@polyester/sdk 0.3.1 → 0.4.1

package/dist/shared/connect-error-mapping.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-error-mapping.js","names":["OrderErrorDetailSchema"],"sources":["../../src/shared/connect-error-mapping.ts"],"sourcesContent":["import { Code, ConnectError, type Interceptor } from \"@connectrpc/connect\";\nimport * as v from \"valibot\";\nimport { AuthErrorCode, AuthErrorDetailSchema } from \"../gen/auth/v1/auth_pb.js\";\nimport {\n    ErrorCode as OrderErrorCode,\n    ErrorDetailSchema as OrderErrorDetailSchema,\n} from \"../gen/orders/v1/orders_pb.js\";\nimport {\n    AlreadyExistsError,\n    AuthenticationError,\n    InternalServerError,\n    isAbortError,\n    MfaEnrollmentRequiredError,\n    MfaLastFactorRequiredError,\n    MfaVerificationError,\n    type MfaVerificationFailureReason,\n    normalizeErrorMessage,\n    PermissionError,\n    PolicyInUseError,\n    PolicyLockedError,\n    PolicyScopeMismatchError,\n    PolyesterError,\n    type PolyesterErrorOptions,\n    PreconditionFailedError,\n    RateLimitError,\n    ResourceNotFoundError,\n    RevisionConflictError,\n    ServiceUnavailableError,\n    SessionElevationRequiredError,\n    StaleQuoteError,\n    StepUpRequiredError,\n    TimeoutError,\n    TransientError,\n    ValidationError,\n} from \"./errors.js\";\nimport { RateLimitDetailSchema, type RateLimitDetail } from \"./rate-limit.schemas.js\";\n\nfunction getAuthErrorDetails(err: unknown) {\n    return ConnectError.from(err).findDetails(AuthErrorDetailSchema);\n}\n\nfunction hasAuthErrorCode(err: unknown, code: AuthErrorCode): boolean {\n    return getAuthErrorDetails(err).some((detail) => detail.code === code);\n}\n\nfunction hasOrderErrorCode(err: unknown, code: OrderErrorCode): boolean {\n    return getOrderErrorDetails(err).some((detail) => detail.code === code);\n}\n\nfunction getOrderErrorDetails(err: unknown) {\n    return ConnectError.from(err).findDetails(OrderErrorDetailSchema);\n}\n\nfunction getRateLimitDetail(err: unknown): RateLimitDetail | undefined {\n    for (const orderDetail of getOrderErrorDetails(err)) {\n        if (!orderDetail.rateLimit) continue;\n        const result = v.safeParse(RateLimitDetailSchema, orderDetail.rateLimit);\n        if (result.success) return result.output;\n    }\n    return undefined;\n}\n\nfunction safeRetryAfterMs(rateLimit: RateLimitDetail | undefined): number | undefined {\n    if (rateLimit?.retryAfterMs === undefined) return undefined;\n    const value = BigInt(rateLimit.retryAfterMs);\n    return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : undefined;\n}\n\n/**\n * Returns the error message without the leading \"[code] \" prefix that\n * `ConnectError` prepends, e.g. \"[invalid_argument] Insufficient funds.\"\n * becomes \"Insufficient funds.\".\n */\nexport function getNormalizedConnectMessage(err: unknown): string {\n    const ce = ConnectError.from(err);\n    const raw = ce.message ?? \"\";\n    return normalizeErrorMessage(raw);\n}\n\nexport type MfaErrorKind = \"session-elevation\" | \"enrollment\" | \"step-up\";\n\n/**\n * Classifies an error as one of the MFA flows the backend can demand.\n * Classification is based only on stable structured auth error details.\n */\nexport function detectMfaErrorKind(err: unknown): MfaErrorKind | null {\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_ELEVATION_REQUIRED)) {\n        return \"session-elevation\";\n    }\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_STEP_UP_REQUIRED)) return \"step-up\";\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_NOT_ENROLLED)) return \"enrollment\";\n    return null;\n}\n\nfunction parseRetryAfterMs(ce: ConnectError): number | undefined {\n    const value = ce.metadata.get(\"retry-after\");\n    if (!value) return undefined;\n    const seconds = Number(value);\n    if (Number.isFinite(seconds)) return Math.max(0, Math.round(seconds * 1000));\n    const date = Date.parse(value);\n    if (!Number.isNaN(date)) return Math.max(0, date - Date.now());\n    return undefined;\n}\n\nconst MFA_ERROR_CLASSES = {\n    \"session-elevation\": SessionElevationRequiredError,\n    enrollment: MfaEnrollmentRequiredError,\n    \"step-up\": StepUpRequiredError,\n} as const;\n\n/**\n * Maps a `ConnectError` from the Polyester backend onto the typed\n * {@link PolyesterError} tree. The original error is preserved as `cause`.\n */\nexport function connectErrorToPolyesterError(ce: ConnectError): PolyesterError {\n    const message = getNormalizedConnectMessage(ce);\n    const options: PolyesterErrorOptions = { cause: ce };\n    const withFallback = (fallback: string) => message || fallback;\n\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_RESOURCE_NOT_FOUND)) {\n        return new ResourceNotFoundError(withFallback(\"Resource not found.\"), options);\n    }\n\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_REVISION_CONFLICT)) {\n        return new RevisionConflictError(\n            withFallback(\"Resource changed since it was last read.\"),\n            options,\n        );\n    }\n\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_POLICY_IN_USE)) {\n        return new PolicyInUseError(withFallback(\"Policy is still in use.\"), options);\n    }\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_POLICY_LOCKED)) {\n        return new PolicyLockedError(withFallback(\"Policy is locked.\"), options);\n    }\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_POLICY_SCOPE_MISMATCH)) {\n        return new PolicyScopeMismatchError(\n            withFallback(\"Policy does not belong to the target account scope.\"),\n            options,\n        );\n    }\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_MFA_LAST_FACTOR_REQUIRED)) {\n        return new MfaLastFactorRequiredError(\n            withFallback(\"At least one active MFA factor must remain enrolled.\"),\n            options,\n        );\n    }\n\n    const mfaVerificationReason = getMfaVerificationFailureReason(ce);\n    if (mfaVerificationReason) {\n        return new MfaVerificationError(\n            withFallback(\"MFA verification failed.\"),\n            mfaVerificationReason,\n            options,\n        );\n    }\n\n    const mfaKind = detectMfaErrorKind(ce);\n    if (mfaKind) {\n        return new MFA_ERROR_CLASSES[mfaKind](\n            withFallback(\"Multi-factor authentication required.\"),\n            options,\n        );\n    }\n\n    if (hasOrderErrorCode(ce, OrderErrorCode.STALE_QUOTE)) {\n        return new StaleQuoteError(withFallback(\"The submitted market quote is stale.\"), options);\n    }\n\n    const rateLimit = getRateLimitDetail(ce);\n    if (rateLimit || hasOrderErrorCode(ce, OrderErrorCode.RATE_LIMIT_EXCEEDED)) {\n        return new RateLimitError(withFallback(\"Rate limit exceeded.\"), {\n            ...options,\n            rateLimit,\n            retryAfterMs: safeRetryAfterMs(rateLimit) ?? parseRetryAfterMs(ce),\n        });\n    }\n\n    switch (ce.code) {\n        case Code.InvalidArgument:\n        case Code.OutOfRange:\n            return new ValidationError(withFallback(\"Invalid request.\"), options);\n        case Code.NotFound:\n            return new ResourceNotFoundError(withFallback(\"Resource not found.\"), options);\n        case Code.AlreadyExists:\n            return new AlreadyExistsError(withFallback(\"Resource already exists.\"), options);\n        case Code.PermissionDenied:\n            return new PermissionError(withFallback(\"Permission denied.\"), options);\n        case Code.Unauthenticated:\n            return new AuthenticationError(withFallback(\"Authentication required.\"), options);\n        case Code.FailedPrecondition:\n            return new PreconditionFailedError(withFallback(\"Precondition failed.\"), options);\n        case Code.ResourceExhausted:\n            return new RateLimitError(withFallback(\"Rate limit exceeded.\"), {\n                ...options,\n                retryAfterMs: parseRetryAfterMs(ce),\n            });\n        case Code.DeadlineExceeded:\n            return new TimeoutError(withFallback(\"Request timed out.\"), options);\n        case Code.Unavailable:\n            return new ServiceUnavailableError(withFallback(\"Service unavailable.\"), options);\n        case Code.Aborted:\n            return new TransientError(withFallback(\"Operation aborted by the backend.\"), options);\n        default:\n            // Gateways sometimes surface outages as Unknown with this stock phrase.\n            if (/service temporarily unavailable/i.test(message)) {\n                return new ServiceUnavailableError(withFallback(\"Service unavailable.\"), options);\n            }\n            return new InternalServerError(withFallback(\"Internal server error.\"), options);\n    }\n}\n\nfunction getMfaVerificationFailureReason(err: unknown): MfaVerificationFailureReason | null {\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_CHALLENGE_INVALID)) {\n        return \"challenge-invalid\";\n    }\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_CHALLENGE_LOCKED)) {\n        return \"challenge-locked\";\n    }\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_OTP_INVALID)) return \"otp-invalid\";\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_RECOVERY_INVALID)) {\n        return \"recovery-code-invalid\";\n    }\n    if (\n        hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_PASSKEY_CREDENTIAL_INVALID) ||\n        hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_PASSKEY_VERIFY_FAILED)\n    ) {\n        return \"passkey-invalid\";\n    }\n\n    return null;\n}\n\nfunction findPolyesterErrorInCauseChain(err: unknown): PolyesterError | null {\n    let current: unknown = err;\n    for (let depth = 0; depth < 5 && current instanceof Error; depth++) {\n        current = current.cause;\n        if (current instanceof PolyesterError) return current;\n    }\n    return null;\n}\n\n/**\n * Converts any RPC-layer failure into its typed SDK error. Abort errors and\n * caller-cancelled requests pass through unchanged, as do errors that are\n * already typed (e.g. a `NetworkError` from the SDK fetch wrapper).\n */\nexport function toPolyesterError(err: unknown): unknown {\n    if (err instanceof PolyesterError) return err;\n    if (isAbortError(err)) return err;\n    if (err instanceof ConnectError) {\n        if (err.code === Code.Canceled) return err;\n        const wrapped = findPolyesterErrorInCauseChain(err);\n        if (wrapped) return wrapped;\n        return connectErrorToPolyesterError(err);\n    }\n    return err;\n}\n\nasync function* mapStreamErrors<T>(source: AsyncIterable<T>): AsyncIterable<T> {\n    try {\n        yield* source;\n    } catch (err) {\n        throw toPolyesterError(err);\n    }\n}\n\n/**\n * Interceptor that converts every RPC failure (unary and streaming) into the\n * typed {@link PolyesterError} hierarchy. Installed outermost by\n * `createTransports`, so callers of SDK services always see typed errors.\n */\nexport function createErrorMappingInterceptor(): Interceptor {\n    return (next) => async (req) => {\n        try {\n            const res = await next(req);\n            if (res.stream) {\n                return { ...res, message: mapStreamErrors(res.message) };\n            }\n            return res;\n        } catch (err) {\n            throw toPolyesterError(err);\n        }\n    };\n}\n"],"mappings":";;;;;;;AAqCA,SAAS,oBAAoB,KAAc;CACvC,OAAO,aAAa,KAAK,GAAG,CAAC,CAAC,YAAY,qBAAqB;AACnE;AAEA,SAAS,iBAAiB,KAAc,MAA8B;CAClE,OAAO,oBAAoB,GAAG,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI;AACzE;AAEA,SAAS,kBAAkB,KAAc,MAA+B;CACpE,OAAO,qBAAqB,GAAG,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI;AAC1E;AAEA,SAAS,qBAAqB,KAAc;CACxC,OAAO,aAAa,KAAK,GAAG,CAAC,CAAC,YAAYA,iBAAsB;AACpE;AAEA,SAAS,mBAAmB,KAA2C;CACnE,KAAK,MAAM,eAAe,qBAAqB,GAAG,GAAG;EACjD,IAAI,CAAC,YAAY,WAAW;EAC5B,MAAM,SAAS,EAAE,UAAU,uBAAuB,YAAY,SAAS;EACvE,IAAI,OAAO,SAAS,OAAO,OAAO;CACtC;AAEJ;AAEA,SAAS,iBAAiB,WAA4D;CAClF,IAAI,WAAW,iBAAiB,KAAA,GAAW,OAAO,KAAA;CAClD,MAAM,QAAQ,OAAO,UAAU,YAAY;CAC3C,OAAO,SAAS,OAAO,OAAO,gBAAgB,IAAI,OAAO,KAAK,IAAI,KAAA;AACtE;;;;;;AAOA,SAAgB,4BAA4B,KAAsB;CAE9D,MAAM,MADK,aAAa,KAAK,GAChB,CAAC,CAAC,WAAW;CAC1B,OAAO,sBAAsB,GAAG;AACpC;;;;;AAQA,SAAgB,mBAAmB,KAAmC;CAClE,IAAI,iBAAiB,KAAA,EAA8C,GAC/D,OAAO;CAEX,IAAI,iBAAiB,KAAA,EAAwC,GAAG,OAAO;CACvE,IAAI,iBAAiB,KAAA,EAAwC,GAAG,OAAO;CACvE,OAAO;AACX;AAEA,SAAS,kBAAkB,IAAsC;CAC7D,MAAM,QAAQ,GAAG,SAAS,IAAI,aAAa;CAC3C,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,GAAI,CAAC;CAC3E,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,IAAI,CAAC,OAAO,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AAEjE;AAEA,MAAM,oBAAoB;CACtB,qBAAqB;CACrB,YAAY;CACZ,WAAW;AACf;;;;;AAMA,SAAgB,6BAA6B,IAAkC;CAC3E,MAAM,UAAU,4BAA4B,EAAE;CAC9C,MAAM,UAAiC,EAAE,OAAO,GAAG;CACnD,MAAM,gBAAgB,aAAqB,WAAW;CAEtD,IAAI,iBAAiB,IAAA,EAAyC,GAC1D,OAAO,IAAI,sBAAsB,aAAa,qBAAqB,GAAG,OAAO;CAGjF,IAAI,iBAAiB,IAAA,EAAwC,GACzD,OAAO,IAAI,sBACP,aAAa,0CAA0C,GACvD,OACJ;CAGJ,IAAI,iBAAiB,IAAA,EAAoC,GACrD,OAAO,IAAI,iBAAiB,aAAa,yBAAyB,GAAG,OAAO;CAEhF,IAAI,iBAAiB,IAAA,EAAoC,GACrD,OAAO,IAAI,kBAAkB,aAAa,mBAAmB,GAAG,OAAO;CAE3E,IAAI,iBAAiB,IAAA,EAA4C,GAC7D,OAAO,IAAI,yBACP,aAAa,qDAAqD,GAClE,OACJ;CAEJ,IAAI,iBAAiB,IAAA,EAA+C,GAChE,OAAO,IAAI,2BACP,aAAa,sDAAsD,GACnE,OACJ;CAGJ,MAAM,wBAAwB,gCAAgC,EAAE;CAChE,IAAI,uBACA,OAAO,IAAI,qBACP,aAAa,0BAA0B,GACvC,uBACA,OACJ;CAGJ,MAAM,UAAU,mBAAmB,EAAE;CACrC,IAAI,SACA,OAAO,IAAI,kBAAkB,SACzB,aAAa,uCAAuC,GACpD,OACJ;CAGJ,IAAI,kBAAkB,IAAA,EAA8B,GAChD,OAAO,IAAI,gBAAgB,aAAa,sCAAsC,GAAG,OAAO;CAG5F,MAAM,YAAY,mBAAmB,EAAE;CACvC,IAAI,aAAa,kBAAkB,IAAA,EAAsC,GACrE,OAAO,IAAI,eAAe,aAAa,sBAAsB,GAAG;EAC5D,GAAG;EACH;EACA,cAAc,iBAAiB,SAAS,KAAK,kBAAkB,EAAE;CACrE,CAAC;CAGL,QAAQ,GAAG,MAAX;EACI,KAAK,KAAK;EACV,KAAK,KAAK,YACN,OAAO,IAAI,gBAAgB,aAAa,kBAAkB,GAAG,OAAO;EACxE,KAAK,KAAK,UACN,OAAO,IAAI,sBAAsB,aAAa,qBAAqB,GAAG,OAAO;EACjF,KAAK,KAAK,eACN,OAAO,IAAI,mBAAmB,aAAa,0BAA0B,GAAG,OAAO;EACnF,KAAK,KAAK,kBACN,OAAO,IAAI,gBAAgB,aAAa,oBAAoB,GAAG,OAAO;EAC1E,KAAK,KAAK,iBACN,OAAO,IAAI,oBAAoB,aAAa,0BAA0B,GAAG,OAAO;EACpF,KAAK,KAAK,oBACN,OAAO,IAAI,wBAAwB,aAAa,sBAAsB,GAAG,OAAO;EACpF,KAAK,KAAK,mBACN,OAAO,IAAI,eAAe,aAAa,sBAAsB,GAAG;GAC5D,GAAG;GACH,cAAc,kBAAkB,EAAE;EACtC,CAAC;EACL,KAAK,KAAK,kBACN,OAAO,IAAI,aAAa,aAAa,oBAAoB,GAAG,OAAO;EACvE,KAAK,KAAK,aACN,OAAO,IAAI,wBAAwB,aAAa,sBAAsB,GAAG,OAAO;EACpF,KAAK,KAAK,SACN,OAAO,IAAI,eAAe,aAAa,mCAAmC,GAAG,OAAO;EACxF;GAEI,IAAI,mCAAmC,KAAK,OAAO,GAC/C,OAAO,IAAI,wBAAwB,aAAa,sBAAsB,GAAG,OAAO;GAEpF,OAAO,IAAI,oBAAoB,aAAa,wBAAwB,GAAG,OAAO;CACtF;AACJ;AAEA,SAAS,gCAAgC,KAAmD;CACxF,IAAI,iBAAiB,KAAA,EAA6C,GAC9D,OAAO;CAEX,IAAI,iBAAiB,KAAA,EAA4C,GAC7D,OAAO;CAEX,IAAI,iBAAiB,KAAA,EAAuC,GAAG,OAAO;CACtE,IAAI,iBAAiB,KAAA,EAA4C,GAC7D,OAAO;CAEX,IACI,iBAAiB,KAAA,EAAsD,KACvE,iBAAiB,KAAA,EAAiD,GAElE,OAAO;CAGX,OAAO;AACX;AAEA,SAAS,+BAA+B,KAAqC;CACzE,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,mBAAmB,OAAO,SAAS;EAChE,UAAU,QAAQ;EAClB,IAAI,mBAAmB,gBAAgB,OAAO;CAClD;CACA,OAAO;AACX;;;;;;AAOA,SAAgB,iBAAiB,KAAuB;CACpD,IAAI,eAAe,gBAAgB,OAAO;CAC1C,IAAI,aAAa,GAAG,GAAG,OAAO;CAC9B,IAAI,eAAe,cAAc;EAC7B,IAAI,IAAI,SAAS,KAAK,UAAU,OAAO;EACvC,MAAM,UAAU,+BAA+B,GAAG;EAClD,IAAI,SAAS,OAAO;EACpB,OAAO,6BAA6B,GAAG;CAC3C;CACA,OAAO;AACX;AAEA,gBAAgB,gBAAmB,QAA4C;CAC3E,IAAI;EACA,OAAO;CACX,SAAS,KAAK;EACV,MAAM,iBAAiB,GAAG;CAC9B;AACJ;;;;;;AAOA,SAAgB,gCAA6C;CACzD,QAAQ,SAAS,OAAO,QAAQ;EAC5B,IAAI;GACA,MAAM,MAAM,MAAM,KAAK,GAAG;GAC1B,IAAI,IAAI,QACJ,OAAO;IAAE,GAAG;IAAK,SAAS,gBAAgB,IAAI,OAAO;GAAE;GAE3D,OAAO;EACX,SAAS,KAAK;GACV,MAAM,iBAAiB,GAAG;EAC9B;CACJ;AACJ"}
+{"version":3,"file":"connect-error-mapping.js","names":["OrderErrorDetailSchema"],"sources":["../../src/shared/connect-error-mapping.ts"],"sourcesContent":["import { Code, ConnectError, type Interceptor, type Transport } from \"@connectrpc/connect\";\nimport * as v from \"valibot\";\nimport { AuthErrorCode, AuthErrorDetailSchema } from \"../gen/auth/v1/auth_pb.js\";\nimport {\n    ErrorCode as OrderErrorCode,\n    ErrorDetailSchema as OrderErrorDetailSchema,\n} from \"../gen/orders/v1/orders_pb.js\";\nimport {\n    AlreadyExistsError,\n    AuthenticationError,\n    InternalServerError,\n    isAbortError,\n    MfaEnrollmentRequiredError,\n    MfaLastFactorRequiredError,\n    MfaVerificationError,\n    type MfaVerificationFailureReason,\n    normalizeErrorMessage,\n    PermissionError,\n    PolicyInUseError,\n    PolicyLockedError,\n    PolicyScopeMismatchError,\n    PolyesterError,\n    type PolyesterErrorOptions,\n    PreconditionFailedError,\n    RateLimitError,\n    ResourceNotFoundError,\n    RevisionConflictError,\n    ServiceUnavailableError,\n    SessionElevationRequiredError,\n    StaleQuoteError,\n    StepUpRequiredError,\n    TimeoutError,\n    TransientError,\n    ValidationError,\n} from \"./errors.js\";\nimport { RateLimitDetailSchema, type RateLimitDetail } from \"./rate-limit.schemas.js\";\n\nfunction getAuthErrorDetails(err: unknown) {\n    return ConnectError.from(err).findDetails(AuthErrorDetailSchema);\n}\n\nfunction hasAuthErrorCode(err: unknown, code: AuthErrorCode): boolean {\n    return getAuthErrorDetails(err).some((detail) => detail.code === code);\n}\n\nfunction hasOrderErrorCode(err: unknown, code: OrderErrorCode): boolean {\n    return getOrderErrorDetails(err).some((detail) => detail.code === code);\n}\n\nfunction getOrderErrorDetails(err: unknown) {\n    return ConnectError.from(err).findDetails(OrderErrorDetailSchema);\n}\n\nfunction getRateLimitDetail(err: unknown): RateLimitDetail | undefined {\n    for (const orderDetail of getOrderErrorDetails(err)) {\n        if (!orderDetail.rateLimit) continue;\n        const result = v.safeParse(RateLimitDetailSchema, orderDetail.rateLimit);\n        if (result.success) return result.output;\n    }\n    return undefined;\n}\n\nfunction safeRetryAfterMs(rateLimit: RateLimitDetail | undefined): number | undefined {\n    if (rateLimit?.retryAfterMs === undefined) return undefined;\n    const value = BigInt(rateLimit.retryAfterMs);\n    return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : undefined;\n}\n\n/**\n * Returns the error message without the leading \"[code] \" prefix that\n * `ConnectError` prepends, e.g. \"[invalid_argument] Insufficient funds.\"\n * becomes \"Insufficient funds.\".\n */\nexport function getNormalizedConnectMessage(err: unknown): string {\n    const ce = ConnectError.from(err);\n    const raw = ce.message ?? \"\";\n    return normalizeErrorMessage(raw);\n}\n\nexport type MfaErrorKind = \"session-elevation\" | \"enrollment\" | \"step-up\";\n\n/**\n * Classifies an error as one of the MFA flows the backend can demand.\n * Classification is based only on stable structured auth error details.\n */\nexport function detectMfaErrorKind(err: unknown): MfaErrorKind | null {\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_ELEVATION_REQUIRED)) {\n        return \"session-elevation\";\n    }\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_STEP_UP_REQUIRED)) return \"step-up\";\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_NOT_ENROLLED)) return \"enrollment\";\n    return null;\n}\n\nfunction parseRetryAfterMs(ce: ConnectError): number | undefined {\n    const value = ce.metadata.get(\"retry-after\");\n    if (!value) return undefined;\n    const seconds = Number(value);\n    if (Number.isFinite(seconds)) return Math.max(0, Math.round(seconds * 1000));\n    const date = Date.parse(value);\n    if (!Number.isNaN(date)) return Math.max(0, date - Date.now());\n    return undefined;\n}\n\nconst MFA_ERROR_CLASSES = {\n    \"session-elevation\": SessionElevationRequiredError,\n    enrollment: MfaEnrollmentRequiredError,\n    \"step-up\": StepUpRequiredError,\n} as const;\n\n/**\n * Maps a `ConnectError` from the Polyester backend onto the typed\n * {@link PolyesterError} tree. The original error is preserved as `cause`.\n */\nexport function connectErrorToPolyesterError(ce: ConnectError): PolyesterError {\n    const message = getNormalizedConnectMessage(ce);\n    const options: PolyesterErrorOptions = { cause: ce };\n    const withFallback = (fallback: string) => message || fallback;\n\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_RESOURCE_NOT_FOUND)) {\n        return new ResourceNotFoundError(withFallback(\"Resource not found.\"), options);\n    }\n\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_REVISION_CONFLICT)) {\n        return new RevisionConflictError(\n            withFallback(\"Resource changed since it was last read.\"),\n            options,\n        );\n    }\n\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_POLICY_IN_USE)) {\n        return new PolicyInUseError(withFallback(\"Policy is still in use.\"), options);\n    }\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_POLICY_LOCKED)) {\n        return new PolicyLockedError(withFallback(\"Policy is locked.\"), options);\n    }\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_POLICY_SCOPE_MISMATCH)) {\n        return new PolicyScopeMismatchError(\n            withFallback(\"Policy does not belong to the target account scope.\"),\n            options,\n        );\n    }\n    if (hasAuthErrorCode(ce, AuthErrorCode.AUTH_MFA_LAST_FACTOR_REQUIRED)) {\n        return new MfaLastFactorRequiredError(\n            withFallback(\"At least one active MFA factor must remain enrolled.\"),\n            options,\n        );\n    }\n\n    const mfaVerificationReason = getMfaVerificationFailureReason(ce);\n    if (mfaVerificationReason) {\n        return new MfaVerificationError(\n            withFallback(\"MFA verification failed.\"),\n            mfaVerificationReason,\n            options,\n        );\n    }\n\n    const mfaKind = detectMfaErrorKind(ce);\n    if (mfaKind) {\n        return new MFA_ERROR_CLASSES[mfaKind](\n            withFallback(\"Multi-factor authentication required.\"),\n            options,\n        );\n    }\n\n    if (hasOrderErrorCode(ce, OrderErrorCode.STALE_QUOTE)) {\n        return new StaleQuoteError(withFallback(\"The submitted market quote is stale.\"), options);\n    }\n\n    const rateLimit = getRateLimitDetail(ce);\n    if (rateLimit || hasOrderErrorCode(ce, OrderErrorCode.RATE_LIMIT_EXCEEDED)) {\n        return new RateLimitError(withFallback(\"Rate limit exceeded.\"), {\n            ...options,\n            rateLimit,\n            retryAfterMs: safeRetryAfterMs(rateLimit) ?? parseRetryAfterMs(ce),\n        });\n    }\n\n    switch (ce.code) {\n        case Code.InvalidArgument:\n        case Code.OutOfRange:\n            return new ValidationError(withFallback(\"Invalid request.\"), options);\n        case Code.NotFound:\n            return new ResourceNotFoundError(withFallback(\"Resource not found.\"), options);\n        case Code.AlreadyExists:\n            return new AlreadyExistsError(withFallback(\"Resource already exists.\"), options);\n        case Code.PermissionDenied:\n            return new PermissionError(withFallback(\"Permission denied.\"), options);\n        case Code.Unauthenticated:\n            return new AuthenticationError(withFallback(\"Authentication required.\"), options);\n        case Code.FailedPrecondition:\n            return new PreconditionFailedError(withFallback(\"Precondition failed.\"), options);\n        case Code.ResourceExhausted:\n            return new RateLimitError(withFallback(\"Rate limit exceeded.\"), {\n                ...options,\n                retryAfterMs: parseRetryAfterMs(ce),\n            });\n        case Code.DeadlineExceeded:\n            return new TimeoutError(withFallback(\"Request timed out.\"), options);\n        case Code.Unavailable:\n            return new ServiceUnavailableError(withFallback(\"Service unavailable.\"), options);\n        case Code.Aborted:\n            return new TransientError(withFallback(\"Operation aborted by the backend.\"), options);\n        default:\n            // Gateways sometimes surface outages as Unknown with this stock phrase.\n            if (/service temporarily unavailable/i.test(message)) {\n                return new ServiceUnavailableError(withFallback(\"Service unavailable.\"), options);\n            }\n            return new InternalServerError(withFallback(\"Internal server error.\"), options);\n    }\n}\n\nfunction getMfaVerificationFailureReason(err: unknown): MfaVerificationFailureReason | null {\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_CHALLENGE_INVALID)) {\n        return \"challenge-invalid\";\n    }\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_CHALLENGE_LOCKED)) {\n        return \"challenge-locked\";\n    }\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_OTP_INVALID)) return \"otp-invalid\";\n    if (hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_RECOVERY_INVALID)) {\n        return \"recovery-code-invalid\";\n    }\n    if (\n        hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_PASSKEY_CREDENTIAL_INVALID) ||\n        hasAuthErrorCode(err, AuthErrorCode.AUTH_MFA_PASSKEY_VERIFY_FAILED)\n    ) {\n        return \"passkey-invalid\";\n    }\n\n    return null;\n}\n\nfunction findPolyesterErrorInCauseChain(err: unknown): PolyesterError | null {\n    let current: unknown = err;\n    for (let depth = 0; depth < 5 && current instanceof Error; depth++) {\n        current = current.cause;\n        if (current instanceof PolyesterError) return current;\n    }\n    return null;\n}\n\n/**\n * Converts any RPC-layer failure into its typed SDK error. Abort errors and\n * caller-cancelled requests pass through unchanged, as do errors that are\n * already typed (e.g. a `NetworkError` from the SDK fetch wrapper).\n */\nexport function toPolyesterError(err: unknown): unknown {\n    if (err instanceof PolyesterError) return err;\n    if (isAbortError(err)) return err;\n    if (err instanceof ConnectError) {\n        if (err.code === Code.Canceled) return err;\n        const wrapped = findPolyesterErrorInCauseChain(err);\n        if (wrapped) return wrapped;\n        return connectErrorToPolyesterError(err);\n    }\n    return err;\n}\n\nasync function* mapStreamErrors<T>(source: AsyncIterable<T>): AsyncIterable<T> {\n    try {\n        yield* source;\n    } catch (err) {\n        throw toPolyesterError(err);\n    }\n}\n\n/**\n * Interceptor that converts every RPC failure (unary and streaming) into the\n * typed {@link PolyesterError} hierarchy. Installed outermost by\n * `createTransports`, so callers of SDK services always see typed errors.\n */\nexport function createErrorMappingInterceptor(): Interceptor {\n    return (next) => async (req) => {\n        try {\n            const res = await next(req);\n            if (res.stream) {\n                return { ...res, message: mapStreamErrors(res.message) };\n            }\n            return res;\n        } catch (err) {\n            throw toPolyesterError(err);\n        }\n    };\n}\n\n/**\n * Wraps a Connect transport so errors are translated after Connect's call\n * runner has applied its own error normalization.\n */\nexport function createErrorMappingTransport(transport: Transport): Transport {\n    return {\n        async unary(method, signal, timeoutMs, header, input, contextValues) {\n            try {\n                return await transport.unary(\n                    method,\n                    signal,\n                    timeoutMs,\n                    header,\n                    input,\n                    contextValues,\n                );\n            } catch (error) {\n                throw toPolyesterError(error);\n            }\n        },\n        async stream(method, signal, timeoutMs, header, input, contextValues) {\n            try {\n                const response = await transport.stream(\n                    method,\n                    signal,\n                    timeoutMs,\n                    header,\n                    input,\n                    contextValues,\n                );\n                return { ...response, message: mapStreamErrors(response.message) };\n            } catch (error) {\n                throw toPolyesterError(error);\n            }\n        },\n    };\n}\n"],"mappings":";;;;;;;AAqCA,SAAS,oBAAoB,KAAc;CACvC,OAAO,aAAa,KAAK,GAAG,CAAC,CAAC,YAAY,qBAAqB;AACnE;AAEA,SAAS,iBAAiB,KAAc,MAA8B;CAClE,OAAO,oBAAoB,GAAG,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI;AACzE;AAEA,SAAS,kBAAkB,KAAc,MAA+B;CACpE,OAAO,qBAAqB,GAAG,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI;AAC1E;AAEA,SAAS,qBAAqB,KAAc;CACxC,OAAO,aAAa,KAAK,GAAG,CAAC,CAAC,YAAYA,iBAAsB;AACpE;AAEA,SAAS,mBAAmB,KAA2C;CACnE,KAAK,MAAM,eAAe,qBAAqB,GAAG,GAAG;EACjD,IAAI,CAAC,YAAY,WAAW;EAC5B,MAAM,SAAS,EAAE,UAAU,uBAAuB,YAAY,SAAS;EACvE,IAAI,OAAO,SAAS,OAAO,OAAO;CACtC;AAEJ;AAEA,SAAS,iBAAiB,WAA4D;CAClF,IAAI,WAAW,iBAAiB,KAAA,GAAW,OAAO,KAAA;CAClD,MAAM,QAAQ,OAAO,UAAU,YAAY;CAC3C,OAAO,SAAS,OAAO,OAAO,gBAAgB,IAAI,OAAO,KAAK,IAAI,KAAA;AACtE;;;;;;AAOA,SAAgB,4BAA4B,KAAsB;CAE9D,MAAM,MADK,aAAa,KAAK,GAChB,CAAC,CAAC,WAAW;CAC1B,OAAO,sBAAsB,GAAG;AACpC;;;;;AAQA,SAAgB,mBAAmB,KAAmC;CAClE,IAAI,iBAAiB,KAAA,EAA8C,GAC/D,OAAO;CAEX,IAAI,iBAAiB,KAAA,EAAwC,GAAG,OAAO;CACvE,IAAI,iBAAiB,KAAA,EAAwC,GAAG,OAAO;CACvE,OAAO;AACX;AAEA,SAAS,kBAAkB,IAAsC;CAC7D,MAAM,QAAQ,GAAG,SAAS,IAAI,aAAa;CAC3C,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,GAAI,CAAC;CAC3E,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,IAAI,CAAC,OAAO,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AAEjE;AAEA,MAAM,oBAAoB;CACtB,qBAAqB;CACrB,YAAY;CACZ,WAAW;AACf;;;;;AAMA,SAAgB,6BAA6B,IAAkC;CAC3E,MAAM,UAAU,4BAA4B,EAAE;CAC9C,MAAM,UAAiC,EAAE,OAAO,GAAG;CACnD,MAAM,gBAAgB,aAAqB,WAAW;CAEtD,IAAI,iBAAiB,IAAA,EAAyC,GAC1D,OAAO,IAAI,sBAAsB,aAAa,qBAAqB,GAAG,OAAO;CAGjF,IAAI,iBAAiB,IAAA,EAAwC,GACzD,OAAO,IAAI,sBACP,aAAa,0CAA0C,GACvD,OACJ;CAGJ,IAAI,iBAAiB,IAAA,EAAoC,GACrD,OAAO,IAAI,iBAAiB,aAAa,yBAAyB,GAAG,OAAO;CAEhF,IAAI,iBAAiB,IAAA,EAAoC,GACrD,OAAO,IAAI,kBAAkB,aAAa,mBAAmB,GAAG,OAAO;CAE3E,IAAI,iBAAiB,IAAA,EAA4C,GAC7D,OAAO,IAAI,yBACP,aAAa,qDAAqD,GAClE,OACJ;CAEJ,IAAI,iBAAiB,IAAA,EAA+C,GAChE,OAAO,IAAI,2BACP,aAAa,sDAAsD,GACnE,OACJ;CAGJ,MAAM,wBAAwB,gCAAgC,EAAE;CAChE,IAAI,uBACA,OAAO,IAAI,qBACP,aAAa,0BAA0B,GACvC,uBACA,OACJ;CAGJ,MAAM,UAAU,mBAAmB,EAAE;CACrC,IAAI,SACA,OAAO,IAAI,kBAAkB,SACzB,aAAa,uCAAuC,GACpD,OACJ;CAGJ,IAAI,kBAAkB,IAAA,EAA8B,GAChD,OAAO,IAAI,gBAAgB,aAAa,sCAAsC,GAAG,OAAO;CAG5F,MAAM,YAAY,mBAAmB,EAAE;CACvC,IAAI,aAAa,kBAAkB,IAAA,EAAsC,GACrE,OAAO,IAAI,eAAe,aAAa,sBAAsB,GAAG;EAC5D,GAAG;EACH;EACA,cAAc,iBAAiB,SAAS,KAAK,kBAAkB,EAAE;CACrE,CAAC;CAGL,QAAQ,GAAG,MAAX;EACI,KAAK,KAAK;EACV,KAAK,KAAK,YACN,OAAO,IAAI,gBAAgB,aAAa,kBAAkB,GAAG,OAAO;EACxE,KAAK,KAAK,UACN,OAAO,IAAI,sBAAsB,aAAa,qBAAqB,GAAG,OAAO;EACjF,KAAK,KAAK,eACN,OAAO,IAAI,mBAAmB,aAAa,0BAA0B,GAAG,OAAO;EACnF,KAAK,KAAK,kBACN,OAAO,IAAI,gBAAgB,aAAa,oBAAoB,GAAG,OAAO;EAC1E,KAAK,KAAK,iBACN,OAAO,IAAI,oBAAoB,aAAa,0BAA0B,GAAG,OAAO;EACpF,KAAK,KAAK,oBACN,OAAO,IAAI,wBAAwB,aAAa,sBAAsB,GAAG,OAAO;EACpF,KAAK,KAAK,mBACN,OAAO,IAAI,eAAe,aAAa,sBAAsB,GAAG;GAC5D,GAAG;GACH,cAAc,kBAAkB,EAAE;EACtC,CAAC;EACL,KAAK,KAAK,kBACN,OAAO,IAAI,aAAa,aAAa,oBAAoB,GAAG,OAAO;EACvE,KAAK,KAAK,aACN,OAAO,IAAI,wBAAwB,aAAa,sBAAsB,GAAG,OAAO;EACpF,KAAK,KAAK,SACN,OAAO,IAAI,eAAe,aAAa,mCAAmC,GAAG,OAAO;EACxF;GAEI,IAAI,mCAAmC,KAAK,OAAO,GAC/C,OAAO,IAAI,wBAAwB,aAAa,sBAAsB,GAAG,OAAO;GAEpF,OAAO,IAAI,oBAAoB,aAAa,wBAAwB,GAAG,OAAO;CACtF;AACJ;AAEA,SAAS,gCAAgC,KAAmD;CACxF,IAAI,iBAAiB,KAAA,EAA6C,GAC9D,OAAO;CAEX,IAAI,iBAAiB,KAAA,EAA4C,GAC7D,OAAO;CAEX,IAAI,iBAAiB,KAAA,EAAuC,GAAG,OAAO;CACtE,IAAI,iBAAiB,KAAA,EAA4C,GAC7D,OAAO;CAEX,IACI,iBAAiB,KAAA,EAAsD,KACvE,iBAAiB,KAAA,EAAiD,GAElE,OAAO;CAGX,OAAO;AACX;AAEA,SAAS,+BAA+B,KAAqC;CACzE,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,mBAAmB,OAAO,SAAS;EAChE,UAAU,QAAQ;EAClB,IAAI,mBAAmB,gBAAgB,OAAO;CAClD;CACA,OAAO;AACX;;;;;;AAOA,SAAgB,iBAAiB,KAAuB;CACpD,IAAI,eAAe,gBAAgB,OAAO;CAC1C,IAAI,aAAa,GAAG,GAAG,OAAO;CAC9B,IAAI,eAAe,cAAc;EAC7B,IAAI,IAAI,SAAS,KAAK,UAAU,OAAO;EACvC,MAAM,UAAU,+BAA+B,GAAG;EAClD,IAAI,SAAS,OAAO;EACpB,OAAO,6BAA6B,GAAG;CAC3C;CACA,OAAO;AACX;AAEA,gBAAgB,gBAAmB,QAA4C;CAC3E,IAAI;EACA,OAAO;CACX,SAAS,KAAK;EACV,MAAM,iBAAiB,GAAG;CAC9B;AACJ;;;;;;AAOA,SAAgB,gCAA6C;CACzD,QAAQ,SAAS,OAAO,QAAQ;EAC5B,IAAI;GACA,MAAM,MAAM,MAAM,KAAK,GAAG;GAC1B,IAAI,IAAI,QACJ,OAAO;IAAE,GAAG;IAAK,SAAS,gBAAgB,IAAI,OAAO;GAAE;GAE3D,OAAO;EACX,SAAS,KAAK;GACV,MAAM,iBAAiB,GAAG;EAC9B;CACJ;AACJ;;;;;AAMA,SAAgB,4BAA4B,WAAiC;CACzE,OAAO;EACH,MAAM,MAAM,QAAQ,QAAQ,WAAW,QAAQ,OAAO,eAAe;GACjE,IAAI;IACA,OAAO,MAAM,UAAU,MACnB,QACA,QACA,WACA,QACA,OACA,aACJ;GACJ,SAAS,OAAO;IACZ,MAAM,iBAAiB,KAAK;GAChC;EACJ;EACA,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,OAAO,eAAe;GAClE,IAAI;IACA,MAAM,WAAW,MAAM,UAAU,OAC7B,QACA,QACA,WACA,QACA,OACA,aACJ;IACA,OAAO;KAAE,GAAG;KAAU,SAAS,gBAAgB,SAAS,OAAO;IAAE;GACrE,SAAS,OAAO;IACZ,MAAM,iBAAiB,KAAK;GAChC;EACJ;CACJ;AACJ"}

package/dist/shared/transports.js

@@ -1,5 +1,5 @@
 import { ConfigurationError, NetworkError, isAbortError } from "./errors.js";
-import { createErrorMappingInterceptor } from "./connect-error-mapping.js";
+import { createErrorMappingTransport } from "./connect-error-mapping.js";
 import { createConnectTransport } from "@connectrpc/connect-web";
 import { toBinary, toJsonString } from "@bufbuild/protobuf";
 import { signAsync } from "@noble/ed25519";
@@ -28,25 +28,20 @@ function makeFetch() {
 function createTransports(config) {
 	const { apiUrl, interceptors = [], auth, wireFormat = "binary" } = config;
 	const useBinaryFormat = wireFormat === "binary";
-	const errorMapping = createErrorMappingInterceptor();
-	const publicApi = createConnectTransport({
+	const publicApi = createErrorMappingTransport(createConnectTransport({
 		baseUrl: apiUrl,
 		useBinaryFormat,
-		interceptors: [errorMapping, ...interceptors],
+		interceptors,
 		fetch: makeFetch()
-	});
-	const authInterceptors = auth ? [
-		errorMapping,
-		createAuthInterceptor(auth, { wireFormat }),
-		...interceptors
-	] : [errorMapping, ...interceptors];
+	}));
+	const authInterceptors = auth ? [createAuthInterceptor(auth, { wireFormat }), ...interceptors] : interceptors;
 	return {
-		authApi: createConnectTransport({
+		authApi: createErrorMappingTransport(createConnectTransport({
 			baseUrl: apiUrl,
 			useBinaryFormat,
 			interceptors: authInterceptors,
 			fetch: makeFetch()
-		}),
+		})),
 		publicApi
 	};
 }

package/dist/shared/transports.js.map

@@ -1 +1 @@
-{"version":3,"file":"transports.js","names":[],"sources":["../../src/shared/transports.ts"],"sourcesContent":["import { createConnectTransport } from \"@connectrpc/connect-web\";\nimport type { Transport, Interceptor } from \"@connectrpc/connect\";\nimport { toBinary, toJsonString } from \"@bufbuild/protobuf\";\nimport { signAsync } from \"@noble/ed25519\";\nimport { createErrorMappingInterceptor } from \"./connect-error-mapping.js\";\nimport { ConfigurationError, isAbortError, NetworkError } from \"./errors.js\";\n\nexport { isAbortError };\n\nexport type ConnectWireFormat = \"binary\" | \"json\";\n\nexport const POLYESTER_MOCK_HEADER = \"x-polyester-mock\";\n\nexport interface TransportConfig {\n    apiUrl: string;\n    interceptors?: Interceptor[];\n    auth?: JwtAuthProvider | ApiKeyEd25519AuthProvider;\n    /**\n     * Connect wire format. Defaults to binary for production performance.\n     * Use `json` for the API Playground visualization.\n     */\n    wireFormat?: ConnectWireFormat;\n}\n\nexport interface Transports {\n    authApi: Transport;\n    publicApi: Transport;\n}\n\n/**\n * Generic JWT auth for HTTP/Connect endpoints that follow the Bearer token contract.\n */\nexport interface JwtAuthProvider {\n    kind: \"jwt\";\n    /** Typically wraps the configured browser auth token storage. */\n    getToken: () => string | null | Promise<string | null>;\n}\n\n/**\n * Generic Ed25519 API key auth for HTTP/Connect endpoints that follow the\n * X-API-KEY-ID / X-API-TIMESTAMP / X-API-SIGNATURE contract.\n */\nexport interface ApiKeyEd25519AuthProvider {\n    kind: \"api-key-ed25519\";\n    getKeyId: () => string | null | Promise<string | null>;\n    /** Ed25519 secret key bytes (not hex) for signing. */\n    getSecretKey: () => Uint8Array | null | Promise<Uint8Array | null>;\n}\n\nexport interface ApiKeyEd25519SigningRequest {\n    url: string | URL;\n    method: string;\n    body?: Uint8Array;\n    timestamp?: string;\n}\n\n/**\n * Returns the fetch implementation used by SDK transports.\n */\nexport function makeFetch(): typeof fetch {\n    const wrappedFetch = Object.assign(\n        async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n            // Normalize headers into a mutable Headers object\n            const headers = new Headers(init?.headers);\n\n            try {\n                const res = await fetch(input, {\n                    ...init,\n                    headers,\n                    redirect: \"manual\",\n                });\n\n                return res;\n            } catch (err) {\n                if (isAbortError(err)) throw err;\n                throw new NetworkError(\"Transport request failed\", { cause: err });\n            }\n        },\n        fetch,\n    );\n\n    return wrappedFetch;\n}\n\n/**\n * Creates Connect transports for SDK service clients.\n */\nexport function createTransports(config: TransportConfig): Transports {\n    const { apiUrl, interceptors = [], auth, wireFormat = \"binary\" } = config;\n    const useBinaryFormat = wireFormat === \"binary\";\n    // Outermost so every RPC failure surfaces as a typed PolyesterError.\n    const errorMapping = createErrorMappingInterceptor();\n\n    const publicApi = createConnectTransport({\n        baseUrl: apiUrl,\n        useBinaryFormat,\n        interceptors: [errorMapping, ...interceptors],\n        fetch: makeFetch(),\n    });\n\n    const authInterceptors = auth\n        ? [errorMapping, createAuthInterceptor(auth, { wireFormat }), ...interceptors]\n        : [errorMapping, ...interceptors];\n    const authApi = createConnectTransport({\n        baseUrl: apiUrl,\n        useBinaryFormat,\n        interceptors: authInterceptors,\n        fetch: makeFetch(),\n    });\n\n    return { authApi, publicApi };\n}\n\n/**\n * Creates an interceptor that enables mock transport behavior.\n */\nexport function createMockInterceptor(getEnabled: () => boolean): Interceptor {\n    return (next) => async (req) => {\n        if (getEnabled()) req.header.set(POLYESTER_MOCK_HEADER, \"true\");\n        return next(req);\n    };\n}\n\nasync function sha256Hex(bytes: Uint8Array): Promise<string> {\n    if (typeof crypto === \"undefined\" || !crypto.subtle) {\n        throw new ConfigurationError(\"SHA-256 not available in this environment\");\n    }\n    const hash = await crypto.subtle.digest(\"SHA-256\", bytes.slice());\n    return Array.from(new Uint8Array(hash), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction canonicalQueryString(params: URLSearchParams): string {\n    const pairs: string[] = [];\n    for (const [k, v] of params.entries()) {\n        pairs.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);\n    }\n    pairs.sort();\n    return pairs.join(\"&\");\n}\n\n/**\n * Creates API-key authentication headers for endpoints using the Polyester Ed25519 signing contract.\n */\nexport async function createApiKeyEd25519AuthHeaders(\n    auth: ApiKeyEd25519AuthProvider,\n    request: ApiKeyEd25519SigningRequest,\n): Promise<Record<string, string>> {\n    const [keyId, secretKey] = await Promise.all([auth.getKeyId(), auth.getSecretKey()]);\n    if (!keyId || !secretKey) throw new ConfigurationError(\"Missing API key ID or secret key\");\n\n    const urlObj = new URL(request.url);\n    const timestamp = request.timestamp ?? String(Date.now());\n    const bodyHash = await sha256Hex(request.body ?? new Uint8Array(0));\n    const canonicalQuery = canonicalQueryString(urlObj.searchParams);\n    const canonical = `${timestamp}\\n${request.method}\\n${urlObj.pathname}\\n${canonicalQuery}\\n${bodyHash}`;\n    const msgBytes = new TextEncoder().encode(canonical);\n    const sig = await signAsync(msgBytes, secretKey);\n    const signatureHex = Array.from(sig, (b: number) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n    return {\n        \"X-API-KEY-ID\": keyId,\n        \"X-API-TIMESTAMP\": timestamp,\n        \"X-API-SIGNATURE\": signatureHex,\n    };\n}\n\n/**\n * Creates an interceptor that attaches SDK authentication headers.\n */\nexport function createAuthInterceptor(\n    auth: JwtAuthProvider | ApiKeyEd25519AuthProvider,\n    options?: { wireFormat?: ConnectWireFormat },\n): Interceptor {\n    return (next) => async (req) => {\n        const wireFormat = options?.wireFormat ?? \"binary\";\n        if (auth.kind === \"jwt\") {\n            const token = await auth.getToken();\n            if (token) {\n                req.header.set(\"Authorization\", `Bearer ${token}`);\n            }\n        } else if (auth.kind === \"api-key-ed25519\") {\n            let bodyBytes: Uint8Array;\n            if (!req.stream) {\n                // unary request - serialize the message using the method's input schema\n                const inputSchema = req.method.input;\n                bodyBytes =\n                    wireFormat === \"json\"\n                        ? new TextEncoder().encode(toJsonString(inputSchema, req.message))\n                        : toBinary(inputSchema, req.message);\n            } else {\n                // stream request - empty body for signing (streams don't have a single body)\n                bodyBytes = new Uint8Array(0);\n            }\n\n            const headers = await createApiKeyEd25519AuthHeaders(auth, {\n                url: req.url,\n                method: req.requestMethod,\n                body: bodyBytes,\n            });\n            for (const [key, value] of Object.entries(headers)) {\n                req.header.set(key, value);\n            }\n        }\n        return next(req);\n    };\n}\n"],"mappings":";;;;;;;;;AA2DA,SAAgB,YAA0B;CAsBtC,OArBqB,OAAO,OACxB,OAAO,OAAoC,SAAuC;EAE9E,MAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;EAEzC,IAAI;GAOA,OAAO,MANW,MAAM,OAAO;IAC3B,GAAG;IACH;IACA,UAAU;GACd,CAAC;EAGL,SAAS,KAAK;GACV,IAAI,aAAa,GAAG,GAAG,MAAM;GAC7B,MAAM,IAAI,aAAa,4BAA4B,EAAE,OAAO,IAAI,CAAC;EACrE;CACJ,GACA,KAGc;AACtB;;;;AAKA,SAAgB,iBAAiB,QAAqC;CAClE,MAAM,EAAE,QAAQ,eAAe,CAAC,GAAG,MAAM,aAAa,aAAa;CACnE,MAAM,kBAAkB,eAAe;CAEvC,MAAM,eAAe,8BAA8B;CAEnD,MAAM,YAAY,uBAAuB;EACrC,SAAS;EACT;EACA,cAAc,CAAC,cAAc,GAAG,YAAY;EAC5C,OAAO,UAAU;CACrB,CAAC;CAED,MAAM,mBAAmB,OACnB;EAAC;EAAc,sBAAsB,MAAM,EAAE,WAAW,CAAC;EAAG,GAAG;CAAY,IAC3E,CAAC,cAAc,GAAG,YAAY;CAQpC,OAAO;EAAE,SAPO,uBAAuB;GACnC,SAAS;GACT;GACA,cAAc;GACd,OAAO,UAAU;EACrB,CAEe;EAAG;CAAU;AAChC;AAYA,eAAe,UAAU,OAAoC;CACzD,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,QACzC,MAAM,IAAI,mBAAmB,2CAA2C;CAE5E,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;CAChE,OAAO,MAAM,KAAK,IAAI,WAAW,IAAI,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC3F;AAEA,SAAS,qBAAqB,QAAiC;CAC3D,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,GAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,mBAAmB,CAAC,GAAG;CAElE,MAAM,KAAK;CACX,OAAO,MAAM,KAAK,GAAG;AACzB;;;;AAKA,eAAsB,+BAClB,MACA,SAC+B;CAC/B,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,KAAK,SAAS,GAAG,KAAK,aAAa,CAAC,CAAC;CACnF,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,IAAI,mBAAmB,kCAAkC;CAEzF,MAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;CAClC,MAAM,YAAY,QAAQ,aAAa,OAAO,KAAK,IAAI,CAAC;CACxD,MAAM,WAAW,MAAM,UAAU,QAAQ,wBAAQ,IAAI,WAAW,CAAC,CAAC;CAClE,MAAM,iBAAiB,qBAAqB,OAAO,YAAY;CAC/D,MAAM,YAAY,GAAG,UAAU,IAAI,QAAQ,OAAO,IAAI,OAAO,SAAS,IAAI,eAAe,IAAI;CAC7F,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;CACnD,MAAM,MAAM,MAAM,UAAU,UAAU,SAAS;CAG/C,OAAO;EACH,gBAAgB;EAChB,mBAAmB;EACnB,mBALiB,MAAM,KAAK,MAAM,MAAc,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAKxD;CAClC;AACJ;;;;AAKA,SAAgB,sBACZ,MACA,SACW;CACX,QAAQ,SAAS,OAAO,QAAQ;EAC5B,MAAM,aAAa,SAAS,cAAc;EAC1C,IAAI,KAAK,SAAS,OAAO;GACrB,MAAM,QAAQ,MAAM,KAAK,SAAS;GAClC,IAAI,OACA,IAAI,OAAO,IAAI,iBAAiB,UAAU,OAAO;EAEzD,OAAO,IAAI,KAAK,SAAS,mBAAmB;GACxC,IAAI;GACJ,IAAI,CAAC,IAAI,QAAQ;IAEb,MAAM,cAAc,IAAI,OAAO;IAC/B,YACI,eAAe,SACT,IAAI,YAAY,CAAC,CAAC,OAAO,aAAa,aAAa,IAAI,OAAO,CAAC,IAC/D,SAAS,aAAa,IAAI,OAAO;GAC/C,OAEI,4BAAY,IAAI,WAAW,CAAC;GAGhC,MAAM,UAAU,MAAM,+BAA+B,MAAM;IACvD,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ,MAAM;GACV,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC7C,IAAI,OAAO,IAAI,KAAK,KAAK;EAEjC;EACA,OAAO,KAAK,GAAG;CACnB;AACJ"}
+{"version":3,"file":"transports.js","names":[],"sources":["../../src/shared/transports.ts"],"sourcesContent":["import { createConnectTransport } from \"@connectrpc/connect-web\";\nimport type { Transport, Interceptor } from \"@connectrpc/connect\";\nimport { toBinary, toJsonString } from \"@bufbuild/protobuf\";\nimport { signAsync } from \"@noble/ed25519\";\nimport { createErrorMappingTransport } from \"./connect-error-mapping.js\";\nimport { ConfigurationError, isAbortError, NetworkError } from \"./errors.js\";\n\nexport { isAbortError };\n\nexport type ConnectWireFormat = \"binary\" | \"json\";\n\nexport const POLYESTER_MOCK_HEADER = \"x-polyester-mock\";\n\nexport interface TransportConfig {\n    apiUrl: string;\n    interceptors?: Interceptor[];\n    auth?: JwtAuthProvider | ApiKeyEd25519AuthProvider;\n    /**\n     * Connect wire format. Defaults to binary for production performance.\n     * Use `json` for the API Playground visualization.\n     */\n    wireFormat?: ConnectWireFormat;\n}\n\nexport interface Transports {\n    authApi: Transport;\n    publicApi: Transport;\n}\n\n/**\n * Generic JWT auth for HTTP/Connect endpoints that follow the Bearer token contract.\n */\nexport interface JwtAuthProvider {\n    kind: \"jwt\";\n    /** Typically wraps the configured browser auth token storage. */\n    getToken: () => string | null | Promise<string | null>;\n}\n\n/**\n * Generic Ed25519 API key auth for HTTP/Connect endpoints that follow the\n * X-API-KEY-ID / X-API-TIMESTAMP / X-API-SIGNATURE contract.\n */\nexport interface ApiKeyEd25519AuthProvider {\n    kind: \"api-key-ed25519\";\n    getKeyId: () => string | null | Promise<string | null>;\n    /** Ed25519 secret key bytes (not hex) for signing. */\n    getSecretKey: () => Uint8Array | null | Promise<Uint8Array | null>;\n}\n\nexport interface ApiKeyEd25519SigningRequest {\n    url: string | URL;\n    method: string;\n    body?: Uint8Array;\n    timestamp?: string;\n}\n\n/**\n * Returns the fetch implementation used by SDK transports.\n */\nexport function makeFetch(): typeof fetch {\n    const wrappedFetch = Object.assign(\n        async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n            // Normalize headers into a mutable Headers object\n            const headers = new Headers(init?.headers);\n\n            try {\n                const res = await fetch(input, {\n                    ...init,\n                    headers,\n                    redirect: \"manual\",\n                });\n\n                return res;\n            } catch (err) {\n                if (isAbortError(err)) throw err;\n                throw new NetworkError(\"Transport request failed\", { cause: err });\n            }\n        },\n        fetch,\n    );\n\n    return wrappedFetch;\n}\n\n/**\n * Creates Connect transports for SDK service clients.\n */\nexport function createTransports(config: TransportConfig): Transports {\n    const { apiUrl, interceptors = [], auth, wireFormat = \"binary\" } = config;\n    const useBinaryFormat = wireFormat === \"binary\";\n    const publicApi = createErrorMappingTransport(\n        createConnectTransport({\n            baseUrl: apiUrl,\n            useBinaryFormat,\n            interceptors,\n            fetch: makeFetch(),\n        }),\n    );\n\n    const authInterceptors = auth\n        ? [createAuthInterceptor(auth, { wireFormat }), ...interceptors]\n        : interceptors;\n    const authApi = createErrorMappingTransport(\n        createConnectTransport({\n            baseUrl: apiUrl,\n            useBinaryFormat,\n            interceptors: authInterceptors,\n            fetch: makeFetch(),\n        }),\n    );\n\n    return { authApi, publicApi };\n}\n\n/**\n * Creates an interceptor that enables mock transport behavior.\n */\nexport function createMockInterceptor(getEnabled: () => boolean): Interceptor {\n    return (next) => async (req) => {\n        if (getEnabled()) req.header.set(POLYESTER_MOCK_HEADER, \"true\");\n        return next(req);\n    };\n}\n\nasync function sha256Hex(bytes: Uint8Array): Promise<string> {\n    if (typeof crypto === \"undefined\" || !crypto.subtle) {\n        throw new ConfigurationError(\"SHA-256 not available in this environment\");\n    }\n    const hash = await crypto.subtle.digest(\"SHA-256\", bytes.slice());\n    return Array.from(new Uint8Array(hash), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction canonicalQueryString(params: URLSearchParams): string {\n    const pairs: string[] = [];\n    for (const [k, v] of params.entries()) {\n        pairs.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);\n    }\n    pairs.sort();\n    return pairs.join(\"&\");\n}\n\n/**\n * Creates API-key authentication headers for endpoints using the Polyester Ed25519 signing contract.\n */\nexport async function createApiKeyEd25519AuthHeaders(\n    auth: ApiKeyEd25519AuthProvider,\n    request: ApiKeyEd25519SigningRequest,\n): Promise<Record<string, string>> {\n    const [keyId, secretKey] = await Promise.all([auth.getKeyId(), auth.getSecretKey()]);\n    if (!keyId || !secretKey) throw new ConfigurationError(\"Missing API key ID or secret key\");\n\n    const urlObj = new URL(request.url);\n    const timestamp = request.timestamp ?? String(Date.now());\n    const bodyHash = await sha256Hex(request.body ?? new Uint8Array(0));\n    const canonicalQuery = canonicalQueryString(urlObj.searchParams);\n    const canonical = `${timestamp}\\n${request.method}\\n${urlObj.pathname}\\n${canonicalQuery}\\n${bodyHash}`;\n    const msgBytes = new TextEncoder().encode(canonical);\n    const sig = await signAsync(msgBytes, secretKey);\n    const signatureHex = Array.from(sig, (b: number) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n    return {\n        \"X-API-KEY-ID\": keyId,\n        \"X-API-TIMESTAMP\": timestamp,\n        \"X-API-SIGNATURE\": signatureHex,\n    };\n}\n\n/**\n * Creates an interceptor that attaches SDK authentication headers.\n */\nexport function createAuthInterceptor(\n    auth: JwtAuthProvider | ApiKeyEd25519AuthProvider,\n    options?: { wireFormat?: ConnectWireFormat },\n): Interceptor {\n    return (next) => async (req) => {\n        const wireFormat = options?.wireFormat ?? \"binary\";\n        if (auth.kind === \"jwt\") {\n            const token = await auth.getToken();\n            if (token) {\n                req.header.set(\"Authorization\", `Bearer ${token}`);\n            }\n        } else if (auth.kind === \"api-key-ed25519\") {\n            let bodyBytes: Uint8Array;\n            if (!req.stream) {\n                // unary request - serialize the message using the method's input schema\n                const inputSchema = req.method.input;\n                bodyBytes =\n                    wireFormat === \"json\"\n                        ? new TextEncoder().encode(toJsonString(inputSchema, req.message))\n                        : toBinary(inputSchema, req.message);\n            } else {\n                // stream request - empty body for signing (streams don't have a single body)\n                bodyBytes = new Uint8Array(0);\n            }\n\n            const headers = await createApiKeyEd25519AuthHeaders(auth, {\n                url: req.url,\n                method: req.requestMethod,\n                body: bodyBytes,\n            });\n            for (const [key, value] of Object.entries(headers)) {\n                req.header.set(key, value);\n            }\n        }\n        return next(req);\n    };\n}\n"],"mappings":";;;;;;;;;AA2DA,SAAgB,YAA0B;CAsBtC,OArBqB,OAAO,OACxB,OAAO,OAAoC,SAAuC;EAE9E,MAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;EAEzC,IAAI;GAOA,OAAO,MANW,MAAM,OAAO;IAC3B,GAAG;IACH;IACA,UAAU;GACd,CAAC;EAGL,SAAS,KAAK;GACV,IAAI,aAAa,GAAG,GAAG,MAAM;GAC7B,MAAM,IAAI,aAAa,4BAA4B,EAAE,OAAO,IAAI,CAAC;EACrE;CACJ,GACA,KAGc;AACtB;;;;AAKA,SAAgB,iBAAiB,QAAqC;CAClE,MAAM,EAAE,QAAQ,eAAe,CAAC,GAAG,MAAM,aAAa,aAAa;CACnE,MAAM,kBAAkB,eAAe;CACvC,MAAM,YAAY,4BACd,uBAAuB;EACnB,SAAS;EACT;EACA;EACA,OAAO,UAAU;CACrB,CAAC,CACL;CAEA,MAAM,mBAAmB,OACnB,CAAC,sBAAsB,MAAM,EAAE,WAAW,CAAC,GAAG,GAAG,YAAY,IAC7D;CAUN,OAAO;EAAE,SATO,4BACZ,uBAAuB;GACnB,SAAS;GACT;GACA,cAAc;GACd,OAAO,UAAU;EACrB,CAAC,CAGU;EAAG;CAAU;AAChC;AAYA,eAAe,UAAU,OAAoC;CACzD,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,QACzC,MAAM,IAAI,mBAAmB,2CAA2C;CAE5E,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;CAChE,OAAO,MAAM,KAAK,IAAI,WAAW,IAAI,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC3F;AAEA,SAAS,qBAAqB,QAAiC;CAC3D,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,GAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,mBAAmB,CAAC,GAAG;CAElE,MAAM,KAAK;CACX,OAAO,MAAM,KAAK,GAAG;AACzB;;;;AAKA,eAAsB,+BAClB,MACA,SAC+B;CAC/B,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,KAAK,SAAS,GAAG,KAAK,aAAa,CAAC,CAAC;CACnF,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,IAAI,mBAAmB,kCAAkC;CAEzF,MAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;CAClC,MAAM,YAAY,QAAQ,aAAa,OAAO,KAAK,IAAI,CAAC;CACxD,MAAM,WAAW,MAAM,UAAU,QAAQ,wBAAQ,IAAI,WAAW,CAAC,CAAC;CAClE,MAAM,iBAAiB,qBAAqB,OAAO,YAAY;CAC/D,MAAM,YAAY,GAAG,UAAU,IAAI,QAAQ,OAAO,IAAI,OAAO,SAAS,IAAI,eAAe,IAAI;CAC7F,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;CACnD,MAAM,MAAM,MAAM,UAAU,UAAU,SAAS;CAG/C,OAAO;EACH,gBAAgB;EAChB,mBAAmB;EACnB,mBALiB,MAAM,KAAK,MAAM,MAAc,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAKxD;CAClC;AACJ;;;;AAKA,SAAgB,sBACZ,MACA,SACW;CACX,QAAQ,SAAS,OAAO,QAAQ;EAC5B,MAAM,aAAa,SAAS,cAAc;EAC1C,IAAI,KAAK,SAAS,OAAO;GACrB,MAAM,QAAQ,MAAM,KAAK,SAAS;GAClC,IAAI,OACA,IAAI,OAAO,IAAI,iBAAiB,UAAU,OAAO;EAEzD,OAAO,IAAI,KAAK,SAAS,mBAAmB;GACxC,IAAI;GACJ,IAAI,CAAC,IAAI,QAAQ;IAEb,MAAM,cAAc,IAAI,OAAO;IAC/B,YACI,eAAe,SACT,IAAI,YAAY,CAAC,CAAC,OAAO,aAAa,aAAa,IAAI,OAAO,CAAC,IAC/D,SAAS,aAAa,IAAI,OAAO;GAC/C,OAEI,4BAAY,IAAI,WAAW,CAAC;GAGhC,MAAM,UAAU,MAAM,+BAA+B,MAAM;IACvD,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ,MAAM;GACV,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC7C,IAAI,OAAO,IAAI,KAAK,KAAK;EAEjC;EACA,OAAO,KAAK,GAAG;CACnB;AACJ"}

package/dist/shared/types.d.ts

@@ -1,9 +1,21 @@
 import { SdkSubscriptionErrorContext } from "./subscription-errors.js";
 //#region src/shared/types.d.ts
 interface BaseSubscribeInput<T> {
+  /**
+   * Called after the channel subscription is confirmed. The unsubscribe function
+   * returned by subscribe only starts the connection; wait for the first onOpen
+   * call before issuing writes whose events must be observed. Called again after
+   * a successful resubscription.
+   */
   onOpen?: () => void;
+  /** Called when an active channel subscription closes. */
   onClose?: () => void;
+  /**
+   * Called when the subscription or an event handler reports an error. When omitted,
+   * a synchronously detected missing-authentication failure throws instead.
+   */
   onError?: (ctx: SdkSubscriptionErrorContext) => void;
+  /** Called for each event received while the channel subscription is active. */
   onEvent: (c: T) => void;
 }
 //#endregion

package/dist/shared/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/shared/types.ts"],"mappings":";;UAEiB,mBAAmB;EAChC;EACA;EACA,WAAW,KAAK;EAChB,UAAU,GAAG"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/shared/types.ts"],"mappings":";;UAEiB,mBAAmB;;;;;;;EAOhC;;EAEA;;;;;EAKA,WAAW,KAAK;;EAEhB,UAAU,GAAG"}

package/dist/shared/validation.js

@@ -0,0 +1,19 @@
+import { ValidationError } from "./errors.js";
+import * as v from "valibot";
+//#region src/shared/validation.ts
+/**
+* Parses a value with Valibot and translates schema failures into the SDK's
+* public error hierarchy.
+*/
+function parse(schema, input, config) {
+	try {
+		return v.parse(schema, input, config);
+	} catch (error) {
+		if (v.isValiError(error)) throw new ValidationError(error.message, { cause: error });
+		throw error;
+	}
+}
+//#endregion
+export { parse };
+
+//# sourceMappingURL=validation.js.map

package/dist/shared/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","names":[],"sources":["../../src/shared/validation.ts"],"sourcesContent":["import * as v from \"valibot\";\nimport { ValidationError } from \"./errors.js\";\n\n/**\n * Parses a value with Valibot and translates schema failures into the SDK's\n * public error hierarchy.\n */\nexport function parse<const TSchema extends v.BaseSchema<unknown, unknown, v.BaseIssue<unknown>>>(\n    schema: TSchema,\n    input: unknown,\n    config?: v.Config<v.InferIssue<TSchema>>,\n): v.InferOutput<TSchema> {\n    try {\n        return v.parse(schema, input, config);\n    } catch (error) {\n        if (v.isValiError(error)) {\n            throw new ValidationError(error.message, { cause: error });\n        }\n        throw error;\n    }\n}\n"],"mappings":";;;;;;;AAOA,SAAgB,MACZ,QACA,OACA,QACsB;CACtB,IAAI;EACA,OAAO,EAAE,MAAM,QAAQ,OAAO,MAAM;CACxC,SAAS,OAAO;EACZ,IAAI,EAAE,YAAY,KAAK,GACnB,MAAM,IAAI,gBAAgB,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAE7D,MAAM;CACV;AACJ"}

package/dist/utils/cookies.d.ts

@@ -1,7 +1,12 @@
 //#region src/utils/cookies.d.ts
-type CookieGetter = Record<string, string> | {
-  get(name: string): string | undefined;
-} | Request;
+type CookieValue = string | {
+  readonly value: string;
+};
+type CookieStoreLike = {
+  get(name: string): CookieValue | undefined;
+};
+/** A supported server-side cookie source. */
+type CookieGetter = Record<string, string> | CookieStoreLike | Request;
 //#endregion
 export { CookieGetter };
 //# sourceMappingURL=cookies.d.ts.map

package/dist/utils/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","names":[],"sources":["../../src/utils/cookies.ts"],"mappings":";KA6DY,eACN;EACE,IAAI;IACN"}
+{"version":3,"file":"cookies.d.ts","names":[],"sources":["../../src/utils/cookies.ts"],"mappings":";KA6DK;WAAkC;;KAClC;EAAoB,IAAI,eAAe;;;KAGhC,eAAe,yBAAyB,kBAAkB"}

package/dist/utils/cookies.js

@@ -42,6 +42,9 @@ function deleteCookie(name, options) {
 		expires: /* @__PURE__ */ new Date("Thu, 01 Jan 1970 00:00:00 GMT")
 	});
 }
+function isCookieStore(cookies) {
+	return typeof cookies.get === "function";
+}
 /**
 * Parses cookies from a Request header.
 */
@@ -55,7 +58,10 @@ function parseCookiesFromRequest(request) {
 */
 function getCookieValue(cookies, name) {
 	if (cookies instanceof Request) return parseCookiesFromRequest(cookies)[name];
-	if (typeof cookies.get === "function") return cookies.get(name);
+	if (isCookieStore(cookies)) {
+		const cookie = cookies.get(name);
+		return typeof cookie === "string" ? cookie : cookie?.value;
+	}
 	return cookies[name];
 }
 /**

package/dist/utils/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","names":["serializeCookie","parseCookie","#name"],"sources":["../../src/utils/cookies.ts"],"sourcesContent":["import {\n    type Cookies,\n    type CookieSerializeOptions,\n    parseCookie,\n    serializeCookie,\n} from \"./cookie-es/index.js\";\nimport { isLocalNetworkHost } from \"./is-dev.js\";\n\n/**\n * Whether auth cookies should carry the `Secure` attribute.\n *\n * On https pages: always Secure. On plaintext pages, browsers silently DROP\n * Secure cookies (localhost excepted), so dev against a LAN IP — e.g. phone\n * testing http://192.168.x.x — logged users out instantly because the freshly\n * written session cookies never persisted. The downgrade is therefore allowed\n * ONLY on local/private-network hosts; on a public hostname served over http\n * (a misconfigured production deployment) cookies stay Secure so auth fails\n * closed instead of shipping session cookies over plaintext.\n */\nexport function shouldSecureCookies(): boolean {\n    if (typeof window === \"undefined\") return true;\n    if (window.location.protocol === \"https:\") return true;\n    return !isLocalNetworkHost(window.location.hostname);\n}\n\ninterface SetCookieParams {\n    name: string;\n    value: string;\n    options: CookieSerializeOptions;\n}\n\n/**\n * Writes a browser cookie.\n */\nexport function setCookie({ name, value, options }: SetCookieParams): void {\n    if (typeof document === \"undefined\") return;\n\n    document.cookie = serializeCookie(name, value, options);\n}\n\n/**\n * Reads a browser cookie by name.\n */\nexport function getCookie(name: string): string | undefined {\n    if (typeof document === \"undefined\") return;\n\n    return parseCookie(document.cookie)[name];\n}\n\n/**\n * Deletes a browser cookie by name.\n */\nexport function deleteCookie(name: string, options?: { path?: string }): void {\n    if (typeof document === \"undefined\") return;\n\n    document.cookie = serializeCookie(name, \"\", {\n        path: options?.path ?? \"/\",\n        expires: new Date(\"Thu, 01 Jan 1970 00:00:00 GMT\"),\n    });\n}\n\nexport type CookieGetter =\n    | Record<string, string>\n    | { get(name: string): string | undefined }\n    | Request;\n\n/**\n * Parses cookies from a Request header.\n */\nexport function parseCookiesFromRequest(request: Request): Cookies {\n    const cookieHeader = request.headers.get(\"cookie\");\n    if (!cookieHeader) return {};\n\n    return parseCookie(cookieHeader);\n}\n\n/**\n * Reads a cookie value from either a cookie map or cookie getter.\n */\nexport function getCookieValue(cookies: CookieGetter, name: string): string | undefined {\n    if (cookies instanceof Request) {\n        const parsed = parseCookiesFromRequest(cookies);\n        return parsed[name];\n    }\n    if (typeof cookies.get === \"function\") {\n        return cookies.get(name);\n    }\n    return (cookies as Record<string, string>)[name];\n}\n\ninterface CookieManagerOptions {\n    /**\n     * The name of the cookie to manage.\n     */\n    name: string;\n}\n\n/**\n * A generic class for managing cookies on the client side.\n * Provides a consistent interface for getting, setting, and deleting cookies.\n *\n * @example\n * ```ts\n * const cookieManager = new CookieManager({ name: \"my-cookie\" });\n * cookieManager.get();\n * cookieManager.set(\"my-value\");\n * cookieManager.clear();\n * ```\n */\nexport class CookieManager {\n    #name: string;\n    constructor(opts: CookieManagerOptions) {\n        this.#name = opts.name;\n    }\n    /**\n     * Reads the managed cookie value.\n     */\n    get(): string | null {\n        const token = getCookie(this.#name);\n        return token ?? null;\n    }\n\n    /**\n     * Writes the managed cookie value.\n     */\n    set(\n        token: string,\n        options?: {\n            path?: string;\n            secure?: boolean;\n            sameSite?: \"lax\" | \"strict\" | \"none\";\n            maxAge?: number;\n            expires?: Date;\n        },\n    ): void {\n        setCookie({\n            name: this.#name,\n            value: token,\n            options: {\n                path: options?.path ?? \"/\",\n                sameSite: options?.sameSite ?? \"lax\",\n                secure: options?.secure ?? shouldSecureCookies(),\n                maxAge: options?.maxAge,\n                expires: options?.expires,\n            },\n        });\n    }\n\n    /**\n     * Clears the managed cookie value.\n     */\n    clear(options?: { path?: string }): void {\n        deleteCookie(this.#name, options);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,SAAgB,sBAA+B;CAC3C,IAAI,OAAO,WAAW,aAAa,OAAO;CAC1C,IAAI,OAAO,SAAS,aAAa,UAAU,OAAO;CAClD,OAAO,CAAC,mBAAmB,OAAO,SAAS,QAAQ;AACvD;;;;AAWA,SAAgB,UAAU,EAAE,MAAM,OAAO,WAAkC;CACvE,IAAI,OAAO,aAAa,aAAa;CAErC,SAAS,SAASA,UAAgB,MAAM,OAAO,OAAO;AAC1D;;;;AAKA,SAAgB,UAAU,MAAkC;CACxD,IAAI,OAAO,aAAa,aAAa;CAErC,OAAOC,MAAY,SAAS,MAAM,CAAC,CAAC;AACxC;;;;AAKA,SAAgB,aAAa,MAAc,SAAmC;CAC1E,IAAI,OAAO,aAAa,aAAa;CAErC,SAAS,SAASD,UAAgB,MAAM,IAAI;EACxC,MAAM,SAAS,QAAQ;EACvB,yBAAS,IAAI,KAAK,+BAA+B;CACrD,CAAC;AACL;;;;AAUA,SAAgB,wBAAwB,SAA2B;CAC/D,MAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ;CACjD,IAAI,CAAC,cAAc,OAAO,CAAC;CAE3B,OAAOC,MAAY,YAAY;AACnC;;;;AAKA,SAAgB,eAAe,SAAuB,MAAkC;CACpF,IAAI,mBAAmB,SAEnB,OADe,wBAAwB,OAC3B,CAAC,CAAC;CAElB,IAAI,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,IAAI,IAAI;CAE3B,OAAQ,QAAmC;AAC/C;;;;;;;;;;;;;AAqBA,IAAa,gBAAb,MAA2B;CACvB;CACA,YAAY,MAA4B;EACpC,KAAKC,QAAQ,KAAK;CACtB;;;;CAIA,MAAqB;EAEjB,OADc,UAAU,KAAKA,KAClB,KAAK;CACpB;;;;CAKA,IACI,OACA,SAOI;EACJ,UAAU;GACN,MAAM,KAAKA;GACX,OAAO;GACP,SAAS;IACL,MAAM,SAAS,QAAQ;IACvB,UAAU,SAAS,YAAY;IAC/B,QAAQ,SAAS,UAAU,oBAAoB;IAC/C,QAAQ,SAAS;IACjB,SAAS,SAAS;GACtB;EACJ,CAAC;CACL;;;;CAKA,MAAM,SAAmC;EACrC,aAAa,KAAKA,OAAO,OAAO;CACpC;AACJ"}
+{"version":3,"file":"cookies.js","names":["serializeCookie","parseCookie","#name"],"sources":["../../src/utils/cookies.ts"],"sourcesContent":["import {\n    type Cookies,\n    type CookieSerializeOptions,\n    parseCookie,\n    serializeCookie,\n} from \"./cookie-es/index.js\";\nimport { isLocalNetworkHost } from \"./is-dev.js\";\n\n/**\n * Whether auth cookies should carry the `Secure` attribute.\n *\n * On https pages: always Secure. On plaintext pages, browsers silently DROP\n * Secure cookies (localhost excepted), so dev against a LAN IP — e.g. phone\n * testing http://192.168.x.x — logged users out instantly because the freshly\n * written session cookies never persisted. The downgrade is therefore allowed\n * ONLY on local/private-network hosts; on a public hostname served over http\n * (a misconfigured production deployment) cookies stay Secure so auth fails\n * closed instead of shipping session cookies over plaintext.\n */\nexport function shouldSecureCookies(): boolean {\n    if (typeof window === \"undefined\") return true;\n    if (window.location.protocol === \"https:\") return true;\n    return !isLocalNetworkHost(window.location.hostname);\n}\n\ninterface SetCookieParams {\n    name: string;\n    value: string;\n    options: CookieSerializeOptions;\n}\n\n/**\n * Writes a browser cookie.\n */\nexport function setCookie({ name, value, options }: SetCookieParams): void {\n    if (typeof document === \"undefined\") return;\n\n    document.cookie = serializeCookie(name, value, options);\n}\n\n/**\n * Reads a browser cookie by name.\n */\nexport function getCookie(name: string): string | undefined {\n    if (typeof document === \"undefined\") return;\n\n    return parseCookie(document.cookie)[name];\n}\n\n/**\n * Deletes a browser cookie by name.\n */\nexport function deleteCookie(name: string, options?: { path?: string }): void {\n    if (typeof document === \"undefined\") return;\n\n    document.cookie = serializeCookie(name, \"\", {\n        path: options?.path ?? \"/\",\n        expires: new Date(\"Thu, 01 Jan 1970 00:00:00 GMT\"),\n    });\n}\n\ntype CookieValue = string | { readonly value: string };\ntype CookieStoreLike = { get(name: string): CookieValue | undefined };\n\n/** A supported server-side cookie source. */\nexport type CookieGetter = Record<string, string> | CookieStoreLike | Request;\n\nfunction isCookieStore(\n    cookies: Record<string, string> | CookieStoreLike,\n): cookies is CookieStoreLike {\n    return typeof cookies.get === \"function\";\n}\n\n/**\n * Parses cookies from a Request header.\n */\nexport function parseCookiesFromRequest(request: Request): Cookies {\n    const cookieHeader = request.headers.get(\"cookie\");\n    if (!cookieHeader) return {};\n\n    return parseCookie(cookieHeader);\n}\n\n/**\n * Reads a cookie value from either a cookie map or cookie getter.\n */\nexport function getCookieValue(cookies: CookieGetter, name: string): string | undefined {\n    if (cookies instanceof Request) {\n        const parsed = parseCookiesFromRequest(cookies);\n        return parsed[name];\n    }\n    if (isCookieStore(cookies)) {\n        const cookie = cookies.get(name);\n        return typeof cookie === \"string\" ? cookie : cookie?.value;\n    }\n    return cookies[name];\n}\n\ninterface CookieManagerOptions {\n    /**\n     * The name of the cookie to manage.\n     */\n    name: string;\n}\n\n/**\n * A generic class for managing cookies on the client side.\n * Provides a consistent interface for getting, setting, and deleting cookies.\n *\n * @example\n * ```ts\n * const cookieManager = new CookieManager({ name: \"my-cookie\" });\n * cookieManager.get();\n * cookieManager.set(\"my-value\");\n * cookieManager.clear();\n * ```\n */\nexport class CookieManager {\n    #name: string;\n    constructor(opts: CookieManagerOptions) {\n        this.#name = opts.name;\n    }\n    /**\n     * Reads the managed cookie value.\n     */\n    get(): string | null {\n        const token = getCookie(this.#name);\n        return token ?? null;\n    }\n\n    /**\n     * Writes the managed cookie value.\n     */\n    set(\n        token: string,\n        options?: {\n            path?: string;\n            secure?: boolean;\n            sameSite?: \"lax\" | \"strict\" | \"none\";\n            maxAge?: number;\n            expires?: Date;\n        },\n    ): void {\n        setCookie({\n            name: this.#name,\n            value: token,\n            options: {\n                path: options?.path ?? \"/\",\n                sameSite: options?.sameSite ?? \"lax\",\n                secure: options?.secure ?? shouldSecureCookies(),\n                maxAge: options?.maxAge,\n                expires: options?.expires,\n            },\n        });\n    }\n\n    /**\n     * Clears the managed cookie value.\n     */\n    clear(options?: { path?: string }): void {\n        deleteCookie(this.#name, options);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,SAAgB,sBAA+B;CAC3C,IAAI,OAAO,WAAW,aAAa,OAAO;CAC1C,IAAI,OAAO,SAAS,aAAa,UAAU,OAAO;CAClD,OAAO,CAAC,mBAAmB,OAAO,SAAS,QAAQ;AACvD;;;;AAWA,SAAgB,UAAU,EAAE,MAAM,OAAO,WAAkC;CACvE,IAAI,OAAO,aAAa,aAAa;CAErC,SAAS,SAASA,UAAgB,MAAM,OAAO,OAAO;AAC1D;;;;AAKA,SAAgB,UAAU,MAAkC;CACxD,IAAI,OAAO,aAAa,aAAa;CAErC,OAAOC,MAAY,SAAS,MAAM,CAAC,CAAC;AACxC;;;;AAKA,SAAgB,aAAa,MAAc,SAAmC;CAC1E,IAAI,OAAO,aAAa,aAAa;CAErC,SAAS,SAASD,UAAgB,MAAM,IAAI;EACxC,MAAM,SAAS,QAAQ;EACvB,yBAAS,IAAI,KAAK,+BAA+B;CACrD,CAAC;AACL;AAQA,SAAS,cACL,SAC0B;CAC1B,OAAO,OAAO,QAAQ,QAAQ;AAClC;;;;AAKA,SAAgB,wBAAwB,SAA2B;CAC/D,MAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ;CACjD,IAAI,CAAC,cAAc,OAAO,CAAC;CAE3B,OAAOC,MAAY,YAAY;AACnC;;;;AAKA,SAAgB,eAAe,SAAuB,MAAkC;CACpF,IAAI,mBAAmB,SAEnB,OADe,wBAAwB,OAC3B,CAAC,CAAC;CAElB,IAAI,cAAc,OAAO,GAAG;EACxB,MAAM,SAAS,QAAQ,IAAI,IAAI;EAC/B,OAAO,OAAO,WAAW,WAAW,SAAS,QAAQ;CACzD;CACA,OAAO,QAAQ;AACnB;;;;;;;;;;;;;AAqBA,IAAa,gBAAb,MAA2B;CACvB;CACA,YAAY,MAA4B;EACpC,KAAKC,QAAQ,KAAK;CACtB;;;;CAIA,MAAqB;EAEjB,OADc,UAAU,KAAKA,KAClB,KAAK;CACpB;;;;CAKA,IACI,OACA,SAOI;EACJ,UAAU;GACN,MAAM,KAAKA;GACX,OAAO;GACP,SAAS;IACL,MAAM,SAAS,QAAQ;IACvB,UAAU,SAAS,YAAY;IAC/B,QAAQ,SAAS,UAAU,oBAAoB;IAC/C,QAAQ,SAAS;IACjB,SAAS,SAAS;GACtB;EACJ,CAAC;CACL;;;;CAKA,MAAM,SAAmC;EACrC,aAAa,KAAKA,OAAO,OAAO;CACpC;AACJ"}

package/dist/utils/event-emitter.d.ts

@@ -14,7 +14,7 @@ declare class EventEmitter<TEvents extends { [K in keyof TEvents]: unknown; }> {
    */
   once<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void;
   /**
-   * Emits an event to all registered listeners.
+   * Emits an event to all registered listeners, isolating errors thrown synchronously by each listener.
    */
   emit<K extends keyof TEvents>(event: K, data: TEvents[K]): void;
   /**

package/dist/utils/event-emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-emitter.d.ts","names":[],"sources":["../../src/utils/event-emitter.ts"],"mappings":";KAAK,cAAc,gBAAgB,MAAM;;;;cAK5B,aAAa,mBAAmB,WAAW;;;;;EAMpD,GAAG,gBAAgB,SAAS,OAAO,GAAG,UAAU,cAAc,QAAQ;;;;EActE,KAAK,gBAAgB,SAAS,OAAO,GAAG,UAAU,cAAc,QAAQ;;;;EAWxE,KAAK,gBAAgB,SAAS,OAAO,GAAG,MAAM,QAAQ;;;;EAYtD,IAAI,gBAAgB,SAAS,OAAO,GAAG,WAAW,cAAc,QAAQ;;;;EAWxE"}
+{"version":3,"file":"event-emitter.d.ts","names":[],"sources":["../../src/utils/event-emitter.ts"],"mappings":";KAAK,cAAc,gBAAgB,MAAM;;;;cAK5B,aAAa,mBAAmB,WAAW;;;;;EAMpD,GAAG,gBAAgB,SAAS,OAAO,GAAG,UAAU,cAAc,QAAQ;;;;EActE,KAAK,gBAAgB,SAAS,OAAO,GAAG,UAAU,cAAc,QAAQ;;;;EAWxE,KAAK,gBAAgB,SAAS,OAAO,GAAG,MAAM,QAAQ;;;;EAgBtD,IAAI,gBAAgB,SAAS,OAAO,GAAG,WAAW,cAAc,QAAQ;;;;EAWxE"}

package/dist/utils/event-emitter.js

@@ -25,11 +25,13 @@ var EventEmitter = class {
 		return unsubscribe;
 	}
 	/**
-	* Emits an event to all registered listeners.
+	* Emits an event to all registered listeners, isolating errors thrown synchronously by each listener.
 	*/
 	emit(event, data) {
 		const callbacks = this.#listeners.get(event);
-		if (callbacks) for (const callback of callbacks) callback(data);
+		if (callbacks) for (const callback of callbacks) try {
+			callback(data);
+		} catch {}
 	}
 	/**
 	* Removes a previously registered event listener.

package/dist/utils/event-emitter.js.map

@@ -1 +1 @@
-{"version":3,"file":"event-emitter.js","names":["#listeners"],"sources":["../../src/utils/event-emitter.ts"],"sourcesContent":["type EventCallback<T = unknown> = (data: T) => void;\n\n/**\n * Minimal typed event emitter used by SDK services to publish auth and lifecycle state changes.\n */\nexport class EventEmitter<TEvents extends { [K in keyof TEvents]: unknown }> {\n    #listeners: Map<keyof TEvents, Set<EventCallback>> = new Map();\n\n    /**\n     * Registers an event listener and returns an unsubscribe function.\n     */\n    on<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void {\n        if (!this.#listeners.has(event)) {\n            this.#listeners.set(event, new Set());\n        }\n        this.#listeners.get(event)!.add(callback as EventCallback);\n\n        return () => {\n            this.#listeners.get(event)?.delete(callback as EventCallback);\n        };\n    }\n\n    /**\n     * Registers an event listener that runs at most once.\n     */\n    once<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void {\n        const unsubscribe = this.on(event, (data) => {\n            unsubscribe();\n            callback(data);\n        });\n        return unsubscribe;\n    }\n\n    /**\n     * Emits an event to all registered listeners.\n     */\n    emit<K extends keyof TEvents>(event: K, data: TEvents[K]): void {\n        const callbacks = this.#listeners.get(event);\n        if (callbacks) {\n            for (const callback of callbacks) {\n                callback(data);\n            }\n        }\n    }\n\n    /**\n     * Removes a previously registered event listener.\n     */\n    off<K extends keyof TEvents>(event: K, callback?: EventCallback<TEvents[K]>): void {\n        if (callback) {\n            this.#listeners.get(event)?.delete(callback as EventCallback);\n        } else {\n            this.#listeners.delete(event);\n        }\n    }\n\n    /**\n     * Removes every registered event listener.\n     */\n    removeAllListeners(): void {\n        this.#listeners.clear();\n    }\n}\n"],"mappings":";;;;AAKA,IAAa,eAAb,MAA6E;CACzE,6BAAqD,IAAI,IAAI;;;;CAK7D,GAA4B,OAAU,UAAiD;EACnF,IAAI,CAAC,KAAKA,WAAW,IAAI,KAAK,GAC1B,KAAKA,WAAW,IAAI,uBAAO,IAAI,IAAI,CAAC;EAExC,KAAKA,WAAW,IAAI,KAAK,CAAC,CAAE,IAAI,QAAyB;EAEzD,aAAa;GACT,KAAKA,WAAW,IAAI,KAAK,CAAC,EAAE,OAAO,QAAyB;EAChE;CACJ;;;;CAKA,KAA8B,OAAU,UAAiD;EACrF,MAAM,cAAc,KAAK,GAAG,QAAQ,SAAS;GACzC,YAAY;GACZ,SAAS,IAAI;EACjB,CAAC;EACD,OAAO;CACX;;;;CAKA,KAA8B,OAAU,MAAwB;EAC5D,MAAM,YAAY,KAAKA,WAAW,IAAI,KAAK;EAC3C,IAAI,WACA,KAAK,MAAM,YAAY,WACnB,SAAS,IAAI;CAGzB;;;;CAKA,IAA6B,OAAU,UAA4C;EAC/E,IAAI,UACA,KAAKA,WAAW,IAAI,KAAK,CAAC,EAAE,OAAO,QAAyB;OAE5D,KAAKA,WAAW,OAAO,KAAK;CAEpC;;;;CAKA,qBAA2B;EACvB,KAAKA,WAAW,MAAM;CAC1B;AACJ"}
+{"version":3,"file":"event-emitter.js","names":["#listeners"],"sources":["../../src/utils/event-emitter.ts"],"sourcesContent":["type EventCallback<T = unknown> = (data: T) => void;\n\n/**\n * Minimal typed event emitter used by SDK services to publish auth and lifecycle state changes.\n */\nexport class EventEmitter<TEvents extends { [K in keyof TEvents]: unknown }> {\n    #listeners: Map<keyof TEvents, Set<EventCallback>> = new Map();\n\n    /**\n     * Registers an event listener and returns an unsubscribe function.\n     */\n    on<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void {\n        if (!this.#listeners.has(event)) {\n            this.#listeners.set(event, new Set());\n        }\n        this.#listeners.get(event)!.add(callback as EventCallback);\n\n        return () => {\n            this.#listeners.get(event)?.delete(callback as EventCallback);\n        };\n    }\n\n    /**\n     * Registers an event listener that runs at most once.\n     */\n    once<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void {\n        const unsubscribe = this.on(event, (data) => {\n            unsubscribe();\n            callback(data);\n        });\n        return unsubscribe;\n    }\n\n    /**\n     * Emits an event to all registered listeners, isolating errors thrown synchronously by each listener.\n     */\n    emit<K extends keyof TEvents>(event: K, data: TEvents[K]): void {\n        const callbacks = this.#listeners.get(event);\n        if (callbacks) {\n            for (const callback of callbacks) {\n                try {\n                    callback(data);\n                } catch {\n                    // A consumer callback must not interrupt the SDK operation or other listeners.\n                }\n            }\n        }\n    }\n\n    /**\n     * Removes a previously registered event listener.\n     */\n    off<K extends keyof TEvents>(event: K, callback?: EventCallback<TEvents[K]>): void {\n        if (callback) {\n            this.#listeners.get(event)?.delete(callback as EventCallback);\n        } else {\n            this.#listeners.delete(event);\n        }\n    }\n\n    /**\n     * Removes every registered event listener.\n     */\n    removeAllListeners(): void {\n        this.#listeners.clear();\n    }\n}\n"],"mappings":";;;;AAKA,IAAa,eAAb,MAA6E;CACzE,6BAAqD,IAAI,IAAI;;;;CAK7D,GAA4B,OAAU,UAAiD;EACnF,IAAI,CAAC,KAAKA,WAAW,IAAI,KAAK,GAC1B,KAAKA,WAAW,IAAI,uBAAO,IAAI,IAAI,CAAC;EAExC,KAAKA,WAAW,IAAI,KAAK,CAAC,CAAE,IAAI,QAAyB;EAEzD,aAAa;GACT,KAAKA,WAAW,IAAI,KAAK,CAAC,EAAE,OAAO,QAAyB;EAChE;CACJ;;;;CAKA,KAA8B,OAAU,UAAiD;EACrF,MAAM,cAAc,KAAK,GAAG,QAAQ,SAAS;GACzC,YAAY;GACZ,SAAS,IAAI;EACjB,CAAC;EACD,OAAO;CACX;;;;CAKA,KAA8B,OAAU,MAAwB;EAC5D,MAAM,YAAY,KAAKA,WAAW,IAAI,KAAK;EAC3C,IAAI,WACA,KAAK,MAAM,YAAY,WACnB,IAAI;GACA,SAAS,IAAI;EACjB,QAAQ,CAER;CAGZ;;;;CAKA,IAA6B,OAAU,UAA4C;EAC/E,IAAI,UACA,KAAKA,WAAW,IAAI,KAAK,CAAC,EAAE,OAAO,QAAyB;OAE5D,KAAKA,WAAW,OAAO,KAAK;CAEpC;;;;CAKA,qBAA2B;EACvB,KAAKA,WAAW,MAAM;CAC1B;AACJ"}

package/dist/utils/evm.js

@@ -1,6 +1,6 @@
 import { ConfigurationError } from "../shared/errors.js";
-import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils.js";
 import { keccak_256 } from "@noble/hashes/sha3.js";
+import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils.js";
 //#region src/utils/evm.ts
 const ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 /** Format-only address check (viem `isAddress(value, { strict: false })`). */
@@ -44,7 +44,7 @@ function evmUtf8ToHex(value) {
 }
 /** 0x-prefixed hex to bytes (viem `hexToBytes`); throws on malformed input. */
 function evmHexToBytes(value) {
-	if (!/^0x(?:[0-9a-fA-F]{2})*$/.test(value)) throw new ConfigurationError(`Invalid hex value: ${value}`);
+	if (!/^0x(?:[0-9a-fA-F]{2})*$/.test(value)) throw new ConfigurationError("Invalid hex value");
 	return hexToBytes(value.slice(2).toLowerCase());
 }
 //#endregion

package/dist/utils/evm.js.map

@@ -1 +1 @@
-{"version":3,"file":"evm.js","names":["nobleHexToBytes"],"sources":["../../src/utils/evm.ts"],"sourcesContent":["import { keccak_256 } from \"@noble/hashes/sha3.js\";\nimport { bytesToHex, hexToBytes as nobleHexToBytes, utf8ToBytes } from \"@noble/hashes/utils.js\";\nimport { ConfigurationError } from \"../shared/errors.js\";\n\n/**\n * Minimal EVM helpers backed by @noble/hashes.\n *\n * The SDK core previously imported these five utilities from viem. Rolldown\n * groups all shared viem modules into a single chunk, so those tiny static\n * imports forced viem's entire abi/actions graph (~270 KB emitted) into the\n * app shell and the server's eager exec path, even though everything heavy is\n * loaded lazily. Semantics mirror the viem calls they replaced:\n * `isAddress(x, { strict: false })`, `getAddress`, `keccak256`,\n * `stringToBytes`, `hexToBytes`.\n */\n\nexport type EvmHex = `0x${string}`;\n\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\n\n/** Format-only address check (viem `isAddress(value, { strict: false })`). */\nexport function isEvmAddress(value: string): value is EvmHex {\n    return ADDRESS_RE.test(value);\n}\n\n/**\n * viem `isAddress(value)` default-mode parity: format check plus EIP-55\n * checksum validation for any address that is not all-lowercase.\n */\nexport function isEvmAddressStrict(value: string): value is EvmHex {\n    if (!isEvmAddress(value)) return false;\n    const body = value.slice(2);\n    // viem only exempts all-lowercase addresses from checksum validation.\n    if (body === body.toLowerCase()) return true;\n    return checksumEvmAddress(value) === value;\n}\n\n/** EIP-55 checksummed address (viem `getAddress`); throws on invalid input. */\nexport function checksumEvmAddress(value: string): EvmHex {\n    if (!isEvmAddress(value)) {\n        throw new ConfigurationError(`Invalid EVM address: ${value}`);\n    }\n    const lower = value.slice(2).toLowerCase();\n    const hash = keccak_256(utf8ToBytes(lower));\n    let out = \"0x\";\n    for (let i = 0; i < 40; i++) {\n        const char = lower[i]!;\n        // Each hash byte covers two nibbles of the address.\n        const nibble = (hash[i >> 1]! >> (i % 2 === 0 ? 4 : 0)) & 0x0f;\n        out += nibble >= 8 ? char.toUpperCase() : char;\n    }\n    return out as EvmHex;\n}\n\n/** keccak-256 of raw bytes, hex-encoded (viem `keccak256(bytes)`). */\nexport function keccak256Hex(bytes: Uint8Array): EvmHex {\n    return `0x${bytesToHex(keccak_256(bytes))}`;\n}\n\n/** UTF-8 encode (viem `stringToBytes`). */\nexport function evmUtf8ToBytes(value: string): Uint8Array {\n    return utf8ToBytes(value);\n}\n\n/** UTF-8 string to 0x-prefixed hex (viem `stringToHex`). */\nexport function evmUtf8ToHex(value: string): EvmHex {\n    return `0x${bytesToHex(utf8ToBytes(value))}`;\n}\n\n/** 0x-prefixed hex to bytes (viem `hexToBytes`); throws on malformed input. */\nexport function evmHexToBytes(value: string): Uint8Array {\n    if (!/^0x(?:[0-9a-fA-F]{2})*$/.test(value)) {\n        throw new ConfigurationError(`Invalid hex value: ${value}`);\n    }\n    return nobleHexToBytes(value.slice(2).toLowerCase());\n}\n"],"mappings":";;;;AAkBA,MAAM,aAAa;;AAGnB,SAAgB,aAAa,OAAgC;CACzD,OAAO,WAAW,KAAK,KAAK;AAChC;;;;;AAMA,SAAgB,mBAAmB,OAAgC;CAC/D,IAAI,CAAC,aAAa,KAAK,GAAG,OAAO;CACjC,MAAM,OAAO,MAAM,MAAM,CAAC;CAE1B,IAAI,SAAS,KAAK,YAAY,GAAG,OAAO;CACxC,OAAO,mBAAmB,KAAK,MAAM;AACzC;;AAGA,SAAgB,mBAAmB,OAAuB;CACtD,IAAI,CAAC,aAAa,KAAK,GACnB,MAAM,IAAI,mBAAmB,wBAAwB,OAAO;CAEhE,MAAM,QAAQ,MAAM,MAAM,CAAC,CAAC,CAAC,YAAY;CACzC,MAAM,OAAO,WAAW,YAAY,KAAK,CAAC;CAC1C,IAAI,MAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;EACzB,MAAM,OAAO,MAAM;EAEnB,MAAM,SAAU,KAAK,KAAK,OAAQ,IAAI,MAAM,IAAI,IAAI,KAAM;EAC1D,OAAO,UAAU,IAAI,KAAK,YAAY,IAAI;CAC9C;CACA,OAAO;AACX;;AAGA,SAAgB,aAAa,OAA2B;CACpD,OAAO,KAAK,WAAW,WAAW,KAAK,CAAC;AAC5C;;AAGA,SAAgB,eAAe,OAA2B;CACtD,OAAO,YAAY,KAAK;AAC5B;;AAGA,SAAgB,aAAa,OAAuB;CAChD,OAAO,KAAK,WAAW,YAAY,KAAK,CAAC;AAC7C;;AAGA,SAAgB,cAAc,OAA2B;CACrD,IAAI,CAAC,0BAA0B,KAAK,KAAK,GACrC,MAAM,IAAI,mBAAmB,sBAAsB,OAAO;CAE9D,OAAOA,WAAgB,MAAM,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AACvD"}
+{"version":3,"file":"evm.js","names":["nobleHexToBytes"],"sources":["../../src/utils/evm.ts"],"sourcesContent":["import { keccak_256 } from \"@noble/hashes/sha3.js\";\nimport { bytesToHex, hexToBytes as nobleHexToBytes, utf8ToBytes } from \"@noble/hashes/utils.js\";\nimport { ConfigurationError } from \"../shared/errors.js\";\n\n/**\n * Minimal EVM helpers backed by @noble/hashes.\n *\n * The SDK core previously imported these five utilities from viem. Rolldown\n * groups all shared viem modules into a single chunk, so those tiny static\n * imports forced viem's entire abi/actions graph (~270 KB emitted) into the\n * app shell and the server's eager exec path, even though everything heavy is\n * loaded lazily. Semantics mirror the viem calls they replaced:\n * `isAddress(x, { strict: false })`, `getAddress`, `keccak256`,\n * `stringToBytes`, `hexToBytes`.\n */\n\nexport type EvmHex = `0x${string}`;\n\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\n\n/** Format-only address check (viem `isAddress(value, { strict: false })`). */\nexport function isEvmAddress(value: string): value is EvmHex {\n    return ADDRESS_RE.test(value);\n}\n\n/**\n * viem `isAddress(value)` default-mode parity: format check plus EIP-55\n * checksum validation for any address that is not all-lowercase.\n */\nexport function isEvmAddressStrict(value: string): value is EvmHex {\n    if (!isEvmAddress(value)) return false;\n    const body = value.slice(2);\n    // viem only exempts all-lowercase addresses from checksum validation.\n    if (body === body.toLowerCase()) return true;\n    return checksumEvmAddress(value) === value;\n}\n\n/** EIP-55 checksummed address (viem `getAddress`); throws on invalid input. */\nexport function checksumEvmAddress(value: string): EvmHex {\n    if (!isEvmAddress(value)) {\n        throw new ConfigurationError(`Invalid EVM address: ${value}`);\n    }\n    const lower = value.slice(2).toLowerCase();\n    const hash = keccak_256(utf8ToBytes(lower));\n    let out = \"0x\";\n    for (let i = 0; i < 40; i++) {\n        const char = lower[i]!;\n        // Each hash byte covers two nibbles of the address.\n        const nibble = (hash[i >> 1]! >> (i % 2 === 0 ? 4 : 0)) & 0x0f;\n        out += nibble >= 8 ? char.toUpperCase() : char;\n    }\n    return out as EvmHex;\n}\n\n/** keccak-256 of raw bytes, hex-encoded (viem `keccak256(bytes)`). */\nexport function keccak256Hex(bytes: Uint8Array): EvmHex {\n    return `0x${bytesToHex(keccak_256(bytes))}`;\n}\n\n/** UTF-8 encode (viem `stringToBytes`). */\nexport function evmUtf8ToBytes(value: string): Uint8Array {\n    return utf8ToBytes(value);\n}\n\n/** UTF-8 string to 0x-prefixed hex (viem `stringToHex`). */\nexport function evmUtf8ToHex(value: string): EvmHex {\n    return `0x${bytesToHex(utf8ToBytes(value))}`;\n}\n\n/** 0x-prefixed hex to bytes (viem `hexToBytes`); throws on malformed input. */\nexport function evmHexToBytes(value: string): Uint8Array {\n    if (!/^0x(?:[0-9a-fA-F]{2})*$/.test(value)) {\n        throw new ConfigurationError(\"Invalid hex value\");\n    }\n    return nobleHexToBytes(value.slice(2).toLowerCase());\n}\n"],"mappings":";;;;AAkBA,MAAM,aAAa;;AAGnB,SAAgB,aAAa,OAAgC;CACzD,OAAO,WAAW,KAAK,KAAK;AAChC;;;;;AAMA,SAAgB,mBAAmB,OAAgC;CAC/D,IAAI,CAAC,aAAa,KAAK,GAAG,OAAO;CACjC,MAAM,OAAO,MAAM,MAAM,CAAC;CAE1B,IAAI,SAAS,KAAK,YAAY,GAAG,OAAO;CACxC,OAAO,mBAAmB,KAAK,MAAM;AACzC;;AAGA,SAAgB,mBAAmB,OAAuB;CACtD,IAAI,CAAC,aAAa,KAAK,GACnB,MAAM,IAAI,mBAAmB,wBAAwB,OAAO;CAEhE,MAAM,QAAQ,MAAM,MAAM,CAAC,CAAC,CAAC,YAAY;CACzC,MAAM,OAAO,WAAW,YAAY,KAAK,CAAC;CAC1C,IAAI,MAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;EACzB,MAAM,OAAO,MAAM;EAEnB,MAAM,SAAU,KAAK,KAAK,OAAQ,IAAI,MAAM,IAAI,IAAI,KAAM;EAC1D,OAAO,UAAU,IAAI,KAAK,YAAY,IAAI;CAC9C;CACA,OAAO;AACX;;AAGA,SAAgB,aAAa,OAA2B;CACpD,OAAO,KAAK,WAAW,WAAW,KAAK,CAAC;AAC5C;;AAGA,SAAgB,eAAe,OAA2B;CACtD,OAAO,YAAY,KAAK;AAC5B;;AAGA,SAAgB,aAAa,OAAuB;CAChD,OAAO,KAAK,WAAW,YAAY,KAAK,CAAC;AAC7C;;AAGA,SAAgB,cAAc,OAA2B;CACrD,IAAI,CAAC,0BAA0B,KAAK,KAAK,GACrC,MAAM,IAAI,mBAAmB,mBAAmB;CAEpD,OAAOA,WAAgB,MAAM,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AACvD"}

package/dist/utils/jwt.d.ts

@@ -1,8 +1,8 @@
 //#region src/utils/jwt.d.ts
 /**
- * Checks whether a JWT is present, well formed, and not expired.
+ * Checks whether a value is a present, well-formed, unexpired JWT string.
  */
-declare function isJwtValid(token: string | null): token is string;
+declare function isJwtValid(token: unknown): token is string;
 //#endregion
 export { isJwtValid };
 //# sourceMappingURL=jwt.d.ts.map

package/dist/utils/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","names":[],"sources":["../../src/utils/jwt.ts"],"mappings":";;;;iBA6DgB,WAAW,uBAAuB"}
+{"version":3,"file":"jwt.d.ts","names":[],"sources":["../../src/utils/jwt.ts"],"mappings":";;;;iBA6DgB,WAAW,iBAAiB"}

package/dist/utils/jwt.js

@@ -49,10 +49,10 @@ function isJwtExpired(token) {
 	return exp < Math.floor(Date.now() / 1e3);
 }
 /**
-* Checks whether a JWT is present, well formed, and not expired.
+* Checks whether a value is a present, well-formed, unexpired JWT string.
 */
 function isJwtValid(token) {
-	if (!token) return false;
+	if (typeof token !== "string" || !token) return false;
 	if (!isJwt(token)) return false;
 	if (isJwtExpired(token)) return false;
 	return true;

package/dist/utils/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","names":[],"sources":["../../src/utils/jwt.ts"],"sourcesContent":["/**\n * Checks whether a string has the shape of a JWT.\n */\nexport function isJwt(token: string): boolean {\n    const parts = token.split(\".\");\n    return parts.length === 3 && !!parts[0] && !!parts[1] && !!parts[2];\n}\n\nlet textDecoder: TextDecoder | undefined;\n\n/**\n * Gets a TextDecoder instance.\n */\nfunction getTextDecoder(): TextDecoder {\n    textDecoder ??= new TextDecoder(\"utf-8\", { fatal: true });\n    return textDecoder;\n}\n\nfunction decodeBase64Url(value: string): string | null {\n    const remainder = value.length % 4;\n    if (remainder === 1) return null;\n\n    const base64 = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const paddedBase64 =\n        remainder === 0 ? base64 : base64.padEnd(base64.length + 4 - remainder, \"=\");\n    const binary = atob(paddedBase64);\n    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));\n    return getTextDecoder().decode(bytes);\n}\n\n/**\n * Reads a JWT expiration timestamp when present.\n */\nexport function getJwtExpiration(token: string): number | null {\n    try {\n        const [_, rawPayload] = token.split(\".\");\n        if (!rawPayload) return null;\n        const decodedPayload = decodeBase64Url(rawPayload);\n        if (!decodedPayload) return null;\n        const payload: unknown = JSON.parse(decodedPayload);\n        if (typeof payload !== \"object\" || payload === null) return null;\n        const exp = (payload as { exp?: unknown }).exp;\n        return typeof exp === \"number\" ? exp : null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Checks whether a JWT is expired.\n */\nexport function isJwtExpired(token: string): boolean {\n    const exp = getJwtExpiration(token);\n    if (exp === null) return true;\n    const currentTime = Math.floor(Date.now() / 1000);\n    return exp < currentTime;\n}\n\n/**\n * Checks whether a JWT is present, well formed, and not expired.\n */\nexport function isJwtValid(token: string | null): token is string {\n    if (!token) return false;\n    if (!isJwt(token)) return false;\n    if (isJwtExpired(token)) return false;\n    return true;\n}\n\n/**\n * Returns the number of milliseconds until the JWT expires.\n * Returns 0 if already expired or invalid.\n */\nexport function getJwtTimeToExpiry(token: string): number {\n    const exp = getJwtExpiration(token);\n    if (exp === null) return 0;\n    const nowMs = Date.now();\n    const expiresAtMs = exp * 1000;\n    return Math.max(0, expiresAtMs - nowMs);\n}\n"],"mappings":";;;;AAGA,SAAgB,MAAM,OAAwB;CAC1C,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OAAO,MAAM,WAAW,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM;AACrE;AAEA,IAAI;;;;AAKJ,SAAS,iBAA8B;CACnC,gBAAgB,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;CACxD,OAAO;AACX;AAEA,SAAS,gBAAgB,OAA8B;CACnD,MAAM,YAAY,MAAM,SAAS;CACjC,IAAI,cAAc,GAAG,OAAO;CAE5B,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACzD,MAAM,eACF,cAAc,IAAI,SAAS,OAAO,OAAO,OAAO,SAAS,IAAI,WAAW,GAAG;CAC/E,MAAM,SAAS,KAAK,YAAY;CAChC,MAAM,QAAQ,WAAW,KAAK,SAAS,cAAc,UAAU,WAAW,CAAC,CAAC;CAC5E,OAAO,eAAe,CAAC,CAAC,OAAO,KAAK;AACxC;;;;AAKA,SAAgB,iBAAiB,OAA8B;CAC3D,IAAI;EACA,MAAM,CAAC,GAAG,cAAc,MAAM,MAAM,GAAG;EACvC,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,iBAAiB,gBAAgB,UAAU;EACjD,IAAI,CAAC,gBAAgB,OAAO;EAC5B,MAAM,UAAmB,KAAK,MAAM,cAAc;EAClD,IAAI,OAAO,YAAY,YAAY,YAAY,MAAM,OAAO;EAC5D,MAAM,MAAO,QAA8B;EAC3C,OAAO,OAAO,QAAQ,WAAW,MAAM;CAC3C,QAAQ;EACJ,OAAO;CACX;AACJ;;;;AAKA,SAAgB,aAAa,OAAwB;CACjD,MAAM,MAAM,iBAAiB,KAAK;CAClC,IAAI,QAAQ,MAAM,OAAO;CAEzB,OAAO,MADa,KAAK,MAAM,KAAK,IAAI,IAAI,GACrB;AAC3B;;;;AAKA,SAAgB,WAAW,OAAuC;CAC9D,IAAI,CAAC,OAAO,OAAO;CACnB,IAAI,CAAC,MAAM,KAAK,GAAG,OAAO;CAC1B,IAAI,aAAa,KAAK,GAAG,OAAO;CAChC,OAAO;AACX;;;;;AAMA,SAAgB,mBAAmB,OAAuB;CACtD,MAAM,MAAM,iBAAiB,KAAK;CAClC,IAAI,QAAQ,MAAM,OAAO;CACzB,MAAM,QAAQ,KAAK,IAAI;CACvB,MAAM,cAAc,MAAM;CAC1B,OAAO,KAAK,IAAI,GAAG,cAAc,KAAK;AAC1C"}
+{"version":3,"file":"jwt.js","names":[],"sources":["../../src/utils/jwt.ts"],"sourcesContent":["/**\n * Checks whether a string has the shape of a JWT.\n */\nexport function isJwt(token: string): boolean {\n    const parts = token.split(\".\");\n    return parts.length === 3 && !!parts[0] && !!parts[1] && !!parts[2];\n}\n\nlet textDecoder: TextDecoder | undefined;\n\n/**\n * Gets a TextDecoder instance.\n */\nfunction getTextDecoder(): TextDecoder {\n    textDecoder ??= new TextDecoder(\"utf-8\", { fatal: true });\n    return textDecoder;\n}\n\nfunction decodeBase64Url(value: string): string | null {\n    const remainder = value.length % 4;\n    if (remainder === 1) return null;\n\n    const base64 = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const paddedBase64 =\n        remainder === 0 ? base64 : base64.padEnd(base64.length + 4 - remainder, \"=\");\n    const binary = atob(paddedBase64);\n    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));\n    return getTextDecoder().decode(bytes);\n}\n\n/**\n * Reads a JWT expiration timestamp when present.\n */\nexport function getJwtExpiration(token: string): number | null {\n    try {\n        const [_, rawPayload] = token.split(\".\");\n        if (!rawPayload) return null;\n        const decodedPayload = decodeBase64Url(rawPayload);\n        if (!decodedPayload) return null;\n        const payload: unknown = JSON.parse(decodedPayload);\n        if (typeof payload !== \"object\" || payload === null) return null;\n        const exp = (payload as { exp?: unknown }).exp;\n        return typeof exp === \"number\" ? exp : null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Checks whether a JWT is expired.\n */\nexport function isJwtExpired(token: string): boolean {\n    const exp = getJwtExpiration(token);\n    if (exp === null) return true;\n    const currentTime = Math.floor(Date.now() / 1000);\n    return exp < currentTime;\n}\n\n/**\n * Checks whether a value is a present, well-formed, unexpired JWT string.\n */\nexport function isJwtValid(token: unknown): token is string {\n    if (typeof token !== \"string\" || !token) return false;\n    if (!isJwt(token)) return false;\n    if (isJwtExpired(token)) return false;\n    return true;\n}\n\n/**\n * Returns the number of milliseconds until the JWT expires.\n * Returns 0 if already expired or invalid.\n */\nexport function getJwtTimeToExpiry(token: string): number {\n    const exp = getJwtExpiration(token);\n    if (exp === null) return 0;\n    const nowMs = Date.now();\n    const expiresAtMs = exp * 1000;\n    return Math.max(0, expiresAtMs - nowMs);\n}\n"],"mappings":";;;;AAGA,SAAgB,MAAM,OAAwB;CAC1C,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OAAO,MAAM,WAAW,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM;AACrE;AAEA,IAAI;;;;AAKJ,SAAS,iBAA8B;CACnC,gBAAgB,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;CACxD,OAAO;AACX;AAEA,SAAS,gBAAgB,OAA8B;CACnD,MAAM,YAAY,MAAM,SAAS;CACjC,IAAI,cAAc,GAAG,OAAO;CAE5B,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACzD,MAAM,eACF,cAAc,IAAI,SAAS,OAAO,OAAO,OAAO,SAAS,IAAI,WAAW,GAAG;CAC/E,MAAM,SAAS,KAAK,YAAY;CAChC,MAAM,QAAQ,WAAW,KAAK,SAAS,cAAc,UAAU,WAAW,CAAC,CAAC;CAC5E,OAAO,eAAe,CAAC,CAAC,OAAO,KAAK;AACxC;;;;AAKA,SAAgB,iBAAiB,OAA8B;CAC3D,IAAI;EACA,MAAM,CAAC,GAAG,cAAc,MAAM,MAAM,GAAG;EACvC,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,iBAAiB,gBAAgB,UAAU;EACjD,IAAI,CAAC,gBAAgB,OAAO;EAC5B,MAAM,UAAmB,KAAK,MAAM,cAAc;EAClD,IAAI,OAAO,YAAY,YAAY,YAAY,MAAM,OAAO;EAC5D,MAAM,MAAO,QAA8B;EAC3C,OAAO,OAAO,QAAQ,WAAW,MAAM;CAC3C,QAAQ;EACJ,OAAO;CACX;AACJ;;;;AAKA,SAAgB,aAAa,OAAwB;CACjD,MAAM,MAAM,iBAAiB,KAAK;CAClC,IAAI,QAAQ,MAAM,OAAO;CAEzB,OAAO,MADa,KAAK,MAAM,KAAK,IAAI,IAAI,GACrB;AAC3B;;;;AAKA,SAAgB,WAAW,OAAiC;CACxD,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO;CAChD,IAAI,CAAC,MAAM,KAAK,GAAG,OAAO;CAC1B,IAAI,aAAa,KAAK,GAAG,OAAO;CAChC,OAAO;AACX;;;;;AAMA,SAAgB,mBAAmB,OAAuB;CACtD,MAAM,MAAM,iBAAiB,KAAK;CAClC,IAAI,QAAQ,MAAM,OAAO;CACzB,MAAM,QAAQ,KAAK,IAAI;CACvB,MAAM,cAAc,MAAM;CAC1B,OAAO,KAAK,IAAI,GAAG,cAAc,KAAK;AAC1C"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@polyester/sdk",
-    "version": "0.3.1",
+    "version": "0.4.1",
     "private": false,
     "description": "TypeScript SDK providing access to APIs on Polyester Exchange.",
     "homepage": "https://github.com/Fabric-Labs/polyester-sdk-typescript#readme",
@@ -89,8 +89,8 @@
         "changeset": "changeset",
         "version-packages": "changeset version && bun install --lockfile-only",
         "release": "changeset publish",
-        "verify:package": "bun scripts/verify-package-exports.ts",
-        "ci": "bun run lint && bun run format:check && bun run check && bun run test && bun run build && bun run verify:package"
+        "verify:package": "bun run build && bun scripts/verify-package-exports.ts",
+        "ci": "bun run lint && bun run format:check && bun run check && bun run test && bun run verify:package"
     },
     "dependencies": {
         "@bufbuild/protobuf": "2.13.0",