@misofm/sdk 0.3.0 → 0.5.0

package/README.md

@@ -124,6 +124,37 @@ const miso = read.createMisoClient({ network: "testnet" });
 const artist = await read.getArtistProfile(miso, partyId);
 ```
 
+### Authenticated platform mutations
+
+`@misofm/sdk/auth` implements Miso's Enoki + Sui personal-message authorization
+protocol without owning session state or private credentials. It asks the API
+for a short-lived, method/path-bound challenge, validates the response, signs
+the exact bytes with the caller's Sui signer, and sends the authenticated
+mutation.
+
+```ts
+import { authenticatedFetch } from "@misofm/sdk/auth";
+
+await authenticatedFetch(
+  "https://api.testnet.miso.fm/platform/usernames/alice",
+  {
+    method: "PUT",
+    body: JSON.stringify({}),
+    headers: { "Content-Type": "application/json" },
+    auth: {
+      token: enokiOidcToken,
+      address: suiAddress,
+      signer: await enokiFlow.getKeypair({ network: "testnet" }),
+      network: "testnet",
+    },
+  },
+);
+```
+
+The SDK is only a client and shared wire contract. The API remains the security
+boundary: it verifies Enoki membership, challenge freshness, the recovered Sui
+address, and the exact authorized route on every protected request.
+
 ### Payment
 
 `listing::buy` takes a bare `Balance<Currency>`, and `buyRecord` sources it with

package/dist/auth.d.ts

@@ -0,0 +1,73 @@
+export type AuthNetwork = "testnet" | "mainnet";
+export interface ApiAuthorizationFields {
+    method: string;
+    path: string;
+    address: string;
+    network: AuthNetwork;
+    issuedAt: string;
+}
+export interface AuthorizationChallenge extends ApiAuthorizationFields {
+    payload: string;
+    expiresAt: string;
+}
+export interface PersonalMessageSigner {
+    signPersonalMessage(message: Uint8Array): Promise<{
+        signature: string;
+        bytes?: string;
+    }>;
+}
+export declare const AUTHORIZATION_MAX_AGE_MS: number;
+export declare const AUTHORIZATION_FUTURE_SKEW_MS: number;
+export declare const MISO_AUTH_HEADERS: {
+    readonly address: "X-Sui-Address";
+    readonly signature: "X-Sui-Signature";
+    readonly issuedAt: "X-Sui-Issued-At";
+};
+export type MisoAuthErrorCode = "invalid_target" | "challenge_rejected" | "invalid_challenge" | "signing_failed";
+export declare class MisoAuthError extends Error {
+    readonly code: MisoAuthErrorCode;
+    readonly status?: number;
+    constructor(code: MisoAuthErrorCode, message: string, options?: {
+        status?: number;
+        cause?: unknown;
+    });
+}
+/** The byte-exact Sui personal message required for an authenticated API mutation. */
+export declare function buildApiAuthorizationPayload(fields: ApiAuthorizationFields): string;
+export declare function isValidAuthorizationTarget(method: string, path: string): boolean;
+/** Accept only fresh timestamps in one canonical spelling. */
+export declare function parseFreshAuthorizationIssuedAt(input: unknown, nowMs?: number): string | null;
+export interface RequestAuthorizationChallengeOptions {
+    apiUrl: string | URL;
+    token: string;
+    address: string;
+    method: string;
+    path: string;
+    network?: AuthNetwork;
+    challengeUrl?: string | URL;
+    fetch?: typeof globalThis.fetch;
+    nowMs?: number;
+}
+/** Ask Miso to verify the Enoki account and issue the exact message to sign. */
+export declare function requestAuthorizationChallenge(options: RequestAuthorizationChallengeOptions): Promise<AuthorizationChallenge>;
+export interface CreateAuthorizationHeadersOptions extends RequestAuthorizationChallengeOptions {
+    signer: PersonalMessageSigner;
+}
+/** Verify the challenge locally, sign it as a Sui personal message, and produce API headers. */
+export declare function createAuthorizationHeaders(options: CreateAuthorizationHeadersOptions): Promise<{
+    challenge: AuthorizationChallenge;
+    headers: Headers;
+}>;
+export interface AuthenticatedFetchOptions extends RequestInit {
+    auth: {
+        token: string;
+        address: string;
+        signer: PersonalMessageSigner;
+        network?: AuthNetwork;
+    };
+    challengeUrl?: string | URL;
+    fetch?: typeof globalThis.fetch;
+}
+/** Perform a protected Miso API mutation with a fresh Enoki-verified Sui signature. */
+export declare function authenticatedFetch(input: string | URL, options: AuthenticatedFetchOptions): Promise<Response>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1F;AAED,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAEvD,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAMzG;AAED,sFAAsF;AACtF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAUnF;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOhF;AAED,8DAA8D;AAC9D,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI,CAYzG;AA2ED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAED,MAAM,WAAW,iCAAkC,SAAQ,oCAAoC;IAC7F,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED,gGAAgG;AAChG,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC;IAAE,SAAS,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqBlE;AAED,MAAM,WAAW,yBAA0B,SAAQ,WAAW;IAC5D,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,qBAAqB,CAAC;QAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;KACvB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,uFAAuF;AACvF,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}

package/dist/auth.js

@@ -0,0 +1,193 @@
+// Copyright (c) Miso Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+import { isValidSuiAddress, normalizeSuiAddress } from "@mysten/sui/utils";
+export const AUTHORIZATION_MAX_AGE_MS = 5 * 60 * 1_000;
+export const AUTHORIZATION_FUTURE_SKEW_MS = 60 * 1_000;
+export const MISO_AUTH_HEADERS = {
+    address: "X-Sui-Address",
+    signature: "X-Sui-Signature",
+    issuedAt: "X-Sui-Issued-At",
+};
+export class MisoAuthError extends Error {
+    code;
+    status;
+    constructor(code, message, options = {}) {
+        super(message, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = "MisoAuthError";
+        this.code = code;
+        this.status = options.status;
+    }
+}
+/** The byte-exact Sui personal message required for an authenticated API mutation. */
+export function buildApiAuthorizationPayload(fields) {
+    return [
+        "miso.fm API authorization v1",
+        "",
+        `Method: ${fields.method.toUpperCase()}`,
+        `Path: ${fields.path}`,
+        `Address: ${fields.address}`,
+        `Network: ${fields.network}`,
+        `Issued At: ${fields.issuedAt}`,
+    ].join("\n");
+}
+export function isValidAuthorizationTarget(method, path) {
+    return (["POST", "PUT", "PATCH", "DELETE"].includes(method.toUpperCase()) &&
+        path.startsWith("/platform/") &&
+        path.length <= 2_048 &&
+        !/[\r\n?#]/.test(path));
+}
+/** Accept only fresh timestamps in one canonical spelling. */
+export function parseFreshAuthorizationIssuedAt(input, nowMs = Date.now()) {
+    if (typeof input !== "string")
+        return null;
+    const issuedAtMs = Date.parse(input);
+    if (!Number.isFinite(issuedAtMs))
+        return null;
+    if (issuedAtMs > nowMs + AUTHORIZATION_FUTURE_SKEW_MS ||
+        nowMs - issuedAtMs > AUTHORIZATION_MAX_AGE_MS) {
+        return null;
+    }
+    const canonical = new Date(issuedAtMs).toISOString();
+    return input === canonical ? canonical : null;
+}
+function target(method, path) {
+    const normalized = { method: method.toUpperCase(), path };
+    if (!isValidAuthorizationTarget(normalized.method, normalized.path)) {
+        throw new MisoAuthError("invalid_target", "Authenticated requests require a mutation under /platform/.");
+    }
+    return normalized;
+}
+function parseChallenge(input, expected) {
+    if (input === null || typeof input !== "object" || Array.isArray(input)) {
+        throw new MisoAuthError("invalid_challenge", "The API returned an invalid authorization challenge.");
+    }
+    const body = input;
+    if (typeof body.payload !== "string" ||
+        typeof body.method !== "string" ||
+        typeof body.path !== "string" ||
+        typeof body.address !== "string" ||
+        typeof body.network !== "string" ||
+        typeof body.issuedAt !== "string" ||
+        typeof body.expiresAt !== "string" ||
+        !isValidSuiAddress(body.address) ||
+        (body.network !== "testnet" && body.network !== "mainnet")) {
+        throw new MisoAuthError("invalid_challenge", "The API returned an invalid authorization challenge.");
+    }
+    const nowMs = expected.nowMs ?? Date.now();
+    const issuedAt = parseFreshAuthorizationIssuedAt(body.issuedAt, nowMs);
+    const expiresAtMs = Date.parse(body.expiresAt);
+    const canonicalAddress = normalizeSuiAddress(body.address);
+    const expectedAddress = normalizeSuiAddress(expected.address);
+    const challenge = {
+        payload: body.payload,
+        method: body.method,
+        path: body.path,
+        address: canonicalAddress,
+        network: body.network,
+        issuedAt: body.issuedAt,
+        expiresAt: body.expiresAt,
+    };
+    const canonicalExpiresAt = Number.isFinite(expiresAtMs) ? new Date(expiresAtMs).toISOString() : "";
+    if (!issuedAt ||
+        body.method !== expected.method ||
+        body.path !== expected.path ||
+        canonicalAddress !== expectedAddress ||
+        (expected.network !== undefined && body.network !== expected.network) ||
+        body.expiresAt !== canonicalExpiresAt ||
+        expiresAtMs <= nowMs ||
+        expiresAtMs > Date.parse(issuedAt) + AUTHORIZATION_MAX_AGE_MS ||
+        body.payload !== buildApiAuthorizationPayload(challenge)) {
+        throw new MisoAuthError("invalid_challenge", "The authorization challenge did not match this request.");
+    }
+    return challenge;
+}
+async function responseMessage(response) {
+    const body = await response.clone().json().catch(() => null);
+    if (typeof body?.error === "object" && typeof body.error.message === "string")
+        return body.error.message;
+    if (typeof body?.error === "string")
+        return body.error;
+    if (typeof body?.message === "string")
+        return body.message;
+    return `Authorization challenge failed (${response.status}).`;
+}
+/** Ask Miso to verify the Enoki account and issue the exact message to sign. */
+export async function requestAuthorizationChallenge(options) {
+    const expected = target(options.method, options.path);
+    if (!options.token || !isValidSuiAddress(options.address)) {
+        throw new MisoAuthError("challenge_rejected", "A valid Enoki token and Sui address are required.");
+    }
+    const apiUrl = new URL(options.apiUrl);
+    const challengeUrl = options.challengeUrl === undefined
+        ? new URL("/platform/auth/challenge", apiUrl.origin)
+        : new URL(options.challengeUrl, apiUrl);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const response = await fetcher(challengeUrl, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${options.token}`,
+            [MISO_AUTH_HEADERS.address]: normalizeSuiAddress(options.address),
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify(expected),
+    });
+    if (!response.ok) {
+        throw new MisoAuthError("challenge_rejected", await responseMessage(response), { status: response.status });
+    }
+    const body = await response.json().catch(() => null);
+    return parseChallenge(body, {
+        ...expected,
+        address: options.address,
+        network: options.network,
+        nowMs: options.nowMs,
+    });
+}
+/** Verify the challenge locally, sign it as a Sui personal message, and produce API headers. */
+export async function createAuthorizationHeaders(options) {
+    const challenge = await requestAuthorizationChallenge(options);
+    let signature;
+    try {
+        const signed = await options.signer.signPersonalMessage(new TextEncoder().encode(challenge.payload));
+        signature = signed.signature;
+    }
+    catch (cause) {
+        throw new MisoAuthError("signing_failed", "The authorization request was not signed.", { cause });
+    }
+    if (!signature) {
+        throw new MisoAuthError("signing_failed", "The signer returned an empty authorization signature.");
+    }
+    return {
+        challenge,
+        headers: new Headers({
+            Authorization: `Bearer ${options.token}`,
+            [MISO_AUTH_HEADERS.address]: challenge.address,
+            [MISO_AUTH_HEADERS.signature]: signature,
+            [MISO_AUTH_HEADERS.issuedAt]: challenge.issuedAt,
+        }),
+    };
+}
+/** Perform a protected Miso API mutation with a fresh Enoki-verified Sui signature. */
+export async function authenticatedFetch(input, options) {
+    const { auth, challengeUrl, fetch: fetchOption, ...init } = options;
+    const url = new URL(input);
+    const method = (init.method ?? "").toUpperCase();
+    if (url.search || url.hash) {
+        throw new MisoAuthError("invalid_target", "Authenticated request URLs cannot include a query or fragment.");
+    }
+    const fetcher = fetchOption ?? globalThis.fetch;
+    const authorization = await createAuthorizationHeaders({
+        apiUrl: url,
+        challengeUrl,
+        fetch: fetcher,
+        token: auth.token,
+        address: auth.address,
+        signer: auth.signer,
+        network: auth.network,
+        method,
+        path: url.pathname,
+    });
+    const headers = new Headers(init.headers);
+    authorization.headers.forEach((value, name) => headers.set(name, value));
+    return fetcher(url, { ...init, method, headers });
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,sCAAsC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAqB3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,KAAK,CAAC;AAEvD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,eAAe;IACxB,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,iBAAiB;CACnB,CAAC;AAQX,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IACxB,MAAM,CAAU;IAEzB,YAAY,IAAuB,EAAE,OAAe,EAAE,UAAgD,EAAE;QACtG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,4BAA4B,CAAC,MAA8B;IACzE,OAAO;QACL,8BAA8B;QAC9B,EAAE;QACF,WAAW,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;QACxC,SAAS,MAAM,CAAC,IAAI,EAAE;QACtB,YAAY,MAAM,CAAC,OAAO,EAAE;QAC5B,YAAY,MAAM,CAAC,OAAO,EAAE;QAC5B,cAAc,MAAM,CAAC,QAAQ,EAAE;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,IAAY;IACrE,OAAO,CACL,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,KAAK;QACpB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,+BAA+B,CAAC,KAAc,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACxF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IACE,UAAU,GAAG,KAAK,GAAG,4BAA4B;QACjD,KAAK,GAAG,UAAU,GAAG,wBAAwB,EAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY;IAC1C,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,6DAA6D,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,QAAkG;IAElG,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,sDAAsD,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAG,KAA+D,CAAC;IAC7E,IACE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAChC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,sDAAsD,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAA2B;QACxC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnG,IACE,CAAC,QAAQ;QACT,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC3B,gBAAgB,KAAK,eAAe;QACpC,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC;QACrE,IAAI,CAAC,SAAS,KAAK,kBAAkB;QACrC,WAAW,IAAI,KAAK;QACpB,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,wBAAwB;QAC7D,IAAI,CAAC,OAAO,KAAK,4BAA4B,CAAC,SAAS,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,yDAAyD,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAkB;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAGnD,CAAC;IACT,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IACzG,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACvD,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IAC3D,OAAO,mCAAmC,QAAQ,CAAC,MAAM,IAAI,CAAC;AAChE,CAAC;AAcD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,mDAAmD,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS;QACrD,CAAC,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YACjE,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,GAAG,QAAQ;QACX,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;AACL,CAAC;AAMD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAA0C;IAE1C,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACrG,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,2CAA2C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IACrG,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,IAAI,OAAO,CAAC;YACnB,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO;YAC9C,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,SAAS;YACxC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,QAAQ;SACjD,CAAC;KACH,CAAC;AACJ,CAAC;AAaD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAmB,EACnB,OAAkC;IAElC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,gEAAgE,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC;QACrD,MAAM,EAAE,GAAG;QACX,YAAY;QACZ,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,QAAQ;KACnB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/catalog.d.ts

@@ -33,29 +33,16 @@ export declare function getReleaseTrackCredits(client: ClientWithCoreApi, graphq
 export declare function getTrackCreditsByRecordingIds(client: ClientWithCoreApi, graphqlClient: SuiGraphQLClient, recordingIdsInput: readonly string[], options: GetReleaseTrackCreditsOptions): Promise<Record<string, ReleaseTrackCredits>>;
 export interface GetAdministeredRecordingsOptions {
     /**
-     * Maximum lookups in flight at once. The traversal is one lookup per admin
-     * cap, so an artist with a large catalog would otherwise open as many
-     * concurrent requests as they have recordings. Defaults to 10.
+     * @deprecated Resolution is batched; this option is retained for source
+     * compatibility and no longer affects request concurrency.
      */
     concurrency?: number;
 }
 /**
  * Every `Recording` administered by `owner`.
  *
- * Two stages: list the owner's `RecordingAdminCap`s over the Core API, then
- * resolve each cap's share type back to its recording.
- *
- * The second stage needs GraphQL and is inherently one lookup per cap, because
- * `RecordingAdminCap` carries no back-pointer to its recording — unlike
- * `ReleaseAdminCap`, which stores `release_id` and can therefore be resolved
- * entirely over the Core API. The caps are derived objects (recording → cap via
- * `deriveObjectID`), and that derivation cannot be inverted, so the share type
- * is the only link back. Adding a `recording_id: ID` field to
- * `RecordingAdminCap` on the protocol side would make this a pure Core-API
- * batch read and remove both the GraphQL dependency and the fan-out.
- *
- * Until then the lookups run concurrently in bounded batches rather than
- * serially.
+ * Three bounded stages: list the owner's `RecordingAdminCap`s, resolve every
+ * share type in one aliased GraphQL query, then batch-fetch the recordings.
  */
 export declare function getAdministeredRecordings(client: ClientWithCoreApi, graphqlClient: SuiGraphQLClient, owner: string, misoPackageId: string, options?: GetAdministeredRecordingsOptions): Promise<Recording[]>;
 //# sourceMappingURL=catalog.d.ts.map

package/dist/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAML,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,2BAA2B,EAAE,MAAM,CAAC;IACpC,gEAAgE;IAChE,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,gBAAgB,EAAE,oBAAoB,CAAC;CACxC;AAQD;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,gBAAgB,EAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAQ9C;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAoD9C;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,gBAAgB,EAC/B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,SAAS,EAAE,CAAC,CAsBtB"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,2BAA2B,EAAE,MAAM,CAAC;IACpC,gEAAgE;IAChE,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,gBAAgB,EAAE,oBAAoB,CAAC;CACxC;AAQD;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,gBAAgB,EAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAQ9C;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CA6D9C;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,gBAAgB,EAC/B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,SAAS,EAAE,CAAC,CAoBtB"}

package/dist/catalog.js

@@ -1,7 +1,8 @@
 // Copyright (c) Miso Labs, Inc.
 // SPDX-License-Identifier: Apache-2.0
-import { getCompositionAddressByShareType, getOwnedRecordingAdminCaps, getRecordingByShareType, getRecordingShareTypes, getReleaseById, } from "@misonetwork/sdk";
-import { getCompositionCredits, getRecordingCredits, } from "./credits.js";
+import { extractTypeParams2, getOwnedRecordingAdminCaps, getRecordingsByIds, getReleaseById, } from "@misonetwork/sdk";
+import { getWorkAddressesByShareTypes } from "./read/works.js";
+import { getCompositionCreditsByIds, getRecordingCreditsByIds, } from "./credits.js";
 const EMPTY_RECORDING_CREDITS = {
     credits: [],
     primaryArtistIds: [],
@@ -28,33 +29,42 @@ export async function getReleaseTrackCredits(client, graphqlClient, releaseId, o
  */
 export async function getTrackCreditsByRecordingIds(client, graphqlClient, recordingIdsInput, options) {
     const recordingIds = [...new Set(recordingIdsInput)];
-    const recordingReads = await Promise.all(recordingIds.map(async (recordingId) => {
-        const [recordingCredits, [, compositionShareType]] = await Promise.all([
-            getRecordingCredits(client, recordingId, options.recordingCreditsPackageId),
-            getRecordingShareTypes(client, recordingId),
-        ]);
-        return { recordingId, recordingCredits, compositionShareType };
-    }));
-    const compositionShareTypes = [...new Set(recordingReads.map((read) => read.compositionShareType))];
-    const compositionAddressEntries = await Promise.all(compositionShareTypes.map(async (shareType) => {
-        const compositionId = await getCompositionAddressByShareType(graphqlClient, shareType, options.misoPackageId);
-        if (!compositionId)
+    if (recordingIds.length === 0)
+        return {};
+    const [recordingCreditsById, recordingObjects] = await Promise.all([
+        getRecordingCreditsByIds(client, recordingIds, options.recordingCreditsPackageId),
+        client.core.getObjects({ objectIds: recordingIds }),
+    ]);
+    const recordingReads = recordingObjects.objects.map((object, index) => {
+        const recordingId = recordingIds[index];
+        if (object instanceof Error)
+            throw object;
+        const [, compositionShareType] = extractTypeParams2(object.type);
+        return {
+            recordingId,
+            recordingCredits: recordingCreditsById[recordingId] ?? null,
+            compositionShareType,
+        };
+    });
+    const compositionShareTypes = [
+        ...new Set(recordingReads.map((read) => read.compositionShareType)),
+    ];
+    const addresses = await getWorkAddressesByShareTypes(graphqlClient, { compositions: compositionShareTypes, recordings: [] }, options.misoPackageId);
+    for (const shareType of compositionShareTypes) {
+        if (!addresses.compositions[shareType]) {
             throw new Error(`Composition not found for share type: ${shareType}`);
-        return [shareType, compositionId];
-    }));
-    const compositionAddressByShareType = new Map(compositionAddressEntries);
-    const compositionIds = [...new Set(compositionAddressEntries.map(([, compositionId]) => compositionId))];
-    const compositionCreditEntries = await Promise.all(compositionIds.map(async (compositionId) => {
-        const credits = await getCompositionCredits(client, compositionId, options.compositionCreditsPackageId);
-        return [compositionId, credits ?? []];
-    }));
-    const compositionCreditsById = new Map(compositionCreditEntries);
+        }
+    }
+    const compositionIds = [
+        ...new Set(Object.values(addresses.compositions).filter((id) => id !== undefined)),
+    ];
+    const compositionCreditsById = await getCompositionCreditsByIds(client, compositionIds, options.compositionCreditsPackageId);
     return Object.fromEntries(recordingReads.map((read) => {
-        const compositionId = compositionAddressByShareType.get(read.compositionShareType);
+        const compositionId = addresses.compositions[read.compositionShareType];
         return [
             read.recordingId,
             {
-                compositionCredits: compositionCreditsById.get(compositionId) ?? [],
+                compositionCredits: compositionCreditsById[compositionId] ?? [],
                 recordingCredits: read.recordingCredits ?? EMPTY_RECORDING_CREDITS,
             },
         ];
@@ -63,42 +73,20 @@ export async function getTrackCreditsByRecordingIds(client, graphqlClient, recor
 /**
  * Every `Recording` administered by `owner`.
  *
- * Two stages: list the owner's `RecordingAdminCap`s over the Core API, then
- * resolve each cap's share type back to its recording.
- *
- * The second stage needs GraphQL and is inherently one lookup per cap, because
- * `RecordingAdminCap` carries no back-pointer to its recording — unlike
- * `ReleaseAdminCap`, which stores `release_id` and can therefore be resolved
- * entirely over the Core API. The caps are derived objects (recording → cap via
- * `deriveObjectID`), and that derivation cannot be inverted, so the share type
- * is the only link back. Adding a `recording_id: ID` field to
- * `RecordingAdminCap` on the protocol side would make this a pure Core-API
- * batch read and remove both the GraphQL dependency and the fan-out.
- *
- * Until then the lookups run concurrently in bounded batches rather than
- * serially.
+ * Three bounded stages: list the owner's `RecordingAdminCap`s, resolve every
+ * share type in one aliased GraphQL query, then batch-fetch the recordings.
  */
 export async function getAdministeredRecordings(client, graphqlClient, owner, misoPackageId, options = {}) {
-    const concurrency = Math.max(1, options.concurrency ?? 10);
+    void options;
     const caps = await getOwnedRecordingAdminCaps(client, owner, misoPackageId);
-    const recordings = [];
-    for (let i = 0; i < caps.length; i += concurrency) {
-        const batch = caps.slice(i, i + concurrency);
-        const settled = await Promise.all(batch.map(async (cap) => {
-            try {
-                return await getRecordingByShareType(client, graphqlClient, cap.shareType, misoPackageId);
-            }
-            catch {
-                // A cap whose recording cannot be resolved is skipped rather than
-                // failing the whole catalog — matching the previous behavior, where a
-                // missing address was silently passed over.
-                return null;
-            }
-        }));
-        for (const rec of settled)
-            if (rec)
-                recordings.push(rec);
-    }
-    return recordings;
+    if (caps.length === 0)
+        return [];
+    const addresses = await getWorkAddressesByShareTypes(graphqlClient, { compositions: [], recordings: caps.map((cap) => cap.shareType) }, misoPackageId);
+    const byId = await getRecordingsByIds(client, Object.values(addresses.recordings).filter((id) => id !== undefined));
+    return caps.flatMap((cap) => {
+        const id = addresses.recordings[cap.shareType];
+        const recording = id ? byId[id] : undefined;
+        return recording ? [recording] : [];
+    });
 }
 //# sourceMappingURL=catalog.js.map

package/dist/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,sCAAsC;AActC,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,cAAc,CAAC;AAgBtB,MAAM,uBAAuB,GAAyB;IACpD,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB,EACzB,aAA+B,EAC/B,SAAiB,EACjB,OAAsC;IAEtC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,6BAA6B,CAClC,MAAM,EACN,aAAa,EACb,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAChD,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAyB,EACzB,aAA+B,EAC/B,iBAAoC,EACpC,OAAsC;IAEtC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAErD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACrC,MAAM,CAAC,gBAAgB,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrE,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,yBAAyB,CAAC;YAC3E,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACjE,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,qBAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC5C,MAAM,aAAa,GAAG,MAAM,gCAAgC,CAC1D,aAAa,EACb,SAAS,EACT,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QAC1F,OAAO,CAAC,SAAS,EAAE,aAAa,CAAU,CAAC;IAC7C,CAAC,CAAC,CACH,CAAC;IACF,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEzE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,wBAAwB,GAAG,MAAM,OAAO,CAAC,GAAG,CAChD,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,MAAM,EACN,aAAa,EACb,OAAO,CAAC,2BAA2B,CACpC,CAAC;QACF,OAAO,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAU,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAEjE,OAAO,MAAM,CAAC,WAAW,CACvB,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,aAAa,GAAG,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAE,CAAC;QACpF,OAAO;YACL,IAAI,CAAC,WAAW;YAChB;gBACE,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;gBACnE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,uBAAuB;aACnE;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAyB,EACzB,aAA+B,EAC/B,KAAa,EACb,aAAqB,EACrB,UAA4C,EAAE;IAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAE5E,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,OAAO,MAAM,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;gBAClE,sEAAsE;gBACtE,4CAA4C;gBAC5C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,OAAO;YAAE,IAAI,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,sCAAsC;AActC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GAGzB,MAAM,cAAc,CAAC;AAgBtB,MAAM,uBAAuB,GAAyB;IACpD,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB,EACzB,aAA+B,EAC/B,SAAiB,EACjB,OAAsC;IAEtC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,6BAA6B,CAClC,MAAM,EACN,aAAa,EACb,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAChD,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAyB,EACzB,aAA+B,EAC/B,iBAAoC,EACpC,OAAsC;IAEtC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,wBAAwB,CACtB,MAAM,EACN,YAAY,EACZ,OAAO,CAAC,yBAAyB,CAClC;QACD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACpE,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAE,CAAC;QACzC,IAAI,MAAM,YAAY,KAAK;YAAE,MAAM,MAAM,CAAC;QAC1C,MAAM,CAAC,EAAE,oBAAoB,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO;YACL,WAAW;YACX,gBAAgB,EAAE,oBAAoB,CAAC,WAAW,CAAC,IAAI,IAAI;YAC3D,oBAAoB;SACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG;QAC5B,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;KACpE,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAClD,aAAa,EACb,EAAE,YAAY,EAAE,qBAAqB,EAAE,UAAU,EAAE,EAAE,EAAE,EACvD,OAAO,CAAC,aAAa,CACtB,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,qBAAqB,EAAE,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,MAAM,CAC1C,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CACvC,CACF;KACF,CAAC;IACF,MAAM,sBAAsB,GAAG,MAAM,0BAA0B,CAC7D,MAAM,EACN,cAAc,EACd,OAAO,CAAC,2BAA2B,CACpC,CAAC;IAEF,OAAO,MAAM,CAAC,WAAW,CACvB,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAE,CAAC;QACzE,OAAO;YACL,IAAI,CAAC,WAAW;YAChB;gBACE,kBAAkB,EAAE,sBAAsB,CAAC,aAAa,CAAC,IAAI,EAAE;gBAC/D,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,uBAAuB;aACnE;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAyB,EACzB,aAA+B,EAC/B,KAAa,EACb,aAAqB,EACrB,UAA4C,EAAE;IAE9C,KAAK,OAAO,CAAC;IACb,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAClD,aAAa,EACb,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAClE,aAAa,CACd,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CACnC,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,CACxC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CACvC,CACF,CAAC;IACF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cover.d.ts

@@ -45,4 +45,14 @@ export interface ReleaseCoverView {
  * animation) as normalized Walrus refs for the app's featured-pressing card.
  */
 export declare function getReleaseCover(client: ClientWithCoreApi, releaseId: string, releaseCoverArtPackageId: string): Promise<ReleaseCoverView | null>;
+export declare function parseReleaseCoverContent(content: Uint8Array): ReleaseCoverView | null;
+/** Deterministic dynamic-field id for one release-cover package generation. */
+export declare function releaseCoverFieldId(releaseId: string, releaseCoverArtPackageId: string): string;
+/**
+ * Read covers for many releases and package generations in one Core request.
+ *
+ * Package IDs are ordered newest to oldest. If both fields exist, the newest
+ * wins; legacy fallbacks add bytes to the same bulk request, not serial probes.
+ */
+export declare function getReleaseCoversByIds(client: ClientWithCoreApi, releaseIdsInput: readonly string[], releaseCoverArtPackageIds: readonly string[]): Promise<Partial<Record<string, ReleaseCoverView>>>;
 //# sourceMappingURL=cover.d.ts.map

package/dist/cover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cover.d.ts","sourceRoot":"","sources":["../src/cover.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAMjD,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,wBAAwB,EAAE,MAAM,CAAC;IACjC,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAoBjE;AAID;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAuBD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,SAAS,EAAE,MAAM,EACjB,wBAAwB,EAAE,MAAM,GAC/B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA0BlC"}
+{"version":3,"file":"cover.d.ts","sourceRoot":"","sources":["../src/cover.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAKjD,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,wBAAwB,EAAE,MAAM,CAAC;IACjC,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAgCjE;AAID;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAkCD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,SAAS,EAAE,MAAM,EACjB,wBAAwB,EAAE,MAAM,GAC/B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAUlC;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,GAClB,gBAAgB,GAAG,IAAI,CAWzB;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,wBAAwB,EAAE,MAAM,GAC/B,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,EACzB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,yBAAyB,EAAE,SAAS,MAAM,EAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CA8BpD"}