@polyester/sdk 0.11.0 → 0.13.0

package/dist/shared/transports.d.ts

@@ -5,6 +5,12 @@ interface Transports {
   authApi: Transport;
   publicApi: Transport;
 }
+/** Connect transports available to services that call authenticated APIs. */
+type AuthApiTransports = Pick<Transports, "authApi">;
+/** Connect transports available to services that call public APIs. */
+type PublicApiTransports = Pick<Transports, "publicApi">;
+/** Connect transports available to services that call both public and authenticated APIs. */
+type AuthAndPublicApiTransports = Pick<Transports, "authApi" | "publicApi">;
 /**
  * Generic JWT auth for HTTP/Connect endpoints that follow the Bearer token contract.
  */
@@ -24,5 +30,5 @@ interface ApiKeyEd25519AuthProvider {
   getSecretKey: () => Uint8Array | null | Promise<Uint8Array | null>;
 }
 //#endregion
-export { ApiKeyEd25519AuthProvider, JwtAuthProvider, Transports };
+export { ApiKeyEd25519AuthProvider, AuthAndPublicApiTransports, AuthApiTransports, JwtAuthProvider, PublicApiTransports, Transports };
 //# sourceMappingURL=transports.d.ts.map

package/dist/shared/transports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports.d.ts","names":[],"sources":["../../src/shared/transports.ts"],"mappings":";;;UA8BiB;EACb,SAAS;EACT,WAAW;;;;;UAME;EACb;;EAEA,gCAAgC;;;;;;UAOnB;EACb;EACA,gCAAgC;;EAEhC,oBAAoB,oBAAoB,QAAQ"}
+{"version":3,"file":"transports.d.ts","names":[],"sources":["../../src/shared/transports.ts"],"mappings":";;;UA8BiB;EACb,SAAS;EACT,WAAW;;;KAIH,oBAAoB,KAAK;;KAGzB,sBAAsB,KAAK;;KAG3B,6BAA6B,KAAK;;;;UAK7B;EACb;;EAEA,gCAAgC;;;;;;UAOnB;EACb;EACA,gCAAgC;;EAEhC,oBAAoB,oBAAoB,QAAQ"}

package/dist/shared/transports.js.map

@@ -1 +1 @@
-{"version":3,"file":"transports.js","names":[],"sources":["../../src/shared/transports.ts"],"sourcesContent":["import { createConnectTransport } from \"@connectrpc/connect-web\";\nimport type { Transport, Interceptor } from \"@connectrpc/connect\";\nimport { toBinary, toJsonString } from \"@bufbuild/protobuf\";\nimport { signAsync } from \"@noble/ed25519\";\nimport { createErrorMappingTransport } from \"./connect-error-mapping.js\";\nimport {\n    AuthenticationError,\n    ConfigurationError,\n    isAbortError,\n    NetworkError,\n    PolyesterError,\n} from \"./errors.js\";\n\nexport { isAbortError };\n\nexport type ConnectWireFormat = \"binary\" | \"json\";\n\nexport const POLYESTER_MOCK_HEADER = \"x-polyester-mock\";\n\nexport interface TransportConfig {\n    apiUrl: string;\n    interceptors?: Interceptor[];\n    auth?: JwtAuthProvider | ApiKeyEd25519AuthProvider;\n    /**\n     * Connect wire format. Defaults to binary for production performance.\n     * Use `json` for the API Playground visualization.\n     */\n    wireFormat?: ConnectWireFormat;\n}\n\nexport interface Transports {\n    authApi: Transport;\n    publicApi: Transport;\n}\n\n/**\n * Generic JWT auth for HTTP/Connect endpoints that follow the Bearer token contract.\n */\nexport interface JwtAuthProvider {\n    kind: \"jwt\";\n    /** Typically wraps the configured browser auth token storage. */\n    getToken: () => string | null | Promise<string | null>;\n}\n\n/**\n * Generic Ed25519 API key auth for HTTP/Connect endpoints that follow the\n * X-API-KEY-ID / X-API-TIMESTAMP / X-API-SIGNATURE contract.\n */\nexport interface ApiKeyEd25519AuthProvider {\n    kind: \"api-key-ed25519\";\n    getKeyId: () => string | null | Promise<string | null>;\n    /** Ed25519 secret key bytes (not hex) for signing. */\n    getSecretKey: () => Uint8Array | null | Promise<Uint8Array | null>;\n}\n\nexport interface ApiKeyEd25519SigningRequest {\n    url: string | URL;\n    method: string;\n    body?: Uint8Array;\n    timestamp?: string;\n}\n\n/**\n * Returns the fetch implementation used by SDK transports.\n */\nexport function makeFetch(): typeof fetch {\n    const wrappedFetch = Object.assign(\n        async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n            // Normalize headers into a mutable Headers object\n            const headers = new Headers(init?.headers);\n\n            try {\n                const res = await fetch(input, {\n                    ...init,\n                    headers,\n                    redirect: \"manual\",\n                });\n\n                return res;\n            } catch (err) {\n                if (isAbortError(err)) throw err;\n                throw new NetworkError(\"Transport request failed\", { cause: err });\n            }\n        },\n        fetch,\n    );\n\n    return wrappedFetch;\n}\n\n/**\n * Creates Connect transports for SDK service clients.\n */\nexport function createTransports(config: TransportConfig): Transports {\n    const { apiUrl, interceptors = [], auth, wireFormat = \"binary\" } = config;\n    const useBinaryFormat = wireFormat === \"binary\";\n    const publicApi = createErrorMappingTransport(\n        createConnectTransport({\n            baseUrl: apiUrl,\n            useBinaryFormat,\n            interceptors,\n            fetch: makeFetch(),\n        }),\n    );\n\n    const authInterceptors = auth\n        ? auth.kind === \"jwt\"\n            ? [createAuthInterceptor(auth, { wireFormat }), ...interceptors]\n            : [...interceptors, createAuthInterceptor(auth, { wireFormat })]\n        : interceptors;\n    const authApi = createErrorMappingTransport(\n        createConnectTransport({\n            baseUrl: apiUrl,\n            useBinaryFormat,\n            interceptors: authInterceptors,\n            fetch: makeFetch(),\n        }),\n    );\n\n    return { authApi, publicApi };\n}\n\n/**\n * Creates an interceptor that enables mock transport behavior.\n */\nexport function createMockInterceptor(getEnabled: () => boolean): Interceptor {\n    return (next) => async (req) => {\n        if (getEnabled()) req.header.set(POLYESTER_MOCK_HEADER, \"true\");\n        return next(req);\n    };\n}\n\nasync function sha256Hex(bytes: Uint8Array): Promise<string> {\n    if (typeof crypto === \"undefined\" || !crypto.subtle) {\n        throw new ConfigurationError(\"SHA-256 not available in this environment\");\n    }\n    const hash = await crypto.subtle.digest(\"SHA-256\", bytes.slice());\n    return Array.from(new Uint8Array(hash), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nlet lastTimestamp = 0;\nfunction nextTimestamp(): string {\n    lastTimestamp = Math.max(lastTimestamp + 1, Date.now());\n    return String(lastTimestamp);\n}\n\nfunction canonicalQueryString(params: URLSearchParams): string {\n    const pairs: string[] = [];\n    for (const [k, v] of params.entries()) {\n        pairs.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);\n    }\n    pairs.sort();\n    return pairs.join(\"&\");\n}\n\n/**\n * Creates API-key authentication headers for endpoints using the Polyester Ed25519 signing contract.\n */\nexport async function createApiKeyEd25519AuthHeaders(\n    auth: ApiKeyEd25519AuthProvider,\n    request: ApiKeyEd25519SigningRequest,\n): Promise<Record<string, string>> {\n    let keyId: string | null;\n    let secretKey: Uint8Array | null;\n    try {\n        [keyId, secretKey] = await Promise.all([auth.getKeyId(), auth.getSecretKey()]);\n    } catch (cause) {\n        if (cause instanceof PolyesterError) throw cause;\n        throw new ConfigurationError(\"API key credential provider failed\", { cause });\n    }\n    if (!keyId || !secretKey) throw new ConfigurationError(\"Missing API key ID or secret key\");\n    if (!(secretKey instanceof Uint8Array) || secretKey.byteLength !== 32) {\n        throw new ConfigurationError(\"API key secret key must contain exactly 32 bytes\");\n    }\n\n    const urlObj = new URL(request.url);\n    const timestamp = request.timestamp ?? nextTimestamp();\n    const bodyHash = await sha256Hex(request.body ?? new Uint8Array(0));\n    const canonicalQuery = canonicalQueryString(urlObj.searchParams);\n    const canonical = `${timestamp}\\n${request.method}\\n${urlObj.pathname}\\n${canonicalQuery}\\n${bodyHash}`;\n    const msgBytes = new TextEncoder().encode(canonical);\n    const sig = await signAsync(msgBytes, secretKey);\n    const signatureHex = Array.from(sig, (b: number) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n    return {\n        \"X-API-KEY-ID\": keyId,\n        \"X-API-TIMESTAMP\": timestamp,\n        \"X-API-SIGNATURE\": signatureHex,\n    };\n}\n\n/**\n * Resolves a JWT credential and translates provider failures or invalid values\n * into stable SDK errors.\n */\nexport async function resolveJwtToken(auth: JwtAuthProvider): Promise<string | null> {\n    let token: string | null;\n    try {\n        token = await auth.getToken();\n    } catch (cause) {\n        if (cause instanceof PolyesterError) throw cause;\n        throw new AuthenticationError(\"JWT token provider failed\", { cause });\n    }\n    if (token !== null && typeof token !== \"string\") {\n        throw new ConfigurationError(\"JWT token provider must return a string or null\");\n    }\n    return token;\n}\n\n/**\n * Creates an interceptor that attaches SDK authentication headers.\n */\nexport function createAuthInterceptor(\n    auth: JwtAuthProvider | ApiKeyEd25519AuthProvider,\n    options?: { wireFormat?: ConnectWireFormat },\n): Interceptor {\n    return (next) => async (req) => {\n        const wireFormat = options?.wireFormat ?? \"binary\";\n        if (auth.kind === \"jwt\") {\n            const token = await resolveJwtToken(auth);\n            if (token) {\n                req.header.set(\"Authorization\", `Bearer ${token}`);\n            }\n        } else if (auth.kind === \"api-key-ed25519\") {\n            if (req.stream) {\n                throw new ConfigurationError(\n                    \"API key authentication does not support streaming Connect RPCs\",\n                );\n            }\n            // Unary request: serialize the message using the method's input schema.\n            const inputSchema = req.method.input;\n            const bodyBytes =\n                wireFormat === \"json\"\n                    ? new TextEncoder().encode(toJsonString(inputSchema, req.message))\n                    : toBinary(inputSchema, req.message);\n\n            const headers = await createApiKeyEd25519AuthHeaders(auth, {\n                url: req.url,\n                method: req.requestMethod,\n                body: bodyBytes,\n            });\n            for (const [key, value] of Object.entries(headers)) {\n                req.header.set(key, value);\n            }\n        }\n        return next(req);\n    };\n}\n"],"mappings":";;;;;;;;;AAiEA,SAAgB,YAA0B;CAsBtC,OArBqB,OAAO,OACxB,OAAO,OAAoC,SAAuC;EAE9E,MAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;EAEzC,IAAI;GAOA,OAAO,MANW,MAAM,OAAO;IAC3B,GAAG;IACH;IACA,UAAU;GACd,CAAC;EAGL,SAAS,KAAK;GACV,IAAI,aAAa,GAAG,GAAG,MAAM;GAC7B,MAAM,IAAI,aAAa,4BAA4B,EAAE,OAAO,IAAI,CAAC;EACrE;CACJ,GACA,KAGc;AACtB;;;;AAKA,SAAgB,iBAAiB,QAAqC;CAClE,MAAM,EAAE,QAAQ,eAAe,CAAC,GAAG,MAAM,aAAa,aAAa;CACnE,MAAM,kBAAkB,eAAe;CACvC,MAAM,YAAY,4BACd,uBAAuB;EACnB,SAAS;EACT;EACA;EACA,OAAO,UAAU;CACrB,CAAC,CACL;CAEA,MAAM,mBAAmB,OACnB,KAAK,SAAS,QACV,CAAC,sBAAsB,MAAM,EAAE,WAAW,CAAC,GAAG,GAAG,YAAY,IAC7D,CAAC,GAAG,cAAc,sBAAsB,MAAM,EAAE,WAAW,CAAC,CAAC,IACjE;CAUN,OAAO;EAAE,SATO,4BACZ,uBAAuB;GACnB,SAAS;GACT;GACA,cAAc;GACd,OAAO,UAAU;EACrB,CAAC,CAGU;EAAG;CAAU;AAChC;AAYA,eAAe,UAAU,OAAoC;CACzD,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,QACzC,MAAM,IAAI,mBAAmB,2CAA2C;CAE5E,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;CAChE,OAAO,MAAM,KAAK,IAAI,WAAW,IAAI,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC3F;AAEA,IAAI,gBAAgB;AACpB,SAAS,gBAAwB;CAC7B,gBAAgB,KAAK,IAAI,gBAAgB,GAAG,KAAK,IAAI,CAAC;CACtD,OAAO,OAAO,aAAa;AAC/B;AAEA,SAAS,qBAAqB,QAAiC;CAC3D,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,GAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,mBAAmB,CAAC,GAAG;CAElE,MAAM,KAAK;CACX,OAAO,MAAM,KAAK,GAAG;AACzB;;;;AAKA,eAAsB,+BAClB,MACA,SAC+B;CAC/B,IAAI;CACJ,IAAI;CACJ,IAAI;EACA,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,KAAK,SAAS,GAAG,KAAK,aAAa,CAAC,CAAC;CACjF,SAAS,OAAO;EACZ,IAAI,iBAAiB,gBAAgB,MAAM;EAC3C,MAAM,IAAI,mBAAmB,sCAAsC,EAAE,MAAM,CAAC;CAChF;CACA,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,IAAI,mBAAmB,kCAAkC;CACzF,IAAI,EAAE,qBAAqB,eAAe,UAAU,eAAe,IAC/D,MAAM,IAAI,mBAAmB,kDAAkD;CAGnF,MAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;CAClC,MAAM,YAAY,QAAQ,aAAa,cAAc;CACrD,MAAM,WAAW,MAAM,UAAU,QAAQ,wBAAQ,IAAI,WAAW,CAAC,CAAC;CAClE,MAAM,iBAAiB,qBAAqB,OAAO,YAAY;CAC/D,MAAM,YAAY,GAAG,UAAU,IAAI,QAAQ,OAAO,IAAI,OAAO,SAAS,IAAI,eAAe,IAAI;CAC7F,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;CACnD,MAAM,MAAM,MAAM,UAAU,UAAU,SAAS;CAC/C,MAAM,eAAe,MAAM,KAAK,MAAM,MAAc,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAE5F,OAAO;EACH,gBAAgB;EAChB,mBAAmB;EACnB,mBAAmB;CACvB;AACJ;;;;;AAMA,eAAsB,gBAAgB,MAA+C;CACjF,IAAI;CACJ,IAAI;EACA,QAAQ,MAAM,KAAK,SAAS;CAChC,SAAS,OAAO;EACZ,IAAI,iBAAiB,gBAAgB,MAAM;EAC3C,MAAM,IAAI,oBAAoB,6BAA6B,EAAE,MAAM,CAAC;CACxE;CACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,MAAM,IAAI,mBAAmB,iDAAiD;CAElF,OAAO;AACX;;;;AAKA,SAAgB,sBACZ,MACA,SACW;CACX,QAAQ,SAAS,OAAO,QAAQ;EAC5B,MAAM,aAAa,SAAS,cAAc;EAC1C,IAAI,KAAK,SAAS,OAAO;GACrB,MAAM,QAAQ,MAAM,gBAAgB,IAAI;GACxC,IAAI,OACA,IAAI,OAAO,IAAI,iBAAiB,UAAU,OAAO;EAEzD,OAAO,IAAI,KAAK,SAAS,mBAAmB;GACxC,IAAI,IAAI,QACJ,MAAM,IAAI,mBACN,gEACJ;GAGJ,MAAM,cAAc,IAAI,OAAO;GAC/B,MAAM,YACF,eAAe,SACT,IAAI,YAAY,CAAC,CAAC,OAAO,aAAa,aAAa,IAAI,OAAO,CAAC,IAC/D,SAAS,aAAa,IAAI,OAAO;GAE3C,MAAM,UAAU,MAAM,+BAA+B,MAAM;IACvD,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ,MAAM;GACV,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC7C,IAAI,OAAO,IAAI,KAAK,KAAK;EAEjC;EACA,OAAO,KAAK,GAAG;CACnB;AACJ"}
+{"version":3,"file":"transports.js","names":[],"sources":["../../src/shared/transports.ts"],"sourcesContent":["import { createConnectTransport } from \"@connectrpc/connect-web\";\nimport type { Transport, Interceptor } from \"@connectrpc/connect\";\nimport { toBinary, toJsonString } from \"@bufbuild/protobuf\";\nimport { signAsync } from \"@noble/ed25519\";\nimport { createErrorMappingTransport } from \"./connect-error-mapping.js\";\nimport {\n    AuthenticationError,\n    ConfigurationError,\n    isAbortError,\n    NetworkError,\n    PolyesterError,\n} from \"./errors.js\";\n\nexport { isAbortError };\n\nexport type ConnectWireFormat = \"binary\" | \"json\";\n\nexport const POLYESTER_MOCK_HEADER = \"x-polyester-mock\";\n\nexport interface TransportConfig {\n    apiUrl: string;\n    interceptors?: Interceptor[];\n    auth?: JwtAuthProvider | ApiKeyEd25519AuthProvider;\n    /**\n     * Connect wire format. Defaults to binary for production performance.\n     * Use `json` for the API Playground visualization.\n     */\n    wireFormat?: ConnectWireFormat;\n}\n\nexport interface Transports {\n    authApi: Transport;\n    publicApi: Transport;\n}\n\n/** Connect transports available to services that call authenticated APIs. */\nexport type AuthApiTransports = Pick<Transports, \"authApi\">;\n\n/** Connect transports available to services that call public APIs. */\nexport type PublicApiTransports = Pick<Transports, \"publicApi\">;\n\n/** Connect transports available to services that call both public and authenticated APIs. */\nexport type AuthAndPublicApiTransports = Pick<Transports, \"authApi\" | \"publicApi\">;\n\n/**\n * Generic JWT auth for HTTP/Connect endpoints that follow the Bearer token contract.\n */\nexport interface JwtAuthProvider {\n    kind: \"jwt\";\n    /** Typically wraps the configured browser auth token storage. */\n    getToken: () => string | null | Promise<string | null>;\n}\n\n/**\n * Generic Ed25519 API key auth for HTTP/Connect endpoints that follow the\n * X-API-KEY-ID / X-API-TIMESTAMP / X-API-SIGNATURE contract.\n */\nexport interface ApiKeyEd25519AuthProvider {\n    kind: \"api-key-ed25519\";\n    getKeyId: () => string | null | Promise<string | null>;\n    /** Ed25519 secret key bytes (not hex) for signing. */\n    getSecretKey: () => Uint8Array | null | Promise<Uint8Array | null>;\n}\n\nexport interface ApiKeyEd25519SigningRequest {\n    url: string | URL;\n    method: string;\n    body?: Uint8Array;\n    timestamp?: string;\n}\n\n/**\n * Returns the fetch implementation used by SDK transports.\n */\nexport function makeFetch(): typeof fetch {\n    const wrappedFetch = Object.assign(\n        async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n            // Normalize headers into a mutable Headers object\n            const headers = new Headers(init?.headers);\n\n            try {\n                const res = await fetch(input, {\n                    ...init,\n                    headers,\n                    redirect: \"manual\",\n                });\n\n                return res;\n            } catch (err) {\n                if (isAbortError(err)) throw err;\n                throw new NetworkError(\"Transport request failed\", { cause: err });\n            }\n        },\n        fetch,\n    );\n\n    return wrappedFetch;\n}\n\n/**\n * Creates Connect transports for SDK service clients.\n */\nexport function createTransports(config: TransportConfig): Transports {\n    const { apiUrl, interceptors = [], auth, wireFormat = \"binary\" } = config;\n    const useBinaryFormat = wireFormat === \"binary\";\n    const publicApi = createErrorMappingTransport(\n        createConnectTransport({\n            baseUrl: apiUrl,\n            useBinaryFormat,\n            interceptors,\n            fetch: makeFetch(),\n        }),\n    );\n\n    const authInterceptors = auth\n        ? auth.kind === \"jwt\"\n            ? [createAuthInterceptor(auth, { wireFormat }), ...interceptors]\n            : [...interceptors, createAuthInterceptor(auth, { wireFormat })]\n        : interceptors;\n    const authApi = createErrorMappingTransport(\n        createConnectTransport({\n            baseUrl: apiUrl,\n            useBinaryFormat,\n            interceptors: authInterceptors,\n            fetch: makeFetch(),\n        }),\n    );\n\n    return { authApi, publicApi };\n}\n\n/**\n * Creates an interceptor that enables mock transport behavior.\n */\nexport function createMockInterceptor(getEnabled: () => boolean): Interceptor {\n    return (next) => async (req) => {\n        if (getEnabled()) req.header.set(POLYESTER_MOCK_HEADER, \"true\");\n        return next(req);\n    };\n}\n\nasync function sha256Hex(bytes: Uint8Array): Promise<string> {\n    if (typeof crypto === \"undefined\" || !crypto.subtle) {\n        throw new ConfigurationError(\"SHA-256 not available in this environment\");\n    }\n    const hash = await crypto.subtle.digest(\"SHA-256\", bytes.slice());\n    return Array.from(new Uint8Array(hash), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nlet lastTimestamp = 0;\nfunction nextTimestamp(): string {\n    lastTimestamp = Math.max(lastTimestamp + 1, Date.now());\n    return String(lastTimestamp);\n}\n\nfunction canonicalQueryString(params: URLSearchParams): string {\n    const pairs: string[] = [];\n    for (const [k, v] of params.entries()) {\n        pairs.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);\n    }\n    pairs.sort();\n    return pairs.join(\"&\");\n}\n\n/**\n * Creates API-key authentication headers for endpoints using the Polyester Ed25519 signing contract.\n */\nexport async function createApiKeyEd25519AuthHeaders(\n    auth: ApiKeyEd25519AuthProvider,\n    request: ApiKeyEd25519SigningRequest,\n): Promise<Record<string, string>> {\n    let keyId: string | null;\n    let secretKey: Uint8Array | null;\n    try {\n        [keyId, secretKey] = await Promise.all([auth.getKeyId(), auth.getSecretKey()]);\n    } catch (cause) {\n        if (cause instanceof PolyesterError) throw cause;\n        throw new ConfigurationError(\"API key credential provider failed\", { cause });\n    }\n    if (!keyId || !secretKey) throw new ConfigurationError(\"Missing API key ID or secret key\");\n    if (!(secretKey instanceof Uint8Array) || secretKey.byteLength !== 32) {\n        throw new ConfigurationError(\"API key secret key must contain exactly 32 bytes\");\n    }\n\n    const urlObj = new URL(request.url);\n    const timestamp = request.timestamp ?? nextTimestamp();\n    const bodyHash = await sha256Hex(request.body ?? new Uint8Array(0));\n    const canonicalQuery = canonicalQueryString(urlObj.searchParams);\n    const canonical = `${timestamp}\\n${request.method}\\n${urlObj.pathname}\\n${canonicalQuery}\\n${bodyHash}`;\n    const msgBytes = new TextEncoder().encode(canonical);\n    const sig = await signAsync(msgBytes, secretKey);\n    const signatureHex = Array.from(sig, (b: number) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n    return {\n        \"X-API-KEY-ID\": keyId,\n        \"X-API-TIMESTAMP\": timestamp,\n        \"X-API-SIGNATURE\": signatureHex,\n    };\n}\n\n/**\n * Resolves a JWT credential and translates provider failures or invalid values\n * into stable SDK errors.\n */\nexport async function resolveJwtToken(auth: JwtAuthProvider): Promise<string | null> {\n    let token: string | null;\n    try {\n        token = await auth.getToken();\n    } catch (cause) {\n        if (cause instanceof PolyesterError) throw cause;\n        throw new AuthenticationError(\"JWT token provider failed\", { cause });\n    }\n    if (token !== null && typeof token !== \"string\") {\n        throw new ConfigurationError(\"JWT token provider must return a string or null\");\n    }\n    return token;\n}\n\n/**\n * Creates an interceptor that attaches SDK authentication headers.\n */\nexport function createAuthInterceptor(\n    auth: JwtAuthProvider | ApiKeyEd25519AuthProvider,\n    options?: { wireFormat?: ConnectWireFormat },\n): Interceptor {\n    return (next) => async (req) => {\n        const wireFormat = options?.wireFormat ?? \"binary\";\n        if (auth.kind === \"jwt\") {\n            const token = await resolveJwtToken(auth);\n            if (token) {\n                req.header.set(\"Authorization\", `Bearer ${token}`);\n            }\n        } else if (auth.kind === \"api-key-ed25519\") {\n            if (req.stream) {\n                throw new ConfigurationError(\n                    \"API key authentication does not support streaming Connect RPCs\",\n                );\n            }\n            // Unary request: serialize the message using the method's input schema.\n            const inputSchema = req.method.input;\n            const bodyBytes =\n                wireFormat === \"json\"\n                    ? new TextEncoder().encode(toJsonString(inputSchema, req.message))\n                    : toBinary(inputSchema, req.message);\n\n            const headers = await createApiKeyEd25519AuthHeaders(auth, {\n                url: req.url,\n                method: req.requestMethod,\n                body: bodyBytes,\n            });\n            for (const [key, value] of Object.entries(headers)) {\n                req.header.set(key, value);\n            }\n        }\n        return next(req);\n    };\n}\n"],"mappings":";;;;;;;;;AA0EA,SAAgB,YAA0B;CAsBtC,OArBqB,OAAO,OACxB,OAAO,OAAoC,SAAuC;EAE9E,MAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;EAEzC,IAAI;GAOA,OAAO,MANW,MAAM,OAAO;IAC3B,GAAG;IACH;IACA,UAAU;GACd,CAAC;EAGL,SAAS,KAAK;GACV,IAAI,aAAa,GAAG,GAAG,MAAM;GAC7B,MAAM,IAAI,aAAa,4BAA4B,EAAE,OAAO,IAAI,CAAC;EACrE;CACJ,GACA,KAGc;AACtB;;;;AAKA,SAAgB,iBAAiB,QAAqC;CAClE,MAAM,EAAE,QAAQ,eAAe,CAAC,GAAG,MAAM,aAAa,aAAa;CACnE,MAAM,kBAAkB,eAAe;CACvC,MAAM,YAAY,4BACd,uBAAuB;EACnB,SAAS;EACT;EACA;EACA,OAAO,UAAU;CACrB,CAAC,CACL;CAEA,MAAM,mBAAmB,OACnB,KAAK,SAAS,QACV,CAAC,sBAAsB,MAAM,EAAE,WAAW,CAAC,GAAG,GAAG,YAAY,IAC7D,CAAC,GAAG,cAAc,sBAAsB,MAAM,EAAE,WAAW,CAAC,CAAC,IACjE;CAUN,OAAO;EAAE,SATO,4BACZ,uBAAuB;GACnB,SAAS;GACT;GACA,cAAc;GACd,OAAO,UAAU;EACrB,CAAC,CAGU;EAAG;CAAU;AAChC;AAYA,eAAe,UAAU,OAAoC;CACzD,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,QACzC,MAAM,IAAI,mBAAmB,2CAA2C;CAE5E,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;CAChE,OAAO,MAAM,KAAK,IAAI,WAAW,IAAI,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC3F;AAEA,IAAI,gBAAgB;AACpB,SAAS,gBAAwB;CAC7B,gBAAgB,KAAK,IAAI,gBAAgB,GAAG,KAAK,IAAI,CAAC;CACtD,OAAO,OAAO,aAAa;AAC/B;AAEA,SAAS,qBAAqB,QAAiC;CAC3D,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,GAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,mBAAmB,CAAC,GAAG;CAElE,MAAM,KAAK;CACX,OAAO,MAAM,KAAK,GAAG;AACzB;;;;AAKA,eAAsB,+BAClB,MACA,SAC+B;CAC/B,IAAI;CACJ,IAAI;CACJ,IAAI;EACA,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,KAAK,SAAS,GAAG,KAAK,aAAa,CAAC,CAAC;CACjF,SAAS,OAAO;EACZ,IAAI,iBAAiB,gBAAgB,MAAM;EAC3C,MAAM,IAAI,mBAAmB,sCAAsC,EAAE,MAAM,CAAC;CAChF;CACA,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,IAAI,mBAAmB,kCAAkC;CACzF,IAAI,EAAE,qBAAqB,eAAe,UAAU,eAAe,IAC/D,MAAM,IAAI,mBAAmB,kDAAkD;CAGnF,MAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;CAClC,MAAM,YAAY,QAAQ,aAAa,cAAc;CACrD,MAAM,WAAW,MAAM,UAAU,QAAQ,wBAAQ,IAAI,WAAW,CAAC,CAAC;CAClE,MAAM,iBAAiB,qBAAqB,OAAO,YAAY;CAC/D,MAAM,YAAY,GAAG,UAAU,IAAI,QAAQ,OAAO,IAAI,OAAO,SAAS,IAAI,eAAe,IAAI;CAC7F,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;CACnD,MAAM,MAAM,MAAM,UAAU,UAAU,SAAS;CAC/C,MAAM,eAAe,MAAM,KAAK,MAAM,MAAc,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAE5F,OAAO;EACH,gBAAgB;EAChB,mBAAmB;EACnB,mBAAmB;CACvB;AACJ;;;;;AAMA,eAAsB,gBAAgB,MAA+C;CACjF,IAAI;CACJ,IAAI;EACA,QAAQ,MAAM,KAAK,SAAS;CAChC,SAAS,OAAO;EACZ,IAAI,iBAAiB,gBAAgB,MAAM;EAC3C,MAAM,IAAI,oBAAoB,6BAA6B,EAAE,MAAM,CAAC;CACxE;CACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,MAAM,IAAI,mBAAmB,iDAAiD;CAElF,OAAO;AACX;;;;AAKA,SAAgB,sBACZ,MACA,SACW;CACX,QAAQ,SAAS,OAAO,QAAQ;EAC5B,MAAM,aAAa,SAAS,cAAc;EAC1C,IAAI,KAAK,SAAS,OAAO;GACrB,MAAM,QAAQ,MAAM,gBAAgB,IAAI;GACxC,IAAI,OACA,IAAI,OAAO,IAAI,iBAAiB,UAAU,OAAO;EAEzD,OAAO,IAAI,KAAK,SAAS,mBAAmB;GACxC,IAAI,IAAI,QACJ,MAAM,IAAI,mBACN,gEACJ;GAGJ,MAAM,cAAc,IAAI,OAAO;GAC/B,MAAM,YACF,eAAe,SACT,IAAI,YAAY,CAAC,CAAC,OAAO,aAAa,aAAa,IAAI,OAAO,CAAC,IAC/D,SAAS,aAAa,IAAI,OAAO;GAE3C,MAAM,UAAU,MAAM,+BAA+B,MAAM;IACvD,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ,MAAM;GACV,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC7C,IAAI,OAAO,IAAI,KAAK,KAAK;EAEjC;EACA,OAAO,KAAK,GAAG;CACnB;AACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@polyester/sdk",
-    "version": "0.11.0",
+    "version": "0.13.0",
     "private": false,
     "description": "TypeScript SDK providing access to APIs on Polyester Exchange.",
     "homepage": "https://github.com/Fabric-Labs/polyester-sdk-typescript#readme",