@covia/covia-sdk 1.9.0 → 1.9.1

package/dist/index.d.mts

@@ -262,6 +262,21 @@ declare class Ed25519Auth extends Auth {
      */
     constructor(privateKey: Uint8Array, tokenLifetimeSeconds?: number);
     apply(headers: Record<string, string>, audience?: string): void;
+    /**
+     * Mint a bearer-usable identity JWT for this key — the same token
+     * {@link apply} attaches to every request, exposed for callers that need
+     * to present this identity elsewhere (CLI tools, curl, another client:
+     * `Authorization: Bearer <token>`).
+     *
+     * An explicitly-pinned {@link audience} wins; otherwise the JWT `aud` is
+     * bound to the venue DID given here. A token with no `aud` is replayable
+     * at any venue that accepts the caller's DID, so minting one is refused
+     * rather than silently weakened.
+     *
+     * @param audience - The venue DID the token is bound to (`aud` claim).
+     * @param lifetimeSeconds - Token lifetime; defaults to this instance's.
+     */
+    identityToken(audience?: string, lifetimeSeconds?: number): string;
     /** The caller's DID derived from the public key. */
     getDID(): string;
     /**

package/dist/index.d.ts

@@ -262,6 +262,21 @@ declare class Ed25519Auth extends Auth {
      */
     constructor(privateKey: Uint8Array, tokenLifetimeSeconds?: number);
     apply(headers: Record<string, string>, audience?: string): void;
+    /**
+     * Mint a bearer-usable identity JWT for this key — the same token
+     * {@link apply} attaches to every request, exposed for callers that need
+     * to present this identity elsewhere (CLI tools, curl, another client:
+     * `Authorization: Bearer <token>`).
+     *
+     * An explicitly-pinned {@link audience} wins; otherwise the JWT `aud` is
+     * bound to the venue DID given here. A token with no `aud` is replayable
+     * at any venue that accepts the caller's DID, so minting one is refused
+     * rather than silently weakened.
+     *
+     * @param audience - The venue DID the token is bound to (`aud` claim).
+     * @param lifetimeSeconds - Token lifetime; defaults to this instance's.
+     */
+    identityToken(audience?: string, lifetimeSeconds?: number): string;
     /** The caller's DID derived from the public key. */
     getDID(): string;
     /**

package/dist/index.js

@@ -1217,14 +1217,30 @@ var Ed25519Auth = class _Ed25519Auth extends Auth {
     this._lifetime = tokenLifetimeSeconds;
   }
   apply(headers, audience) {
+    headers["Authorization"] = `Bearer ${this.identityToken(audience)}`;
+  }
+  /**
+   * Mint a bearer-usable identity JWT for this key — the same token
+   * {@link apply} attaches to every request, exposed for callers that need
+   * to present this identity elsewhere (CLI tools, curl, another client:
+   * `Authorization: Bearer <token>`).
+   *
+   * An explicitly-pinned {@link audience} wins; otherwise the JWT `aud` is
+   * bound to the venue DID given here. A token with no `aud` is replayable
+   * at any venue that accepts the caller's DID, so minting one is refused
+   * rather than silently weakened.
+   *
+   * @param audience - The venue DID the token is bound to (`aud` claim).
+   * @param lifetimeSeconds - Token lifetime; defaults to this instance's.
+   */
+  identityToken(audience, lifetimeSeconds) {
     const aud = this._audience ?? (audience || void 0);
     if (!aud) {
       throw new CoviaError(
         "Ed25519Auth requires a venue audience to bind the token to: connect via Grid.connect()/Venue.connect() so the venue DID is known, or pin auth.audience explicitly."
       );
     }
-    const jwt = createEdDSAJWT(this._privateKey, this._lifetime, aud);
-    headers["Authorization"] = `Bearer ${jwt}`;
+    return createEdDSAJWT(this._privateKey, lifetimeSeconds ?? this._lifetime, aud);
   }
   /** The caller's DID derived from the public key. */
   getDID() {

package/dist/index.mjs

@@ -1215,14 +1215,30 @@ var Ed25519Auth = class _Ed25519Auth extends Auth {
     this._lifetime = tokenLifetimeSeconds;
   }
   apply(headers, audience) {
+    headers["Authorization"] = `Bearer ${this.identityToken(audience)}`;
+  }
+  /**
+   * Mint a bearer-usable identity JWT for this key — the same token
+   * {@link apply} attaches to every request, exposed for callers that need
+   * to present this identity elsewhere (CLI tools, curl, another client:
+   * `Authorization: Bearer <token>`).
+   *
+   * An explicitly-pinned {@link audience} wins; otherwise the JWT `aud` is
+   * bound to the venue DID given here. A token with no `aud` is replayable
+   * at any venue that accepts the caller's DID, so minting one is refused
+   * rather than silently weakened.
+   *
+   * @param audience - The venue DID the token is bound to (`aud` claim).
+   * @param lifetimeSeconds - Token lifetime; defaults to this instance's.
+   */
+  identityToken(audience, lifetimeSeconds) {
     const aud = this._audience ?? (audience || void 0);
     if (!aud) {
       throw new CoviaError(
         "Ed25519Auth requires a venue audience to bind the token to: connect via Grid.connect()/Venue.connect() so the venue DID is known, or pin auth.audience explicitly."
       );
     }
-    const jwt = createEdDSAJWT(this._privateKey, this._lifetime, aud);
-    headers["Authorization"] = `Bearer ${jwt}`;
+    return createEdDSAJWT(this._privateKey, lifetimeSeconds ?? this._lifetime, aud);
   }
   /** The caller's DID derived from the public key. */
   getDID() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@covia/covia-sdk",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Typescript library for covia-ai",
   "packageManager": "pnpm@11.9.0",
   "main": "./dist/index.js",