SDKs

TypeScript

@cresva/osp version 0.2.1, published 2026-09-15, MIT licensed. Requires Node >=18.

npm install @cresva/osp

yarn add @cresva/osp

pnpm add @cresva/osp

bun add @cresva/osp

Types are included. There is no separate @types package.

Fixed in 0.2.1: the default baseUrl

0.2.1 defaults baseUrl to https://cresva.ai, which is where the storefront routes are. A client constructed with no options works.

In 0.2.0 and earlier it defaulted to https://api.cresva.ai, which serves the discovery documents and the platform API and returns 404 for every /api/storefront/* path. A client with no options could call discover() and nothing else. If you are pinned to 0.2.0, pass baseUrl explicitly or upgrade.

import { CresvaClient } from "@cresva/osp";

// 0.2.1: this works. baseUrl defaults to https://cresva.ai.
const client = new CresvaClient();

// Still fine, and what you need on 0.2.0 or earlier.
const explicit = new CresvaClient({ baseUrl: "https://cresva.ai" });

What the client covers

Seven methods. Each maps to one endpoint.

import { CresvaClient } from "@cresva/osp";

const client = new CresvaClient({ baseUrl: "https://cresva.ai" });

const { products } = await client.products.list(BRAND_ID, { limit: 2 });
const trust = await client.trust.get(BRAND_ID);

console.log(products[0].title, trust.tier);

What it does not cover

client.transactions.* and client.feedback.* exist in the types and throw NotImplementedError when called. They are there so the shape is discoverable, not because they work.

Checkout sessions, offers, bundles, the confirmation window and the platform feeds have no client methods at all. Call them with cURL or with fetch.

There is no @cresva/osp/testing entry point. The package exports . and ./package.json and nothing else, so an import of any other subpath will fail to resolve.

Reading a trust component

TrustScore.components types each field as number | null in 0.2.1, which matches what the API returns: null for any component it could not measure. In 0.2.0 all seven were typed number, so TypeScript did not warn you.

Either way, read measured_components before trusting a component value. A null tells you the component was not measured; it does not tell you the storefront scored badly, and the two are easy to conflate in a filter.

Errors

import { CresvaApiError, CresvaNetworkError } from "@cresva/osp";

try {
  await client.products.list(BRAND_ID);
} catch (err) {
  if (err instanceof CresvaApiError && err.status === 429) {
    // Over the rate limit. Read Retry-After and back off.
  } else if (err instanceof CresvaNetworkError) {
    // Never reached the server.
  } else {
    throw err;
  }
}

Older names

The client has been published under three names. The older two are deprecated on npm and still installable, so nothing you have already shipped breaks. Their deprecation notices are reproduced here exactly as the registry serves them.

Python

There is no Python client. The name cresva is reserved on PyPI at version 0.0.2, and the package's own summary says what it is:

Name reservation for the official Cresva Python client. Not yet functional; call the API over HTTP.

Do not install it. It will install cleanly and give you nothing to import, which is a worse failure than a name that 404s: a package manager that succeeds tells you nothing is wrong. Call the API over HTTP with requests or httpx until a real client exists.

Every language

The API is JSON over HTTP with a bearer token, and most of it needs no token at all. A client is a convenience, never a requirement.

curl "https://cresva.ai/api/storefront/$BRAND_ID/products?limit=2"