@medialane/sdk 0.128.0 → 0.129.1

package/README.md

@@ -465,6 +465,40 @@ try {
 }
 ```
 
+### Showing an error to a user
+
+Three types carry text written for someone to read. Everything else is machinery, and the
+message belongs to whatever your screen was trying to do.
+
+| Type | What it means | Show |
+|---|---|---|
+| `MedialaneApiError` | The API refused the request | `err.message`, which is the reason the API gave or a plain statement of the status |
+| `UserFacingError` | The SDK got partway and stopped, for example a transaction that reverted | `err.message` |
+| `PasskeyCancelledError` | The prompt was dismissed | Nothing was submitted, so avoid wording it as a failure |
+
+```typescript
+import { MedialaneApiError, PasskeyCancelledError, UserFacingError } from "@medialane/sdk";
+
+function describe(err: unknown, fallback: string): string {
+  if (err instanceof PasskeyCancelledError) return "Request not completed. Nothing was submitted.";
+  if (err instanceof UserFacingError) return err.message;
+  if (err instanceof MedialaneApiError) return err.message;
+  return fallback;
+}
+
+catch (err) {
+  console.error(err);
+  setError(describe(err, "We couldn't create that listing. Please try again."));
+}
+```
+
+The fallback matters. An error carrying none of those types says nothing a reader can act on,
+and its text is as likely to be a gateway response as a sentence. Your call site knows which
+action was attempted, so that is the message worth showing.
+
+A response body that is not ours stays in `err.details`, where it is available while debugging
+without reaching a reader.
+
 ---
 
 ## Configuration Reference

package/dist/{errors-De9avg1S.d.ts → errors-DQJIxfVu.d.ts}

@@ -1057,9 +1057,8 @@ declare class MedialaneApiError extends Error {
     readonly status: number;
     readonly retryAfterMs?: number | undefined;
     readonly details?: unknown | undefined;
-    readonly isAuthored: boolean;
     readonly code: MedialaneErrorCode;
-    constructor(status: number, message: string, retryAfterMs?: number | undefined, details?: unknown | undefined, isAuthored?: boolean);
+    constructor(status: number, message: string, retryAfterMs?: number | undefined, details?: unknown | undefined);
 }
 declare class ApiClient {
     private readonly baseUrl;

package/dist/{errors-CO99guAf.d.cts → errors-Fgqpww_8.d.cts}

@@ -1057,9 +1057,8 @@ declare class MedialaneApiError extends Error {
     readonly status: number;
     readonly retryAfterMs?: number | undefined;
     readonly details?: unknown | undefined;
-    readonly isAuthored: boolean;
     readonly code: MedialaneErrorCode;
-    constructor(status: number, message: string, retryAfterMs?: number | undefined, details?: unknown | undefined, isAuthored?: boolean);
+    constructor(status: number, message: string, retryAfterMs?: number | undefined, details?: unknown | undefined);
 }
 declare class ApiClient {
     private readonly baseUrl;

package/dist/index.cjs

@@ -275,12 +275,11 @@ function deriveErrorCode(status) {
   return "UNKNOWN";
 }
 var MedialaneApiError = class extends Error {
-  constructor(status, message, retryAfterMs, details, isAuthored = false) {
+  constructor(status, message, retryAfterMs, details) {
     super(message);
     this.status = status;
     this.retryAfterMs = retryAfterMs;
     this.details = details;
-    this.isAuthored = isAuthored;
     this.name = "MedialaneApiError";
     this.code = deriveErrorCode(status);
   }
@@ -317,14 +316,12 @@ var ApiClient = class {
       });
       if (!response.ok && !allowed(response.status)) {
         const text = await response.text().catch(() => response.statusText);
-        let message = text;
-        let details;
-        let isAuthored = false;
+        let message = `Request failed with status ${response.status}`;
+        let details = text;
         try {
           const body = JSON.parse(text);
           if (typeof body.error === "string" && body.error.trim() !== "") {
             message = body.error;
-            isAuthored = true;
           }
           details = body;
         } catch {
@@ -333,8 +330,7 @@ var ApiClient = class {
           response.status,
           message,
           parseRetryAfter(response.headers.get("retry-after")),
-          details,
-          isAuthored
+          details
         );
       }
       return response;
@@ -1473,8 +1469,6 @@ function createRateLimiter(windowMs, max) {
 }
 var TRUSTED_APP_IP_HEADER = "x-medialane-client-ip";
 function requestIp(req) {
-  const fromApp = req.headers.get(TRUSTED_APP_IP_HEADER)?.trim();
-  if (fromApp) return fromApp;
   const fromEdge = req.headers.get("x-vercel-forwarded-for")?.split(",")[0]?.trim();
   if (fromEdge) return fromEdge;
   const forwarded = req.headers.get("x-forwarded-for");
@@ -1863,6 +1857,30 @@ async function getBackendSignedUrl(config, kind = "image") {
   if (!res.ok || !data.data) throw new Error(data.error ?? "Failed to create upload URL");
   return data.data.url;
 }
+
+// src/server/trusted-client-ip.ts
+var SPOOFABLE_FORWARDING_HEADERS = [
+  "x-forwarded-for",
+  "x-real-ip",
+  "x-client-ip",
+  "true-client-ip",
+  "cf-connecting-ip",
+  TRUSTED_APP_IP_HEADER
+];
+function isSpoofableForwardingHeader(name) {
+  return SPOOFABLE_FORWARDING_HEADERS.includes(name.toLowerCase());
+}
+function trustedClientIp(req) {
+  const vercel = req.headers.get("x-vercel-forwarded-for")?.split(",")[0]?.trim();
+  if (vercel) return vercel;
+  const forwarded = req.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const hops = forwarded.split(",").map((hop) => hop.trim()).filter(Boolean);
+    const nearest = hops[hops.length - 1];
+    if (nearest) return nearest;
+  }
+  return "unknown";
+}
 var IDENTITY_PREFIX = "siws_";
 var ACCOUNT_SESSION_PREFIX = "account_session_";
 var IDENTITY_DOMAIN = "siws-identity-v1";
@@ -2124,6 +2142,7 @@ exports.isPrivateHost = isPrivateHost;
 exports.isPrivateOrInsecureUrl = isPrivateOrInsecureUrl;
 exports.isSameOrigin = isSameOrigin;
 exports.isServiceId = isServiceId;
+exports.isSpoofableForwardingHeader = isSpoofableForwardingHeader;
 exports.isTransientRpcError = isTransientRpcError;
 exports.isValidIpfsCidPath = isValidIpfsCidPath;
 exports.issueAccountSessionToken = issueAccountSessionToken;
@@ -2141,6 +2160,7 @@ exports.resolveRemixPolicy = resolveRemixPolicy;
 exports.resolveSafeImageContentType = resolveSafeImageContentType;
 exports.shortenAddress = shortenAddress;
 exports.stringifyBigInts = stringifyBigInts;
+exports.trustedClientIp = trustedClientIp;
 exports.u256ToBigInt = u256ToBigInt;
 exports.uploadDirectoryToBackend = uploadDirectoryToBackend;
 exports.uploadFileToBackend = uploadFileToBackend;