@opendatalabs/vana-sdk 3.19.0 → 3.20.0

package/dist/index.browser.js

@@ -1364,6 +1364,17 @@ var DerivativeQuestionNotFoundError = class extends PersonalServerWriteError {
     super(message, "DERIVATIVE_QUESTION_NOT_FOUND", 404, errorCode, details);
   }
 };
+var DerivativeDerivedScopeRequiredError = class extends PersonalServerWriteError {
+  constructor(message, errorCode = null, details) {
+    super(
+      message,
+      "DERIVATIVE_DERIVED_SCOPE_REQUIRED",
+      400,
+      errorCode,
+      details
+    );
+  }
+};
 var DerivativeSourceNotGrantedError = class extends PersonalServerWriteError {
   constructor(message, errorCode = null, details) {
     super(message, "DERIVATIVE_SOURCE_NOT_GRANTED", 403, errorCode, details);
@@ -29146,6 +29157,9 @@ async function buildWeb3SignedHeader(params) {
   if (params.grantId !== void 0) {
     payload["grantId"] = params.grantId;
   }
+  if (params.nonce !== void 0) {
+    payload["nonce"] = params.nonce;
+  }
   const sortedPayload = Object.keys(payload).sort().reduce((acc, key) => {
     acc[key] = payload[key];
     return acc;
@@ -33871,6 +33885,18 @@ function nextProofIat(proofKey) {
   if (waitSec <= 0) return Promise.resolve(iat);
   return sleep2(waitSec * 1e3).then(() => iat);
 }
+function freshProofNonce() {
+  const webCrypto = globalThis.crypto;
+  if (typeof webCrypto?.randomUUID === "function") {
+    return webCrypto.randomUUID();
+  }
+  if (typeof webCrypto?.getRandomValues === "function") {
+    return bytesToHex2(webCrypto.getRandomValues(new Uint8Array(16)));
+  }
+  throw new WriteRequestError(
+    "No secure random source available to build a proof nonce; provide a crypto global"
+  );
+}
 function proofKeyFor(parts) {
   return bytesToHex2(
     sha2565(
@@ -34412,12 +34438,7 @@ var DerivativeQuestionSchema = z5.object({
 var QuestionListSchema = z5.object({
   questions: z5.array(DerivativeQuestionSchema)
 });
-var QuestionRecomputeResultSchema = z5.object({
-  questionId: z5.string().min(1),
-  derivedScope: z5.string().min(1),
-  /** `pending` when the question was never computed, else `stale`. */
-  status: QuestionStatusSchema
-});
+var QuestionRecomputeResultSchema = DerivativeQuestionSchema;
 var QuestionDeleteResultSchema = z5.object({
   questionId: z5.string().min(1),
   deleted: z5.literal(true)
@@ -34485,8 +34506,18 @@ async function resolveSession(params, resolved, force) {
   cache.set(resolved.cacheKey, session);
   return session;
 }
-async function questionErrorFromResponse(response) {
-  const { errorCode, message, details } = await readPersonalServerErrorBody(response);
+var PROOF_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "WRITE_ATTRIBUTION_REQUIRED",
+  "WRITE_ATTRIBUTION_INVALID",
+  "WRITE_ATTRIBUTION_SIGNER_MISMATCH",
+  "WRITE_ATTRIBUTION_GRANT_MISMATCH",
+  "WRITE_ATTRIBUTION_REPLAY"
+]);
+function isStaleSession(errorCode) {
+  return errorCode === null || !PROOF_FAILURE_CODES.has(errorCode);
+}
+async function questionErrorFromResponse(response, body) {
+  const { errorCode, message, details } = body ?? await readPersonalServerErrorBody(response);
   const text = message ?? `Derivative question request failed: ${response.status} ${response.statusText}`;
   switch (errorCode) {
     case "DERIVATIVE_SOURCE_NOT_GRANTED":
@@ -34505,6 +34536,8 @@ async function questionErrorFromResponse(response) {
       );
     case "DERIVATIVE_QUESTION_NOT_FOUND":
       return new DerivativeQuestionNotFoundError(text, errorCode, details);
+    case "DERIVATIVE_DERIVED_SCOPE_REQUIRED":
+      return new DerivativeDerivedScopeRequiredError(text, errorCode, details);
     default:
       break;
   }
@@ -34534,7 +34567,7 @@ async function sendOnce(params, resolved, session, spec, bodyBytes) {
     proofKeyFor({
       aud: session.audience,
       method: spec.method,
-      uri: spec.path,
+      uri: spec.target,
       grantId: session.grantId,
       signedBytes: bodyBytes
     }),
@@ -34550,17 +34583,22 @@ async function sendOnce(params, resolved, session, spec, bodyBytes) {
         await buildWeb3SignedHeader({
           signMessage: session.signer.signMessage,
           aud: session.audience,
-          // The Personal Server verifies the proof against the request's
-          // path only, so the signed `uri` must not carry the query string.
-          uri: spec.path,
+          // The proof commits to the whole request target, query included:
+          // `?derivedScope=` is what the list route authorizes against, and a
+          // proof that did not cover it would authorize any other scope.
+          uri: spec.target,
           method: spec.method,
           body: bodyBytes,
           grantId: session.grantId,
+          // Fresh per attempt, so a retry after a thrown `fetch` is never the
+          // proof the server may already have consumed, and so two identical
+          // polls inside one second stay distinct.
+          nonce: freshProofNonce(),
           iat
         })
       );
       return {
-        url: `${resolved.baseUrl}${spec.path}${spec.query ?? ""}`,
+        url: `${resolved.baseUrl}${spec.target}`,
         init: {
           method: spec.method,
           headers,
@@ -34576,12 +34614,17 @@ async function sendQuestionRequest(params, spec, schema) {
   const bodyBytes = spec.body === void 0 ? void 0 : new TextEncoder().encode(JSON.stringify(spec.body));
   let session = await resolveSession(params, resolved, false);
   let response = await sendOnce(params, resolved, session, spec, bodyBytes);
+  let errorBody;
   if (response.status === 401) {
-    session = await resolveSession(params, resolved, true);
-    response = await sendOnce(params, resolved, session, spec, bodyBytes);
+    errorBody = await readPersonalServerErrorBody(response);
+    if (isStaleSession(errorBody.errorCode)) {
+      session = await resolveSession(params, resolved, true);
+      response = await sendOnce(params, resolved, session, spec, bodyBytes);
+      errorBody = void 0;
+    }
   }
   if (!response.ok) {
-    throw await questionErrorFromResponse(response);
+    throw await questionErrorFromResponse(response, errorBody);
   }
   let body;
   try {
@@ -34675,7 +34718,7 @@ async function registerQuestion(params) {
     params,
     {
       method: "POST",
-      path: DERIVATIVE_QUESTIONS_PATH,
+      target: DERIVATIVE_QUESTIONS_PATH,
       body,
       label: "Register derivative question"
     },
@@ -34683,10 +34726,10 @@ async function registerQuestion(params) {
   );
 }
 async function getQuestion(params) {
-  const path = assertQuestionId(params.questionId);
+  const target = assertQuestionId(params.questionId);
   return sendQuestionRequest(
     params,
-    { method: "GET", path, label: "Read derivative question" },
+    { method: "GET", target, label: "Read derivative question" },
     DerivativeQuestionSchema
   );
 }
@@ -34696,12 +34739,12 @@ async function listQuestions(params) {
       "derivedScope is required; a builder may only list its own questions on a scope it may write"
     );
   }
+  const target = `${DERIVATIVE_QUESTIONS_PATH}?derivedScope=${encodeURIComponent(params.derivedScope)}`;
   const { questions } = await sendQuestionRequest(
     params,
     {
       method: "GET",
-      path: DERIVATIVE_QUESTIONS_PATH,
-      query: `?derivedScope=${encodeURIComponent(params.derivedScope)}`,
+      target,
       label: "List derivative questions"
     },
     QuestionListSchema
@@ -34709,18 +34752,18 @@ async function listQuestions(params) {
   return questions;
 }
 async function recomputeQuestion(params) {
-  const path = `${assertQuestionId(params.questionId)}/recompute`;
+  const target = `${assertQuestionId(params.questionId)}/recompute`;
   return sendQuestionRequest(
     params,
-    { method: "POST", path, label: "Recompute derivative question" },
+    { method: "POST", target, label: "Recompute derivative question" },
     QuestionRecomputeResultSchema
   );
 }
 async function deleteQuestion(params) {
-  const path = assertQuestionId(params.questionId);
+  const target = assertQuestionId(params.questionId);
   return sendQuestionRequest(
     params,
-    { method: "DELETE", path, label: "Delete derivative question" },
+    { method: "DELETE", target, label: "Delete derivative question" },
     QuestionDeleteResultSchema
   );
 }
@@ -35417,6 +35460,7 @@ export {
   DataPointVersionConflictError,
   DerivativeComputeUnavailableError,
   DerivativeCycleError,
+  DerivativeDerivedScopeRequiredError,
   DerivativeQuestionFailedError,
   DerivativeQuestionInvalidError,
   DerivativeQuestionNotFoundError,