cabalspy-id 0.0.0-stage → 0.5.2

package/dist/api.d.cts

@@ -0,0 +1,193 @@
+export { A as ApiErrorBody, a as AuthenticationError, B as BadRequestError, C as CabalSpyID, b as CabalSpyIDError, c as CabalSpyIDErrorOptions, d as CabalSpyIDOptions, e as CabalSpyIDStream, f as CloseEvent, g as ConnectionError, D as DEFAULT_BASE_URL, h as DEFAULT_STREAM_URL, E as Envelope, H as HandleKind, k as HeaderSource, l as HeartbeatEvent, m as HistoryParams, I as InvalidResponseError, n as LatestTransactionsParams, o as LeaderboardParams, N as NotFoundError, O as OAuthError, P as PermissionError, q as PlanUserLimitError, s as ProfileParams, Q as Query, R as RateLimitError, t as RateLimitInfo, v as ReconnectEvent, S as SDK_VERSION, y as ScopedParams, z as ServerError, F as StreamEvent, G as StreamEventMap, J as StreamOptions, K as StreamTopic, T as SubscribedEvent, a3 as TokenVerificationError, a4 as TrackerParams, a5 as UserLike, a7 as UsersParams, a8 as VerifyWebhookOptions, a9 as WalletParams, aa as WebhookVerificationError, ab as handleKind, ac as hasX, ad as signWebhook, ae as verifyWebhook } from './users-3DAw88_U.cjs';
+import { O as OidcScope, D as DiscoveryDocument, a8 as TokenResponse, c as CabalSpyIDClaims } from './types-UZeY9n1e.cjs';
+export { A as ActiveTokens, a as ApiResponse, C as CHAINS, b as CURRENCY_BY_CHAIN, d as Chain, e as Currency, H as HealthResponse, f as HistoryResponse, g as HistoryToken, h as HistoryTrade, i as HoldingToken, j as HoldingsResponse, L as LEADERBOARD_SORTS, k as LeaderboardEntry, l as LeaderboardResponse, m as LeaderboardSort, n as LifetimeStats, M as MeResponse, P as PERIODS, o as Pagination, p as Period, q as PeriodStats, r as PnlCalendarDay, s as PnlCalendarMonth, t as PnlCalendarResponse, u as PnlChartPoint, v as Profile, R as ResponseMeta, S as Scope, a7 as TokenOverview, a9 as TrackerResponse, aa as TrackerTrade, ab as Trade, ac as TradeOwner, ad as TraderProfile, ae as VerifiedWallet, af as WalletClaim, ag as WalletLookupResponse, ah as WebhookEvent, ai as WebhookEventType, aj as WinRateBuckets, ak as WinRateDistribution, al as XProfileClaim } from './types-UZeY9n1e.cjs';
+
+/** ES256 JWT verification against a JWKS, with WebCrypto only (no dependencies). */
+interface EcJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+}
+interface Jwks {
+    keys: EcJwk[];
+}
+interface JwtHeader {
+    alg: string;
+    kid?: string;
+    typ?: string;
+    [key: string]: unknown;
+}
+interface DecodedJwt<P = Record<string, unknown>> {
+    header: JwtHeader;
+    payload: P;
+}
+/** Decodes a JWT without verifying it. Never trust the result. */
+declare function decodeJwt<P = Record<string, unknown>>(token: string): DecodedJwt<P>;
+/**
+ * Caches the provider's public keys. An unknown `kid` triggers one refetch
+ * (key rotation), at most once per `cooldownMs`.
+ */
+declare class JwksCache {
+    private readonly load;
+    private readonly cooldownMs;
+    private keys;
+    private loaded;
+    private inflight;
+    constructor(load: () => Promise<Jwks>, cooldownMs?: number);
+    private refresh;
+    getKey(kid: string | undefined): Promise<CryptoKey>;
+}
+
+declare const DEFAULT_ISSUER = "https://id.cabalspy.xyz";
+type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
+interface CabalSpyIDAuthOptions {
+    /** Your instance's client_id (`csid_…`). */
+    clientId: string;
+    /** Client secret (`csid_sk_…`) of a server-side app. Omit for public clients. */
+    clientSecret?: string;
+    /** Default redirect URI. Must exactly match one registered in the dashboard. */
+    redirectUri?: string;
+    /** Default: https://id.cabalspy.xyz (env CABALSPY_ID_ISSUER) */
+    issuer?: string;
+    /** Default: client_secret_basic with a secret, else none. */
+    tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
+    /** Accepted clock skew in seconds when checking tokens. Default: 60 */
+    clockTolerance?: number;
+    /** Per-request timeout in milliseconds. Default: 15_000 */
+    timeout?: number;
+    fetch?: typeof globalThis.fetch;
+}
+interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** A fresh PKCE verifier (64 chars) and its S256 challenge. */
+declare function generatePkce(): Promise<PkcePair>;
+interface AuthorizationUrlParams {
+    /** Default: ['openid', 'profile']. `openid` is added when missing. */
+    scope?: OidcScope[] | string;
+    redirectUri?: string;
+    /** 'none' (silent, live apps only) or 'consent'. */
+    prompt?: 'none' | 'consent';
+    /** Your own state value; generated when omitted. */
+    state?: string;
+    /** Your own nonce; generated when omitted. */
+    nonce?: string;
+    /** Additional query parameters. */
+    extraParams?: Record<string, string>;
+}
+/**
+ * What you must keep (e.g. in a signed, http-only cookie or the server
+ * session) until the user comes back to your redirect URI.
+ */
+interface AuthorizationRequest {
+    url: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+interface CallbackChecks {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri?: string;
+}
+interface VerifyIdTokenOptions {
+    /** The nonce you sent; required after an authorization request. */
+    nonce?: string;
+    /** Maximum seconds since the user authenticated (checks auth_time). */
+    maxAge?: number;
+}
+interface LoginResult {
+    tokens: TokenResponse;
+    /** Verified ID token claims. Check `claims.limited` before using profile data. */
+    claims: CabalSpyIDClaims;
+}
+/** True when the platform is over its plan's user limit: anonymous sub, no profile data. */
+declare function isLimited(claims: Pick<CabalSpyIDClaims, 'limited' | 'sub'>): boolean;
+/**
+ * OpenID Connect client for "Login with CabalSpy ID".
+ *
+ *   const auth = new CabalSpyIDAuth({ clientId, clientSecret, redirectUri });
+ *   const req = await auth.createAuthorizationUrl({ scope: ['openid', 'profile', 'wallets'] });
+ *   // store req.state, req.nonce, req.codeVerifier; redirect to req.url
+ *   const { tokens, claims } = await auth.handleCallback(callbackUrl, stored);
+ */
+declare class CabalSpyIDAuth {
+    readonly clientId: string;
+    readonly issuer: string;
+    readonly redirectUri?: string;
+    readonly authMethod: TokenEndpointAuthMethod;
+    private readonly clientSecret?;
+    private readonly clockTolerance;
+    private readonly timeout;
+    private readonly fetchImpl;
+    private discovery;
+    private readonly jwks;
+    constructor(options: CabalSpyIDAuthOptions);
+    private send;
+    private fetchJson;
+    private clientAuth;
+    private postForm;
+    /** The provider's discovery document (cached for the life of this object). */
+    discover(): Promise<DiscoveryDocument>;
+    /** The provider's public signing keys. */
+    getJwks(): Promise<Jwks>;
+    /**
+     * Builds the authorization URL with PKCE (S256), state and nonce.
+     * Store `state`, `nonce` and `codeVerifier` until the callback.
+     */
+    createAuthorizationUrl(params?: AuthorizationUrlParams): Promise<AuthorizationRequest>;
+    /**
+     * Completes the login on your redirect URI: checks `error`, `state` and
+     * `iss`, exchanges the code and verifies the ID token (signature, iss, aud,
+     * exp, nonce).
+     *
+     * @param callback the full callback URL, its query string or URLSearchParams
+     */
+    handleCallback(callback: string | URL | URLSearchParams, checks: CallbackChecks): Promise<LoginResult>;
+    /** POST /oauth/token with grant_type=authorization_code. */
+    exchangeCode(params: {
+        code: string;
+        codeVerifier: string;
+        redirectUri?: string;
+    }): Promise<TokenResponse>;
+    /**
+     * POST /oauth/token with grant_type=refresh_token. Refresh tokens rotate:
+     * always store the new `refresh_token`. Reusing an old one revokes the whole
+     * chain.
+     */
+    refresh(refreshToken: string): Promise<TokenResponse>;
+    /** POST /oauth/revoke (RFC 7009). Revoking a refresh token ends its whole chain. */
+    revoke(token: string): Promise<void>;
+    /** GET /oauth/userinfo — full claims for the access token's scopes (x, wallets, onchain …). */
+    userinfo(accessToken: string): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies an ID token: ES256 signature (JWKS), iss, aud, azp, exp, nonce.
+     * Use it for tokens from your own callback and for `idToken` sent from the
+     * browser widget's `csid:login` event.
+     *
+     * When the platform is over its plan's user limit, `sub` is `anon_…` and
+     * `limited` is true; see isLimited().
+     */
+    verifyIdToken(idToken: string, options?: VerifyIdTokenOptions): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies a CabalSpy ID access token (typ at+jwt) issued to this client,
+     * e.g. one your frontend sends to your API. Returns its claims
+     * (sub, scope, client_id, exp, jti).
+     */
+    verifyAccessToken(accessToken: string): Promise<{
+        sub: string;
+        scope: string;
+        client_id: string;
+        exp: number;
+        jti: string;
+    } & Record<string, unknown>>;
+}
+
+export { type AuthorizationRequest, type AuthorizationUrlParams, CabalSpyIDAuth, type CabalSpyIDAuthOptions, CabalSpyIDClaims, type CallbackChecks, DEFAULT_ISSUER, type DecodedJwt, DiscoveryDocument, type EcJwk, type Jwks, JwksCache, type JwtHeader, type LoginResult, OidcScope, type PkcePair, type TokenEndpointAuthMethod, TokenResponse, type VerifyIdTokenOptions, decodeJwt, generatePkce, isLimited };

package/dist/api.d.ts

@@ -0,0 +1,193 @@
+export { A as ApiErrorBody, a as AuthenticationError, B as BadRequestError, C as CabalSpyID, b as CabalSpyIDError, c as CabalSpyIDErrorOptions, d as CabalSpyIDOptions, e as CabalSpyIDStream, f as CloseEvent, g as ConnectionError, D as DEFAULT_BASE_URL, h as DEFAULT_STREAM_URL, E as Envelope, H as HandleKind, k as HeaderSource, l as HeartbeatEvent, m as HistoryParams, I as InvalidResponseError, n as LatestTransactionsParams, o as LeaderboardParams, N as NotFoundError, O as OAuthError, P as PermissionError, q as PlanUserLimitError, s as ProfileParams, Q as Query, R as RateLimitError, t as RateLimitInfo, v as ReconnectEvent, S as SDK_VERSION, y as ScopedParams, z as ServerError, F as StreamEvent, G as StreamEventMap, J as StreamOptions, K as StreamTopic, T as SubscribedEvent, a3 as TokenVerificationError, a4 as TrackerParams, a5 as UserLike, a7 as UsersParams, a8 as VerifyWebhookOptions, a9 as WalletParams, aa as WebhookVerificationError, ab as handleKind, ac as hasX, ad as signWebhook, ae as verifyWebhook } from './users-B4r33i4O.js';
+import { O as OidcScope, D as DiscoveryDocument, a8 as TokenResponse, c as CabalSpyIDClaims } from './types-UZeY9n1e.js';
+export { A as ActiveTokens, a as ApiResponse, C as CHAINS, b as CURRENCY_BY_CHAIN, d as Chain, e as Currency, H as HealthResponse, f as HistoryResponse, g as HistoryToken, h as HistoryTrade, i as HoldingToken, j as HoldingsResponse, L as LEADERBOARD_SORTS, k as LeaderboardEntry, l as LeaderboardResponse, m as LeaderboardSort, n as LifetimeStats, M as MeResponse, P as PERIODS, o as Pagination, p as Period, q as PeriodStats, r as PnlCalendarDay, s as PnlCalendarMonth, t as PnlCalendarResponse, u as PnlChartPoint, v as Profile, R as ResponseMeta, S as Scope, a7 as TokenOverview, a9 as TrackerResponse, aa as TrackerTrade, ab as Trade, ac as TradeOwner, ad as TraderProfile, ae as VerifiedWallet, af as WalletClaim, ag as WalletLookupResponse, ah as WebhookEvent, ai as WebhookEventType, aj as WinRateBuckets, ak as WinRateDistribution, al as XProfileClaim } from './types-UZeY9n1e.js';
+
+/** ES256 JWT verification against a JWKS, with WebCrypto only (no dependencies). */
+interface EcJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+}
+interface Jwks {
+    keys: EcJwk[];
+}
+interface JwtHeader {
+    alg: string;
+    kid?: string;
+    typ?: string;
+    [key: string]: unknown;
+}
+interface DecodedJwt<P = Record<string, unknown>> {
+    header: JwtHeader;
+    payload: P;
+}
+/** Decodes a JWT without verifying it. Never trust the result. */
+declare function decodeJwt<P = Record<string, unknown>>(token: string): DecodedJwt<P>;
+/**
+ * Caches the provider's public keys. An unknown `kid` triggers one refetch
+ * (key rotation), at most once per `cooldownMs`.
+ */
+declare class JwksCache {
+    private readonly load;
+    private readonly cooldownMs;
+    private keys;
+    private loaded;
+    private inflight;
+    constructor(load: () => Promise<Jwks>, cooldownMs?: number);
+    private refresh;
+    getKey(kid: string | undefined): Promise<CryptoKey>;
+}
+
+declare const DEFAULT_ISSUER = "https://id.cabalspy.xyz";
+type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
+interface CabalSpyIDAuthOptions {
+    /** Your instance's client_id (`csid_…`). */
+    clientId: string;
+    /** Client secret (`csid_sk_…`) of a server-side app. Omit for public clients. */
+    clientSecret?: string;
+    /** Default redirect URI. Must exactly match one registered in the dashboard. */
+    redirectUri?: string;
+    /** Default: https://id.cabalspy.xyz (env CABALSPY_ID_ISSUER) */
+    issuer?: string;
+    /** Default: client_secret_basic with a secret, else none. */
+    tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
+    /** Accepted clock skew in seconds when checking tokens. Default: 60 */
+    clockTolerance?: number;
+    /** Per-request timeout in milliseconds. Default: 15_000 */
+    timeout?: number;
+    fetch?: typeof globalThis.fetch;
+}
+interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** A fresh PKCE verifier (64 chars) and its S256 challenge. */
+declare function generatePkce(): Promise<PkcePair>;
+interface AuthorizationUrlParams {
+    /** Default: ['openid', 'profile']. `openid` is added when missing. */
+    scope?: OidcScope[] | string;
+    redirectUri?: string;
+    /** 'none' (silent, live apps only) or 'consent'. */
+    prompt?: 'none' | 'consent';
+    /** Your own state value; generated when omitted. */
+    state?: string;
+    /** Your own nonce; generated when omitted. */
+    nonce?: string;
+    /** Additional query parameters. */
+    extraParams?: Record<string, string>;
+}
+/**
+ * What you must keep (e.g. in a signed, http-only cookie or the server
+ * session) until the user comes back to your redirect URI.
+ */
+interface AuthorizationRequest {
+    url: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+interface CallbackChecks {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri?: string;
+}
+interface VerifyIdTokenOptions {
+    /** The nonce you sent; required after an authorization request. */
+    nonce?: string;
+    /** Maximum seconds since the user authenticated (checks auth_time). */
+    maxAge?: number;
+}
+interface LoginResult {
+    tokens: TokenResponse;
+    /** Verified ID token claims. Check `claims.limited` before using profile data. */
+    claims: CabalSpyIDClaims;
+}
+/** True when the platform is over its plan's user limit: anonymous sub, no profile data. */
+declare function isLimited(claims: Pick<CabalSpyIDClaims, 'limited' | 'sub'>): boolean;
+/**
+ * OpenID Connect client for "Login with CabalSpy ID".
+ *
+ *   const auth = new CabalSpyIDAuth({ clientId, clientSecret, redirectUri });
+ *   const req = await auth.createAuthorizationUrl({ scope: ['openid', 'profile', 'wallets'] });
+ *   // store req.state, req.nonce, req.codeVerifier; redirect to req.url
+ *   const { tokens, claims } = await auth.handleCallback(callbackUrl, stored);
+ */
+declare class CabalSpyIDAuth {
+    readonly clientId: string;
+    readonly issuer: string;
+    readonly redirectUri?: string;
+    readonly authMethod: TokenEndpointAuthMethod;
+    private readonly clientSecret?;
+    private readonly clockTolerance;
+    private readonly timeout;
+    private readonly fetchImpl;
+    private discovery;
+    private readonly jwks;
+    constructor(options: CabalSpyIDAuthOptions);
+    private send;
+    private fetchJson;
+    private clientAuth;
+    private postForm;
+    /** The provider's discovery document (cached for the life of this object). */
+    discover(): Promise<DiscoveryDocument>;
+    /** The provider's public signing keys. */
+    getJwks(): Promise<Jwks>;
+    /**
+     * Builds the authorization URL with PKCE (S256), state and nonce.
+     * Store `state`, `nonce` and `codeVerifier` until the callback.
+     */
+    createAuthorizationUrl(params?: AuthorizationUrlParams): Promise<AuthorizationRequest>;
+    /**
+     * Completes the login on your redirect URI: checks `error`, `state` and
+     * `iss`, exchanges the code and verifies the ID token (signature, iss, aud,
+     * exp, nonce).
+     *
+     * @param callback the full callback URL, its query string or URLSearchParams
+     */
+    handleCallback(callback: string | URL | URLSearchParams, checks: CallbackChecks): Promise<LoginResult>;
+    /** POST /oauth/token with grant_type=authorization_code. */
+    exchangeCode(params: {
+        code: string;
+        codeVerifier: string;
+        redirectUri?: string;
+    }): Promise<TokenResponse>;
+    /**
+     * POST /oauth/token with grant_type=refresh_token. Refresh tokens rotate:
+     * always store the new `refresh_token`. Reusing an old one revokes the whole
+     * chain.
+     */
+    refresh(refreshToken: string): Promise<TokenResponse>;
+    /** POST /oauth/revoke (RFC 7009). Revoking a refresh token ends its whole chain. */
+    revoke(token: string): Promise<void>;
+    /** GET /oauth/userinfo — full claims for the access token's scopes (x, wallets, onchain …). */
+    userinfo(accessToken: string): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies an ID token: ES256 signature (JWKS), iss, aud, azp, exp, nonce.
+     * Use it for tokens from your own callback and for `idToken` sent from the
+     * browser widget's `csid:login` event.
+     *
+     * When the platform is over its plan's user limit, `sub` is `anon_…` and
+     * `limited` is true; see isLimited().
+     */
+    verifyIdToken(idToken: string, options?: VerifyIdTokenOptions): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies a CabalSpy ID access token (typ at+jwt) issued to this client,
+     * e.g. one your frontend sends to your API. Returns its claims
+     * (sub, scope, client_id, exp, jti).
+     */
+    verifyAccessToken(accessToken: string): Promise<{
+        sub: string;
+        scope: string;
+        client_id: string;
+        exp: number;
+        jti: string;
+    } & Record<string, unknown>>;
+}
+
+export { type AuthorizationRequest, type AuthorizationUrlParams, CabalSpyIDAuth, type CabalSpyIDAuthOptions, CabalSpyIDClaims, type CallbackChecks, DEFAULT_ISSUER, type DecodedJwt, DiscoveryDocument, type EcJwk, type Jwks, JwksCache, type JwtHeader, type LoginResult, OidcScope, type PkcePair, type TokenEndpointAuthMethod, TokenResponse, type VerifyIdTokenOptions, decodeJwt, generatePkce, isLimited };

package/dist/api.js

@@ -0,0 +1,74 @@
+import {
+  CabalSpyIDAuth,
+  DEFAULT_ISSUER,
+  JwksCache,
+  decodeJwt,
+  generatePkce,
+  isLimited
+} from "./chunk-DBYCRBVS.js";
+import "./chunk-CJFIOVBA.js";
+import {
+  CHAINS,
+  CURRENCY_BY_CHAIN,
+  CabalSpyID,
+  CabalSpyIDStream,
+  DEFAULT_BASE_URL,
+  DEFAULT_STREAM_URL,
+  LEADERBOARD_SORTS,
+  PERIODS,
+  SDK_VERSION,
+  handleKind,
+  hasX,
+  signWebhook,
+  verifyWebhook
+} from "./chunk-XLBO2RSL.js";
+import {
+  AuthenticationError,
+  BadRequestError,
+  CabalSpyIDError,
+  ConnectionError,
+  InvalidResponseError,
+  NotFoundError,
+  OAuthError,
+  PermissionError,
+  PlanUserLimitError,
+  RateLimitError,
+  ServerError,
+  TokenVerificationError,
+  WebhookVerificationError
+} from "./chunk-VOTYIQAY.js";
+export {
+  AuthenticationError,
+  BadRequestError,
+  CHAINS,
+  CURRENCY_BY_CHAIN,
+  CabalSpyID,
+  CabalSpyIDAuth,
+  CabalSpyIDError,
+  CabalSpyIDStream,
+  ConnectionError,
+  DEFAULT_BASE_URL,
+  DEFAULT_ISSUER,
+  DEFAULT_STREAM_URL,
+  InvalidResponseError,
+  JwksCache,
+  LEADERBOARD_SORTS,
+  NotFoundError,
+  OAuthError,
+  PERIODS,
+  PermissionError,
+  PlanUserLimitError,
+  RateLimitError,
+  SDK_VERSION,
+  ServerError,
+  TokenVerificationError,
+  WebhookVerificationError,
+  decodeJwt,
+  generatePkce,
+  handleKind,
+  hasX,
+  isLimited,
+  signWebhook,
+  verifyWebhook
+};
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-A2ZAFAWC.cjs

@@ -0,0 +1 @@
+"use strict";//# sourceMappingURL=chunk-A2ZAFAWC.cjs.map

package/dist/chunk-A2ZAFAWC.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/cabalspy-id-js/cabalspy-id-js/dist/chunk-A2ZAFAWC.cjs"],"names":[],"mappings":"AAAA","file":"/home/runner/work/cabalspy-id-js/cabalspy-id-js/dist/chunk-A2ZAFAWC.cjs"}

package/dist/chunk-ABFIPCBY.cjs

@@ -0,0 +1,109 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;// src/errors.ts
+var EMPTY_RATE_LIMIT = Object.freeze({ limit: null, remaining: null, reset: null });
+var CabalSpyIDError = class extends Error {
+  
+  
+  
+  
+  
+  
+  
+  /** The parsed response body, when there was one. */
+  
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = new.target.name;
+    this.status = _nullishCoalesce(opts.status, () => ( 0));
+    this.code = _nullishCoalesce(opts.code, () => ( "unknown_error"));
+    this.requestId = opts.requestId;
+    this.docs = opts.docs;
+    this.parameter = opts.parameter;
+    this.allowed = opts.allowed;
+    this.rateLimit = _nullishCoalesce(opts.rateLimit, () => ( { ...EMPTY_RATE_LIMIT }));
+    this.body = opts.body;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var BadRequestError = class extends CabalSpyIDError {
+};
+var AuthenticationError = class extends CabalSpyIDError {
+};
+var PermissionError = class extends CabalSpyIDError {
+};
+var PlanUserLimitError = (_class = class extends PermissionError {constructor(...args) { super(...args); _class.prototype.__init.call(this); }
+  __init() {this.limited = true}
+}, _class);
+var NotFoundError = class extends CabalSpyIDError {
+};
+var RateLimitError = class extends CabalSpyIDError {
+  /** Seconds until the next request is allowed, taken from Retry-After. */
+  
+  constructor(message, opts = {}) {
+    super(message, opts);
+    this.retryAfter = _nullishCoalesce(opts.retryAfter, () => ( null));
+  }
+};
+var ServerError = class extends CabalSpyIDError {
+};
+var ConnectionError = class extends CabalSpyIDError {
+};
+var InvalidResponseError = class extends CabalSpyIDError {
+};
+var OAuthError = class extends CabalSpyIDError {
+  
+  
+  constructor(error, description, opts = {}) {
+    super(description ? `${error}: ${description}` : error, { ...opts, code: error });
+    this.error = error;
+    this.errorDescription = description;
+  }
+};
+var TokenVerificationError = class extends CabalSpyIDError {
+};
+var WebhookVerificationError = class extends CabalSpyIDError {
+};
+function errorFromStatus(status, body, rateLimit, retryAfter, fallbackMessage) {
+  const opts = {
+    status,
+    code: _nullishCoalesce(_optionalChain([body, 'optionalAccess', _ => _.code]), () => ( `http_${status}`)),
+    requestId: _optionalChain([body, 'optionalAccess', _2 => _2.request_id]),
+    docs: _optionalChain([body, 'optionalAccess', _3 => _3.docs]),
+    parameter: _optionalChain([body, 'optionalAccess', _4 => _4.parameter]),
+    allowed: _optionalChain([body, 'optionalAccess', _5 => _5.allowed]),
+    rateLimit,
+    body: _nullishCoalesce(body, () => ( void 0))
+  };
+  const msg = _nullishCoalesce(_optionalChain([body, 'optionalAccess', _6 => _6.message]), () => ( fallbackMessage));
+  if (status === 400) return new BadRequestError(msg, opts);
+  if (status === 401) return new AuthenticationError(msg, opts);
+  if (status === 403) {
+    return _optionalChain([body, 'optionalAccess', _7 => _7.code]) === "plan_user_limit" ? new PlanUserLimitError(msg, opts) : new PermissionError(msg, opts);
+  }
+  if (status === 404) return new NotFoundError(msg, opts);
+  if (status === 429) return new RateLimitError(msg, { ...opts, retryAfter });
+  if (status >= 500) return new ServerError(msg, opts);
+  return new CabalSpyIDError(msg, opts);
+}
+function isRetryable(err) {
+  return err instanceof RateLimitError || err instanceof ServerError || err instanceof ConnectionError;
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.EMPTY_RATE_LIMIT = EMPTY_RATE_LIMIT; exports.CabalSpyIDError = CabalSpyIDError; exports.BadRequestError = BadRequestError; exports.AuthenticationError = AuthenticationError; exports.PermissionError = PermissionError; exports.PlanUserLimitError = PlanUserLimitError; exports.NotFoundError = NotFoundError; exports.RateLimitError = RateLimitError; exports.ServerError = ServerError; exports.ConnectionError = ConnectionError; exports.InvalidResponseError = InvalidResponseError; exports.OAuthError = OAuthError; exports.TokenVerificationError = TokenVerificationError; exports.WebhookVerificationError = WebhookVerificationError; exports.errorFromStatus = errorFromStatus; exports.isRetryable = isRetryable;
+//# sourceMappingURL=chunk-ABFIPCBY.cjs.map

package/dist/chunk-ABFIPCBY.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/cabalspy-id-js/cabalspy-id-js/dist/chunk-ABFIPCBY.cjs","../src/errors.ts"],"names":[],"mappings":"AAAA;ACYO,IAAM,iBAAA,EAAkC,MAAA,CAAO,MAAA,CAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,KAAK,CAAC,CAAA;AA4BnG,IAAM,gBAAA,EAAN,MAAA,QAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,KAAA,EAA+B,CAAC,CAAA,EAAG;AAC9D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,KAAA,EAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,OAAA,mBAAS,IAAA,CAAK,MAAA,UAAU,GAAA;AAC7B,IAAA,IAAA,CAAK,KAAA,mBAAO,IAAA,CAAK,IAAA,UAAQ,iBAAA;AACzB,IAAA,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,OAAA;AACpB,IAAA,IAAA,CAAK,UAAA,mBAAY,IAAA,CAAK,SAAA,UAAa,EAAE,GAAG,iBAAiB,GAAA;AACzD,IAAA,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,IAAA;AACjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF,CAAA;AAGO,IAAM,gBAAA,EAAN,MAAA,QAA8B,gBAAgB;AAAC,CAAA;AAE/C,IAAM,oBAAA,EAAN,MAAA,QAAkC,gBAAgB;AAAC,CAAA;AAEnD,IAAM,gBAAA,EAAN,MAAA,QAA8B,gBAAgB;AAAC,CAAA;AAK/C,IAAM,mBAAA,YAAN,MAAA,QAAiC,gBAAgB;AAAA,iBAC7C,QAAA,EAAU,KAAA;AACrB,UAAA;AAEO,IAAM,cAAA,EAAN,MAAA,QAA4B,gBAAgB;AAAC,CAAA;AAE7C,IAAM,eAAA,EAAN,MAAA,QAA6B,gBAAgB;AAAA;AAAA,EAEzC;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,KAAA,EAAgE,CAAC,CAAA,EAAG;AAC/F,IAAA,KAAA,CAAM,OAAA,EAAS,IAAI,CAAA;AACnB,IAAA,IAAA,CAAK,WAAA,mBAAa,IAAA,CAAK,UAAA,UAAc,MAAA;AAAA,EACvC;AACF,CAAA;AAEO,IAAM,YAAA,EAAN,MAAA,QAA0B,gBAAgB;AAAC,CAAA;AAE3C,IAAM,gBAAA,EAAN,MAAA,QAA8B,gBAAgB;AAAC,CAAA;AAE/C,IAAM,qBAAA,EAAN,MAAA,QAAmC,gBAAgB;AAAC,CAAA;AAOpD,IAAM,WAAA,EAAN,MAAA,QAAyB,gBAAgB;AAAA,EACrC;AAAA,EACA;AAAA,EACT,WAAA,CAAY,KAAA,EAAe,WAAA,EAAsB,KAAA,EAA+B,CAAC,CAAA,EAAG;AAClF,IAAA,KAAA,CAAM,YAAA,EAAc,CAAA,EAAA;AACP,IAAA;AACR,IAAA;AACP,EAAA;AACF;AAGa;AAAgD;AAGhD;AAAkD;AAI7D;AAMqC,EAAA;AACnC,IAAA;AACoB,IAAA;AACH,IAAA;AACL,IAAA;AACK,IAAA;AACF,IAAA;AACf,IAAA;AACc,IAAA;AAChB,EAAA;AACkB,EAAA;AAEE,EAAA;AACA,EAAA;AACA,EAAA;AACL,IAAA;AACf,EAAA;AACoB,EAAA;AACA,EAAA;AACD,EAAA;AACR,EAAA;AACb;AAE4B;AACJ,EAAA;AACxB;AD9DyB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/cabalspy-id-js/cabalspy-id-js/dist/chunk-ABFIPCBY.cjs","sourcesContent":[null,"// ═══════════════════════════════════════════════════════════════════════════\n//  ERRORS\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport interface RateLimitInfo {\n  /** Requests per second allowed by the plan. `null` when the header is absent. */\n  limit: number | null;\n  remaining: number | null;\n  /** Seconds until the current one-second window resets. */\n  reset: number | null;\n}\n\nexport const EMPTY_RATE_LIMIT: RateLimitInfo = Object.freeze({ limit: null, remaining: null, reset: null });\n\n/** Error body of the Data API: `{\"success\": false, \"error\": {...}}`. */\nexport interface ApiErrorBody {\n  code: string;\n  message: string;\n  request_id: string;\n  /** Link to the error's documentation, e.g. https://docs.cabalspy.xyz/cabalspy-id/errors#wallet_not_found */\n  docs: string;\n  parameter?: string;\n  allowed?: unknown[];\n  /** Set on `plan_user_limit`. */\n  limited?: boolean;\n  [key: string]: unknown;\n}\n\nexport interface CabalSpyIDErrorOptions {\n  status?: number;\n  code?: string;\n  requestId?: string;\n  docs?: string;\n  parameter?: string;\n  allowed?: unknown[];\n  rateLimit?: RateLimitInfo;\n  body?: unknown;\n}\n\n/** Base class for every error thrown by this SDK. */\nexport class CabalSpyIDError extends Error {\n  readonly status: number;\n  readonly code: string;\n  readonly requestId?: string;\n  readonly docs?: string;\n  readonly parameter?: string;\n  readonly allowed?: unknown[];\n  readonly rateLimit: RateLimitInfo;\n  /** The parsed response body, when there was one. */\n  readonly body?: unknown;\n\n  constructor(message: string, opts: CabalSpyIDErrorOptions = {}) {\n    super(message);\n    this.name = new.target.name;\n    this.status = opts.status ?? 0;\n    this.code = opts.code ?? 'unknown_error';\n    this.requestId = opts.requestId;\n    this.docs = opts.docs;\n    this.parameter = opts.parameter;\n    this.allowed = opts.allowed;\n    this.rateLimit = opts.rateLimit ?? { ...EMPTY_RATE_LIMIT };\n    this.body = opts.body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** 400 — missing_parameter, invalid_parameter, instance_required */\nexport class BadRequestError extends CabalSpyIDError {}\n/** 401 — missing_api_key; thesis API: client_id_required, invalid_client */\nexport class AuthenticationError extends CabalSpyIDError {}\n/** 403 — invalid_api_key, product_not_enabled, no_instance, scope_not_allowed; thesis API: origin_not_allowed */\nexport class PermissionError extends CabalSpyIDError {}\n/**\n * 403 — plan_user_limit. The person signed in beyond the plan's user limit:\n * the platform receives no data for them until it upgrades.\n */\nexport class PlanUserLimitError extends PermissionError {\n  readonly limited = true as const;\n}\n/** 404 — profile_not_found, wallet_not_found, instance_not_found */\nexport class NotFoundError extends CabalSpyIDError {}\n/** 429 — rate_limit_exceeded; thesis API: rate_limited (Retry-After 60) */\nexport class RateLimitError extends CabalSpyIDError {\n  /** Seconds until the next request is allowed, taken from Retry-After. */\n  readonly retryAfter: number | null;\n  constructor(message: string, opts: CabalSpyIDErrorOptions & { retryAfter?: number | null } = {}) {\n    super(message, opts);\n    this.retryAfter = opts.retryAfter ?? null;\n  }\n}\n/** 5xx — internal_error, service_unavailable */\nexport class ServerError extends CabalSpyIDError {}\n/** Network failure, timeout or aborted connection. */\nexport class ConnectionError extends CabalSpyIDError {}\n/** Response was not valid JSON, or did not have the expected envelope. */\nexport class InvalidResponseError extends CabalSpyIDError {}\n\n/**\n * An error from the OpenID Connect endpoints (`/oauth/token`, `/oauth/userinfo`,\n * `/oauth/revoke`) or from the authorization redirect, in OAuth's own format:\n * `code` is the OAuth `error` (invalid_grant, invalid_client, access_denied …).\n */\nexport class OAuthError extends CabalSpyIDError {\n  readonly error: string;\n  readonly errorDescription?: string;\n  constructor(error: string, description?: string, opts: CabalSpyIDErrorOptions = {}) {\n    super(description ? `${error}: ${description}` : error, { ...opts, code: error });\n    this.error = error;\n    this.errorDescription = description;\n  }\n}\n\n/** An ID or access token failed verification (signature, iss, aud, exp, nonce …). */\nexport class TokenVerificationError extends CabalSpyIDError {}\n\n/** A webhook failed signature or timestamp verification. */\nexport class WebhookVerificationError extends CabalSpyIDError {}\n\n/** Maps an HTTP status and Data API error body onto the right error class. */\nexport function errorFromStatus(\n  status: number,\n  body: ApiErrorBody | null,\n  rateLimit: RateLimitInfo,\n  retryAfter: number | null,\n  fallbackMessage: string,\n): CabalSpyIDError {\n  const opts: CabalSpyIDErrorOptions = {\n    status,\n    code: body?.code ?? `http_${status}`,\n    requestId: body?.request_id,\n    docs: body?.docs,\n    parameter: body?.parameter,\n    allowed: body?.allowed,\n    rateLimit,\n    body: body ?? undefined,\n  };\n  const msg = body?.message ?? fallbackMessage;\n\n  if (status === 400) return new BadRequestError(msg, opts);\n  if (status === 401) return new AuthenticationError(msg, opts);\n  if (status === 403) {\n    return body?.code === 'plan_user_limit' ? new PlanUserLimitError(msg, opts) : new PermissionError(msg, opts);\n  }\n  if (status === 404) return new NotFoundError(msg, opts);\n  if (status === 429) return new RateLimitError(msg, { ...opts, retryAfter });\n  if (status >= 500) return new ServerError(msg, opts);\n  return new CabalSpyIDError(msg, opts);\n}\n\nexport function isRetryable(err: unknown): boolean {\n  return err instanceof RateLimitError || err instanceof ServerError || err instanceof ConnectionError;\n}\n"]}

package/dist/chunk-CJFIOVBA.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-CJFIOVBA.js.map

package/dist/chunk-CJFIOVBA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}