@on-belay/sdk 2.2.0 → 2.2.1

package/README.md

@@ -4,7 +4,7 @@ Build a fieldset that runs on the [On Belay](https://app.onbelay.ai) governance
 
 [![npm](https://img.shields.io/npm/v/@on-belay/sdk)](https://www.npmjs.com/package/@on-belay/sdk)
 
-`@on-belay/sdk@2.0.0` is the HTTP-only contract between the On Belay platform and an external fieldset (a Node service you write and host). The platform calls your service over a signed webhook on a schedule; you call the platform back through `/api/sdk/*` to reach connected integrations on behalf of enrolled orgs. No platform internals are imported. No customer credentials live in your code. Node 20+, one runtime dependency (`jose`).
+`@on-belay/sdk` is the HTTP-only contract between the On Belay platform and an external fieldset (a Node service you write and host). The platform calls your service over a signed webhook on a schedule; you call the platform back through `/api/sdk/*` to reach connected integrations on behalf of enrolled orgs. No platform internals are imported. No customer credentials live in your code. Node 20+, one runtime dependency (`jose`).
 
 ---
 
@@ -17,6 +17,8 @@ Build a fieldset that runs on the [On Belay](https://app.onbelay.ai) governance
 5. [Quickstart — Hello World](#5-quickstart--hello-world)
 6. [The webhook handler](#6-the-webhook-handler)
 7. [SDK API reference](#7-sdk-api-reference)
+   - [Typed integration helpers](#typed-integration-helpers)
+   - [logAction](#logaction)
 8. [Webhook payload contract](#8-webhook-payload-contract)
 9. [Embedded UI / dashboard tokens](#9-embedded-ui--dashboard-tokens)
 10. [Migration from 1.0.0](#10-migration-from-100)
@@ -30,7 +32,7 @@ Build a fieldset that runs on the [On Belay](https://app.onbelay.ai) governance
 ## 1. Install
 
 ```bash
-npm install @on-belay/sdk@^2.0.0
+npm install @on-belay/sdk@^2.2.0
 ```
 
 Minimal usage — a complete signed-webhook receiver in five lines:
@@ -106,7 +108,7 @@ Optional: `NEON_CONNECTION_STRING` (per-enrollment, injected when an org has a N
 
 ## 5. Quickstart — Hello World
 
-A fully working sample fieldset lives at [`packages/fieldset-hello-world/`](../fieldset-hello-world/). It is the canonical 2.0.0 reference — start there. The summary:
+A fully working sample fieldset lives at [`packages/fieldset-hello-world/`](../fieldset-hello-world/). It is the canonical reference fieldset — start there. The summary:
 
 ```bash
 # 1. Clone the scaffold (or fork the Hello World fieldset).
@@ -261,6 +263,62 @@ Every HTTP-bound function shares one network contract:
 
 All `/api/sdk/*` success bodies are wrapped on the wire as `{ "data": T }`; errors are `{ "error": { "code", "message" } }`. **The SDK unwraps the envelope for you** — the return types below are the unwrapped `T`. If you bypass the SDK with `curl`, expect the wrapped wire shape.
 
+### Typed integration helpers
+
+*Added in 2.1.0.* The package ships **75 integration modules** — auto-generated typed wrappers over `executeProxyCall`, one per connected integration (`shopify`, `hubspot`, `klaviyo`, `linear`, …). Each helper has the `operationKey` and upstream path baked in, and returns the same `Promise<ProxyResult<T>>` with the **identical retry and error contract** described above. They are a typed convenience layer, not a new transport.
+
+Operations are **namespaced, never bare exports.** Many integrations share operation names (`listOrders`, `listCustomers`), so the SDK exports one namespace object per integration rather than colliding top-level functions. There are three ways to reach a helper:
+
+```ts
+import { shopify, createShopifySubClient, OnbelayClient } from "@on-belay/sdk"
+
+// 1. Namespace object — pass orgId + integrationSlug on every call.
+const a = await shopify.listOrders<MyOrder[]>(orgId, "shopify", {
+  queryParams: { status: "any" },
+})
+
+// 2. Sub-client factory — bind orgId + slug + config once.
+const sc = createShopifySubClient(orgId, "shopify", { fieldsetSlug: "my-fieldset" })
+const b = await sc.listOrders<MyOrder[]>({ queryParams: { status: "any" } })
+
+// 3. Via OnbelayClient — the accessor returns the same bound sub-client.
+const client = new OnbelayClient({ fieldsetSlug: "my-fieldset" })
+const c = await client.shopify(orgId).listOrders<MyOrder[]>()
+```
+
+Helpers that target a single resource take the id as a positional argument. `getLocation` is a **Shopify integration helper** (not a top-level SDK function) — it looks up one location:
+
+```ts
+// Namespace form:
+const loc = await shopify.getLocation<{ location: ShopifyLocation }>(
+  orgId,
+  "shopify",
+  locationId,
+)
+
+// OnbelayClient form — orgId is already bound by the accessor:
+const loc2 = await client.shopify(orgId).getLocation<{ location: ShopifyLocation }>(
+  locationId,
+)
+
+if (loc.ok) console.log(loc.data.location.name)
+```
+
+GraphQL integrations (Linear, Monday) expose helpers that post `{ query, variables }` to `/graphql` — pass the GraphQL document through `options.body`:
+
+```ts
+import { linear } from "@on-belay/sdk"
+
+const issues = await linear.listIssues<{ issues: { nodes: unknown[] } }>(orgId, {
+  body: {
+    query: "query { issues(first: 20) { nodes { id title } } }",
+    variables: {},
+  },
+})
+```
+
+> A typed helper is exactly as permitted as the raw `executeProxyCall` it wraps. It does **not** bypass proxy permission gates — the org must have the integration connected, and the helper's `operationKey` (e.g. `get_location`) must be declared in your fieldset's `requiredOperations`. Calling a helper for an operation you have not declared still returns `403 operation_not_permitted`.
+
 ### `OnbelayConfig`
 
 ```ts
@@ -351,7 +409,7 @@ interface OrgContext {
 interface ConnectedIntegration {
   slug: string
   status: "active" | "error" | "pending"
-  /** Server-allowlisted public config. v2.0.0: shopify → { shopDomain }, others → {}. */
+  /** Server-allowlisted public config. shopify → { shopDomain }, others → {}. */
   extraConfig: Record<string, string | null>
 }
 ```
@@ -425,7 +483,7 @@ function recordPublish(
 
 interface PublishResult {
   count: number          // new running count after this publish
-  freeAllowance: number  // 10 by default in 2.0.0
+  freeAllowance: number  // 10 by default
   billable: boolean      // true once count > freeAllowance
 }
 ```
@@ -440,7 +498,7 @@ const result = await recordPublish(orgId, "product_brief", {
 console.log(`${result.count}/${result.freeAllowance} — billable: ${result.billable}`)
 ```
 
-> **No `idempotencyKey` in 2.0.0.** The atomic upsert on `(orgId, fieldsetId, contentType)` is the only concurrency guarantee. Strict per-key idempotency requires a `BillingIdempotency` table that is deferred to v2.1. Until then, dedupe on `payload.runId` in your handler before calling `recordPublish` so retries don't double-bill.
+> **No `idempotencyKey`.** The atomic upsert on `(orgId, fieldsetId, contentType)` is the only concurrency guarantee. Strict per-key idempotency requires a `BillingIdempotency` table that is deferred to a future release. Until then, dedupe on `payload.runId` in your handler before calling `recordPublish` so retries don't double-bill.
 
 ### `isEnrolled`
 
@@ -467,6 +525,34 @@ const orgs = await getEnrolledOrgs({ fieldsetSlug: "my-fieldset" })
 // → ["clk_abc123", "clk_def456"]
 ```
 
+### `logAction`
+
+```ts
+function logAction(
+  orgId: string,
+  action: string,
+  metadata?: Record<string, unknown>,
+  config?: OnbelayConfig,
+): Promise<{ ok: boolean }>
+```
+
+*Added in 2.2.0.* `POST /api/sdk/orgs/:orgId/audit`. Writes a governance-visible `AuditLog` row for an org-scoped action your fieldset took. `action` must match `/^[a-z0-9_-]+$/` and be at most 128 characters; the platform stores it namespaced as `external_fieldset_<action>`. The `orgId`, your fieldset id, and the timestamp are taken from the verified Bearer token — never from the request body — so the row cannot be spoofed to another org or fieldset.
+
+> **`logAction` is audit-only — it is NEVER billed.** It does not touch any publish counter. Use `recordPublish` when content goes live and should count toward billing; use `logAction` to record everything else worth an audit trail (a sync started, an org skipped, a threshold crossed).
+
+Throws `OnbelayProtocolError` on a 4xx (e.g. `invalid_action` when `action` fails the pattern or length check). Throws `OnbelayTransportError` on transport failure or a platform 5xx after the single retry.
+
+```ts
+const result = await logAction(orgId, "daily_sync_completed", {
+  productsScanned: 142,
+  runId: payload.runId,
+})
+// Stored as AuditLog action "external_fieldset_daily_sync_completed".
+console.log(result.ok) // → true
+```
+
+Also available as an `OnbelayClient` method — `client.logAction(orgId, action, metadata?)`.
+
 ### `validateWebhookSignature`
 
 ```ts
@@ -575,12 +661,20 @@ class OnbelayClient {
     contentType: string,
     metadata?: Record<string, unknown>,
   ): Promise<PublishResult>
+  logAction(
+    orgId: string,
+    action: string,
+    metadata?: Record<string, unknown>,
+  ): Promise<{ ok: boolean }>
   isEnrolled(orgId: string): Promise<boolean>
   getEnrolledOrgs(): Promise<string[]>
+
+  shopify(orgId: string, integrationSlug?: "shopify" | "shopify_temp"): ShopifySubClient
+  // + one accessor per integration (hubspot, klaviyo, linear, …)
 }
 ```
 
-Convenience class that holds an `OnbelayConfig` and exposes the seven HTTP-bound functions as instance methods. Pure ergonomic wrapper — every method delegates to the equivalent free function with the bound config. Constructor throws if `fieldsetSlug` is missing.
+Convenience class that holds an `OnbelayConfig` and exposes the eight HTTP-bound functions as instance methods, plus one bound sub-client accessor per integration (see [Typed integration helpers](#typed-integration-helpers)). Pure ergonomic wrapper — every method delegates to the equivalent free function or sub-client factory with the bound config. Constructor throws if `fieldsetSlug` is missing.
 
 ```ts
 import { OnbelayClient } from "@on-belay/sdk"
@@ -617,7 +711,7 @@ class OnbelayProtocolError extends Error {
 }
 ```
 
-Thrown by HTTP-bound functions that return raw values (`getOrgContext`, `getFieldsetConfig`, `setFieldsetConfig`, `recordPublish`, `isEnrolled`, `getEnrolledOrgs`) when the platform returns a 4xx. **`executeProxyCall` does NOT throw this** — it returns the typed `ProxyResult` envelope so you can branch without a `try/catch`.
+Thrown by HTTP-bound functions that return raw values (`getOrgContext`, `getFieldsetConfig`, `setFieldsetConfig`, `recordPublish`, `logAction`, `isEnrolled`, `getEnrolledOrgs`) when the platform returns a 4xx. **`executeProxyCall` does NOT throw this** — it returns the typed `ProxyResult` envelope so you can branch without a `try/catch`.
 
 ### Public types
 
@@ -632,6 +726,8 @@ The full type surface re-exported from the package root:
 | `EnrolledOrg` | Forward-compatible richer enrollment shape (the function returns `string[]`; this is exposed for typed downstream usage). |
 | `ContentType` | Free-form string alias used by `recordPublish`. |
 | `PublishResult` | `recordPublish` return shape. |
+| `LogActionResult` | `logAction` return shape (`{ ok: boolean }`). |
+| `ShopifySlug` | `"shopify" \| "shopify_temp"` — accepted by the Shopify integration helpers. |
 | `WebhookPayload` | Inbound webhook body. See [§8](#8-webhook-payload-contract). |
 | `WebhookHandlerOptions`, `WebhookHandlerContext`, `WebhookResult` | `createOnbelayWebhookHandler` shapes. |
 | `WebhookVerifyOptions` | Options for `validateWebhookSignature` / handler. |
@@ -673,7 +769,7 @@ X-Onbelay-Timestamp: <ISO 8601, equal to payload.timestamp>
 |---|---|---|
 | `orgId` | yes | The enrolled org this run targets. |
 | `fieldsetSlug` | yes | Your fieldset slug. The handler verifies this matches `options.fieldsetSlug`. |
-| `triggerType` | yes | `scheduled` (daily 8am UTC) or `manual` (owner clicked "Trigger run"). The other three values are reserved for future platform features; the SDK type accepts them but the platform does not currently emit them in 2.0.0. |
+| `triggerType` | yes | `scheduled` (daily 8am UTC) or `manual` (owner clicked "Trigger run"). The other three values are reserved for future platform features; the SDK type accepts them but the platform does not currently emit them. |
 | `timestamp` | yes | ISO 8601. Used together with `maxAgeSeconds` for replay protection. |
 | `runId` | yes | Deterministic: `ofs_<orgFieldsetId>-<YYYYMMDD>-<triggerType>`. Inngest retries on non-200 reuse the same `runId` — dedupe on this and you trivially survive retries. |
 | `neonConnectionString` | optional | Present only when this org has a Neon branch provisioned. Read/write on your branch only. |
@@ -774,6 +870,8 @@ A worked example lives in [`packages/fieldset-hello-world/src/app/dashboard/page
 
 ## 10. Migration from 1.0.0
 
+> **Upgrading from 2.0.0 or later? No code changes.** 2.1.0 (typed integration helpers) and 2.2.0 (`logAction`) are purely additive over 2.0.0 — no exports were removed and no existing signature changed. Upgrading from any 2.x release to 2.2.0 is a no-code `npm install @on-belay/sdk@2.2.0`. The steps below apply **only** to services still on 1.0.0.
+
 `@on-belay/sdk@2.0.0` is a complete rewrite. The 1.0.0 SDK depended on platform internals and could not be installed cleanly outside the On Belay monorepo. 2.0.0 is HTTP-only, framework-agnostic, and has exactly one runtime dependency (`jose`).
 
 ### Removed exports
@@ -791,14 +889,14 @@ These exports do not exist in 2.0.0 — importing them fails at install or compi
 
 ### Other breaking changes
 
-- **`recordPublish` no longer accepts `idempotencyKey`** (Decision B; coming back in v2.1 with a `BillingIdempotency` table). Dedupe on `payload.runId` in your handler instead.
+- **`recordPublish` no longer accepts `idempotencyKey`** (Decision B; coming back in a future release with a `BillingIdempotency` table). Dedupe on `payload.runId` in your handler instead.
 - **`executeProxyCall` signature changed.** New positional arguments: `(orgId, integrationSlug, operationKey, path, options?, config?)`. The `fieldsetSlug` argument is gone — the SDK reads it from `OnbelayConfig`.
 - **The fieldset token is no longer included in the webhook payload.** Read it from `process.env.ONBELAY_FIELDSET_TOKEN`. The SDK does this by default.
 - **`ONBELAY_PROXY_URL` is base URL only** — `https://app.onbelay.ai`. The SDK appends paths internally. The 1.0.0 value ended in `/api/sdk/proxy`; the platform team runs a backfill script for existing services on cutover.
 
 ### Migration checklist
 
-1. `npm install @on-belay/sdk@2.0.0`
+1. `npm install @on-belay/sdk@2.2.0`
 2. Delete imports of the removed exports listed above.
 3. Replace your scheduler/runner setup with `createOnbelayWebhookHandler` from §6.
 4. Update `executeProxyCall` call sites for the new positional signature.
@@ -821,7 +919,7 @@ These exports do not exist in 2.0.0 — importing them fails at install or compi
 | Proxy returns `403 integration_not_connected` | The org has not connected the upstream integration. Skip gracefully — do not throw. The org admin will reconnect on their schedule. |
 | Proxy returns `403 org_not_enrolled` | This org is not enrolled in your fieldset, or enrollment was paused. Check `OrgFieldset.status = "active"`. |
 | Proxy returns `403 fieldset_inactive` | The platform owner deactivated your fieldset (kill switch). Contact On Belay support. |
-| Proxy returns `429 rate_limited` | You exceeded the per-token bucket: 60 proxy calls / 60 s, 30 writes / 60 s, 120 reads / 60 s. Wait 60 seconds before retrying — the bucket refills every 60 s. (`@on-belay/sdk@2.0.0` does not surface the `Retry-After` header on `ProxyResult`; a future patch will.) |
+| Proxy returns `429 rate_limited` | You exceeded the per-token bucket: 60 proxy calls / 60 s, 30 writes / 60 s, 120 reads / 60 s. Wait 60 seconds before retrying — the bucket refills every 60 s. (The SDK does not surface the `Retry-After` header on `ProxyResult`; a future patch will.) |
 | `OnbelayTransportError` with `attempts === 2` | Platform retried once on a 502/503/504 and the second attempt also failed. Catch in your handler, log to Sentry, and let the next scheduled run pick up the work. |
 | `OnbelayTransportError` with `status === 500` | Platform-side bug, not transient. Not retried. Open a support ticket with the run id. |
 | Inngest is retrying my webhook 3× for the same `runId` | Your handler returned 5xx or timed out (>30 s). Implement idempotency on `runId` so retries are cheap, and offload long work to a background queue while returning 200 quickly. |

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 /**
- * @on-belay/sdk@2.0.0 — Public types
+ * @on-belay/sdk — Public types
  *
  * All types used by external fieldset authors are exported from here. The
  * surface matches `docs/onbelay-platform/specs/external-fieldset-sdk-v2-spec.md`
@@ -175,7 +175,7 @@ interface DashboardTokenPayload {
 }
 
 /**
- * @on-belay/sdk@2.0.0 — executeProxyCall + shared HTTP transport
+ * @on-belay/sdk — executeProxyCall + shared HTTP transport
  *
  * `executeProxyCall` is the only sanctioned way for an external fieldset to call
  * a third-party API. Every call is dispatched as
@@ -211,7 +211,7 @@ declare function executeProxyCall<T = unknown>(orgId: string, integrationSlug: s
 }, config?: OnbelayConfig): Promise<ProxyResult<T>>;
 
 /**
- * @on-belay/sdk@2.0.0 — getOrgContext
+ * @on-belay/sdk — getOrgContext
  *
  * Returns the calling fieldset's view of one enrolled org — orgName +
  * connected integrations + server-allowlisted `extraConfig`. Encrypted
@@ -230,7 +230,7 @@ declare function executeProxyCall<T = unknown>(orgId: string, integrationSlug: s
 declare function getOrgContext(orgId: string, config?: OnbelayConfig): Promise<OrgContext>;
 
 /**
- * @on-belay/sdk@2.0.0 — getFieldsetConfig / setFieldsetConfig
+ * @on-belay/sdk — getFieldsetConfig / setFieldsetConfig
  *
  * Read/write the **fieldset namespace** of `OrgFieldset.config` JSON for one
  * enrolled org. The `admin` namespace (used by org admins for config the
@@ -274,7 +274,7 @@ declare function getFieldsetConfig<T = Record<string, unknown>>(orgId: string, c
 declare function setFieldsetConfig<T = Record<string, unknown>>(orgId: string, patch: Partial<T>, config?: OnbelayConfig): Promise<void>;
 
 /**
- * @on-belay/sdk@2.0.0 — isEnrolled / getEnrolledOrgs
+ * @on-belay/sdk — isEnrolled / getEnrolledOrgs
  *
  * Enrollment-state queries scoped to the calling fieldset (the token
  * identifies the fieldset; clients cannot list other fieldsets' enrollments).
@@ -308,7 +308,7 @@ declare function isEnrolled(orgId: string, config?: OnbelayConfig): Promise<bool
 declare function getEnrolledOrgs(config?: OnbelayConfig): Promise<string[]>;
 
 /**
- * @on-belay/sdk@2.0.0 — recordPublish
+ * @on-belay/sdk — recordPublish
  *
  * Increments the org's PublishCounter for this fieldset and content type.
  * v2.0.0 does NOT support an idempotency key (Decision B in spec §15) — the
@@ -354,7 +354,7 @@ interface LogActionResult {
 declare function logAction(orgId: string, action: string, metadata?: Record<string, unknown>, config?: OnbelayConfig): Promise<LogActionResult>;
 
 /**
- * @on-belay/sdk@2.0.0 — validateWebhookSignature
+ * @on-belay/sdk — validateWebhookSignature
  *
  * Self-contained HMAC-SHA256 webhook signature verification.
  *
@@ -391,7 +391,7 @@ declare function logAction(orgId: string, action: string, metadata?: Record<stri
 declare function validateWebhookSignature(rawBody: string | Buffer, signatureHeader: string, secret: string, timestamp?: string, options?: WebhookVerifyOptions): boolean;
 
 /**
- * @on-belay/sdk@2.0.0 — validateDashboardToken
+ * @on-belay/sdk — validateDashboardToken
  *
  * Browser- and Node-compatible JWT verification using `jose`. Validates a
  * dashboard context token issued by the On Belay platform when an org admin
@@ -420,7 +420,7 @@ declare function validateDashboardToken(token: string, secret: string): Promise<
 } | null>;
 
 /**
- * @on-belay/sdk@2.0.0 — createOnbelayWebhookHandler
+ * @on-belay/sdk — createOnbelayWebhookHandler
  *
  * Framework-agnostic webhook handler factory. The returned function takes a
  * raw body string + headers map and returns `{ status, body, headers }` so it
@@ -9842,7 +9842,7 @@ declare const zendesk: {
 };
 
 /**
- * @on-belay/sdk@2.1.0 — OnbelayClient
+ * @on-belay/sdk — OnbelayClient
  *
  * Convenience class that holds an `OnbelayConfig` and exposes the SDK's
  * HTTP-bound functions as instance methods. Pure ergonomic wrapper — every

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * @on-belay/sdk@2.0.0 — Public types
+ * @on-belay/sdk — Public types
  *
  * All types used by external fieldset authors are exported from here. The
  * surface matches `docs/onbelay-platform/specs/external-fieldset-sdk-v2-spec.md`
@@ -175,7 +175,7 @@ interface DashboardTokenPayload {
 }
 
 /**
- * @on-belay/sdk@2.0.0 — executeProxyCall + shared HTTP transport
+ * @on-belay/sdk — executeProxyCall + shared HTTP transport
  *
  * `executeProxyCall` is the only sanctioned way for an external fieldset to call
  * a third-party API. Every call is dispatched as
@@ -211,7 +211,7 @@ declare function executeProxyCall<T = unknown>(orgId: string, integrationSlug: s
 }, config?: OnbelayConfig): Promise<ProxyResult<T>>;
 
 /**
- * @on-belay/sdk@2.0.0 — getOrgContext
+ * @on-belay/sdk — getOrgContext
  *
  * Returns the calling fieldset's view of one enrolled org — orgName +
  * connected integrations + server-allowlisted `extraConfig`. Encrypted
@@ -230,7 +230,7 @@ declare function executeProxyCall<T = unknown>(orgId: string, integrationSlug: s
 declare function getOrgContext(orgId: string, config?: OnbelayConfig): Promise<OrgContext>;
 
 /**
- * @on-belay/sdk@2.0.0 — getFieldsetConfig / setFieldsetConfig
+ * @on-belay/sdk — getFieldsetConfig / setFieldsetConfig
  *
  * Read/write the **fieldset namespace** of `OrgFieldset.config` JSON for one
  * enrolled org. The `admin` namespace (used by org admins for config the
@@ -274,7 +274,7 @@ declare function getFieldsetConfig<T = Record<string, unknown>>(orgId: string, c
 declare function setFieldsetConfig<T = Record<string, unknown>>(orgId: string, patch: Partial<T>, config?: OnbelayConfig): Promise<void>;
 
 /**
- * @on-belay/sdk@2.0.0 — isEnrolled / getEnrolledOrgs
+ * @on-belay/sdk — isEnrolled / getEnrolledOrgs
  *
  * Enrollment-state queries scoped to the calling fieldset (the token
  * identifies the fieldset; clients cannot list other fieldsets' enrollments).
@@ -308,7 +308,7 @@ declare function isEnrolled(orgId: string, config?: OnbelayConfig): Promise<bool
 declare function getEnrolledOrgs(config?: OnbelayConfig): Promise<string[]>;
 
 /**
- * @on-belay/sdk@2.0.0 — recordPublish
+ * @on-belay/sdk — recordPublish
  *
  * Increments the org's PublishCounter for this fieldset and content type.
  * v2.0.0 does NOT support an idempotency key (Decision B in spec §15) — the
@@ -354,7 +354,7 @@ interface LogActionResult {
 declare function logAction(orgId: string, action: string, metadata?: Record<string, unknown>, config?: OnbelayConfig): Promise<LogActionResult>;
 
 /**
- * @on-belay/sdk@2.0.0 — validateWebhookSignature
+ * @on-belay/sdk — validateWebhookSignature
  *
  * Self-contained HMAC-SHA256 webhook signature verification.
  *
@@ -391,7 +391,7 @@ declare function logAction(orgId: string, action: string, metadata?: Record<stri
 declare function validateWebhookSignature(rawBody: string | Buffer, signatureHeader: string, secret: string, timestamp?: string, options?: WebhookVerifyOptions): boolean;
 
 /**
- * @on-belay/sdk@2.0.0 — validateDashboardToken
+ * @on-belay/sdk — validateDashboardToken
  *
  * Browser- and Node-compatible JWT verification using `jose`. Validates a
  * dashboard context token issued by the On Belay platform when an org admin
@@ -420,7 +420,7 @@ declare function validateDashboardToken(token: string, secret: string): Promise<
 } | null>;
 
 /**
- * @on-belay/sdk@2.0.0 — createOnbelayWebhookHandler
+ * @on-belay/sdk — createOnbelayWebhookHandler
  *
  * Framework-agnostic webhook handler factory. The returned function takes a
  * raw body string + headers map and returns `{ status, body, headers }` so it
@@ -9842,7 +9842,7 @@ declare const zendesk: {
 };
 
 /**
- * @on-belay/sdk@2.1.0 — OnbelayClient
+ * @on-belay/sdk — OnbelayClient
  *
  * Convenience class that holds an `OnbelayConfig` and exposes the SDK's
  * HTTP-bound functions as instance methods. Pure ergonomic wrapper — every

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@on-belay/sdk",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "private": false,
   "publishConfig": {
     "access": "public"
   },
-  "description": "On Belay fieldset SDK — HTTP-only contract between the platform and external fieldsets (v2.0.0).",
+  "description": "On Belay fieldset SDK — HTTP-only contract between the platform and external fieldsets.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",