@sparkvault/sdk 1.24.2 → 1.24.4

package/dist/config.d.ts

@@ -26,8 +26,9 @@ export interface SparkVaultConfig {
     /** Enable backdrop blur on dialogs (default: true) */
     backdropBlur?: boolean;
     /**
-     * Optional host allowlist for backend-issued ingot download URLs.
-     * When omitted, the SDK preserves the existing HTTPS-only validation behavior.
+     * Host allowlist for backend-issued ingot download URLs. Defaults to the
+     * canonical SparkVault Forge / S3 / CloudFront hosts. Override only when
+     * pointing at a custom deployment.
      */
     allowedDownloadHostPatterns?: RegExp[];
 }
@@ -41,7 +42,7 @@ export interface ResolvedConfig {
     apiKey?: string;
     preloadConfig: boolean;
     backdropBlur: boolean;
-    allowedDownloadHostPatterns?: RegExp[];
+    allowedDownloadHostPatterns: RegExp[];
 }
 export declare function resolveConfig(config: SparkVaultConfig): ResolvedConfig;
 export declare function validateConfig(config: SparkVaultConfig): void;

package/dist/index.d.ts

@@ -26,8 +26,9 @@ interface SparkVaultConfig {
     /** Enable backdrop blur on dialogs (default: true) */
     backdropBlur?: boolean;
     /**
-     * Optional host allowlist for backend-issued ingot download URLs.
-     * When omitted, the SDK preserves the existing HTTPS-only validation behavior.
+     * Host allowlist for backend-issued ingot download URLs. Defaults to the
+     * canonical SparkVault Forge / S3 / CloudFront hosts. Override only when
+     * pointing at a custom deployment.
      */
     allowedDownloadHostPatterns?: RegExp[];
 }
@@ -41,7 +42,7 @@ interface ResolvedConfig {
     apiKey?: string;
     preloadConfig: boolean;
     backdropBlur: boolean;
-    allowedDownloadHostPatterns?: RegExp[];
+    allowedDownloadHostPatterns: RegExp[];
 }
 
 interface HealthCheckOptions {

package/dist/sparkvault.cjs.js

@@ -68,6 +68,14 @@ class PopupBlockedError extends SparkVaultError {
 /**
  * SparkVault SDK Configuration
  */
+// Hosts that are allowed to serve backend-issued ingot download URLs.
+// Keep in sync with the sdk-mobile default in packages/sdk-mobile/src/config.ts.
+const DEFAULT_ALLOWED_DOWNLOAD_HOST_PATTERNS = [
+    /(^|\.)sparkvault\.com$/i,
+    /(^|\.)(x|files|file|send|spark|by|at|db|auth)\.sv$/i,
+    /\.amazonaws\.com$/i,
+    /\.cloudfront\.net$/i,
+];
 const API_URL = 'https://api.sparkvault.com';
 const IDENTITY_URL = 'https://api.sparkvault.com/v1/apps/identity';
 function normalizeApiBaseUrl(url) {
@@ -88,7 +96,7 @@ function resolveConfig(config) {
         apiKey: config.apiKey,
         preloadConfig: config.preloadConfig !== false, // Default: true
         backdropBlur: config.backdropBlur !== false, // Default: true
-        allowedDownloadHostPatterns: config.allowedDownloadHostPatterns,
+        allowedDownloadHostPatterns: config.allowedDownloadHostPatterns ?? DEFAULT_ALLOWED_DOWNLOAD_HOST_PATTERNS,
     };
 }
 function validateConfig(config) {
@@ -9790,14 +9798,27 @@ class VaultsModule {
      */
     async downloadIngot(vault, ingotId) {
         const cleanId = ingotId.startsWith('ing_') ? ingotId : `ing_${ingotId}`;
-        const response = await this.http.post(`/v1/vaults/${vault.id}/ingots/${cleanId}/download`, undefined, {
-            headers: { 'X-Vault-Access-Token': vault.vatToken },
-        });
-        if (!response.data.download_url) {
-            throw new ValidationError('Download endpoint did not return a download URL');
+        let lastError = null;
+        for (let attempt = 1; attempt <= DOWNLOAD_MAX_ATTEMPTS; attempt++) {
+            try {
+                const response = await this.http.post(`/v1/vaults/${vault.id}/ingots/${cleanId}/download`, undefined, {
+                    headers: { 'X-Vault-Access-Token': vault.vatToken },
+                });
+                if (!response.data.download_url) {
+                    throw new ValidationError('Download endpoint did not return a download URL');
+                }
+                this.validateDownloadUrl(response.data.download_url);
+                return await fetchBlobWithTimeout(response.data.download_url);
+            }
+            catch (err) {
+                lastError = err instanceof Error ? err : new Error(String(err));
+                if (!isRetryableDownloadError(lastError) || attempt === DOWNLOAD_MAX_ATTEMPTS) {
+                    throw lastError;
+                }
+                await delayExponential(attempt);
+            }
         }
-        this.validateDownloadUrl(response.data.download_url);
-        return fetchBlobWithTimeout(response.data.download_url);
+        throw lastError ?? new Error('Download failed');
     }
     /**
      * List all ingots in an unsealed vault.
@@ -9858,9 +9879,6 @@ class VaultsModule {
             throw new ValidationError('Download URL must use HTTPS');
         }
         const allowedHosts = this.config.allowedDownloadHostPatterns;
-        if (!allowedHosts?.length) {
-            return;
-        }
         if (!allowedHosts.some(pattern => pattern.test(parsed.hostname))) {
             throw new ValidationError('Invalid download URL from server');
         }
@@ -9944,13 +9962,32 @@ function uploadChunkWithProgress(uploadUrl, chunk, chunkStart, totalSize, tusVer
         xhr.send(chunk);
     });
 }
+const DOWNLOAD_MAX_ATTEMPTS = 3;
+const DOWNLOAD_RETRY_BASE_MS = 500;
+function delayExponential(attempt) {
+    return new Promise(resolve => setTimeout(resolve, DOWNLOAD_RETRY_BASE_MS * 2 ** (attempt - 1)));
+}
+function isRetryableDownloadError(err) {
+    // Server contract / client-side validation errors aren't fixed by retrying.
+    if (err instanceof ValidationError)
+        return false;
+    // Network errors carry a status code only when the SDK HTTP client attached
+    // one; treat any explicitly-4xx response as a permanent failure.
+    const status = err.statusCode;
+    if (typeof status === 'number' && status >= 400 && status < 500 && status !== 408 && status !== 429) {
+        return false;
+    }
+    return true;
+}
 async function fetchBlobWithTimeout(url, timeout = 300000) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeout);
     try {
         const response = await fetch(url, { signal: controller.signal });
         if (!response.ok) {
-            throw new Error(`Download failed with status ${response.status}`);
+            const error = new Error(`Download failed with status ${response.status}`);
+            error.statusCode = response.status;
+            throw error;
         }
         return response.blob();
     }