feat(crypto): add createAuthChainHeaders utility

[decentraland-bot]

Summary

• Adds a createAuthChainHeaders(authChain, timestamp, metadata?) export to @dcl/crypto, placed in libs/crypto/src/headers.ts next to the AUTH_CHAIN_HEADER_PREFIX / AUTH_TIMESTAMP_HEADER / AUTH_METADATA_HEADER constants it serializes into.
• Serialization only — it does not sign anything. Building/signing the AuthChain remains Authenticator.signPayload's job.
• Returns a plain Record<string, string> headers object (not a JSON blob), so HTTP consumers can spread it directly into fetch headers, while consumers needing a serialized blob (e.g. Pulse's proto auth_chain field) can JSON.stringify() the result themselves.
• Purely additive — no existing exports or signatures changed. Already re-exported automatically via libs/crypto/src/index.ts's export * from './headers'.
• Adds a minor changeset for @dcl/crypto.

Why

This exact serialization logic is currently duplicated in the ecosystem:

• libs/crypto-middleware/src/createAuthChainHeaders.ts (this same monorepo) — its own copy, already importing the header-name constants from @dcl/crypto via a deprecated re-export.
• @dcl/pulse-client's buildAuthChain — the serialization half.

Centralizing it in @dcl/crypto removes that duplication and keeps the serialization next to the constants it depends on. Migrating libs/crypto-middleware and @dcl/pulse-client onto this shared implementation is a follow-up, gated on a published @dcl/crypto release containing this change.

Plan

1. Explored libs/crypto conventions: headers.ts houses the three signed-fetch header constants; AuthChain is defined in libs/crypto/src/types.ts (re-exported from @dcl/schemas); tests use Jest with nested describe/when/it blocks (mirrored from libs/crypto/test/unit/sanity.spec.ts and libs/crypto-middleware/test/unit/helpers.spec.ts, which has its own createAuthChainHeaders test as a direct behavioral reference); the repo uses @changesets/cli for versioning; scripts are build (tsc), test (jest), lint/lint:fix (eslint, prettier-integrated).
2. Implemented createAuthChainHeaders in libs/crypto/src/headers.ts, importing the existing constants and the AuthChain type — no redefinition.
3. Added libs/crypto/test/unit/headers.spec.ts covering: multi-link chain → one AUTH_CHAIN_HEADER_PREFIX{i} entry per link (JSON-stringified); single-link chain; timestamp stringification; metadata defaulting to {} when omitted; metadata JSON-stringified when provided. (No round-trip test: the header-parsing counterpart, extractAuthChain/verify, lives in the separate @dcl/crypto-middleware package, not in @dcl/crypto itself.)
4. Added a minor changeset (@dcl/crypto gains a new public export).
5. Verified the full gate: package-level build/test/lint for libs/crypto, then repo-wide pnpm build / pnpm lint / pnpm test (all 9 workspace packages) and pnpm changeset status --since=origin/main (correctly reports @dcl/crypto for a minor bump, with internal dependents auto-bumped patch per updateInternalDependencies).

Changes

.changeset/crypto-create-auth-chain-headers.md |  5 ++
libs/crypto/src/headers.ts                     | 28 +++++++++++
libs/crypto/test/unit/headers.spec.ts          | 67 ++++++++++++++++++++++++++
3 files changed, 100 insertions(+)

Testing

• pnpm build (repo-wide, 9 packages) — pass
• pnpm lint (repo-wide) — pass (one prettier formatting issue in the new test file was auto-fixed via lint:fix)
• pnpm test (repo-wide) — pass, including 5 new assertions in libs/crypto/test/unit/headers.spec.ts (55/55 tests passing in libs/crypto)
• pnpm changeset status --since=origin/main — confirms @dcl/crypto is queued for a minor bump

Closes

Closes #53

---

🤖 Created via Slack with Claude
Requested by Gabriel Díaz via Slack