@rei-standard/amsg-client 2.7.0 → 2.9.0-next.0

package/dist/index.cjs

@@ -36,7 +36,6 @@ module.exports = __toCommonJS(src_exports);
 var import_amsg_shared = require("@rei-standard/amsg-shared");
 var import_amsg_shared2 = require("@rei-standard/amsg-shared");
 var TEXT_ENCODER = new TextEncoder();
-var AVATAR_URL_MAX_LENGTH = 2048;
 function makeLocalError(code, message, details) {
   const err = new Error(`[rei-standard-amsg-client] ${message}`);
   err.code = code;
@@ -98,6 +97,7 @@ var ReiClient = class {
     this._userKey = null;
     this._instantEncryption = instantEncryption;
     this._instantClientToken = typeof config.instantClientToken === "string" && config.instantClientToken ? config.instantClientToken : "";
+    this._serverToken = typeof config.serverToken === "string" && config.serverToken ? config.serverToken : "";
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     this._lowLevelWarned = /* @__PURE__ */ new Set();
   }
@@ -111,6 +111,17 @@ var ReiClient = class {
   _resolveBaseUrl(endpointName) {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers["X-Client-Token"] = this._serverToken;
+    return headers;
+  }
   // ─── Initialisation ─────────────────────────────────────────────
   /**
    * Fetch the user-specific encryption key.
@@ -129,7 +140,7 @@ var ReiClient = class {
     }
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: "GET",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     const json = await res.json();
     if (!json.success) throw new Error(json.error?.message || "Failed to fetch user key");
@@ -166,12 +177,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: "POST",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -509,12 +520,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: "PUT",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -528,7 +539,7 @@ var ReiClient = class {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: "DELETE",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     return res.json();
   }
@@ -550,11 +561,11 @@ var ReiClient = class {
     const url = `${this._baseUrl}/messages${qs ? "?" + qs : ""}`;
     const res = await fetch(url, {
       method: "GET",
-      headers: {
+      headers: this._withServerToken({
         "X-User-Id": this._userId,
         "X-Response-Encrypted": "true",
         "X-Encryption-Version": "1"
-      }
+      })
     });
     const json = await res.json();
     if (!json?.success || json?.encrypted !== true) return json;
@@ -597,16 +608,7 @@ var ReiClient = class {
    */
   _sanitizeAvatarUrl(target) {
     if (!target || typeof target !== "object") return false;
-    const value = target.avatarUrl;
-    if (value === void 0 || value === null) return false;
-    let reason = null;
-    if (typeof value !== "string") {
-      reason = "avatarUrl \u5FC5\u987B\u662F\u5B57\u7B26\u4E32";
-    } else if (/^data:/i.test(value)) {
-      reason = "\u5934\u50CF\u4E0D\u652F\u6301\u4F20\u5165 data: URI\uFF0C\u8BF7\u6539\u4E3A\u516C\u7F51\u53EF\u8BBF\u95EE\u7684 https:// \u56FE\u7247 URL";
-    } else if (value.length > AVATAR_URL_MAX_LENGTH) {
-      reason = `\u5934\u50CF URL \u957F\u5EA6 ${value.length} \u5B57\u7B26\u8D85\u8FC7 ${AVATAR_URL_MAX_LENGTH} \u4E0A\u9650\uFF0C\u8BF7\u6539\u4E3A\u66F4\u77ED\u7684\u56FE\u7247 URL`;
-    }
+    const reason = (0, import_amsg_shared.validateAvatarUrl)(target.avatarUrl);
     if (reason) {
       console.warn("[rei-standard-amsg-client] avatarUrl \u4E0D\u5408\u6CD5\uFF0C\u5DF2\u7F6E\u7A7A\uFF1A", reason);
       target.avatarUrl = null;
@@ -695,7 +697,8 @@ var ReiClient = class {
       err.status = res.status;
       throw err;
     }
-    const contentType = res.headers.get("content-type") || "";
+    const rawContentType = res.headers.get("content-type");
+    const contentType = rawContentType || "";
     const kind = classifyContentType(contentType);
     if (kind === "sse") {
       if (!res.body) throw new Error("Response body is null");
@@ -705,7 +708,7 @@ var ReiClient = class {
         responseMeta: {
           status: res.status,
           contentEncoding: res.headers.get("content-encoding"),
-          contentType: res.headers.get("content-type")
+          contentType: rawContentType
         }
       });
       return { kind: "sse" };

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { base64UrlToBytes } from '@rei-standard/amsg-shared';
+import { base64UrlToBytes, validateAvatarUrl } from '@rei-standard/amsg-shared';
 export { MESSAGE_KIND, MESSAGE_TYPE, PUSH_SOURCE, buildContentPush, buildErrorPush, buildReasoningPush, buildToolRequestPush, isContentPush, isErrorPush, isReasoningPush, isToolRequestPush } from '@rei-standard/amsg-shared';
 
 /**
@@ -75,6 +75,11 @@ const TEXT_ENCODER = new TextEncoder();
  *                                                         inside any frontend bundle that uses it, so
  *                                                         devtools can read it. Use for casual URL-direct
  *                                                         abuse only.
+ * @property {string} [serverToken]                       - Optional shared secret for a single-user amsg-server.
+ *                                                         When set, sent as the `X-Client-Token` header on
+ *                                                         amsg-server endpoints (schedule / messages / update /
+ *                                                         cancel / user-key / init). Not applied to the instant
+ *                                                         path (that uses `instantClientToken`).
  * @property {number|null} [maxPayloadBytes=null]        - Optional local UTF-8 byte cap for outgoing request
  *                                                         payloads before encryption. `null` / omitted means
  *                                                         no SDK-level request-size limit.
@@ -231,14 +236,6 @@ const TEXT_ENCODER = new TextEncoder();
  * @property {number}  [status]                 - `res.status`. First call only.
  */
 
-/**
- * Max length of `avatarUrl` accepted by local preflight (2 KB). Mirrors
- * `@rei-standard/amsg-instant` / `@rei-standard/amsg-server` server-side
- * limits — kept in lockstep on purpose so client-side rejects match what
- * the server would reject.
- */
-const AVATAR_URL_MAX_LENGTH = 2048;
-
 function makeLocalError(code, message, details) {
   const err = new Error(`[rei-standard-amsg-client] ${message}`);
   err.code = code;
@@ -375,6 +372,10 @@ class ReiClient {
       ? config.instantClientToken
       : '';
     /** @private */
+    this._serverToken = typeof config.serverToken === 'string' && config.serverToken
+      ? config.serverToken
+      : '';
+    /** @private */
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     /**
      * Per-instance latch (set of method names already warned). The
@@ -395,6 +396,18 @@ class ReiClient {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
 
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers['X-Client-Token'] = this._serverToken;
+    return headers;
+  }
+
   // ─── Initialisation ─────────────────────────────────────────────
 
   /**
@@ -415,7 +428,7 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: 'GET',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     const json = await res.json();
@@ -458,12 +471,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: 'POST',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -891,12 +904,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: 'PUT',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -912,7 +925,7 @@ class ReiClient {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: 'DELETE',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     return res.json();
@@ -938,11 +951,11 @@ class ReiClient {
 
     const res = await fetch(url, {
       method: 'GET',
-      headers: {
+      headers: this._withServerToken({
         'X-User-Id': this._userId,
         'X-Response-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      }
+      })
     });
 
     const json = await res.json();
@@ -991,16 +1004,7 @@ class ReiClient {
    */
   _sanitizeAvatarUrl(target) {
     if (!target || typeof target !== 'object') return false;
-    const value = target.avatarUrl;
-    if (value === undefined || value === null) return false;
-    let reason = null;
-    if (typeof value !== 'string') {
-      reason = 'avatarUrl 必须是字符串';
-    } else if (/^data:/i.test(value)) {
-      reason = '头像不支持传入 data: URI，请改为公网可访问的 https:// 图片 URL';
-    } else if (value.length > AVATAR_URL_MAX_LENGTH) {
-      reason = `头像 URL 长度 ${value.length} 字符超过 ${AVATAR_URL_MAX_LENGTH} 上限，请改为更短的图片 URL`;
-    }
+    const reason = validateAvatarUrl(target.avatarUrl);
     if (reason) {
       console.warn('[rei-standard-amsg-client] avatarUrl 不合法，已置空：', reason);
       target.avatarUrl = null;
@@ -1105,7 +1109,8 @@ class ReiClient {
       throw err;
     }
 
-    const contentType = res.headers.get('content-type') || '';
+    const rawContentType = res.headers.get('content-type');
+    const contentType = rawContentType || '';
     const kind = classifyContentType(contentType);
     if (kind === 'sse') {
       if (!res.body) throw new Error('Response body is null');
@@ -1115,7 +1120,7 @@ class ReiClient {
         responseMeta: {
           status: res.status,
           contentEncoding: res.headers.get('content-encoding'),
-          contentType: res.headers.get('content-type'),
+          contentType: rawContentType,
         },
       });
       return { kind: 'sse' };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { base64UrlToBytes } from '@rei-standard/amsg-shared';
+import { base64UrlToBytes, validateAvatarUrl } from '@rei-standard/amsg-shared';
 export { MESSAGE_KIND, MESSAGE_TYPE, PUSH_SOURCE, buildContentPush, buildErrorPush, buildReasoningPush, buildToolRequestPush, isContentPush, isErrorPush, isReasoningPush, isToolRequestPush } from '@rei-standard/amsg-shared';
 
 /**
@@ -75,6 +75,11 @@ const TEXT_ENCODER = new TextEncoder();
  *                                                         inside any frontend bundle that uses it, so
  *                                                         devtools can read it. Use for casual URL-direct
  *                                                         abuse only.
+ * @property {string} [serverToken]                       - Optional shared secret for a single-user amsg-server.
+ *                                                         When set, sent as the `X-Client-Token` header on
+ *                                                         amsg-server endpoints (schedule / messages / update /
+ *                                                         cancel / user-key / init). Not applied to the instant
+ *                                                         path (that uses `instantClientToken`).
  * @property {number|null} [maxPayloadBytes=null]        - Optional local UTF-8 byte cap for outgoing request
  *                                                         payloads before encryption. `null` / omitted means
  *                                                         no SDK-level request-size limit.
@@ -231,14 +236,6 @@ const TEXT_ENCODER = new TextEncoder();
  * @property {number}  [status]                 - `res.status`. First call only.
  */
 
-/**
- * Max length of `avatarUrl` accepted by local preflight (2 KB). Mirrors
- * `@rei-standard/amsg-instant` / `@rei-standard/amsg-server` server-side
- * limits — kept in lockstep on purpose so client-side rejects match what
- * the server would reject.
- */
-const AVATAR_URL_MAX_LENGTH = 2048;
-
 function makeLocalError(code, message, details) {
   const err = new Error(`[rei-standard-amsg-client] ${message}`);
   err.code = code;
@@ -375,6 +372,10 @@ class ReiClient {
       ? config.instantClientToken
       : '';
     /** @private */
+    this._serverToken = typeof config.serverToken === 'string' && config.serverToken
+      ? config.serverToken
+      : '';
+    /** @private */
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     /**
      * Per-instance latch (set of method names already warned). The
@@ -395,6 +396,18 @@ class ReiClient {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
 
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers['X-Client-Token'] = this._serverToken;
+    return headers;
+  }
+
   // ─── Initialisation ─────────────────────────────────────────────
 
   /**
@@ -415,7 +428,7 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: 'GET',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     const json = await res.json();
@@ -458,12 +471,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: 'POST',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -891,12 +904,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: 'PUT',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -912,7 +925,7 @@ class ReiClient {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: 'DELETE',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     return res.json();
@@ -938,11 +951,11 @@ class ReiClient {
 
     const res = await fetch(url, {
       method: 'GET',
-      headers: {
+      headers: this._withServerToken({
         'X-User-Id': this._userId,
         'X-Response-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      }
+      })
     });
 
     const json = await res.json();
@@ -991,16 +1004,7 @@ class ReiClient {
    */
   _sanitizeAvatarUrl(target) {
     if (!target || typeof target !== 'object') return false;
-    const value = target.avatarUrl;
-    if (value === undefined || value === null) return false;
-    let reason = null;
-    if (typeof value !== 'string') {
-      reason = 'avatarUrl 必须是字符串';
-    } else if (/^data:/i.test(value)) {
-      reason = '头像不支持传入 data: URI，请改为公网可访问的 https:// 图片 URL';
-    } else if (value.length > AVATAR_URL_MAX_LENGTH) {
-      reason = `头像 URL 长度 ${value.length} 字符超过 ${AVATAR_URL_MAX_LENGTH} 上限，请改为更短的图片 URL`;
-    }
+    const reason = validateAvatarUrl(target.avatarUrl);
     if (reason) {
       console.warn('[rei-standard-amsg-client] avatarUrl 不合法，已置空：', reason);
       target.avatarUrl = null;
@@ -1105,7 +1109,8 @@ class ReiClient {
       throw err;
     }
 
-    const contentType = res.headers.get('content-type') || '';
+    const rawContentType = res.headers.get('content-type');
+    const contentType = rawContentType || '';
     const kind = classifyContentType(contentType);
     if (kind === 'sse') {
       if (!res.body) throw new Error('Response body is null');
@@ -1115,7 +1120,7 @@ class ReiClient {
         responseMeta: {
           status: res.status,
           contentEncoding: res.headers.get('content-encoding'),
-          contentType: res.headers.get('content-type'),
+          contentType: rawContentType,
         },
       });
       return { kind: 'sse' };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 // src/index.js
-import { base64UrlToBytes } from "@rei-standard/amsg-shared";
+import { base64UrlToBytes, validateAvatarUrl } from "@rei-standard/amsg-shared";
 import {
   MESSAGE_KIND,
   MESSAGE_TYPE,
@@ -14,7 +14,6 @@ import {
   isErrorPush
 } from "@rei-standard/amsg-shared";
 var TEXT_ENCODER = new TextEncoder();
-var AVATAR_URL_MAX_LENGTH = 2048;
 function makeLocalError(code, message, details) {
   const err = new Error(`[rei-standard-amsg-client] ${message}`);
   err.code = code;
@@ -76,6 +75,7 @@ var ReiClient = class {
     this._userKey = null;
     this._instantEncryption = instantEncryption;
     this._instantClientToken = typeof config.instantClientToken === "string" && config.instantClientToken ? config.instantClientToken : "";
+    this._serverToken = typeof config.serverToken === "string" && config.serverToken ? config.serverToken : "";
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     this._lowLevelWarned = /* @__PURE__ */ new Set();
   }
@@ -89,6 +89,17 @@ var ReiClient = class {
   _resolveBaseUrl(endpointName) {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers["X-Client-Token"] = this._serverToken;
+    return headers;
+  }
   // ─── Initialisation ─────────────────────────────────────────────
   /**
    * Fetch the user-specific encryption key.
@@ -107,7 +118,7 @@ var ReiClient = class {
     }
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: "GET",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     const json = await res.json();
     if (!json.success) throw new Error(json.error?.message || "Failed to fetch user key");
@@ -144,12 +155,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: "POST",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -487,12 +498,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: "PUT",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -506,7 +517,7 @@ var ReiClient = class {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: "DELETE",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     return res.json();
   }
@@ -528,11 +539,11 @@ var ReiClient = class {
     const url = `${this._baseUrl}/messages${qs ? "?" + qs : ""}`;
     const res = await fetch(url, {
       method: "GET",
-      headers: {
+      headers: this._withServerToken({
         "X-User-Id": this._userId,
         "X-Response-Encrypted": "true",
         "X-Encryption-Version": "1"
-      }
+      })
     });
     const json = await res.json();
     if (!json?.success || json?.encrypted !== true) return json;
@@ -575,16 +586,7 @@ var ReiClient = class {
    */
   _sanitizeAvatarUrl(target) {
     if (!target || typeof target !== "object") return false;
-    const value = target.avatarUrl;
-    if (value === void 0 || value === null) return false;
-    let reason = null;
-    if (typeof value !== "string") {
-      reason = "avatarUrl \u5FC5\u987B\u662F\u5B57\u7B26\u4E32";
-    } else if (/^data:/i.test(value)) {
-      reason = "\u5934\u50CF\u4E0D\u652F\u6301\u4F20\u5165 data: URI\uFF0C\u8BF7\u6539\u4E3A\u516C\u7F51\u53EF\u8BBF\u95EE\u7684 https:// \u56FE\u7247 URL";
-    } else if (value.length > AVATAR_URL_MAX_LENGTH) {
-      reason = `\u5934\u50CF URL \u957F\u5EA6 ${value.length} \u5B57\u7B26\u8D85\u8FC7 ${AVATAR_URL_MAX_LENGTH} \u4E0A\u9650\uFF0C\u8BF7\u6539\u4E3A\u66F4\u77ED\u7684\u56FE\u7247 URL`;
-    }
+    const reason = validateAvatarUrl(target.avatarUrl);
     if (reason) {
       console.warn("[rei-standard-amsg-client] avatarUrl \u4E0D\u5408\u6CD5\uFF0C\u5DF2\u7F6E\u7A7A\uFF1A", reason);
       target.avatarUrl = null;
@@ -673,7 +675,8 @@ var ReiClient = class {
       err.status = res.status;
       throw err;
     }
-    const contentType = res.headers.get("content-type") || "";
+    const rawContentType = res.headers.get("content-type");
+    const contentType = rawContentType || "";
     const kind = classifyContentType(contentType);
     if (kind === "sse") {
       if (!res.body) throw new Error("Response body is null");
@@ -683,7 +686,7 @@ var ReiClient = class {
         responseMeta: {
           status: res.status,
           contentEncoding: res.headers.get("content-encoding"),
-          contentType: res.headers.get("content-type")
+          contentType: rawContentType
         }
       });
       return { kind: "sse" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rei-standard/amsg-client",
-  "version": "2.7.0",
+  "version": "2.9.0-next.0",
   "description": "ReiStandard Active Messaging browser client SDK — also re-exports shared push types, builders, and guards from @rei-standard/amsg-shared",
   "repository": {
     "type": "git",
@@ -33,7 +33,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@rei-standard/amsg-shared": "0.2.0"
+    "@rei-standard/amsg-shared": "^0.3.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0",