i99dash docs

When in doubt, this is the source of truth for terminology. Alphabetical.

admin client

The privileged client exported from i99dash (alongside the runtime MiniAppClient). Lets a mini-app run device-side commands (pm.*, sys.*, diag.*, fs.*). Mini-apps run with full host capability — there is no manifest-side permission system.

allow-list (network egress)

The set of external HTTPS origins a mini-app may reach, declared by the developer in manifest.network. The car host turns it into a per-app Content-Security-Policy and blocks every undeclared origin. Replaces the old host-side route allow-list — there is no longer any ops-managed path mapping. See Calling an external API.

app id

The first field in manifest.json. URL-safe, globally unique, baked into pinned home-screen shortcuts on every user's device. Rotating it orphans every shortcut. Pick something you won't regret.

beta track

A separate catalog pointer that ships a build to a limited cohort of testers (≤ 25 per app) before promoting to production. See Beta testing.

bridge

The JavaScript object the host injects on window.__i99dashHost (and friends) when it loads a mini-app. The "bridge" is the only seam between your code and the outside world. Your code never touches it directly — MiniAppClient wraps it. See The bridge.

brand

A car-payload field, separate from deviceId. Lowercase wire string drawn from a fixed enum ('byd' | 'geely' | 'nio' | 'tesla'). Redundant with the prefix in deviceId but carried as its own field so consumers can match/route without parsing the prefix; the host rejects mismatched pairs with HTTP 422. Also drives the {brand} segment of MQTT topics so Mosquitto ACLs can authorize per-brand without parsing JSON.

bundle

The tarball your CLI uploads to the CDN. Contains your built static files plus manifest.json. Identified by a SHA-256; immutable once uploaded.

cap (capability token)

In i99dash: a 30-day token the host stores after the user consents at install. The cap lives in the host's encrypted SQLite, never in the mini-app's bundle. Each privileged op the host attaches the right cap before forwarding to the device-side executor.

catalog

The backend table of published mini-apps. publish writes a new row keyed by (id, version); the host's store reads from it.

context

The snapshot the host returns from getContext(): userId, activeCarId (BYD device ID), locale, isDark, appVersion, appId. Stable for the life of one app launch — read once, cache, don't poll.

device ID (`deviceId` / `device_id`)

The activeCarId field in the context, and the routing key the host uses for everything car-scoped. A stable per-head-unit identifier carried as a brand-prefixed canonical: <brand>:<native_id>, e.g. byd:BYDMCKLE0PARD8801. The prefix is always present in payloads, DB rows, Redis keys, HTTP path segments, and JWT claims; the only place the prefix is stripped is the brand segment of an MQTT topic (cars/byd/BYDMCKLE…/…), where the brand already lives in a preceding segment.

For the BYD adapter, the un-prefixed native ID comes from the head unit's persist.sys.cloud.last_vin system property — typically a BYDXXXXXXXXXXXXXXX token. It is not the chassis VIN (the legal ISO 3779 17-character identifier on the vehicle); third-party apps on DiLink can't read the chassis VIN. Treat as a device pseudonym: useful for binding state to "this car," but not for cross-system lookups.

Still treat it as sensitive in user-facing UI — render only the last 4 characters. See Best practices › privacy.

The TypeScript field is deviceId: string; the wire field is device_id. A separate brand: 'byd' | 'geely' | 'nio' | 'tesla' field is carried alongside it on every car-scoped payload. See the v4 multi-brand note for the full shape and the rationale for the prefix.

device cert

A per-installation certificate the backend mints when a user installs your privileged mini-app. The host attaches it to admin operations; the executor checks it for revocation. Affects which apps a user sees in the catalog.

dev-server

i99dash/dev-server, run via i99dash dev. Boots a local HTTP server on port 5173, injects a bridge shim that fakes getContext() + the car-status simulator, and exposes a control panel at /_sdk/ui for live driving / device ID / locale / theme toggles. External fetch() calls go straight to the real origin — the on-car CSP isn't enforced in dev. Same code paths as production.

flight test

The pre-flight checklist run during a beta cycle, before promoting to production. Verifies safety gate, context handling, network paths, subscription cleanup, and crash/recovery. See Flight test.

gitlink

A git tree entry of mode 160000 that records a submodule's pinned commit SHA. The doc site reads vendor/i99dash-sdk's gitlink at build time to pin the SDK version it generates API pages from.

head-unit

The car's in-dash display where i99dash runs. Roughly an entry-level phone from 2018. Cold start matters — keep your bundle small.

host

Singular: the i99dash Flutter app running on the head-unit. It owns the WebView, the bridge, the catalog UI, and the safety gate. Sometimes also used to mean "the host process" or "the host repo" — context disambiguates.

llms.txt

The well-known path (/llms.txt) where AI tooling looks for a human- and machine-readable index of a doc site. We expose it + /llms-full.txt (every page concatenated) + /llms.mdx/<slug> (per-page markdown). Standard convention for coding agents.

manifest

manifest.json at the project root. The catalog row for your app: id, name (per locale), icon (bundle-relative path), coverImage, screenshots, url, version, category (closed enum), tags, permissions, minHostVersion, safeWhileDriving. The CLI's validate command zod-checks it; the publish flow rewrites icon / coverImage / screenshots paths to absolute CDN URLs at submit time.

MCP

Model Context Protocol. The wire spec coding assistants speak to fetch external context. We expose a Streamable-HTTP MCP server at /api/mcp with five tools (list_sections, list_packages, list_symbols, search_docs, get_doc). See MCP server.

minHostVersion

A field in manifest.json that gates which host versions can install your mini-app. Bump it the moment you start using a new host feature; the catalog hides your app from users on older hosts instead of installing-then-crashing.

mini-app

A static HTML/JS/CSS bundle the i99dash host loads inside a sandboxed WebView. The thing this whole platform exists to ship. See What is a mini-app?.

network (manifest field)

Optional manifest.network: an array of up to 10 bare HTTPS origins (https://host[:port] — no path, query, wildcard, IP literal, or localhost) the mini-app may reach with fetch(). The car host enforces it as a per-app Content-Security-Policy; undeclared origins are blocked, including redirect targets. Declared egress is unauthenticated — no i99dash credentials are attached. Omit ⇒ no third-party network. See Calling an external API.

production track

The default catalog pointer. Every user sees the bundle on next launch. Counterpart to the beta track.

safeWhileDriving

A manifest boolean. When true, the host shows your app while the car is moving (≥ ~5 km/h). When false or unset, the host shows "not available while driving" instead. Choose carefully; affects the safety review.

CLI

The i99dash binary, shipped inside the i99dash package on public npm. Invoked as i99dash <command> after install, or via pnpm dlx i99dash <command>. Provides init, dev, validate, build, publish, login, logout, whoami, doctor, status, perms, and the beta * subtree.

Glossary