@singi-labs/sifa-sdk 0.19.9 → 0.19.11

package/dist/{network-map-DUIEbJf9.d.cts → network-map-BH_qbSvm.d.cts}

@@ -216,8 +216,12 @@ interface FetchPendingEndorsementsOptions extends ApiFetchOptions {
 }
 /**
  * Endorsements awaiting the signed-in user's decision. Requires credentials --
- * the AppView reads the subject DID from the session, not from a parameter, so
- * there is no way to read someone else's inbox.
+ * the AppView reads the subject DID from the caller's identity, not from a
+ * parameter, so there is no way to read someone else's inbox.
+ *
+ * Auth is identity-only server-side, so the NATIVE app supplies
+ * `config.getAuthToken` to mint a service-auth Bearer, while WEB relies on its
+ * session cookie (`credentials: 'include'`).
  *
  * Returns an empty page on failure so a broken inbox degrades to "nothing
  * pending" rather than breaking the surface hosting it.

package/dist/{network-map-BXpm9LIk.d.ts → network-map-CBllUH38.d.ts}

@@ -216,8 +216,12 @@ interface FetchPendingEndorsementsOptions extends ApiFetchOptions {
 }
 /**
  * Endorsements awaiting the signed-in user's decision. Requires credentials --
- * the AppView reads the subject DID from the session, not from a parameter, so
- * there is no way to read someone else's inbox.
+ * the AppView reads the subject DID from the caller's identity, not from a
+ * parameter, so there is no way to read someone else's inbox.
+ *
+ * Auth is identity-only server-side, so the NATIVE app supplies
+ * `config.getAuthToken` to mint a service-auth Bearer, while WEB relies on its
+ * session cookie (`credentials: 'include'`).
  *
  * Returns an empty page on failure so a broken inbox degrades to "nothing
  * pending" rather than breaking the surface hosting it.

package/dist/query/fetchers/index.cjs

@@ -471,10 +471,15 @@ async function fetchReciprocityCandidate(config, options = {}) {
 }
 
 // src/query/fetchers/endorsement-inbox.ts
+var PENDING_ENDORSEMENTS_LXM = "id.sifa.endorsement.getPending";
 async function fetchPendingEndorsements(config, options = {}) {
   const { cookieHeader, ...rest } = options;
   const headers = { ...rest.headers ?? {} };
   if (cookieHeader) headers.cookie = cookieHeader;
+  if (config.getAuthToken) {
+    const token = await config.getAuthToken(PENDING_ENDORSEMENTS_LXM);
+    if (token) headers.Authorization = `Bearer ${token}`;
+  }
   try {
     const data = await apiFetch(config, "/api/endorsements/pending", {
       cache: "no-store",