SDK Overview

@dataprism/sdk is the client-side core of DataPrism, in TypeScript, embeddable anywhere: browser, Node backend, or a script. It exposes a single API for three jobs:

Drive the public registry: create prisms, read and write data slots, whether or not the user pays network fees themselves.
Encrypt and decrypt: keys derived from a signature, never stored.
Store files: chunking, Reed-Solomon erasure coding, multi-cloud dispersion, and quorum-based reconstruction.

It is ESM, strict TypeScript, and pulls in no heavy cloud SDK. Dependencies: viem (peer, 2.0 or later), @noble/curves, @noble/ciphers, @noble/hashes.

Install

npm install @dataprism/sdk viem

Quick start

import { DataPrismClient, DataPrismNetwork, DEMO } from "@dataprism/sdk";
 
const network = new DataPrismNetwork(DEMO, "https://rpc.example.com");
 
// direct mode (default): the user's account pays network fees
const client = new DataPrismClient(network, { accountClient });
 
// api mode: a relayer fronts the fees, reimbursed in DPC
const client = new DataPrismClient(network, {
  accountClient,
  apiUrl,
  mode: "api",
});
 
// read-only: no account at all
const client = new DataPrismClient(network);

The entry point is DataPrismClient, a lazy facade that builds its sub-clients on first access:

Getter	Type	Needs an account
`reader`	`NetworkReader`	no
`execution`	`ExecutionLayer`	yes
`signer`	`DataPrismSigner`	yes
`prism(std, cloudId?)`	`PrismManager`	yes

Layered architecture

                 YOUR APPLICATION
                       │
   ┌───────────────────▼───────────────────────────────────────┐
   │ STANDARD   CloudStandard / CloudReader   prism slots       │
   ├────────────────────────────────────────────────────────────┤
   │ CRYPTO     DataPrismKey   keys + seal/open                 │
   ├────────────────────────────────────────────────────────────┤
   │ FILES      FilePipeline + ReedSolomon                      │
   │ STORAGE    StorageProvider (signed URLs, Memory)           │
   ├────────────────────────────────────────────────────────────┤
   │ EXECUTION  ExecutionLayer (direct | api)   writes          │
   │ READING    NetworkReader      SIGNING  DataPrismSigner     │
   ├────────────────────────────────────────────────────────────┤
   │ NETWORK    DataPrismNetwork (network id, RPC, addresses)   │
   └────────────────────────────────────────────────────────────┘
                       │
        DataPrism public registry  ←  encrypted indexes
                       │
   Storage providers (S3 / R2 / Scaleway …)  ←  file shards

Golden rule: each layer only knows the one directly beneath it. Your application talks to the top; the network and the buckets sit at the bottom.

Importable modules (subpaths)

Everything is re-exported from the root @dataprism/sdk, and each module is also importable on its own subpath.

import { DataPrismClient } from "@dataprism/sdk"; // facade
import { DataPrismNetwork, DEMO } from "@dataprism/sdk/network";
import { accountExecution } from "@dataprism/sdk/execution";
import { DataPrismSigner } from "@dataprism/sdk/signing";
import { ApiWriter } from "@dataprism/sdk/api";
import { DataPrismKey } from "@dataprism/sdk/crypto";
import { CloudStandard, CloudReader } from "@dataprism/sdk/standard";
import { PrismManager } from "@dataprism/sdk/prism";
import { initProviders, signedUrlFactories } from "@dataprism/sdk/storage";
import { TenantScopeKeyring } from "@dataprism/sdk/tenants";
import { FilePipeline } from "@dataprism/sdk/files";
import { CustomerEvidenceJournal } from "@dataprism/sdk/evidence";

Subpath	Role	Main exports	Docs
`/network`	the "where" (network, RPC, addresses) plus low-level reads	`DataPrismNetwork`, `DEMO`, `NetworkReader`, `computeCloudId`	Client & networks, Reading
`/execution`	unified write layer	`ExecutionLayer`, `AccountExecution`, `ApiExecution`	Writing & execution
`/signing`	typed request signatures	`DataPrismSigner`, `hashBytes32Array`, `hashPayloadsArray`	Writing & execution
`/api`	delegated execution REST client	`ApiWriter`, `extractCloudId`	Writing & execution
`/crypto`	prism keys and encryption	`DataPrismKey`, `seal`, `open`	Keys & encryption
`/standard`	prism slots (codec plus decrypting reads)	`CloudStandard`, `CloudReader`, `SLOT_IDS`	Cloud Standard slots
`/prism`	high-level prism lifecycle	`PrismManager`	Cloud Standard slots
`/storage`	storage connectors	`StorageProvider`, `MemoryProvider`, `SignedUrlProvider`, `initProviders`	Storage providers
`/tenants`	self-custodied tenant scope-key lifecycle	`TenantScopeKeyring`, `TenantScopeKeyStore`	Tenant scope keys
`/files`	file pipeline	`FilePipeline`, `ReedSolomon`, `FastCDCChunker`, `convergentSeal`	File pipeline
`/evidence`	customer-owned append-only evidence journal	`CustomerEvidenceJournal`, `EvidenceJournalStore`	Evidence journal

End-to-end at a glance

Create your project in the dashboard, then open its SDK tab and copy the Project ID (cloudId) and Secret key. The file pipeline also requires a client-held 32-byte scopeKey: generate it once per prism, persist and back it up with the prism secrets, and distribute it only to authorized members. Restore that same value for every scoped upload or download.

// 1. Project ID and Secret key, copied from the project's SDK tab
const cloudId = "<project-id>";
const key = DataPrismKey.fromSecret(secretKey, {
  curve: "secp256k1",
  algorithm: "aes-256-gcm",
});
const std = new CloudStandard(key);
 
// 2. Initialize providers from non-secret project metadata. The access token
// authenticates only to your own signing service and is never stored in the prism.
const storage = initProviders(
  await std.reader(client.reader, cloudId).providers(),
  signedUrlFactories({
    getSignerHeaders: async () => ({
      authorization: `Bearer ${await getStorageToken()}`,
    }),
  }),
);
 
// 3. upload a file (dispersed multi-cloud); the index is written to the network
// Application-owned helper; see /sdk/files for its fail-closed load contract.
const scopeKey = await loadPrismScopeKey(cloudId);
const pipeline = new FilePipeline({
  providers: storage,
  standard: std,
  scopeKey,
  execution: client.execution,
  cloudId,
});
await pipeline.upload("report.pdf", bytes, {
  chunkSize: 65536,
  dataShards: 4,
  parityShards: 2,
});
 
// 4. read it back
const view = std.reader(client.reader, cloudId);
const index = await view.file("report.pdf");
const bytes = await pipeline.download(index);

Prisms can also be created entirely from code, and keys can be derived from an account signature instead of pasted; see Cloud Standard slots and Keys & encryption. Each step is detailed in the pages that follow. If you are new to the concepts, start with Prisms & the Cloud Standard.