@pymthouse/builder-sdk 0.4.3 → 0.4.5

package/dist/errors-C9-V_zSi.d.cts

@@ -0,0 +1,13 @@
+declare class PmtHouseError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: unknown;
+    constructor(message: string, { status, code, details, }?: {
+        status?: number;
+        code?: string;
+        details?: unknown;
+    });
+}
+declare function toPmtHouseError(error: unknown, fallbackMessage: string): PmtHouseError;
+
+export { PmtHouseError as P, toPmtHouseError as t };

package/dist/errors-C9-V_zSi.d.ts

@@ -0,0 +1,13 @@
+declare class PmtHouseError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: unknown;
+    constructor(message: string, { status, code, details, }?: {
+        status?: number;
+        code?: string;
+        details?: unknown;
+    });
+}
+declare function toPmtHouseError(error: unknown, fallbackMessage: string): PmtHouseError;
+
+export { PmtHouseError as P, toPmtHouseError as t };

package/dist/{index-D5wdxNYy.d.cts → index-M0tsyotJ.d.cts}

@@ -1,5 +1,5 @@
-import { F as FetchLike } from './types-BORaHW_x.cjs';
-import { U as UsageIdentity, P as PaymentWebhookRequest, V as VerifiedEndUserAuth, E as EndUserAuthVerifier } from './verifier-Be9WAjFF.cjs';
+import { F as FetchLike } from './types-CcP67AZm.cjs';
+import { U as UsageIdentity, P as PaymentWebhookRequest, V as VerifiedEndUserAuth, E as EndUserAuthVerifier } from './verifier-D8z3spC0.cjs';
 import { TrustedHeadersEndUserAuthConfig } from './signer/webhook/adapters/trusted-headers.cjs';
 
 type WebhookIdentityClaimMapping = {

package/dist/{index-DFJ6qcK0.d.ts → index-rC8smShg.d.ts}

@@ -1,5 +1,5 @@
-import { F as FetchLike } from './types-BORaHW_x.js';
-import { U as UsageIdentity, P as PaymentWebhookRequest, V as VerifiedEndUserAuth, E as EndUserAuthVerifier } from './verifier-Be9WAjFF.js';
+import { F as FetchLike } from './types-CcP67AZm.js';
+import { U as UsageIdentity, P as PaymentWebhookRequest, V as VerifiedEndUserAuth, E as EndUserAuthVerifier } from './verifier-D8z3spC0.js';
 import { TrustedHeadersEndUserAuthConfig } from './signer/webhook/adapters/trusted-headers.js';
 
 type WebhookIdentityClaimMapping = {

package/dist/index.cjs

@@ -338,6 +338,32 @@ var init_mint_token = __esm({
   }
 });
 
+// src/signer/direct-signer.ts
+function assertDirectSignerBaseUrl(signerBaseUrl) {
+  let parsed;
+  try {
+    parsed = new URL(signerBaseUrl.trim());
+  } catch {
+    throw new exports.PmtHouseError("signer URL must be an absolute http(s) URL", {
+      status: 400,
+      code: "invalid_signer_url"
+    });
+  }
+  const pathname = stripTrailingSlashes(parsed.pathname);
+  if (pathname === "/api/signer" || pathname.startsWith("/api/signer/")) {
+    throw new exports.PmtHouseError(
+      "signer URL must be the remote signer DMZ base, not a dashboard /api/signer/* proxy path. Exchange at the platform facade, then call signer endpoints directly using signerUrl from the exchange response.",
+      { status: 400, code: "invalid_signer_url" }
+    );
+  }
+}
+var init_direct_signer = __esm({
+  "src/signer/direct-signer.ts"() {
+    init_string_utils();
+    init_errors();
+  }
+});
+
 // src/signer/device-exchange.ts
 function extractSignerAccessTokenFromExchangeBody(body) {
   const tokenObj = body.token;
@@ -570,6 +596,9 @@ async function exchangeApiKeyForSigner(options) {
   const accessToken = extractSignerAccessTokenFromExchangeBody(parsed);
   const signerUrlRaw = parsed.signerUrl ?? parsed.signer_url;
   const signerUrl = typeof signerUrlRaw === "string" && signerUrlRaw.trim() ? signerUrlRaw.trim() : void 0;
+  if (signerUrl) {
+    assertDirectSignerBaseUrl(signerUrl);
+  }
   return normalizeDeviceExchangeResponse(
     {
       access_token: accessToken,
@@ -632,6 +661,7 @@ var init_api_key_exchange = __esm({
     init_fetch_json();
     init_handler_errors();
     init_device_exchange();
+    init_direct_signer();
     EXCHANGE_RESPONSE_ERROR2 = "invalid_exchange_response";
   }
 });
@@ -1340,8 +1370,14 @@ var PmtHouseClient = class {
     });
   }
   /**
-   * Exchange a dashboard API key for a signer session via a trusted facade (recommended)
-   * or directly when M2M credentials are available on this client.
+   * Exchange a dashboard API key for a short-lived signer JWT via a trusted facade.
+   *
+   * `facadeUrl` is used only for `POST {facadeUrl}/api/pymthouse/keys/exchange`.
+   * After exchange, call signer RPCs directly at `signerUrl` from the response
+   * (e.g. `{signerUrl}/sign-orchestrator-info`), not via dashboard `/api/signer/*`.
+   *
+   * When M2M credentials are available on this client, omit `facadeUrl` to exchange
+   * directly against the PymtHouse issuer.
    */
   async exchangeApiKeyForSignerSession(input) {
     if (input.facadeUrl?.trim()) {
@@ -1358,7 +1394,8 @@ var PmtHouseClient = class {
         token_type: exchanged.token_type,
         expires_in: exchanged.expires_in,
         scope: exchanged.scope,
-        issued_token_type: "urn:ietf:params:oauth:token-type:access_token"
+        issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
+        signerUrl: exchanged.signerUrl
       };
     }
     const userToken = await this.exchangeApiKeyForUserAccessToken({