@xkova/sdk 0.1.0-alpha.1 → 0.1.0-alpha.2

package/README.md

@@ -6,7 +6,7 @@ holders, wallets, payments, tokenization, and other customer resources.
 ## Install
 
 ```bash
-npm install @xkova/sdk@0.1.0-alpha.1
+npm install @xkova/sdk@0.1.0-alpha.2
 ```
 
 Requires Node.js 22 or newer. Keep this package and your API keys on the server.
@@ -412,7 +412,7 @@ import { verifyWebhookSignature } from '@xkova/sdk/webhook';
 import type { components, paths } from '@xkova/sdk/types';
 ```
 
-Pass the raw request body to `verifyWebhookSignature`. The `types` subpath contains only the customer operations included in this SDK release.
+Pass the raw request body to `verifyWebhookSignature`. Import request and response types from `@xkova/sdk/types`.
 
 The package also exposes `@xkova/sdk/rwa-verify` for offline RWA transparency proof verification and `@xkova/sdk/abi` for the documented customer contract ABIs.
 
@@ -432,14 +432,6 @@ idempotency, and settlement. It links the public customer OpenAPI and expanded
 documentation. Installed declarations determine the methods available in your
 version; live documentation may describe a newer release.
 
-## Thirdweb and dependencies
-
-The only direct runtime dependency is `viem`, used for offline RWA signature
-verification. This SDK does not import Thirdweb. The optional `@xkova/browser`
-browser companion has no runtime dependencies. XKOVA manages wallet signing,
-and API provider metadata may name Thirdweb. You do not need to install its SDK
-or obtain Thirdweb credentials.
-
 ## Contributing
 
 Run `pnpm check` from the source repository root before committing. The

package/llms.txt

@@ -22,7 +22,6 @@ Use this package on a Node.js 22+ server. Read the installed declarations before
 1. Server business integration: create XKOVAClient.forTenant({ baseUrl, apiKey }). Use https://sandbox-api.xkova.com for sandbox and https://api.xkova.com for production. The API key binds the workspace and mode.
 2. Member application: use XKOVAMemberBffClient from @xkova/sdk/member-bff in your BFF. Resolve confidential sessions to request-scoped resources with resolveResources(). The browser sends only its application cookie and CSRF proof to your BFF.
 3. Browser companion: optionally install @xkova/browser. It calls your same-origin routes; it does not create those routes or install a session store.
-4. Institution staff and management: use the Console and its documented setup flows. Do not invent customer SDK methods for API-key lifecycle, treasury administration, staff governance, or platform management.
 
 ## Find a capability
 
@@ -58,7 +57,7 @@ API availability does not grant permission. Product entitlement, selected API-ke
 ## Requests and results
 
 - Start with the README's sandbox read example. Validate required environment variables on the server; never emit their values into logs, generated files, browser bundles, or prompts.
-- Use exported package entry points and typed resource methods. Do not import dist files as runtime subpaths, use private endpoints, fabricate request fields, or suppress type errors with any.
+- Use exported package entry points and typed resource methods. Do not import dist files as runtime subpaths, fabricate request fields, or suppress type errors with any.
 - Production writes require the bearer key plus an active asymmetric requestSigner credential. Its async callback signs through your key provider. The SDK supplies RFC 9421 signatures and RFC 9530 digests. Production reads use bearer authentication.
 - Generate one idempotency key before a logical mutation and persist it. Reuse it only with the identical request. The SDK does not automatically retry writes. A timeout or disconnect can leave the outcome unknown; reconcile the existing resource before starting another operation.
 - Use decimal strings for monetary values according to the request type. Preserve asset and chain identity throughout a flow. Do not perform monetary calculations with JavaScript floating-point numbers.
@@ -75,10 +74,6 @@ API availability does not grant permission. Product entitlement, selected API-ke
 - Reuse one createMemberActionReference() from @xkova/browser for a durable review. Save the draft before setup detours. Expired or missing reviews require checking activity and an explicit new review.
 - Setup readiness is advisory. beginMemberAction() and completeMemberAction() obtain fresh approval for the exact resource. Browser code must not receive provider wallet credentials or internal signing capabilities. Completion of authorization is distinct from execution and settlement.
 
-## Dependencies
-
-The server SDK uses viem for offline RWA signature verification. The browser companion has no runtime dependencies. Neither imports Thirdweb. You may see Thirdweb in API provider metadata, but these integrations require no Thirdweb SDK or credentials.
-
 ## Before handing off code
 
 List the Console setup and stores the application needs. Test denied access, uncertain writes, pagination, cancellation, and terminal outcomes. Report a missing method or setup requirement explicitly. Do not invent methods, suppress type errors, or bypass authorization to make an example run.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xkova/sdk",
-  "version": "0.1.0-alpha.1",
-  "description": "Server-side TypeScript client for the XKOVA customer API, with customer-only generated types and production request signing.",
+  "version": "0.1.0-alpha.2",
+  "description": "TypeScript SDK for the XKOVA API.",
   "homepage": "https://docs.xkova.com",
   "repository": {
     "type": "git",