@synap-core/sdk 1.0.0 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synap-core/sdk",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Type-safe tRPC client SDK for Synap data pods",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -11,12 +11,28 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./public": {
+      "types": "./dist/public.d.ts",
+      "import": "./dist/public.js",
+      "require": "./dist/public.cjs"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js",
+      "require": "./dist/testing.cjs"
     }
   },
   "files": [
     "dist",
-    "src"
+    "src",
+    "!src/__tests__"
   ],
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
   "keywords": [
     "synap",
     "sdk",
@@ -24,7 +40,7 @@
     "data-pod"
   ],
   "dependencies": {
-    "@synap-core/api-types": "^1.23.3",
+    "@synap-core/api-types": "^1.25.7",
     "@trpc/client": "^11.10.0",
     "superjson": "^2.2.6"
   },
@@ -48,9 +64,5 @@
     "url": "https://github.com/synap/synap-app.git",
     "directory": "packages/sdk"
   },
-  "license": "MIT",
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit"
-  }
-}
+  "license": "MIT"
+}

package/src/client.ts

@@ -7,7 +7,7 @@
  *
  * const synap = createSynapClient({
  *   podUrl: "https://pod.example.com",
- *   apiKey: "sk_live_...",
+ *   sessionToken: "<Kratos session token>",
  *   workspaceId: "ws_...",
  * });
  *
@@ -33,8 +33,8 @@ export interface SynapClientOptions {
   podUrl: string;
 
   /**
-   * Ory Kratos session token (for example, from the Pod's
-   * `/api/federation/exchange` endpoint).
+   * Ory Kratos session token (the `session_token` a Kratos API / native
+   * login flow returns).
    * Sent as `X-Session-Token` header — preferred for non-browser clients
    * like extensions, CLI tools, and mobile apps.
    * @example "oathkeeper_token_..."
@@ -42,10 +42,13 @@ export interface SynapClientOptions {
   sessionToken?: string;
 
   /**
-   * API key for authentication (Bearer token).
-   * Generate one in your workspace developer settings.
+   * LOCAL_MODE token only (the desktop host's `LOCAL_AUTH_TOKEN`), sent as
+   * `Authorization: Bearer`. `/trpc` sits behind Ory session auth, so a real
+   * pod refuses hub / user API keys (`synap_hub_*`, `synap_user_*`) with a 401;
+   * this client throws early if given one. Use `@synap-core/hub-rest-client`
+   * against `/api/hub/*` for hub / user API keys, or `sessionToken` / cookies
+   * for a signed-in user.
    * If omitted, the client falls back to cookie-based Kratos session auth.
-   * @example "sk_live_abc123..."
    */
   apiKey?: string;
 
@@ -75,6 +78,13 @@ export interface SynapClientOptions {
   onAuthError?: (error: { status: number; message: string }) => void;
 }
 
+/**
+ * Prefixes of hub / user API keys (SSOT: `KEY_PREFIXES` in synap-backend
+ * `packages/database/src/schema/api-keys.ts`; hub_inbound keys use `synap_hub_`).
+ * The LOCAL_MODE token is random bytes and never starts with these.
+ */
+const HUB_KEY_PREFIXES = ["synap_hub_", "synap_user_"] as const;
+
 /**
  * Creates a fully-typed tRPC client connected to a Synap data pod.
  *
@@ -86,6 +96,13 @@ export function createSynapClient(
 ): CreateTRPCClient<AppRouter> {
   const { podUrl, apiKey, workspaceId, extraHeaders, onAuthError } = options;
 
+  if (apiKey && HUB_KEY_PREFIXES.some((p) => apiKey.startsWith(p))) {
+    throw new Error(
+      "createSynapClient: this is a hub/user API key; /trpc only accepts a session or the local-mode token. " +
+        "Use @synap-core/hub-rest-client against /api/hub/* instead.",
+    );
+  }
+
   const url = `${podUrl.replace(/\/$/, "")}/trpc`;
 
   // Base fetch: always include credentials so session cookies are sent in
@@ -177,7 +194,7 @@ export function createSynapClient(
         headers: () => ({
           // Session token mode (Kratos, preferred for non-browser clients)
           ...(options.sessionToken ? { "x-session-token": options.sessionToken } : {}),
-          // API key mode (Bearer, for legacy SDK usage)
+          // LOCAL_MODE token (Bearer); hub/user API keys are rejected above
           ...(apiKey && !options.sessionToken ? { Authorization: `Bearer ${apiKey}` } : {}),
           ...(workspaceId ? { "x-workspace-id": workspaceId } : {}),
           ...extraHeaders,

package/src/index.ts

@@ -1,2 +1,15 @@
 export { createSynapClient } from "./client";
 export type { SynapClient, SynapClientOptions, AppRouter } from "./client";
+export {
+  ensureTemplate,
+  ensuredWorkspaceId,
+  parseEnsureTemplateResult,
+} from "./templates";
+export type {
+  EnsureTemplateClient,
+  EnsureTemplateInput,
+  EnsureTemplateMissingTemplate,
+  EnsureTemplateOptions,
+  EnsureTemplateResult,
+  EnsureTemplateStatus,
+} from "./templates";