 @@ export { C as ContractViolationError, a as DashwiseError, b as DashwiseErrorCode
  *      `Record<string, unknown>` rows with the generic `db<Row>(slug)`
  *      shape.
  *
- * The HTTP path layout mirrors the existing runtime data plane in
- * `dashwise-backend/src/modules/modules/runtime/data/runtime-table.controller.ts`:
+ * The HTTP path layout targets the Phase 2 module-API plane. Every
+ * route is install-agnostic — the backend resolves the install from
+ * the bearer credential (a scoped `dwk_` key or a sandbox session
+ * token), so no installation id appears in the URL:
  *
- *   POST   /api/modules/<installation>/db/<table>/list
- *   GET    /api/modules/<installation>/db/<table>/<id>
- *   POST   /api/modules/<installation>/db/<table>
- *   PATCH  /api/modules/<installation>/db/<table>/<id>
- *   DELETE /api/modules/<installation>/db/<table>/<id>
+ *   POST   /api/module-api/db/<table>/list
+ *   GET    /api/module-api/db/<table>/<id>
+ *   POST   /api/module-api/db/<table>
+ *   PATCH  /api/module-api/db/<table>/<id>
+ *   DELETE /api/module-api/db/<table>/<id>
  */
 
 /**
@@ -35,9 +37,8 @@ export { C as ContractViolationError, a as DashwiseError, b as DashwiseErrorCode
  *
  * @example
  *   const client = createClient({
- *     baseUrl: 'https://api.dashwise.io',
- *     installationId: 'sandbox',
- *     getToken: () => process.env.DASHWISE_TOKEN ?? null,
+ *     baseUrl: 'https://api.dashwise.net',
+ *     apiKey: process.env.DASHWISE_API_KEY,
  *   });
  *
  *   const page = await client.db<TasksRow>('tasks').list({
@@ -50,35 +51,39 @@ declare function createClient(config: ClientConfig): Client;
 /**
  * `createDevClient()` — `createClient()`'s zero-config sibling for local dev.
  *
- * Resolves `baseUrl`, `installationId`, and `getToken` from a layered
- * config chain so a developer who has run `dashwise login` (and, for the
- * full local-dev experience, `dashwise init`) can do:
+ * Resolves `baseUrl` + `getToken` from a layered config chain so a
+ * developer who has run `dashwise login` (and, for the full local-dev
+ * experience, `dashwise init`) can do:
  *
  * ```ts
  * import { createDevClient } from '@dashai/sdk';
  * const client = createDevClient({ moduleSlug: 'my-tasks' });
  * ```
  *
- * …without copying tokens or installation ids around. The flow this
- * enables is the end-to-end "two-command bootstrap" the CLI's
- * `dashwise login` + `dashwise init` pair targets.
+ * …without copying tokens around. The flow this enables is the
+ * end-to-end "two-command bootstrap" the CLI's `dashwise login` +
+ * `dashwise init` pair targets.
+ *
+ * Phase 2 wire protocol: there is NO installation id anywhere in this
+ * resolver — the backend resolves the install from the credential
+ * (a scoped `dwk_` key or, in the AI builder sandbox, a session token),
+ * and every request hits the install-agnostic `/api/module-api`.
  *
  * ## Resolution chain
  *
  * For each field, the first non-empty source wins:
  *
  *   1. Explicit `overrides` argument (per-call escape hatch).
- *   2. Environment variables — `DASHWISE_API_URL` / `DASHWISE_API_TOKEN`
- *      / `DASHWISE_INSTALLATION_ID` / `DASHWISE_RUNTIME_TOKEN` (HH-CC-LDI-5).
- *      Standard for CI, Docker, prod-like setups; also the path
- *      `dashwise dev` uses to inject per-module credentials into the
- *      Next.js child process.
+ *   2. Environment variables — exactly `DASHWISE_API_URL` +
+ *      `DASHWISE_API_KEY` (the Phase 2 two-var contract). Standard for
+ *      CI, Docker, prod-like setups; also the path `dashwise dev` uses
+ *      to inject the module's scoped `dwk_` key into the Next.js child.
  *   3. The CLI's saved config at `$XDG_CONFIG_HOME/dashwise/auth.json`
  *      (or platform default) — written by `dashwise login` (top-level
- *      `apiUrl` + `token`) and `dashwise init` (per-module entry under
- *      `modules[slug]`).
+ *      `apiUrl` + `token`) and `dashwise init` / `register` (per-module
+ *      entry under `modules[slug]`).
  *
- * ## Per-module local-dev tokens (HH-CC-LDI-5)
+ * ## Per-module local-dev credential (P1-C)
  *
  * When `overrides.moduleSlug` is set, the SDK looks up the per-module
  * entry in `auth.json`:
@@ -89,26 +94,34 @@ declare function createClient(config: ClientConfig): Client;
  *   "token": "dwc_...",                // CLI bearer (login)
  *   "modules": {
  *     "my-tasks": {
- *       "runtimeToken": "<JWT>",       // long-lived runtime token (LDI-2)
- *       "installationId": 4242,        // numeric install id (LDI-2)
+ *       "apiKey": "dwk_...",           // scoped local-dev API key (P1-C)
+ *       "apiKeyId": 88,                // module_api_keys row id
+ *       "installationId": 4242,        // numeric install id (internal)
  *       "expiresAt": "2026-08-22T..."  // informational only
  *     }
  *   }
  * }
  * ```
  *
- * Per-module entries are written by `dashwise init` (HH-CC-LDI-6) when
- * a developer provisions a local-dev install. The SDK prefers the
- * `runtimeToken` over the legacy CLI bearer (`token`) when both
- * exist, and sets `installationId` to the literal `'sandbox'` — the
- * URL placeholder the backend's `RuntimeTokenGuard` accepts (the
- * token resolves to the actual install on the server side).
+ * Per-module entries are written by `dashwise init` / `dashwise module
+ * register` when a developer provisions a local-dev install. The SDK
+ * prefers the per-module `apiKey` over the CLI bearer (`token`) when
+ * both exist. The `installationId` on the entry is CLI-internal
+ * bookkeeping (used only for admin URLs like `dashwise api-keys`); the
+ * SDK never sends it — the key binds the install server-side.
+ *
+ * Back-compat: a pre-P1-C `auth.json` may carry a `runtimeToken` (90-day
+ * JWT) instead of `apiKey`. The SDK still reads it as a last-resort
+ * file fallback so old files keep working until `dashwise dev`
+ * self-heals the entry to a `dwk_` key. The `DASHWISE_RUNTIME_TOKEN` /
+ * `DASHWISE_API_TOKEN` / `DASHWISE_INSTALLATION_ID` env vars no longer
+ * exist in Phase 2 and are not read here.
  *
  * If `moduleSlug` is unset, OR the named module isn't in the
- * `modules` map, OR the entry lacks a `runtimeToken`, the resolver
- * falls back to the legacy chain (`token` field + `'local'` install
- * id, which the backend will reject — surfacing as a typed
- * `UnauthenticatedError` on the first request).
+ * `modules` map, OR the entry lacks a credential, the resolver
+ * falls back to the deploy `DASHWISE_API_KEY` env, then the CLI bearer
+ * (which the backend rejects on the module-API plane — surfacing as a
+ * typed `UnauthenticatedError` on the first request).
  *
  * ## Safety rails
  *
@@ -151,25 +164,25 @@ interface CreateDevClientOptions extends Partial<Omit<ClientConfig, 'getToken'>>
      */
     getToken?: TokenResolver;
     /**
-     * HH-CC-LDI-5 — module slug for per-module runtime-token lookup.
+     * P1-C — module slug for per-module API-key lookup.
      *
      * When set, `createDevClient` reads
-     * `~/.config/dashwise/auth.json#modules[<moduleSlug>]` looking for
-     * a `runtimeToken`. If found, that token is used as the bearer
-     * (overriding `DASHWISE_API_TOKEN` / file-level `token`) and the
-     * SDK sends `installationId='sandbox'` — the URL placeholder
-     * accepted by the backend's `RuntimeTokenGuard`. The runtime
-     * token itself binds to a specific install on the server side.
+     * `~/.config/dashwise/auth.json#modules[<moduleSlug>]` looking for a
+     * scoped `dwk_` `apiKey` (a legacy `runtimeToken` is also honoured
+     * for old files). If found, it is used as the bearer (overriding the
+     * deploy `DASHWISE_API_KEY` / file-level `token`); the key binds to a
+     * specific install server-side, so no installation id is sent.
      *
-     * If `moduleSlug` is unset or the entry is missing, the legacy
-     * resolution chain applies (CLI bearer + `'local'` installation
-     * id, which the backend will 401 — surfacing as a typed
-     * `UnauthenticatedError` on the first request).
+     * If `moduleSlug` is unset or the entry is missing, the resolution
+     * chain falls through to the deploy `DASHWISE_API_KEY` env, then the
+     * CLI bearer (which the backend 401s on the module-API plane —
+     * surfacing as a typed `UnauthenticatedError` on the first request).
      *
      * Typical usage: scaffolded modules read `module.json#module.slug`
-     * and pass it here. The CLI's `dashwise dev` command also exports
-     * it as the `DASHWISE_RUNTIME_TOKEN` env var so child processes
-     * (e.g. `next dev`) can authenticate without re-reading the file.
+     * and pass it here. The CLI's `dashwise dev` command instead exports
+     * the key as the `DASHWISE_API_KEY` env var so child processes (e.g.
+     * `next dev`) authenticate without re-reading the file or passing a
+     * slug.
      */
     moduleSlug?: string;
 }