@newhomestar/sdk 0.8.16 → 0.8.17

package/dist/credentials.js

@@ -190,6 +190,54 @@ async function performTokenExchange(slug, params) {
 async function fetchCredentialsFromAuthServer(authBaseUrl, slug, bearerToken, forceRefresh = false) {
     const url = `${authBaseUrl}/api/integrations/${encodeURIComponent(slug)}/credentials`;
     console.log(`[nova-sdk] 🌐 Fetching credentials via HTTP: GET ${url}${forceRefresh ? " (force-refresh)" : ""}`);
+    // ── Outgoing bearer-token preview ──────────────────────────────────────────
+    // We log the JWT's structural claims (NOT the signature, NOT secrets) so we
+    // can correlate the SDK's outgoing token against what the auth server says
+    // it received on the other side. This is invaluable when diagnosing 401s
+    // from `resolveCredentialsViaServiceToken` (the relay path).
+    try {
+        const parts = bearerToken.split(".");
+        if (parts.length === 3) {
+            // base64url → JSON. atob handles base64; we normalize url-safe chars first.
+            const b64urlDecode = (s) => {
+                const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+                // Pad to a multiple of 4
+                const padded = b64 + "=".repeat((4 - (b64.length % 4)) % 4);
+                if (typeof Buffer !== "undefined") {
+                    return Buffer.from(padded, "base64").toString("utf8");
+                }
+                // Browser-safe fallback
+                // eslint-disable-next-line no-undef
+                return decodeURIComponent(escape(atob(padded)));
+            };
+            const header = JSON.parse(b64urlDecode(parts[0]));
+            const payload = JSON.parse(b64urlDecode(parts[1]));
+            console.log(`[nova-sdk] 🪪 Outgoing bearer header:`, {
+                alg: header.alg,
+                typ: header.typ,
+                kid: header.kid,
+            });
+            console.log(`[nova-sdk] 🪪 Outgoing bearer payload preview:`, {
+                iss: payload.iss,
+                aud: payload.aud,
+                sub: payload.sub,
+                client_id: payload.client_id,
+                scope: payload.scope,
+                service_name: payload.service_name,
+                exp: payload.exp,
+                iat: payload.iat,
+                secondsUntilExp: typeof payload.exp === "number"
+                    ? payload.exp - Math.floor(Date.now() / 1000)
+                    : null,
+            });
+        }
+        else {
+            console.log(`[nova-sdk] 🪪 Outgoing bearer is NOT a 3-part JWT (parts=${parts.length}, length=${bearerToken.length}). This is expected if the SDK is using INTERNAL_API_SECRET as a service token.`);
+        }
+    }
+    catch (decodeErr) {
+        console.warn(`[nova-sdk] ⚠️ Failed to decode outgoing bearer for preview:`, decodeErr instanceof Error ? decodeErr.message : String(decodeErr));
+    }
     const headers = {
         Authorization: `Bearer ${bearerToken}`,
         Accept: "application/json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newhomestar/sdk",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "description": "Type-safe SDK for building Nova pipelines (workers & functions)",
   "homepage": "https://github.com/newhomestar/nova-node-sdk#readme",
   "bugs": {