@sparkvault/sdk 1.24.2 → 1.24.4

package/dist/sparkvault.esm.js

@@ -64,6 +64,14 @@ class PopupBlockedError extends SparkVaultError {
 /**
  * SparkVault SDK Configuration
  */
+// Hosts that are allowed to serve backend-issued ingot download URLs.
+// Keep in sync with the sdk-mobile default in packages/sdk-mobile/src/config.ts.
+const DEFAULT_ALLOWED_DOWNLOAD_HOST_PATTERNS = [
+    /(^|\.)sparkvault\.com$/i,
+    /(^|\.)(x|files|file|send|spark|by|at|db|auth)\.sv$/i,
+    /\.amazonaws\.com$/i,
+    /\.cloudfront\.net$/i,
+];
 const API_URL = 'https://api.sparkvault.com';
 const IDENTITY_URL = 'https://api.sparkvault.com/v1/apps/identity';
 function normalizeApiBaseUrl(url) {
@@ -84,7 +92,7 @@ function resolveConfig(config) {
         apiKey: config.apiKey,
         preloadConfig: config.preloadConfig !== false, // Default: true
         backdropBlur: config.backdropBlur !== false, // Default: true
-        allowedDownloadHostPatterns: config.allowedDownloadHostPatterns,
+        allowedDownloadHostPatterns: config.allowedDownloadHostPatterns ?? DEFAULT_ALLOWED_DOWNLOAD_HOST_PATTERNS,
     };
 }
 function validateConfig(config) {
@@ -9786,14 +9794,27 @@ class VaultsModule {
      */
     async downloadIngot(vault, ingotId) {
         const cleanId = ingotId.startsWith('ing_') ? ingotId : `ing_${ingotId}`;
-        const response = await this.http.post(`/v1/vaults/${vault.id}/ingots/${cleanId}/download`, undefined, {
-            headers: { 'X-Vault-Access-Token': vault.vatToken },
-        });
-        if (!response.data.download_url) {
-            throw new ValidationError('Download endpoint did not return a download URL');
+        let lastError = null;
+        for (let attempt = 1; attempt <= DOWNLOAD_MAX_ATTEMPTS; attempt++) {
+            try {
+                const response = await this.http.post(`/v1/vaults/${vault.id}/ingots/${cleanId}/download`, undefined, {
+                    headers: { 'X-Vault-Access-Token': vault.vatToken },
+                });
+                if (!response.data.download_url) {
+                    throw new ValidationError('Download endpoint did not return a download URL');
+                }
+                this.validateDownloadUrl(response.data.download_url);
+                return await fetchBlobWithTimeout(response.data.download_url);
+            }
+            catch (err) {
+                lastError = err instanceof Error ? err : new Error(String(err));
+                if (!isRetryableDownloadError(lastError) || attempt === DOWNLOAD_MAX_ATTEMPTS) {
+                    throw lastError;
+                }
+                await delayExponential(attempt);
+            }
         }
-        this.validateDownloadUrl(response.data.download_url);
-        return fetchBlobWithTimeout(response.data.download_url);
+        throw lastError ?? new Error('Download failed');
     }
     /**
      * List all ingots in an unsealed vault.
@@ -9854,9 +9875,6 @@ class VaultsModule {
             throw new ValidationError('Download URL must use HTTPS');
         }
         const allowedHosts = this.config.allowedDownloadHostPatterns;
-        if (!allowedHosts?.length) {
-            return;
-        }
         if (!allowedHosts.some(pattern => pattern.test(parsed.hostname))) {
             throw new ValidationError('Invalid download URL from server');
         }
@@ -9940,13 +9958,32 @@ function uploadChunkWithProgress(uploadUrl, chunk, chunkStart, totalSize, tusVer
         xhr.send(chunk);
     });
 }
+const DOWNLOAD_MAX_ATTEMPTS = 3;
+const DOWNLOAD_RETRY_BASE_MS = 500;
+function delayExponential(attempt) {
+    return new Promise(resolve => setTimeout(resolve, DOWNLOAD_RETRY_BASE_MS * 2 ** (attempt - 1)));
+}
+function isRetryableDownloadError(err) {
+    // Server contract / client-side validation errors aren't fixed by retrying.
+    if (err instanceof ValidationError)
+        return false;
+    // Network errors carry a status code only when the SDK HTTP client attached
+    // one; treat any explicitly-4xx response as a permanent failure.
+    const status = err.statusCode;
+    if (typeof status === 'number' && status >= 400 && status < 500 && status !== 408 && status !== 429) {
+        return false;
+    }
+    return true;
+}
 async function fetchBlobWithTimeout(url, timeout = 300000) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeout);
     try {
         const response = await fetch(url, { signal: controller.signal });
         if (!response.ok) {
-            throw new Error(`Download failed with status ${response.status}`);
+            const error = new Error(`Download failed with status ${response.status}`);
+            error.statusCode = response.status;
+            throw error;
         }
         return response.blob();
     }