@settlemint/dalp-sdk 3.1.10 → 3.1.11-main.33538712635

package/dist/chunk-cy9b59s6.js

@@ -0,0 +1,503 @@
+import {
+  createClient
+} from "./chunk-w21k7p99.js";
+import {
+  Secret,
+  normalizeDalpBaseUrl,
+  secret,
+  unwrapSecret
+} from "./chunk-h12fatty.js";
+import {
+  createDalpSdkConfigurationError
+} from "./chunk-y0d2c7kp.js";
+
+// src/client/conditional-request.ts
+var IF_NONE_MATCH = "If-None-Match";
+var CONDITIONAL_RESPONSE_STORE_CAPACITY = 64;
+var CONDITIONAL_RESPONSE_MAX_BODY_BYTES = 1048576;
+var IDENTITY_RESET_PATH_SUFFIXES = [
+  "/api/auth/sign-out",
+  "/api/auth/revoke-session",
+  "/api/auth/revoke-sessions",
+  "/api/auth/revoke-other-sessions",
+  "/api/auth/organization/set-active"
+];
+var states = new WeakMap;
+var headerOrDefault = (headers, name) => headers.get(name)?.trim() || "default";
+var tenantOf = (headers) => `${headerOrDefault(headers, "X-Organization-Id")}\x00${headerOrDefault(headers, "X-Participant")}`;
+var resourceKey = (request) => {
+  const url = new URL(request.url);
+  return `${url.origin}${url.pathname}${url.search}\x00${tenantOf(request.headers)}`;
+};
+var isIdentityResetPath = (url) => {
+  const path = new URL(url).pathname;
+  return IDENTITY_RESET_PATH_SUFFIXES.some((suffix) => path === suffix || path.endsWith(suffix));
+};
+var isEventStream = (response) => (response.headers.get("content-type") ?? "").includes("text/event-stream");
+var stateFor = (client) => {
+  const existing = states.get(client);
+  if (existing !== undefined) {
+    return existing;
+  }
+  const created = { store: new Map, lastIdentity: undefined };
+  states.set(client, created);
+  return created;
+};
+var remember = (store, key, entry) => {
+  store.delete(key);
+  store.set(key, entry);
+  if (store.size > CONDITIONAL_RESPONSE_STORE_CAPACITY) {
+    const oldest = store.keys().next().value;
+    if (oldest !== undefined) {
+      store.delete(oldest);
+    }
+  }
+};
+var touch = (store, key) => {
+  const entry = store.get(key);
+  if (entry === undefined) {
+    return;
+  }
+  store.delete(key);
+  store.set(key, entry);
+  return entry;
+};
+function clearConditionalRequestStore(client) {
+  const state = states.get(client);
+  if (state === undefined) {
+    return;
+  }
+  state.store.clear();
+  state.lastIdentity = undefined;
+}
+var clientFetch = (client, request) => {
+  const fetchImpl = client.getConfig().fetch ?? globalThis.fetch;
+  return fetchImpl(request);
+};
+var requestWithoutIfNoneMatch = (request) => {
+  const headers = new Headers;
+  for (const [name, value] of request.headers.entries()) {
+    if (name.toLowerCase() !== IF_NONE_MATCH.toLowerCase()) {
+      headers.append(name, value);
+    }
+  }
+  return new Request(request.url, {
+    method: request.method,
+    headers,
+    signal: request.signal,
+    credentials: request.credentials,
+    redirect: request.redirect
+  });
+};
+async function captureSuccessfulGet(store, key, response) {
+  if (!response.ok || isEventStream(response)) {
+    return response;
+  }
+  const etag = response.headers.get("etag")?.trim();
+  if (etag === undefined || etag.length === 0) {
+    store.delete(key);
+    return response;
+  }
+  const body = new Uint8Array(await response.arrayBuffer());
+  const headers = new Headers(response.headers);
+  headers.set("etag", etag);
+  if (body.byteLength <= CONDITIONAL_RESPONSE_MAX_BODY_BYTES) {
+    remember(store, key, { body, etag, headers });
+  }
+  return new Response(body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText
+  });
+}
+function installConditionalRequestInterceptors(client) {
+  const state = stateFor(client);
+  const syncIdentity = (headers) => {
+    const identity = tenantOf(headers);
+    if (state.lastIdentity !== undefined && identity !== state.lastIdentity) {
+      state.store.clear();
+    }
+    state.lastIdentity = identity;
+  };
+  client.interceptors.request.use((request) => {
+    syncIdentity(request.headers);
+    if (request.method !== "GET" || request.headers.has(IF_NONE_MATCH)) {
+      return request;
+    }
+    const entry = touch(state.store, resourceKey(request));
+    if (entry === undefined) {
+      return request;
+    }
+    const headers = new Headers(request.headers);
+    headers.set(IF_NONE_MATCH, entry.etag);
+    return new Request(request, { headers });
+  });
+  client.interceptors.response.use(async (response, request) => {
+    if (isIdentityResetPath(request.url) && response.ok) {
+      state.store.clear();
+      state.lastIdentity = undefined;
+      return response;
+    }
+    if (request.method !== "GET") {
+      return response;
+    }
+    const key = resourceKey(request);
+    if (response.status === 304) {
+      const entry = touch(state.store, key);
+      if (entry === undefined) {
+        const retried = await clientFetch(client, requestWithoutIfNoneMatch(request));
+        if (retried.status === 304) {
+          return retried;
+        }
+        return captureSuccessfulGet(state.store, key, retried);
+      }
+      return new Response(new Uint8Array(entry.body), {
+        status: 200,
+        statusText: "OK",
+        headers: entry.headers
+      });
+    }
+    return captureSuccessfulGet(state.store, key, response);
+  });
+}
+
+// src/client/query-serializer.ts
+function appendQueryValue(search, path, value) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (value instanceof Date) {
+    search.append(path, value.toISOString());
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) {
+      const itemPath = typeof item === "object" && item !== null ? `${path}[${String(index)}]` : path;
+      appendQueryValue(search, itemPath, item);
+    }
+    return;
+  }
+  if (typeof value === "object") {
+    for (const [key, item] of Object.entries(value)) {
+      appendQueryValue(search, `${path}[${key}]`, item);
+    }
+    return;
+  }
+  search.append(path, String(value));
+}
+function serializeDalpQuery(query) {
+  const search = new URLSearchParams;
+  if (typeof query === "object" && query !== null) {
+    for (const [key, value] of Object.entries(query)) {
+      appendQueryValue(search, key, value);
+    }
+  }
+  return search.toString();
+}
+
+// src/client/request-compression.ts
+var DALP_SDK_REQUEST_COMPRESSION_MIN_BODY_BYTES = 1024;
+var DALP_SDK_REQUEST_COMPRESSION_MAX_BODY_BYTES = 16777216;
+var NO_BODY_METHODS = new Set(["GET", "HEAD"]);
+function bufferedBodySize(body) {
+  if (typeof body === "string") {
+    return Buffer.byteLength(body);
+  }
+  if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {
+    return body.byteLength;
+  }
+  if (body instanceof Blob) {
+    return body.size;
+  }
+  return;
+}
+function isCompressibleMediaType(contentType) {
+  const mediaType = contentType?.split(";")[0]?.trim().toLowerCase();
+  if (mediaType === undefined || mediaType === "") {
+    return false;
+  }
+  return mediaType === "application/json" || mediaType.endsWith("+json") || mediaType.startsWith("text/");
+}
+async function cancelReaderBestEffort(reader) {
+  try {
+    await reader.cancel();
+  } catch {}
+}
+async function readRequestBodyWithinCap(request, maxBodyBytes) {
+  let body;
+  try {
+    const { body: clonedBody } = request.clone();
+    body = clonedBody;
+  } catch {
+    return;
+  }
+  if (body === null) {
+    return Buffer.alloc(0);
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) {
+        return Buffer.concat(chunks, totalBytes);
+      }
+      totalBytes += next.value.byteLength;
+      if (totalBytes > maxBodyBytes) {
+        cancelReaderBestEffort(reader);
+        return;
+      }
+      chunks.push(next.value);
+    }
+  } catch {
+    return;
+  } finally {
+    reader.releaseLock();
+  }
+}
+function withRequestBodyCompression(fetchImpl, options) {
+  const minBodyBytes = options?.minBodyBytes ?? DALP_SDK_REQUEST_COMPRESSION_MIN_BODY_BYTES;
+  const maxBodyBytes = options?.maxBodyBytes ?? DALP_SDK_REQUEST_COMPRESSION_MAX_BODY_BYTES;
+  const requestCompressionFetch = async (input, init) => {
+    if (init?.compress !== undefined) {
+      return fetchImpl(input, init);
+    }
+    let request;
+    if (input instanceof Request) {
+      request = init === undefined ? input : new Request(input, init);
+    }
+    const method = (request?.method ?? init?.method ?? "GET").toUpperCase();
+    if (NO_BODY_METHODS.has(method)) {
+      return fetchImpl(input, init);
+    }
+    const headers = new Headers(request?.headers ?? init?.headers);
+    if (headers.get("content-encoding") !== null) {
+      return fetchImpl(input, init);
+    }
+    let compress;
+    let bufferedRequestBody;
+    if (request !== undefined && request.body !== null && isCompressibleMediaType(headers.get("content-type"))) {
+      bufferedRequestBody = await readRequestBodyWithinCap(request, maxBodyBytes);
+      if (bufferedRequestBody !== undefined && bufferedRequestBody.byteLength >= minBodyBytes) {
+        compress = "gzip";
+      }
+    } else if (init?.body !== null && init?.body !== undefined) {
+      const size = bufferedBodySize(init.body);
+      if (size !== undefined && size >= minBodyBytes && size <= maxBodyBytes) {
+        compress = "gzip";
+      }
+    }
+    if (compress === undefined) {
+      return fetchImpl(input, init);
+    }
+    if (request !== undefined && bufferedRequestBody !== undefined) {
+      return fetchImpl(request.url, {
+        ...init,
+        body: bufferedRequestBody,
+        cache: init?.cache ?? request.cache,
+        compress,
+        credentials: init?.credentials ?? request.credentials,
+        headers: request.headers,
+        integrity: init?.integrity ?? request.integrity,
+        keepalive: init?.keepalive ?? request.keepalive,
+        method: request.method,
+        mode: init?.mode ?? request.mode,
+        redirect: init?.redirect ?? request.redirect,
+        referrer: init?.referrer ?? request.referrer,
+        referrerPolicy: init?.referrerPolicy ?? request.referrerPolicy,
+        signal: init?.signal ?? request.signal
+      });
+    }
+    return fetchImpl(input, { ...init, compress });
+  };
+  return Object.assign(requestCompressionFetch, {
+    preconnect: fetchImpl.preconnect
+  });
+}
+
+// src/client/ssr-fetch.ts
+class DalpSsrSecurityError extends Error {
+  name = "DalpSsrSecurityError";
+}
+var originOf = (value) => {
+  const url = new URL(value);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new DalpSsrSecurityError(`DALP SDK: ${url.protocol} is not an approved SSR protocol.`);
+  }
+  return url.origin;
+};
+var REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+var SENSITIVE_HEADERS = [
+  "authorization",
+  "baggage",
+  "cookie",
+  "idempotency-key",
+  "origin",
+  "referer",
+  "traceparent",
+  "tracestate",
+  "x-api-key",
+  "x-chain-id",
+  "x-executor",
+  "x-organization-id",
+  "x-participant",
+  "x-selected-signers"
+];
+var withoutSensitiveHeaders = (source) => {
+  const headers = new Headers(source);
+  for (const name of SENSITIVE_HEADERS) {
+    headers.delete(name);
+  }
+  return headers;
+};
+function createSsrFetch(options) {
+  const incoming = new Headers(options.requestHeaders);
+  const approvedOrigins = new Set([originOf(options.baseUrl), ...(options.allowedOrigins ?? []).map(originOf)]);
+  const ssrFetch = async (input, init) => {
+    const request = input instanceof Request && init === undefined ? input : new Request(input, init);
+    if (!approvedOrigins.has(new URL(request.url).origin)) {
+      throw new DalpSsrSecurityError(`DALP SDK: ${request.url} is not an approved SSR destination.`);
+    }
+    const cookie = incoming.get("cookie");
+    if (cookie !== null && !["GET", "HEAD", "OPTIONS"].includes(request.method)) {
+      const incomingOrigin = incoming.get("origin");
+      let trustedOrigin = false;
+      try {
+        trustedOrigin = incomingOrigin !== null && approvedOrigins.has(originOf(incomingOrigin));
+      } catch {
+        trustedOrigin = false;
+      }
+      if (!trustedOrigin || incoming.get("sec-fetch-site") === "cross-site") {
+        throw new DalpSsrSecurityError("DALP SDK: a cookie-authenticated SSR mutation requires a trusted Origin.");
+      }
+    }
+    const headers = new Headers(request.headers);
+    if (cookie === null) {
+      headers.delete("cookie");
+    } else {
+      headers.set("cookie", cookie);
+    }
+    for (const name of ["origin", "traceparent", "tracestate", "baggage"]) {
+      const value = incoming.get(name);
+      if (value !== null && !headers.has(name)) {
+        headers.set(name, value);
+      }
+    }
+    let current = new Request(request, { headers, redirect: "manual" });
+    let sensitiveAllowed = true;
+    for (let redirectCount = 0;redirectCount <= 5; redirectCount += 1) {
+      const replay = current.clone();
+      const response = await options.fetch(current, { credentials: "omit", redirect: "manual" });
+      const location = response.headers.get("location");
+      if (!REDIRECT_STATUSES.has(response.status) || location === null) {
+        return response;
+      }
+      if (redirectCount === 5) {
+        throw new DalpSsrSecurityError("DALP SDK: SSR fetch exceeded the redirect limit.");
+      }
+      const nextUrl = new URL(location, current.url);
+      sensitiveAllowed = sensitiveAllowed && approvedOrigins.has(nextUrl.origin);
+      const redirectToGet = response.status === 303 || (response.status === 301 || response.status === 302) && replay.method === "POST";
+      const method = redirectToGet ? "GET" : replay.method;
+      if (!sensitiveAllowed && method !== "GET" && method !== "HEAD") {
+        throw new DalpSsrSecurityError("DALP SDK: refused to forward an SSR request body outside the trust boundary.");
+      }
+      const nextHeaders = sensitiveAllowed ? new Headers(replay.headers) : withoutSensitiveHeaders(replay.headers);
+      if (redirectToGet) {
+        nextHeaders.delete("content-length");
+        nextHeaders.delete("content-type");
+      }
+      current = new Request(nextUrl, {
+        body: method === "GET" || method === "HEAD" ? undefined : await replay.arrayBuffer(),
+        credentials: sensitiveAllowed ? replay.credentials : "omit",
+        headers: nextHeaders,
+        method,
+        redirect: "manual",
+        signal: replay.signal
+      });
+    }
+    throw new DalpSsrSecurityError("DALP SDK: unreachable redirect state.");
+  };
+  return Object.assign(ssrFetch, {
+    preconnect: options.fetch.preconnect ?? (() => {})
+  });
+}
+
+// src/client/factory.ts
+var CONTEXT_HEADERS = {
+  organizationId: "X-Organization-Id",
+  participant: "X-Participant",
+  executor: "X-Executor",
+  chainId: "X-Chain-Id",
+  selectedSigners: "X-Selected-Signers",
+  idempotencyKey: "Idempotency-Key"
+};
+var setNonEmptyHeader = (headers, name, value) => {
+  if (value !== undefined && String(value).trim().length > 0) {
+    headers.set(name, String(value));
+  }
+};
+function createDalpContextHeaders(context) {
+  const headers = new Headers;
+  setNonEmptyHeader(headers, CONTEXT_HEADERS.organizationId, context.organizationId);
+  setNonEmptyHeader(headers, CONTEXT_HEADERS.participant, context.participant);
+  setNonEmptyHeader(headers, CONTEXT_HEADERS.executor, context.executor);
+  setNonEmptyHeader(headers, CONTEXT_HEADERS.chainId, context.chainId);
+  setNonEmptyHeader(headers, CONTEXT_HEADERS.idempotencyKey, context.idempotencyKey);
+  if (context.selectedSigners !== undefined && context.selectedSigners.length > 0) {
+    headers.set(CONTEXT_HEADERS.selectedSigners, JSON.stringify(context.selectedSigners));
+  }
+  return headers;
+}
+function createDalpClient(options) {
+  const baseUrl = normalizeDalpBaseUrl(String(options.baseUrl));
+  const runtime = options.runtime ?? (globalThis.window === undefined ? "server" : "browser");
+  const baseFetch = options.fetch ?? globalThis.fetch;
+  const transportFetch = runtime === "browser" ? baseFetch : withRequestBodyCompression(baseFetch);
+  const { apiKey: apiKeyOption } = options;
+  let apiKey;
+  if (apiKeyOption === undefined) {
+    apiKey = undefined;
+  } else if (apiKeyOption instanceof Secret) {
+    apiKey = apiKeyOption;
+  } else {
+    apiKey = secret(apiKeyOption.trim());
+  }
+  if (runtime === "browser" && apiKey !== undefined) {
+    throw createDalpSdkConfigurationError({
+      message: "DALP SDK: API keys are server/CLI-only credentials and cannot configure a browser client.",
+      why: "An API key placed in a browser client ships the credential to every visitor's bundle.",
+      fix: "Keep the API key on the server or CLI process; browser clients authenticate with the session cookie."
+    });
+  }
+  const resolvedFetch = options.ssr === undefined ? transportFetch : createSsrFetch({
+    allowedOrigins: options.ssr.allowedOrigins,
+    baseUrl,
+    fetch: transportFetch,
+    requestHeaders: options.ssr.requestHeaders
+  });
+  const client = createClient({
+    baseUrl,
+    credentials: runtime === "browser" ? "include" : "omit",
+    fetch: resolvedFetch,
+    querySerializer: serializeDalpQuery
+  });
+  const contextHeaders = createDalpContextHeaders(options.context ?? {});
+  client.interceptors.request.use((request) => {
+    const headers = new Headers(request.headers);
+    if (apiKey !== undefined) {
+      headers.set("X-Api-Key", unwrapSecret(apiKey));
+    }
+    for (const [name, value] of contextHeaders) {
+      if (!headers.has(name)) {
+        headers.set(name, value);
+      }
+    }
+    return new Request(request, { headers });
+  });
+  installConditionalRequestInterceptors(client);
+  return client;
+}
+
+export { clearConditionalRequestStore, createDalpContextHeaders, createDalpClient };

package/dist/chunk-h12fatty.js

@@ -0,0 +1,63 @@
+import {
+  createDalpSdkConfigurationError
+} from "./chunk-y0d2c7kp.js";
+
+// src/secret.ts
+var SECRET_REDACTION_MARKER = "[REDACTED]";
+var inspectSymbol = Symbol.for("nodejs.util.inspect.custom");
+var secretValue = new WeakMap;
+
+class Secret {
+  constructor(value) {
+    secretValue.set(this, value);
+    Object.freeze(this);
+  }
+  static from(value) {
+    if (value.trim().length === 0) {
+      throw new TypeError("DALP SDK: a secret value must not be empty.");
+    }
+    return new Secret(value);
+  }
+  toString() {
+    return SECRET_REDACTION_MARKER;
+  }
+  toJSON() {
+    return SECRET_REDACTION_MARKER;
+  }
+  [inspectSymbol]() {
+    return SECRET_REDACTION_MARKER;
+  }
+}
+var secret = (value) => Secret.from(value);
+var unwrapSecret = (value) => {
+  const raw = secretValue.get(value);
+  if (raw === undefined) {
+    throw new TypeError("DALP SDK: cannot unwrap an invalid secret value.");
+  }
+  return raw;
+};
+
+// src/url.ts
+function normalizeDalpBaseUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (error) {
+    throw createDalpSdkConfigurationError({
+      message: `DALP SDK: invalid url "${url}". Provide a full URL including the protocol (e.g., "https://dalp.example.com").`,
+      why: "The SDK could not parse the configured DALP API URL.",
+      fix: 'Provide a full http:// or https:// URL, for example "https://dalp.example.com".',
+      cause: error
+    });
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw createDalpSdkConfigurationError({
+      message: `DALP SDK: url must use https:// or http:// protocol, got "${parsed.protocol}".`,
+      why: `The SDK received a URL with the unsupported "${parsed.protocol}" protocol.`,
+      fix: 'Use a DALP API base URL that starts with "https://" or "http://".'
+    });
+  }
+  return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+}
+
+export { SECRET_REDACTION_MARKER, Secret, secret, unwrapSecret, normalizeDalpBaseUrl };