feat(sdk): sign preview generation requests

[rickyrombo]

Stacked on #14550. Review that first — this branch contains only the commit on top of it.

Why previews need signing

generatePreview asks a storage node to slice new bytes out of a cid. The node attests the resulting cid on chain so it can be named as a track's preview_cid — and it will only do that for a user who already claims the source audio. So the request has to say who is asking.

Without that check the endpoint is a gating bypass. Previews stream publicly, and they are 30 seconds long, so an attacker could generate previews of a gated track at offsets 0/30/60/…, name each on a throwaway track of their own, and reassemble the full 320. Requiring a signature and refusing unless the caller owns the source kills that at the door.

What changed

generatePreview takes an optional userId and, when a wallet is configured, signs with signUpload from #14550 — the same EIP-712 payload audio uploads use, passed as signature/userId/timestamp query parameters. Reusing it rather than inventing a second scheme means both audio paths recover a signer through one code path on the node side too.

Both call sites in TracksApi pass the acting user: the uploadTrack fallback that generates a preview when the upload did not, and updateTrack with generatePreview: true. The second is the one that matters most — it has no audio upload at all, so this endpoint is its only route to a preview cid.

Unsigned still works

No wallet or no user id sends the request unsigned, matching uploadFile. Nodes accept those where content authorization is not enforced; the preview just never earns a claim, so it cannot be named on a track once enforcement is on. That makes this safe to land ahead of the gate but means it has to ship before the gate opens.

Testing

Typechecks clean. The SDK's vitest suites do not run in my environment — StorageNodeSelector.test.ts and signUpload.test.ts both fail at collection with TypeError: Object.defineProperty called on non-object, and they fail identically on a clean tree with none of these changes, so it is environmental rather than caused by this branch. These changes have not been exercised by a running test.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 7c6f6d9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@audius/sdk	Minor
@audius/sdk-legacy	Patch
@audius/protocol-dashboard	Patch
@audius/sp-actions	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR