@avaprotocol/sdk-js 3.1.0 → 3.2.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @avaprotocol/sdk-js
 
+## 3.2.1
+
+### Patch Changes
+
+- 3ce791f: `buildAuthMessage` now rejects URIs without an explicit `http:` or `https:` scheme.
+
+  The WHATWG URL parser accepts strings like `localhost:3000` as valid URLs with scheme `localhost`, so the previous validation (`new URL(uri)` inside a try/catch) let bare authority strings through. A signature scoped to a phantom `localhost:` scheme can't be trusted by anything verifying against the real origin — callers passing such values were getting incorrect behavior.
+
+  Existing callers using `http://localhost:3000`, `https://app.example.com`, etc. are unaffected.
+
+## 3.2.0
+
+### Minor Changes
+
+- 8ea2a5b: Extend the catalog re-export surface and bump `@avaprotocol/protocols` to `^0.6.0`.
+
 ## 3.1.0
 
 ### Minor Changes

package/dist/index.js

@@ -34,12 +34,14 @@ __export(index_exports, {
   OperatorsResource: () => OperatorsResource,
   Protocols: () => import_protocols2.Protocols,
   SecretsResource: () => SecretsResource,
+  Tokens: () => import_protocols2.Tokens,
   TokensResource: () => TokensResource,
   Triggers: () => Triggers,
   TriggersResource: () => TriggersResource,
   WalletsResource: () => WalletsResource,
   WorkflowsResource: () => WorkflowsResource,
   buildAuthMessage: () => buildAuthMessage,
+  lookupToken: () => import_protocols2.lookupToken,
   signAuthMessage: () => signAuthMessage
 });
 module.exports = __toCommonJS(index_exports);
@@ -208,11 +210,22 @@ function buildAuthMessage(input) {
       "buildAuthMessage: uri must be a non-empty string (the origin the user is signing into, e.g. window.location.origin)."
     );
   }
+  let parsed;
   try {
-    new URL(trimmedUri);
+    parsed = new URL(trimmedUri);
   } catch {
     throw new Error(
-      "buildAuthMessage: uri must be a valid URL (e.g. window.location.origin)."
+      `buildAuthMessage: uri must be a valid URL (got ${JSON.stringify(trimmedUri)}); use the http(s) origin the user is signing into.`
+    );
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(
+      `buildAuthMessage: uri scheme must be http or https (got ${parsed.protocol}); use the origin the user is signing into.`
+    );
+  }
+  if (!parsed.hostname) {
+    throw new Error(
+      `buildAuthMessage: uri must include a host (got ${JSON.stringify(trimmedUri)}); use the origin the user is signing into.`
     );
   }
   if (!Number.isInteger(input.chainId) || input.chainId <= 0) {
@@ -1007,11 +1020,13 @@ var import_protocols2 = require("@avaprotocol/protocols");
   OperatorsResource,
   Protocols,
   SecretsResource,
+  Tokens,
   TokensResource,
   Triggers,
   TriggersResource,
   WalletsResource,
   WorkflowsResource,
   buildAuthMessage,
+  lookupToken,
   signAuthMessage
 });

package/dist/index.mjs

@@ -162,11 +162,22 @@ function buildAuthMessage(input) {
       "buildAuthMessage: uri must be a non-empty string (the origin the user is signing into, e.g. window.location.origin)."
     );
   }
+  let parsed;
   try {
-    new URL(trimmedUri);
+    parsed = new URL(trimmedUri);
   } catch {
     throw new Error(
-      "buildAuthMessage: uri must be a valid URL (e.g. window.location.origin)."
+      `buildAuthMessage: uri must be a valid URL (got ${JSON.stringify(trimmedUri)}); use the http(s) origin the user is signing into.`
+    );
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(
+      `buildAuthMessage: uri scheme must be http or https (got ${parsed.protocol}); use the origin the user is signing into.`
+    );
+  }
+  if (!parsed.hostname) {
+    throw new Error(
+      `buildAuthMessage: uri must include a host (got ${JSON.stringify(trimmedUri)}); use the origin the user is signing into.`
     );
   }
   if (!Number.isInteger(input.chainId) || input.chainId <= 0) {
@@ -944,7 +955,11 @@ var Nodes = Object.freeze({
 });
 
 // src/v4/protocols/index.ts
-import { Protocols } from "@avaprotocol/protocols";
+import {
+  Protocols,
+  Tokens,
+  lookupToken
+} from "@avaprotocol/protocols";
 export {
   APIError,
   AUTH_TEMPLATE,
@@ -960,11 +975,13 @@ export {
   OperatorsResource,
   Protocols,
   SecretsResource,
+  Tokens,
   TokensResource,
   Triggers,
   TriggersResource,
   WalletsResource,
   WorkflowsResource,
   buildAuthMessage,
+  lookupToken,
   signAuthMessage
 };

package/dist/v4/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/v4/auth.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,kLAOT,CAAC;AAElB,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;OASG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;OAaG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,CA0C/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CA4BvF"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/v4/auth.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,kLAOT,CAAC;AAElB,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;OASG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;OAaG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,CAsD/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CA4BvF"}

package/dist/v4/auth.js

@@ -33,11 +33,19 @@ export function buildAuthMessage(input) {
     if (!trimmedUri) {
         throw new Error("buildAuthMessage: uri must be a non-empty string (the origin the user is signing into, e.g. window.location.origin).");
     }
+    // WHATWG URL treats `localhost:3000` as scheme `localhost:` — require an http(s) origin with a host.
+    let parsed;
     try {
-        new URL(trimmedUri);
+        parsed = new URL(trimmedUri);
     }
     catch {
-        throw new Error("buildAuthMessage: uri must be a valid URL (e.g. window.location.origin).");
+        throw new Error(`buildAuthMessage: uri must be a valid URL (got ${JSON.stringify(trimmedUri)}); use the http(s) origin the user is signing into.`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`buildAuthMessage: uri scheme must be http or https (got ${parsed.protocol}); use the origin the user is signing into.`);
+    }
+    if (!parsed.hostname) {
+        throw new Error(`buildAuthMessage: uri must include a host (got ${JSON.stringify(trimmedUri)}); use the origin the user is signing into.`);
     }
     if (!Number.isInteger(input.chainId) || input.chainId <= 0) {
         throw new Error("buildAuthMessage: chainId must be a positive integer (the wallet's currently-connected chain).");

package/dist/v4/index.d.ts

@@ -2,7 +2,7 @@ export { Client, type ClientOptions } from "./client";
 export { Chains, type ChainId } from "./chains";
 export { Triggers } from "./builders/triggers";
 export { Nodes } from "./builders/nodes";
-export { Protocols, type AbiFragment, type AddressByChain } from "./protocols";
+export { Protocols, Tokens, lookupToken, type AbiFragment, type AddressByChain, type TokenByChain, type TokenChainEntry, type TokenLinks, } from "./protocols";
 export { buildAuthMessage, signAuthMessage, AUTH_TEMPLATE, type BuildAuthMessageInput, type BuiltAuthMessage, } from "./auth";
 export { APIError, NetworkError, AuthRequiredError } from "./internal/errors";
 export { AuthResource } from "./resources/auth";

package/dist/v4/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/v4/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAK9E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI1D,YAAY,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/v4/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EACL,SAAS,EACT,MAAM,EACN,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAK9E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI1D,YAAY,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/v4/index.js

@@ -6,7 +6,7 @@ export { Client } from "./client";
 export { Chains } from "./chains";
 export { Triggers } from "./builders/triggers";
 export { Nodes } from "./builders/nodes";
-export { Protocols } from "./protocols";
+export { Protocols, Tokens, lookupToken, } from "./protocols";
 export { buildAuthMessage, signAuthMessage, AUTH_TEMPLATE, } from "./auth";
 export { APIError, NetworkError, AuthRequiredError } from "./internal/errors";
 // Resource classes are exported in case advanced consumers want to

package/dist/v4/protocols/index.d.ts

@@ -1,2 +1,2 @@
-export { Protocols, type AbiFragment, type AddressByChain } from "@avaprotocol/protocols";
+export { Protocols, Tokens, lookupToken, type AbiFragment, type AddressByChain, type TokenByChain, type TokenChainEntry, type TokenLinks, } from "@avaprotocol/protocols";
 //# sourceMappingURL=index.d.ts.map

package/dist/v4/protocols/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/v4/protocols/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/v4/protocols/index.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,SAAS,EACT,MAAM,EACN,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,wBAAwB,CAAC"}

package/dist/v4/protocols/index.js

@@ -10,4 +10,4 @@
 // when a new protocol address lands or a new chain comes online;
 // bumping `@avaprotocol/protocols` minor version + republishing this
 // SDK package picks it up automatically.
-export { Protocols } from "@avaprotocol/protocols";
+export { Protocols, Tokens, lookupToken, } from "@avaprotocol/protocols";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avaprotocol/sdk-js",
-  "version": "3.1.0",
+  "version": "3.2.1",
   "description": "TypeScript SDK for Ava Protocol's AVS REST API. Resource-grouped sub-clients, fetch transport, EIP-191 auth.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,7 +32,7 @@
     "prepare": "node ../../scripts/prepare-package.js"
   },
   "dependencies": {
-    "@avaprotocol/protocols": "^0.2.0",
+    "@avaprotocol/protocols": "^0.6.0",
     "@avaprotocol/types": "^3.0.0",
     "dotenv": "^16.4.5",
     "ethers": "^6.13.2"