@singi-labs/sifa-sdk 0.19.9 → 0.19.10

package/dist/index.cjs

@@ -6447,7 +6447,7 @@ function describeSifaRecord(collection, value) {
 }
 
 // src/index.ts
-var SIFA_SDK_VERSION = "0.19.9";
+var SIFA_SDK_VERSION = "0.19.10";
 
 exports.ACTIVITY_TIERS = ACTIVITY_TIERS;
 exports.ACTIVITY_VERBS = ACTIVITY_VERBS;

package/dist/index.js

@@ -6445,7 +6445,7 @@ function describeSifaRecord(collection, value) {
 }
 
 // src/index.ts
-var SIFA_SDK_VERSION = "0.19.9";
+var SIFA_SDK_VERSION = "0.19.10";
 
 export { ACTIVITY_TIERS, ACTIVITY_VERBS, ACTIVITY_VISIBILITY_RULES, ADULT_CONTENT_LABELS, ALL_SECTIONS, APP_CATEGORIES, APP_CATEGORY_IDS, APP_CATEGORY_MAP, APP_URL_PATTERNS, ARTIFACT_LINK_KIND_LABELS, ARTIFACT_LINK_KIND_OPTIONS, ArtifactLinkSchema, AtmosphereFeedItemSchema, BlobRefSchema, CALENDAR_EVENT_MODE_LABELS, CALENDAR_EVENT_STATUS_LABELS, CATEGORY_LABELS, CATEGORY_ORDER, COLLECTION_TO_APP, COMPANY_OPTIONAL_EMPLOYMENT_TYPES, COMPANY_PAGE_MIN_FIRMOGRAPHIC_FIELDS, COMPLETENESS_MAX_SCORE, CONTINENTS, COUNTRIES, DIMENSIONS_MAX_SCORE, EMPLOYMENT_TYPE_GROUPS, EMPLOYMENT_TYPE_LABELS, ENTITY_REF_ANCHORS, EndorsementConfirmationRecordSchema, EndorsementRecordSchema, EntityImportSearchResponseSchema, EntityMintDomainResponseSchema, EntityResolveDomainRequestSchema, EntityResolveDomainResponseSchema, EntitySearchResponseSchema, EntitySearchResultSchema, EntitySelectRequestSchema, EntitySelectResponseSchema, FEATURE_FLAGS, FeatureAllowlistEntrySchema, FeedActorSchema, FollowFeedItemSchema, FollowFeedPageSchema, FollowProfilePageSchema, FollowProfileSchema, GraphFollowRecordSchema, INDUSTRY_OPTIONS, INVESTMENT_ROLE_LABELS, INVESTMENT_ROLE_OPTIONS, INVESTMENT_STAGE_LABELS, INVESTMENT_STAGE_OPTIONS, INVESTMENT_STATUS_LABELS, INVESTMENT_STATUS_OPTIONS, INVOLVEMENT_HEADING_ORDER, INVOLVEMENT_KIND_HEADINGS, INVOLVEMENT_KIND_LABELS, INVOLVEMENT_KIND_OPTIONS, InvestmentAmountSchema, MIN_SKILLS, ON_BEHALF_OF_EMPLOYMENT_TYPES, OPEN_TO_OPTIONS, OPEN_TO_TOKENS, OPEN_TO_TOKEN_TO_VALUE, OPEN_TO_VALUE_TO_TOKEN, OrgEmploymentAttestationRecordSchema, OrgProfileRecordSchema, PLATFORM_LABELS, PLATFORM_OPTIONS, PRESENTATION_LINK_TYPE_LABELS, PRESENTATION_LINK_TYPE_OPTIONS, PRESENTATION_ROLE_LABELS, PRESENTATION_ROLE_OPTIONS, PROFILE_INVESTMENT_NSID, PROFILE_INVOLVEMENT_NSID, PROJECT_ROLES, PUBLICATION_TYPE_LABELS, PUBLICATION_TYPE_OPTIONS, PUBLISHERS, PresentationDurationSchema, PresentationLinkSchema, ProfileCertificationRecordSchema, ProfileCourseRecordSchema, ProfileEducationRecordSchema, ProfileExternalAccountRecordSchema, ProfileHonorRecordSchema, ProfileInvestmentRecordSchema, ProfileInvolvementRecordSchema, ProfileLanguageRecordSchema, ProfilePositionRecordSchema, ProfilePresentationDeliveryRecordSchema, ProfilePresentationRecordSchema, ProfileProjectRecordSchema, ProfilePublicationRecordSchema, ProfileSelfRecordSchema, ProfileSkillRecordSchema, ProfileVolunteeringRecordSchema, PublicationAuthorSchema, ROADMAP_ISSUES_REPO, ROADMAP_ITEM_META, SECTION_GROUPS, SECTION_LABELS, SELF_APP_ID, SIFA_REPO_GROUPS, SIFA_SDK_VERSION, SKILL_CATEGORIES, STANDARD_PUBLISHER_ID, STREAM_VERBS, SifaFeedItemSchema, VERIFICATION_PROVIDERS, WORKPLACE_TYPE_LABELS, WORKPLACE_TYPE_OPTIONS, actorShowsIdentity, agentRefSchema, atUriSchema, buildMetaDescription, buildProfileHighlights, buildTalkSlug, categoryForApp, certDateExtractor, cidSchema, classifyEntityRef, completenessPercent, completenessScore, contrastRatio, countFilledDimensions, countRecentActivity, countryCodeToFlag, dateRangeExtractor, datetimeSchema, decodeFeedCursor, dedupeSkills, describeSifaRecord, detectPdsProvider, didSchema, dimensionsFromInputs, durationFromMinutes, encodeFeedCursor, entityDisambiguationLabel, entityResultKey, excludeSelfApp, externalRecordRefSchema, filterHidden, findIndustry, formatCompanyName, formatDateRange, formatDisplayUrl, formatDistanceToNow, formatEventDate, formatLocation, formatPresentationDuration, formatRelativeTime, formatSingleDate, formatSpanDate, formatTimelineDate, getActivityTaxonomyVersion, getActivityTier, getActivityVerbsVersion, getAppCategoryIcon, getAppIdForCollection, getArtifactLinkKindLabel, getCalendarEventModeLabel, getCalendarEventStatusLabel, getContinent, getDisplayLabel, getEmploymentTypeLabel, getFaviconUrl, getFilledDimensionsMap, getHandleStem, getIndustryLabelKey, getInvestmentRoleLabel, getInvestmentStageLabel, getInvestmentStatusLabel, getInvolvementKindHeading, getInvolvementKindLabel, getLexiconEntry, getOpenToLabelKey, getPdsDisplayName, getPlatformLabel, getPresentationLinkTypeLabel, getPresentationRoleLabel, getPublicationTypeLabel, getPublisherByHost, getPublisherById, getPublisherFromSiteUrl, getTierMeta, getVerificationProvider, getVisibleSectionIds, getWorkplaceTypeLabel, groupInvolvementByHeading, groupSkillsByCategory, groupSkillsBySubCategory, groupSkillsForDisplay, hasAdultContent, hasPersonalProfileContent, hoistPrimary, isAppCategory, isCompanyPageIndexable, isCompanyRequired, isKnownAppId, isKnownPlatform, isKnownVerificationProvider, isLinked, isOnBehalfOfApplicable, isPseudoEmployer, isRegistrableDomainHandle, isRoleLineRedundant, isSectionPopulated, isValidRgbColor, isVisibleActivityItem, languageTagSchema, lexiconDateExtractor, limitCombiningMarks, locationSegments, looksLikeDomain, makeGraphFollowRecordSchema, maxGraphemes, meetsContrastAA, normalizeCompanyKey, normalizeDoi, normalizeLegalForm, normalizeOpenTo, normalizePlatformId, normalizePresentationMode, normalizePresentationRole, normalizeSkillCategory, normalizeWorkplaceTypes, openToTokenToValue, openToValueToToken, parseIntendedAudiences, parseLocationString, parsePresentationDuration, parseTalkRkey, partialDateSchema, pdsProviderFromApi, pickPrimaryFlagged, pickPrimaryPosition, presentationCsvRowToRecord, presentationDeliveryCsvRowToRecord, primaryVerification, profileToDimensionInputs, qualifiesAsOrg, relativeLuminance, rendersCompanyProfile, rendersPersonalProfile, repoGroupForCollection, resolveAccountFacetMode, resolveAgentRef, resolveCardHealth, resolveCardUrl, resolveEmbed, resolveVerifierProvider, rgbToString, roadmapIssueUrl, sanitizeDisplayText, sanitizeHandleInput, searchResultDisambiguation, selfLabelsSchema, shouldRenderHighlights, singleDateExtractor, skillRefSchema, slugifyTitle, sortByActiveDateRange, sortByDateDesc, sortCertifications, sortEducation, sortHonors, sortLanguages, sortLanguagesByProficiency, sortPositions, sortProjects, sortPublications, streamAddressSchema, streamAuthorSchema, streamCardBodySchema, streamCardSubjectSchema, streamCardVMSchema, streamExternalLinkSchema, streamGeoSchema, streamMediaSchema, streamRichSegmentSchema, streamSourceSchema, streamThemeSchema, streamVerbSchema, stripHtmlToText, strongRefSchema, summarizePresentationDeliveries, summarizeProfileView, toStreamCardVM, toStreamCardVMs, truncateGraphemes, uriSchema, verbForCollection, visibleItems, youtubeThumbnailUrl, youtubeVideoId };
 //# sourceMappingURL=index.js.map

package/dist/{network-map-DUIEbJf9.d.cts → network-map-BH_qbSvm.d.cts}

@@ -216,8 +216,12 @@ interface FetchPendingEndorsementsOptions extends ApiFetchOptions {
 }
 /**
  * Endorsements awaiting the signed-in user's decision. Requires credentials --
- * the AppView reads the subject DID from the session, not from a parameter, so
- * there is no way to read someone else's inbox.
+ * the AppView reads the subject DID from the caller's identity, not from a
+ * parameter, so there is no way to read someone else's inbox.
+ *
+ * Auth is identity-only server-side, so the NATIVE app supplies
+ * `config.getAuthToken` to mint a service-auth Bearer, while WEB relies on its
+ * session cookie (`credentials: 'include'`).
  *
  * Returns an empty page on failure so a broken inbox degrades to "nothing
  * pending" rather than breaking the surface hosting it.

package/dist/{network-map-BXpm9LIk.d.ts → network-map-CBllUH38.d.ts}

@@ -216,8 +216,12 @@ interface FetchPendingEndorsementsOptions extends ApiFetchOptions {
 }
 /**
  * Endorsements awaiting the signed-in user's decision. Requires credentials --
- * the AppView reads the subject DID from the session, not from a parameter, so
- * there is no way to read someone else's inbox.
+ * the AppView reads the subject DID from the caller's identity, not from a
+ * parameter, so there is no way to read someone else's inbox.
+ *
+ * Auth is identity-only server-side, so the NATIVE app supplies
+ * `config.getAuthToken` to mint a service-auth Bearer, while WEB relies on its
+ * session cookie (`credentials: 'include'`).
  *
  * Returns an empty page on failure so a broken inbox degrades to "nothing
  * pending" rather than breaking the surface hosting it.

package/dist/query/fetchers/index.cjs

@@ -471,10 +471,15 @@ async function fetchReciprocityCandidate(config, options = {}) {
 }
 
 // src/query/fetchers/endorsement-inbox.ts
+var PENDING_ENDORSEMENTS_LXM = "id.sifa.endorsement.getPending";
 async function fetchPendingEndorsements(config, options = {}) {
   const { cookieHeader, ...rest } = options;
   const headers = { ...rest.headers ?? {} };
   if (cookieHeader) headers.cookie = cookieHeader;
+  if (config.getAuthToken) {
+    const token = await config.getAuthToken(PENDING_ENDORSEMENTS_LXM);
+    if (token) headers.Authorization = `Bearer ${token}`;
+  }
   try {
     const data = await apiFetch(config, "/api/endorsements/pending", {
       cache: "no-store",