@declarion/embed 0.64.0 → 0.65.0

package/README.md

@@ -12,7 +12,7 @@ package is the typed integration layer for both sides:
   iframe, runs the auth handshake, auto-resizes, mirrors navigation.
 - **React binding** (`@declarion/embed/react`) - `<DeclarionEmbed />`.
 - **Server helper** (`@declarion/embed/server`) - `createEmbedSession`, the
-  Node-side mint call. Keeps the `dk:` API key out of browser code.
+  Node-side mint call. Keeps the `dcl_` API key out of browser code.
 
 The host installs only `@declarion/embed`; it does **not** depend on
 `@declarion/react` (the full Declarion UI SDK).
@@ -31,15 +31,15 @@ npm install @declarion/embed
 1. The host backend mints a short-lived, scoped token for a target tenant and
    user with
    `createEmbedSession` (`@declarion/embed/server`), which calls the
-   `auth.create_embed_session` action with a server-held `dk:` API key.
+   `auth.create_embed_session` action with a server-held `dcl_` API key.
 2. The host frontend embeds a screen with `createDeclarionEmbed` or
    `<DeclarionEmbed />`, passing a `getToken` callback that fetches a token
    from the host backend.
 3. The SDK runs a `postMessage` handshake: the iframe asks for a token, the
    SDK delivers it, and refreshes it whenever the iframe reports expiry.
 
-The `dk:` API key never leaves the host backend. For multi-tenant hosts, use a
-least-privilege `dk:_global` key whose service-account owner holds only
+The `dcl_` API key never leaves the host backend. For multi-tenant hosts, use a
+least-privilege `dcl_` key key whose service-account owner holds only
 `action:auth.create_embed_session`; tenant-scoped keys can mint only in their
 own tenant.
 
@@ -107,10 +107,10 @@ export function CasesPanel({ tenant, user, route }) {
 ```ts
 import { createEmbedSession } from "@declarion/embed/server";
 
-// In a host backend route. The dk: API key is read from server config.
+// In a host backend route. The dcl_ API key is read from server config.
 const session = await createEmbedSession({
   declarionOrigin: "https://app.example.com",
-  // Prefer a least-privilege dk:_global key whose owner holds only
+  // Prefer a least-privilege dcl_ key whose owner holds only
   // action:auth.create_embed_session. Keep it server-side only.
   apiKey: process.env.DECLARION_EMBED_API_KEY!,
   tenantCode: "acme", // target tenant
@@ -122,7 +122,7 @@ const session = await createEmbedSession({
 
 Hosts on a non-Node backend call the
 `POST /api/actions/auth.create_embed_session` action over HTTP directly with
-the same `dk:` API key in the `Authorization` header.
+the same `dcl_` API key in the `Authorization` header.
 
 ## Script tag (no build step)
 
@@ -241,12 +241,12 @@ contract:
   `createDeclarionEmbed` (any framework) and supplies the async `getToken`
   callback. The SDK owns the iframe, the `ready` -> `set-token` handshake,
   resize, navigation, and token refresh.
-- **Host backend** - holds the `dk:` API key (server-side only) and mints
+- **Host backend** - holds the `dcl_` API key (server-side only) and mints
   short-lived, scoped embed tokens with `createEmbedSession` from
   `@declarion/embed/server`. Your `getToken` callback fetches one from your
   own backend endpoint.
 
-The `dk:` key never leaves your server; the browser only ever holds a
+The `dcl_` key never leaves your server; the browser only ever holds a
 short-lived, scoped embed token. That split is the entire security model -
 keep `@declarion/embed/server` out of any browser bundle.
 

package/dist/server.d.ts

@@ -12,13 +12,13 @@ export interface CreateEmbedSessionOptions {
      */
     readonly declarionOrigin: string;
     /**
-     * The `dk:`-prefixed Declarion API key. The trust anchor for the mint
+     * The `dcl_`-prefixed Declarion API key. The trust anchor for the mint
      * call. MUST be held server-side only; never ship it to a browser.
      */
     readonly apiKey: string;
     /**
-     * The target tenant to mint the embed session in. A tenant-scoped `dk:`
-     * key may name only its own tenant; a `_global` `dk:` key may name any
+     * The target tenant to mint the embed session in. A tenant-scoped `dcl_`
+     * key may name only its own tenant; a `_global` `dcl_` key may name any
      * tenant (one key for a multi-tenant host).
      */
     readonly tenantCode: string;
@@ -60,7 +60,7 @@ export declare class EmbedSessionError extends Error {
  * Mint a short-lived, scoped embed session token for a host-asserted user.
  *
  * Calls `POST /api/actions/auth.create_embed_session` on the Declarion
- * deployment, authenticating with the server-held `dk:` API key, and returns
+ * deployment, authenticating with the server-held `dcl_` API key, and returns
  * the `{ token, expires_at }` the host hands to the iframe (typically as the
  * `getToken` result of `createDeclarionEmbed` / `<DeclarionEmbed />`).
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@declarion/embed",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "private": false,
   "license": "MIT",
   "description": "Host integration SDK for embedding Declarion screens as white-label iframes.",