mirror of
https://github.com/hanzoai/js-sdk.git
synced 2026-10-30 15:02:31 +00:00
zeekayandHanzo Dev
d8b09a274d
Every Hanzo SDK offers the same six capabilities in the same six words. Go and
Python hang them off a client that already existed; TypeScript had none, so it
gains one — `Client`, holding an IAM client id and secret and minting its own
access token (client_secret_basic, RFC 8707 `resource`, held until 60s before
expiry, re-minted once on a 401). It takes no bearer and reads no
HANZO_API_KEY: a credential the SDK is handed is one nobody rotates and one
that says nothing about who is calling.
A refused budget and a refused policy are ANSWERS. `Answer<T>` is a union
discriminated on a literal tag — ok{value} | denied{code, reason, product?,
cures[]} | held{id, clause, reason}, all three carrying the x-request-id that
joins a call to its audit row — so `a.value` does not typecheck until the union
is narrowed and a switch that forgets an arm does not compile. The mapping from
HTTP to arm lives in one function; no capability can grow a rule of its own.
Exceptions stay for outcomes with no decision in them.
The layer is hand-written because the routes it needs are the ones the document
states as an address and not as a shape: /v1/authz/check declares neither a
request body nor a response, /v1/billing/balance and /usage declare no
response. Those three are modelled from what the served handlers read and
write, measured. It sits in src/ beside the generated tree because .generated
is the driver's manifest of what it owns — a file it does not name is this
repo's own and a regeneration never touches it — and the package entry moves to
src/hanzo.ts, which re-exports the generated src/index.ts and adds the client
beside it. Capability types are namespaced (budget.Allowance, search.Hit,
audit.Event, graph.Fact) because thirteen of the contract's names already
belong to generated models.
policy.check sends {subject, verb, path}, which is what
hanzoai/[email protected] serve/use.go reads, not the {sub, obj, act} the route's
own openapi.Describe prose states. The caller still says (sub, act, obj). The
prose and the handler are one fact and should be made to agree upstream.
Gates: `npm run wire` runs the six against a scripted fetch, asserting the
exact request each sends and decoding a realistic answer including both of
cloud's 402 bodies, a 202 hold and a 403 that is not a refusal. examples/six
drives all six in one pass against the live API and is type-checked with the
rest. The agent and tools flows are repaired for the tag names the current
document singularized (AgentsApi -> AgentApi, getTools -> getTool).
Co-authored-by: Hanzo Dev <[email protected]>
29 lines
1.2 KiB
JSON
29 lines
1.2 KiB
JSON
{
|
|
// Examples are type-checked, never emitted — CI runs `npm run examples`, which
|
|
// is the gate that they still compile against the regenerated client.
|
|
//
|
|
// `paths` maps the package's own name onto the package entry, so every example
|
|
// imports `from 'hanzoai'` exactly as a consumer would instead of reaching up a
|
|
// relative path no user would ever write. That entry is src/hanzo.ts, which
|
|
// re-exports the generated client and adds the hand-written one beside it —
|
|
// src/index.ts is the generated half alone and would leave `Client` unreachable.
|
|
"extends": "../tsconfig.json",
|
|
"compilerOptions": {
|
|
"noEmit": true,
|
|
"rootDir": "..",
|
|
"module": "ESNext",
|
|
// The generated client writes extensionless relative imports; node16
|
|
// resolution would reject every one of them. Bundler resolution is what the
|
|
// ESM half of the build already uses for the same reason.
|
|
"moduleResolution": "Bundler",
|
|
"paths": {
|
|
"*": ["./*"], "hanzoai": ["../src/hanzo.ts"] },
|
|
"types": ["node"],
|
|
"strict": true
|
|
},
|
|
// The root config excludes `examples` (so the shipped build never emits them).
|
|
// Inherited as-is that would exclude this project's only inputs, so reset it.
|
|
"exclude": [],
|
|
"include": ["**/*.ts"]
|
|
}
|