@pafi-dev/issuer 0.3.0-beta.7 → 0.3.0-beta.8

package/dist/index.cjs

@@ -1862,18 +1862,22 @@ var PafiBackendError = class extends Error {
   get safeToRetry() {
     if (this.serverSafeToRetry !== void 0) return this.serverSafeToRetry;
     switch (this.code) {
+      // Transient infra
       case "PAYMASTER_UNAVAILABLE":
       case "PAYMASTER_TIMEOUT":
       case "RATE_LIMITER_UNAVAILABLE":
+      case "KMS_UNAVAILABLE":
+      case "SPONSOR_AUTH_SIGNING_FAILED":
       case "INTERNAL_ERROR":
       case "TIMEOUT":
       case "NETWORK_ERROR":
         return true;
+      // Rate-limited — safe to retry after retryAfter window
       case "RATE_LIMIT_EXCEEDED":
       case "RATE_LIMIT_EXCEEDED_DAILY":
       case "RATE_LIMIT_EXCEEDED_PER_USER":
+      case "ISSUER_BUDGET_EXCEEDED":
         return true;
-      // after retryAfter
       default:
         return false;
     }
@@ -1921,15 +1925,36 @@ var PafiBackendClient = class {
     }
   }
   /**
-   * Request paymaster sponsorship for a pre-built UserOperation.
-   * See [SPONSORED_PATH_FLOW.md §4.1] for the API contract.
+   * Request a SponsorAuth signature from PAFI sponsor-relayer (beta.8+).
    *
-   * Retries automatically on transient failures (5xx, timeouts, network
-   * errors, and errors the server flags with `safeToRetry: true`) up to
-   * `retry.maxAttempts`. 4xx errors that are not `safeToRetry` fail fast.
+   * The relayer:
+   *   1. Authenticates user (JWT) + issuer (API key)
+   *   2. Per-(user, scenario) rate limit + per-issuer daily budget
+   *   3. Scenario-specific intent validation (mint cap, KYC, etc.)
+   *   4. Allocates nonce + signs SponsorAuth payload via KMS PAFI key
+   *   5. Returns `{ sponsorAuth, payload }` for the FE to forward to
+   *      Privy's `signUserOperation({ sponsorAuth, payload })`.
+   *
+   * Retries on transient failures (5xx, timeouts, KMS unavailable,
+   * rate-limit-with-retryAfter). 4xx that are not `safeToRetry` fail fast.
+   *
+   * See `pafi-backend/docs/SPONSOR_AUTH_DESIGN.md` for the full spec.
    *
    * @throws PafiBackendError on final failure after exhausting retries
    */
+  async requestSponsorAuth(req) {
+    return this.postWithRetry(
+      "/sponsor-auth",
+      req
+    );
+  }
+  /**
+   * @deprecated Coinbase paymaster path — replaced by `requestSponsorAuth`
+   * in beta.8. Will be removed in 1.0. Migrate by:
+   *   1. Switch to `requestSponsorAuth` returning `{ sponsorAuth, payload }`
+   *   2. Pass both to Privy `signUserOperation` instead of merging
+   *      paymasterData into the UserOp callData
+   */
   async requestSponsorship(req) {
     return this.postWithRetry(
       "/paymaster/sponsor",