Browser & Security

Use the ESM entry with an ESM-aware bundler for tree shaking:

{
  "sideEffects": false
}

Direct browser usage requires bundling the bare Zod dependency or providing it through an import map.

Local browser usage requires no API key.

Production browser applications should communicate through your authenticated application backend. Never embed a server API key in client-side code.

Cross-origin HTTP servers must explicitly allow:

• Your application origin

• POST

• SDK request headers

CommonJS consumers can use:

const { FourBTDClient } = require('@fourbtd/sdk');

Read SECURITY.md for trust boundaries and privacy considerations.

An offchain assertion does not become true simply because its hash is recorded onchain. Inventory transfers also do not transfer blockchain assets.

Treat context and memory as untrusted application content when constructing AI prompts.