@b3dotfun/sdk 0.1.70-alpha.2 → 0.1.70-alpha.21

package/dist/cjs/global-account/better-auth-client.js

@@ -2,16 +2,41 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.betterAuthClient = void 0;
 exports.createB3BetterAuthClient = createB3BetterAuthClient;
+exports.getBetterAuthClient = getBetterAuthClient;
+exports.resetBetterAuthClient = resetBetterAuthClient;
 const client_1 = require("better-auth/client");
+const plugins_1 = require("better-auth/client/plugins");
 const app_shared_1 = require("../app.shared");
-function createB3BetterAuthClient(baseURL = app_shared_1.B3_API_URL) {
+function createB3BetterAuthClient(baseURL) {
     return (0, client_1.createAuthClient)({
-        baseURL,
+        baseURL: baseURL ?? (0, app_shared_1.getB3ApiUrl)(),
         basePath: "/auth",
         fetchOptions: {
             credentials: "include",
         },
+        plugins: [(0, plugins_1.twoFactorClient)()],
     });
 }
-// Default singleton for standard usage
+// Lazily-initialized singleton. Recreated when the API URL changes via
+// `resetBetterAuthClient()` (called by B3Provider when `apiUrl` changes).
+let _client = null;
+let _clientUrl = null;
+/** Get the shared BetterAuth client, creating it if needed. */
+function getBetterAuthClient() {
+    const url = (0, app_shared_1.getB3ApiUrl)();
+    if (!_client || _clientUrl !== url) {
+        _client = createB3BetterAuthClient(url);
+        _clientUrl = url;
+    }
+    return _client;
+}
+/** Force-recreate the client on next access (e.g. after API URL change). */
+function resetBetterAuthClient() {
+    _client = null;
+    _clientUrl = null;
+}
+/**
+ * @deprecated Use `getBetterAuthClient()` instead. This static singleton
+ * does not reflect runtime API URL changes via `B3Provider apiUrl` prop.
+ */
 exports.betterAuthClient = createB3BetterAuthClient();

package/dist/cjs/global-account/bsmnt.d.ts

@@ -1,5 +1,5 @@
 declare const app: import("@b3dotfun/basement-api").ClientApplication;
-export declare const authenticate: (accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<import("@feathersjs/authentication").AuthenticationResult | null>;
+export declare const authenticate: (accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<Record<string, any> | null>;
 export declare const resetSocket: () => void;
-export declare const authenticateWithB3JWT: (fullToken: string, params?: Record<string, any>) => Promise<import("@feathersjs/authentication").AuthenticationResult | null>;
+export declare const authenticateWithB3JWT: (fullToken: string, params?: Record<string, any>) => Promise<Record<string, any> | null>;
 export default app;

package/dist/cjs/global-account/bsmnt.native.d.ts

@@ -1,5 +1,5 @@
 import { MMKV } from "react-native-mmkv";
 export declare const localStoreInstance: MMKV;
 declare const app: import("@b3dotfun/basement-api").ClientApplication;
-export declare const authenticate: (accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<import("@feathersjs/authentication").AuthenticationResult | null>;
+export declare const authenticate: (accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<Record<string, any> | null>;
 export default app;

package/dist/cjs/global-account/client-manager.d.ts

@@ -1,5 +1,7 @@
 import { ClientApplication } from "@b3dotfun/b3-api";
 export type ClientType = "socket" | "rest";
+/** Reset all cached clients (called when API URL changes). */
+export declare function resetClients(): void;
 /**
  * Sets the active client type and creates the appropriate client
  *
@@ -25,20 +27,20 @@ export declare function resetSocket(): void;
 /**
  * Authenticates with the current active client
  */
-export declare const authenticate: (accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<import("@feathersjs/authentication").AuthenticationResult | null>;
+export declare const authenticate: (accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<Record<string, any> | null>;
 /**
  * Authenticates with a specific client type
  */
-export declare const authenticateWithClient: (clientType: ClientType, accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<import("@feathersjs/authentication").AuthenticationResult | null>;
+export declare const authenticateWithClient: (clientType: ClientType, accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<Record<string, any> | null>;
 /**
  * Authenticates with both clients in parallel (useful for migration scenarios)
  */
 export declare const authenticateBoth: (accessToken: string, identityToken: string, params?: Record<string, any>) => Promise<{
-    socket: import("@feathersjs/authentication").AuthenticationResult | null;
-    rest: import("@feathersjs/authentication").AuthenticationResult | null;
+    socket: Record<string, any> | null;
+    rest: Record<string, any> | null;
     success: boolean;
 }>;
 /**
  * Switches the client type and authenticates
  */
-export declare function switchClientAndAuth(type: ClientType, access: string, id: string, params?: any): Promise<import("@feathersjs/authentication").AuthenticationResult | null>;
+export declare function switchClientAndAuth(type: ClientType, access: string, id: string, params?: any): Promise<Record<string, any> | null>;

package/dist/cjs/global-account/client-manager.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authenticateBoth = exports.authenticateWithClient = exports.authenticate = void 0;
+exports.resetClients = resetClients;
 exports.setClientType = setClientType;
 exports.getClient = getClient;
 exports.getClientType = getClientType;
@@ -21,15 +22,50 @@ let currentClient = null;
 // Socket client instance
 let socketClient = null;
 let socketInstance = null;
+let socketClientUrl = null;
 // REST client instance
 let restClient = null;
+let restClientUrl = null;
+// The pinned @b3dotfun/b3-api client's generated usersMethods predates `setBio`,
+// so `users.setBio(...)` throws "setBio is not a function". Re-register the users
+// service with the full list (mirrors users.shared.ts). Remove once the
+// @b3dotfun/b3-api pin includes setBio.
+const USERS_METHODS = [
+    "find",
+    "get",
+    "create",
+    "patch",
+    "remove",
+    "setReferralCode",
+    "syncTwProfiles",
+    "setAvatar",
+    "setBio",
+    "registerUsername",
+    "getMe",
+];
+// Re-register on every client the manager builds — the active transport
+// (REST/socket) switches at runtime.
+function ensureUsersCustomMethods(client) {
+    try {
+        const connection = client.get("connection");
+        if (connection?.service) {
+            client.use("users", connection.service("users"), { methods: USERS_METHODS });
+        }
+    }
+    catch {
+        // Non-fatal: keep whatever methods the generated client already exposes.
+    }
+}
 /**
  * Creates a socket client
  */
 function createSocketClient() {
-    if (!socketClient) {
-        socketInstance = (0, socket_io_client_1.default)(app_shared_1.B3_API_URL, { transports: ["websocket"] });
+    const url = (0, app_shared_1.getB3ApiUrl)();
+    if (!socketClient || socketClientUrl !== url) {
+        socketInstance = (0, socket_io_client_1.default)(url, { transports: ["websocket"] });
         socketClient = (0, b3_api_1.createClient)((0, socketio_client_1.default)(socketInstance), app_shared_1.clientOptions);
+        ensureUsersCustomMethods(socketClient);
+        socketClientUrl = url;
     }
     return socketClient;
 }
@@ -45,12 +81,23 @@ function resolveFetch() {
     return require("cross-fetch").fetch;
 }
 function createRestClient() {
-    if (!restClient) {
-        const connection = (0, rest_client_1.default)(app_shared_1.B3_API_URL).fetch(resolveFetch());
+    const url = (0, app_shared_1.getB3ApiUrl)();
+    if (!restClient || restClientUrl !== url) {
+        const connection = (0, rest_client_1.default)(url).fetch(resolveFetch());
         restClient = (0, b3_api_1.createClient)(connection, app_shared_1.clientOptions);
+        ensureUsersCustomMethods(restClient);
+        restClientUrl = url;
     }
     return restClient;
 }
+/** Reset all cached clients (called when API URL changes). */
+function resetClients() {
+    socketClient = null;
+    socketClientUrl = null;
+    restClient = null;
+    restClientUrl = null;
+    currentClient = null;
+}
 /**
  * Sets the active client type and creates the appropriate client
  *

package/dist/cjs/global-account/react/components/AvatarEditor/AvatarEditor.js

@@ -12,13 +12,12 @@ const profileDisplay_1 = require("../../../../global-account/react/utils/profile
 const cn_1 = require("../../../../shared/utils/cn");
 const debug_1 = require("../../../../shared/utils/debug");
 const ipfs_1 = require("../../../../shared/utils/ipfs");
-const thirdweb_1 = require("../../../../shared/utils/thirdweb");
+const upload_1 = require("../../../../shared/utils/upload");
 const lucide_react_1 = require("lucide-react");
 const react_2 = require("react");
 const react_easy_crop_1 = __importDefault(require("react-easy-crop"));
 require("react-easy-crop/react-easy-crop.css");
 const react_3 = require("thirdweb/react");
-const storage_1 = require("thirdweb/storage");
 const stores_1 = require("../../stores");
 const ModalHeader_1 = __importDefault(require("../ModalHeader/ModalHeader"));
 const debug = (0, debug_1.debugB3React)("AvatarEditor");
@@ -201,18 +200,14 @@ function AvatarEditor({ onSetAvatar, className }) {
                     return;
                 }
             }
-            // Upload to IPFS if we have a file
+            // Upload file if we have one
             if (fileToUpload) {
-                debug("Starting upload to IPFS", fileToUpload);
-                // Upload to IPFS using Thirdweb
-                const ipfsUrl = await (0, storage_1.upload)({
-                    client: thirdweb_1.client,
-                    files: [fileToUpload],
-                });
-                debug("Upload successful", ipfsUrl);
+                debug("Starting upload", fileToUpload);
+                const avatarUrl = await (0, upload_1.uploadFile)(fileToUpload);
+                debug("Upload successful", avatarUrl);
                 // Save avatar URL using profiles service
                 const user = await app_1.default.service("users").setAvatar({
-                    avatar: ipfsUrl,
+                    avatar: avatarUrl,
                 }, 
                 // @ts-expect-error - our typed client is expecting context even though it's set elsewhere
                 {});

package/dist/cjs/global-account/react/components/B3Provider/B3ConfigProvider.d.ts

@@ -30,3 +30,14 @@ export declare function B3ConfigProvider({ children, accountOverride, environmen
     authStrategy?: AuthStrategy;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useB3Config(): B3ConfigContextType;
+/**
+ * Overrides ONLY `partnerId` for a subtree, inheriting every other config value from the parent
+ * B3ConfigProvider. Lets a single route attribute its AnySpend orders/quotes to a different partner
+ * (e.g. `/b3os-deposit` → the b3os partner) without standing up a second B3Provider — the config
+ * context is separate from the wallet/modal machinery, so nothing re-initializes. Must be rendered
+ * inside an existing B3ConfigProvider.
+ */
+export declare function B3ConfigPartnerOverride({ partnerId, children }: {
+    partnerId: string;
+    children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;

package/dist/cjs/global-account/react/components/B3Provider/B3ConfigProvider.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.B3ConfigProvider = B3ConfigProvider;
 exports.useB3Config = useB3Config;
+exports.B3ConfigPartnerOverride = B3ConfigPartnerOverride;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 /**
@@ -35,3 +36,14 @@ function useB3Config() {
     }
     return context;
 }
+/**
+ * Overrides ONLY `partnerId` for a subtree, inheriting every other config value from the parent
+ * B3ConfigProvider. Lets a single route attribute its AnySpend orders/quotes to a different partner
+ * (e.g. `/b3os-deposit` → the b3os partner) without standing up a second B3Provider — the config
+ * context is separate from the wallet/modal machinery, so nothing re-initializes. Must be rendered
+ * inside an existing B3ConfigProvider.
+ */
+function B3ConfigPartnerOverride({ partnerId, children }) {
+    const parent = useB3Config();
+    return (0, jsx_runtime_1.jsx)(B3ConfigContext.Provider, { value: { ...parent, partnerId }, children: children });
+}

package/dist/cjs/global-account/react/components/B3Provider/B3Provider.d.ts

@@ -10,7 +10,7 @@ import { ClientType } from "../../../client-manager";
 /**
  * Main B3Provider component
  */
-export declare function B3Provider({ theme, children, accountOverride, environment, automaticallySetFirstEoa, defaultEoaProvider, simDuneApiKey, toaster: _toaster, clientType, rpcUrls, partnerId, stripePublishableKey, onConnect, onLogout, connectors, overrideDefaultConnectors, createClientReferenceId, defaultPermissions, disableBSMNTAuthentication, queryClient, authStrategy, }: {
+export declare function B3Provider({ theme, children, accountOverride, environment, automaticallySetFirstEoa, defaultEoaProvider, toaster: _toaster, clientType, rpcUrls, partnerId, stripePublishableKey, onConnect, onLogout, connectors, overrideDefaultConnectors, createClientReferenceId, defaultPermissions, disableBSMNTAuthentication, queryClient, authStrategy, apiUrl, notificationsApiUrl, }: {
     theme: "light" | "dark";
     children: React.ReactNode;
     accountOverride?: Account;
@@ -18,7 +18,6 @@ export declare function B3Provider({ theme, children, accountOverride, environme
     automaticallySetFirstEoa?: boolean;
     /** EIP-1193 provider to auto-connect as the default EOA wallet (e.g., Farcaster frame wallet) */
     defaultEoaProvider?: EIP1193.EIP1193Provider;
-    simDuneApiKey?: string;
     toaster?: {
         position?: "top-center" | "top-right" | "bottom-center" | "bottom-right";
         style?: React.CSSProperties;
@@ -39,4 +38,15 @@ export declare function B3Provider({ theme, children, accountOverride, environme
     queryClient?: QueryClient;
     /** Auth strategy: "thirdweb" (default, ecosystem wallet) or "better-auth" (email/password via Better Auth) */
     authStrategy?: AuthStrategy;
+    /**
+     * Override the B3 API URL. When provided, all SDK requests (auth, Feathers,
+     * BetterAuth) will use this URL instead of the `NEXT_PUBLIC_B3_API` env var.
+     *
+     * Useful for local development: pass `http://localhost:3031` to route
+     * OAuth callbacks and session checks through your local B3 API.
+     * If omitted, defaults to `NEXT_PUBLIC_B3_API` or `https://api.b3.fun`.
+     */
+    apiUrl?: string;
+    /** Override the notifications worker URL. Defaults to `https://notifications.b3.fun`. */
+    notificationsApiUrl?: string;
 }): import("react/jsx-runtime").JSX.Element;

package/dist/cjs/global-account/react/components/B3Provider/B3Provider.js

@@ -12,18 +12,40 @@ const react_2 = require("../../../../wallet/react");
 require("@relayprotocol/relay-kit-ui/styles.css");
 const react_3 = require("react");
 const client_manager_1 = require("../../../client-manager");
+const app_shared_1 = require("../../../../app.shared");
+const api_1 = require("../../../../notifications/services/api");
+const better_auth_client_1 = require("../../../better-auth-client");
 const StyleRoot_1 = require("../StyleRoot");
 const index_1 = require("../Toast/index");
 const AuthenticationProvider_1 = __importDefault(require("./AuthenticationProvider"));
 const B3ConfigProvider_1 = require("./B3ConfigProvider");
 const BetterAuthProvider_1 = __importDefault(require("./BetterAuthProvider"));
 const LocalSDKProvider_1 = require("./LocalSDKProvider");
+const NOTIFICATIONS_URL_BY_ENV = {
+    development: "https://dev-notifications.b3.fun",
+    production: "https://notifications.b3.fun",
+};
 /**
  * Main B3Provider component
  */
-function B3Provider({ theme = "light", children, accountOverride, environment, automaticallySetFirstEoa, defaultEoaProvider, simDuneApiKey, 
+function B3Provider({ theme = "light", children, accountOverride, environment, automaticallySetFirstEoa, defaultEoaProvider, 
 // deprecated since v0.0.87
-toaster: _toaster, clientType = "rest", rpcUrls, partnerId, stripePublishableKey, onConnect, onLogout, connectors, overrideDefaultConnectors = false, createClientReferenceId, defaultPermissions, disableBSMNTAuthentication = false, queryClient, authStrategy = "thirdweb", }) {
+toaster: _toaster, clientType = "rest", rpcUrls, partnerId, stripePublishableKey, onConnect, onLogout, connectors, overrideDefaultConnectors = false, createClientReferenceId, defaultPermissions, disableBSMNTAuthentication = false, queryClient, authStrategy = "thirdweb", apiUrl, notificationsApiUrl, }) {
+    // Override the B3 API URL when the `apiUrl` prop is provided.
+    // Must run before client initialization and auth providers mount.
+    (0, react_3.useEffect)(() => {
+        (0, app_shared_1.setB3ApiUrl)(apiUrl ?? null);
+        if (apiUrl) {
+            (0, better_auth_client_1.resetBetterAuthClient)();
+            (0, client_manager_1.resetClients)();
+        }
+        return () => {
+            (0, app_shared_1.setB3ApiUrl)(null);
+        };
+    }, [apiUrl]);
+    (0, react_3.useEffect)(() => {
+        (0, api_1.setApiUrl)(notificationsApiUrl ?? NOTIFICATIONS_URL_BY_ENV[environment ?? "production"]);
+    }, [notificationsApiUrl, environment]);
     // Initialize Google Analytics on mount
     (0, react_3.useEffect)(() => {
         (0, analytics_1.loadGA4Script)();
@@ -33,7 +55,7 @@ toaster: _toaster, clientType = "rest", rpcUrls, partnerId, stripePublishableKey
         (0, client_manager_1.setClientType)(clientType);
     }, [clientType]);
     const wagmiConfig = (0, react_3.useMemo)(() => (0, createWagmiConfig_1.createWagmiConfig)({ partnerId, rpcUrls, connectors, overrideDefaultConnectors }), [partnerId, rpcUrls, connectors, overrideDefaultConnectors]);
-    return ((0, jsx_runtime_1.jsx)(react_2.WalletProvider, { wagmiConfig: wagmiConfig, queryClient: queryClient, children: (0, jsx_runtime_1.jsx)(react_1.TooltipProvider, { children: (0, jsx_runtime_1.jsx)(index_1.ToastProvider, { children: (0, jsx_runtime_1.jsx)(LocalSDKProvider_1.LocalSDKProvider, { onConnectCallback: onConnect, onLogoutCallback: onLogout, disableBSMNTAuthentication: disableBSMNTAuthentication, children: (0, jsx_runtime_1.jsxs)(B3ConfigProvider_1.B3ConfigProvider, { accountOverride: accountOverride, environment: environment, automaticallySetFirstEoa: !!automaticallySetFirstEoa, theme: theme, clientType: clientType, partnerId: partnerId, stripePublishableKey: stripePublishableKey, createClientReferenceId: createClientReferenceId, defaultPermissions: defaultPermissions, authStrategy: authStrategy, children: [(0, jsx_runtime_1.jsx)(ToastContextConnector, {}), (0, jsx_runtime_1.jsxs)(react_1.RelayKitProviderWrapper, { simDuneApiKey: simDuneApiKey, children: [children, (0, jsx_runtime_1.jsx)(StyleRoot_1.StyleRoot, { id: "b3-root" })] }), authStrategy === "better-auth" ? ((0, jsx_runtime_1.jsx)(BetterAuthProvider_1.default, { partnerId: partnerId })) : ((0, jsx_runtime_1.jsx)(AuthenticationProvider_1.default, { partnerId: partnerId, automaticallySetFirstEoa: !!automaticallySetFirstEoa, defaultEoaProvider: defaultEoaProvider }))] }) }) }) }) }));
+    return ((0, jsx_runtime_1.jsx)(react_2.WalletProvider, { wagmiConfig: wagmiConfig, queryClient: queryClient, children: (0, jsx_runtime_1.jsx)(react_1.TooltipProvider, { children: (0, jsx_runtime_1.jsx)(index_1.ToastProvider, { children: (0, jsx_runtime_1.jsx)(LocalSDKProvider_1.LocalSDKProvider, { onConnectCallback: onConnect, onLogoutCallback: onLogout, disableBSMNTAuthentication: disableBSMNTAuthentication, children: (0, jsx_runtime_1.jsxs)(B3ConfigProvider_1.B3ConfigProvider, { accountOverride: accountOverride, environment: environment, automaticallySetFirstEoa: !!automaticallySetFirstEoa, theme: theme, clientType: clientType, partnerId: partnerId, stripePublishableKey: stripePublishableKey, createClientReferenceId: createClientReferenceId, defaultPermissions: defaultPermissions, authStrategy: authStrategy, children: [(0, jsx_runtime_1.jsx)(ToastContextConnector, {}), (0, jsx_runtime_1.jsxs)(react_1.RelayKitProviderWrapper, { children: [children, (0, jsx_runtime_1.jsx)(StyleRoot_1.StyleRoot, { id: "b3-root" })] }), authStrategy === "better-auth" ? ((0, jsx_runtime_1.jsx)(BetterAuthProvider_1.default, { partnerId: partnerId })) : ((0, jsx_runtime_1.jsx)(AuthenticationProvider_1.default, { partnerId: partnerId, automaticallySetFirstEoa: !!automaticallySetFirstEoa, defaultEoaProvider: defaultEoaProvider }))] }) }) }) }) }));
 }
 /**
  * Component to connect the toast context to the global toast API

package/dist/cjs/global-account/react/components/B3Provider/BetterAuthProvider.js

@@ -45,7 +45,7 @@ const BetterAuthProvider = ({ partnerId }) => {
         app_1.default.logout = async () => {
             debug("Patched logout: clearing Better Auth session");
             try {
-                await better_auth_client_1.betterAuthClient.signOut();
+                await (0, better_auth_client_1.getBetterAuthClient)().signOut();
             }
             catch {
                 debug("Better Auth signOut failed (non-critical)");
@@ -79,9 +79,50 @@ const BetterAuthProvider = ({ partnerId }) => {
             catch {
                 debug("No existing Feathers JWT");
             }
-            // 2. Check for a Better Auth session (e.g. after OAuth redirect sets a cookie)
+            // 2. Check for _ba_token in URL (OAuth callback with third-party cookie bypass).
+            //    When the API and frontend are on different domains, browsers with third-party
+            //    cookie blocking (Firefox TCP, Safari ITP, Chrome Privacy Sandbox) prevent the
+            //    better-auth.session_token cookie from being sent on cross-origin requests.
+            //    The B3 API injects the session token into the redirect URL as _ba_token,
+            //    allowing direct exchange without relying on cookies.
+            const params = new URLSearchParams(window.location.search);
+            const baToken = params.get("_ba_token");
+            if (baToken) {
+                debug("Found _ba_token in URL, exchanging for Feathers JWT");
+                // Clean the token from the URL immediately (security)
+                params.delete("_ba_token");
+                const cleanSearch = params.toString();
+                const cleanUrl = window.location.pathname + (cleanSearch ? `?${cleanSearch}` : "") + window.location.hash;
+                window.history.replaceState({}, "", cleanUrl);
+                try {
+                    const response = await app_1.default.authenticate({
+                        strategy: "better-auth",
+                        accessToken: baToken,
+                        partnerId,
+                    });
+                    if (response.accessToken) {
+                        js_cookie_1.default.set(constants_1.B3_AUTH_COOKIE_NAME, response.accessToken, {
+                            secure: true,
+                            sameSite: "Lax",
+                        });
+                    }
+                    if (response.user) {
+                        setUser(response.user);
+                        setIsAuthenticated(true);
+                        setIsConnected(true);
+                    }
+                    debug("_ba_token exchanged for Feathers JWT", { userId: response.user?.userId });
+                    setIsAuthenticating(false);
+                    return;
+                }
+                catch (err) {
+                    debug("_ba_token exchange failed", err);
+                }
+            }
+            // 3. Check for a Better Auth session via cookie (works when API and frontend
+            //    share a domain or when cookies aren't partitioned)
             try {
-                const session = await better_auth_client_1.betterAuthClient.getSession();
+                const session = await (0, better_auth_client_1.getBetterAuthClient)().getSession();
                 if (session.data?.session?.token) {
                     debug("Better Auth session found, exchanging for Feathers JWT", {
                         betterAuthUserId: session.data.user?.id,
@@ -110,7 +151,7 @@ const BetterAuthProvider = ({ partnerId }) => {
             catch {
                 debug("No Better Auth session to restore");
             }
-            // 3. Nothing found — show login UI
+            // 4. Nothing found — show login UI
             setIsAuthenticating(false);
         };
         restoreSession();

package/dist/cjs/global-account/react/components/B3Provider/RelayKitProviderWrapper.d.ts

@@ -1,4 +1,3 @@
-export declare function RelayKitProviderWrapper({ children, simDuneApiKey, }: {
+export declare function RelayKitProviderWrapper({ children }: {
     children: React.ReactNode;
-    simDuneApiKey?: string;
 }): import("react/jsx-runtime").JSX.Element;

package/dist/cjs/global-account/react/components/B3Provider/RelayKitProviderWrapper.js

@@ -5,7 +5,7 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const relay_kit_ui_1 = require("@relayprotocol/relay-kit-ui");
 const relay_sdk_1 = require("@relayprotocol/relay-sdk");
 const react_1 = require("react");
-function RelayKitProviderWrapper({ children, simDuneApiKey, }) {
+function RelayKitProviderWrapper({ children }) {
     const [relayChains, setRelayChains] = (0, react_1.useState)([]);
     (0, react_1.useEffect)(() => {
         const fetchChains = async () => {
@@ -14,16 +14,22 @@ function RelayKitProviderWrapper({ children, simDuneApiKey, }) {
         };
         fetchChains();
     }, []);
+    // Balances for Relay's token selector come from the b3-zerion-api Zerion proxy, not Relay's own Dune
+    // integration. Relay only fires the balance query when duneConfig.apiKey is set, so apiBaseUrl points
+    // it at our proxy; the proxy ignores the client-sent key and holds the real Zerion credential itself.
     return ((0, jsx_runtime_1.jsx)(relay_kit_ui_1.RelayKitProvider, { options: {
             baseApiUrl: relay_sdk_1.MAINNET_RELAY_API,
             source: "anyspend",
-            duneConfig: {
-                apiKey: simDuneApiKey,
-                apiBaseUrl: "https://api.sim.dune.com",
-            },
             chains: relayChains,
             privateChainIds: undefined,
             appName: "AnySpend",
             useGasFeeEstimations: true,
+            duneConfig: {
+                // Non-secret placeholder. Relay only fires its balance query when apiKey is defined; the value is sent
+                // as X-Sim-Api-Key to our proxy, which ignores it. The real Zerion key stays server-side in b3-zerion-api.
+                apiKey: "proxied-via-portfolio-api",
+                // Relay appends /v1/evm/balances/{address}. Our b3-zerion-api worker serves that route, backed by Zerion.
+                apiBaseUrl: "https://portfolio-api.b3.fun",
+            },
         }, children: (0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: children }) }));
 }

package/dist/cjs/global-account/react/components/ManageAccount/ContentTokens.js

@@ -47,7 +47,7 @@ function ContentTokens({ activeTab }) {
     const animationDirection = (0, react_2.useRef)(null);
     // === DATA FETCHING ===
     const account = (0, react_3.useActiveAccount)();
-    const { data: simBalance, refetch: refetchSimBalance, isLoading: isLoadingBalance } = (0, react_1.useSimBalance)(account?.address);
+    const { data: balances, refetch: refetchBalances, isLoading: isLoadingBalance, isError: isBalanceError, } = (0, react_1.usePortfolioBalance)(account?.address);
     // === BLOCKCHAIN INTERACTION ===
     const { switchChainAndExecute } = (0, react_1.useUnifiedChainSwitchAndExecute)();
     // === ANALYTICS ===
@@ -81,13 +81,13 @@ function ContentTokens({ activeTab }) {
     // === HELPER FUNCTION ===
     // Get current version of selected token from fresh balance data
     // 🔧 FIX: Prevents auto-navigation back to token list when balance refreshes
-    // The useSimBalance hook refreshes data, creating new token object references
+    // The balance hook refreshes data, creating new token object references
     // This helper ensures we always get the fresh token data instead of stale references
     const getCurrentSelectedToken = () => {
-        if (!selectedToken || !simBalance?.balances) {
+        if (!selectedToken || !balances) {
             return null;
         }
-        const found = simBalance.balances.find(token => token.chain_id === selectedToken.chain_id && token.address === selectedToken.address);
+        const found = balances.find(token => token.chain_id === selectedToken.chain_id && token.address === selectedToken.address);
         return found || null;
     };
     // ==================================================================================
@@ -153,11 +153,13 @@ function ContentTokens({ activeTab }) {
                     functionName: "transfer",
                     args: [recipientAddress, amountInWei],
                 });
-                const tx = await switchChainAndExecute(displayToken.chain_id, {
-                    to: displayToken.address === "native" ? recipientAddress : displayToken.address,
-                    data: sendTokenData,
-                    value: displayToken.address === "native" ? amountInWei : BigInt(0),
-                });
+                // A native send carries value and no calldata; an ERC-20 send carries calldata and no
+                // value. Branch on the explicit flag, never on the address: the native sentinel is a
+                // display detail, and taking the ERC-20 path for a native coin spends gas without moving
+                // anything.
+                const tx = await switchChainAndExecute(displayToken.chain_id, displayToken.is_native
+                    ? { to: recipientAddress, value: amountInWei }
+                    : { to: displayToken.address, data: sendTokenData, value: BigInt(0) });
                 if (tx) {
                     // Track successful send
                     sendAnalyticsEvent("send_token_button_click", {
@@ -183,7 +185,7 @@ function ContentTokens({ activeTab }) {
                 // Wait 1 second to make sure the tx is indexed on sim api.
                 setTimeout(async () => {
                     // Force refetch to bypass cache and get fresh balance data
-                    await refetchSimBalance();
+                    await refetchBalances();
                 }, 1000);
                 setIsSending(false);
             }
@@ -217,21 +219,27 @@ function ContentTokens({ activeTab }) {
         if (isLoadingBalance) {
             return (0, jsx_runtime_1.jsx)(LoadingIndicator, {});
         }
-        // Show empty state when no account or no balance data
-        if (!account?.address || !simBalance) {
+        // A wallet IS connected here — only the read failed. Prompting the user to connect would send
+        // them to fix something that is not broken.
+        // `isBalanceError` as well as the absent list: after a first success a later refetch failure
+        // keeps `data` populated, so `!balances` alone would show stale numbers as if they were fresh.
+        if (account?.address && (isBalanceError || !balances)) {
+            return ((0, jsx_runtime_1.jsxs)("div", { className: "flex flex-col items-center justify-center py-12 text-center", children: [(0, jsx_runtime_1.jsx)("div", { className: "bg-b3-line/50 mb-4 rounded-full p-4", children: (0, jsx_runtime_1.jsx)(lucide_react_1.Loader2, { className: "text-b3-foreground-muted h-8 w-8" }) }), (0, jsx_runtime_1.jsx)("h3", { className: "text-b3-grey font-neue-montreal-semibold mb-2", children: "Couldn't load your tokens" }), (0, jsx_runtime_1.jsx)("button", { onClick: () => refetchBalances(), className: "text-b3-foreground-muted font-neue-montreal-medium text-sm underline", children: "Try again" })] }));
+        }
+        if (!account?.address) {
             return ((0, jsx_runtime_1.jsxs)("div", { className: "flex flex-col items-center justify-center py-12 text-center", children: [(0, jsx_runtime_1.jsx)("div", { className: "bg-b3-line/50 mb-4 rounded-full p-4", children: (0, jsx_runtime_1.jsx)(lucide_react_1.Loader2, { className: "text-b3-foreground-muted h-8 w-8" }) }), (0, jsx_runtime_1.jsx)("h3", { className: "text-b3-grey font-neue-montreal-semibold mb-2", children: "No wallet connected" }), (0, jsx_runtime_1.jsx)("p", { className: "text-b3-foreground-muted font-neue-montreal-medium text-sm", children: "Connect your wallet to view token balances" })] }));
         }
         // === SMART FILTERING LOGIC ===
         // Filter tokens with value >= $1 to reduce noise from dust tokens
-        const filteredTokens = simBalance?.balances.filter(token => token.value_usd !== undefined && token.value_usd >= 1) || [];
+        const filteredTokens = balances?.filter(token => token.value_usd !== undefined && token.value_usd >= 1) || [];
         // 🧠 INTELLIGENT DISPLAY LOGIC:
         // Show all tokens automatically when filtering would be unhelpful:
         // 1. User explicitly requested to show all, OR
         // 2. No tokens with value >= $1 (user has only dust), OR
         // 3. 5 or fewer tokens with value >= $1 (not enough to warrant filtering)
         const shouldShowAllTokens = showAllTokens || filteredTokens.length === 0 || filteredTokens.length <= 5;
-        const tokensToShow = shouldShowAllTokens ? simBalance?.balances || [] : filteredTokens;
-        const hasHiddenTokens = !shouldShowAllTokens && (simBalance?.balances.length || 0) > filteredTokens.length;
+        const tokensToShow = shouldShowAllTokens ? balances || [] : filteredTokens;
+        const hasHiddenTokens = !shouldShowAllTokens && (balances?.length || 0) > filteredTokens.length;
         // Handle token selection and navigate to send form
         const handleTokenClick = (token) => {
             setSelectedToken(token);

package/dist/cjs/global-account/react/components/ManageAccount/NFTContent.js

@@ -9,7 +9,7 @@ const NFTContent = () => {
     const activeWallet = (0, react_1.useActiveWallet)();
     const activeAccount = activeWallet?.getAccount();
     const activeAddress = activeAccount?.address;
-    const { data: nfts, isLoading } = (0, hooks_1.useSimCollectibles)(activeAddress, [1, 8453], { filterSpam: true });
-    return ((0, jsx_runtime_1.jsx)("div", { style: { minHeight: "100px" }, children: nfts ? ((0, jsx_runtime_1.jsx)(__1.AccountAssets, { nfts: nfts, isLoading: isLoading })) : ((0, jsx_runtime_1.jsx)("div", { className: "py-12 text-center text-gray-500", children: "No NFTs found" })) }));
+    const { data: nfts, isLoading, isError } = (0, hooks_1.usePortfolioCollectibles)(activeAddress, [1, 8453], { filterSpam: true });
+    return ((0, jsx_runtime_1.jsx)("div", { style: { minHeight: "100px" }, children: isError ? ((0, jsx_runtime_1.jsx)("div", { className: "py-12 text-center text-gray-500", children: "Couldn't load your NFTs" })) : nfts ? ((0, jsx_runtime_1.jsx)(__1.AccountAssets, { nfts: nfts, isLoading: isLoading })) : ((0, jsx_runtime_1.jsx)("div", { className: "py-12 text-center text-gray-500", children: "No NFTs found" })) }));
 };
 exports.default = NFTContent;

package/dist/cjs/global-account/react/components/ManageAccount/ProfileSection.js

@@ -29,14 +29,16 @@ const ProfileSection = () => {
     const setB3ModalOpen = (0, react_1.useModalStore)(state => state.setB3ModalOpen);
     const setB3ModalContentType = (0, react_1.useModalStore)(state => state.setB3ModalContentType);
     const navigateBack = (0, react_1.useModalStore)(state => state.navigateBack);
-    const { data: simBalance } = (0, react_1.useSimBalance)(smartWalletAddress);
+    const { data: balances, isError: isBalanceError } = (0, react_1.usePortfolioBalance)(smartWalletAddress);
     const [imgError, setImgError] = (0, react_2.useState)(false);
     const handleImgError = (0, react_2.useCallback)(() => setImgError(true), []);
+    // Null while the holdings are unknown. Summing an absent list to $0.00 would report an empty
+    // portfolio to someone whose balances merely failed to load.
     const totalBalanceUsd = (0, react_2.useMemo)(() => {
-        if (!simBalance?.balances)
-            return 0;
-        return simBalance.balances.reduce((sum, token) => sum + (token.value_usd || 0), 0);
-    }, [simBalance]);
+        if (isBalanceError || !balances)
+            return null;
+        return balances.reduce((sum, token) => sum + (token.value_usd || 0), 0);
+    }, [balances, isBalanceError]);
     const handleEditAvatar = () => {
         setB3ModalOpen(true);
         setB3ModalContentType({
@@ -53,6 +55,6 @@ const ProfileSection = () => {
     }, [avatarSrc]);
     const currentUsername = user?.username || profile?.displayName || (0, utils_1.formatUsername)(profile?.name || "");
     const avatarSeed = eoaAddress || account?.address || smartWalletAddress || currentUsername || user?.email || "user";
-    return ((0, jsx_runtime_1.jsx)("div", { className: "flex items-center justify-between px-5 py-6", children: (0, jsx_runtime_1.jsxs)("div", { className: "global-account-profile flex items-center gap-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: "global-account-profile-avatar relative", children: [(0, jsx_runtime_1.jsx)("div", { className: "border-b3-line border-1 bg-b3-primary-wash size-14 overflow-hidden rounded-full border", children: avatarSrc && !imgError ? ((0, jsx_runtime_1.jsx)(IPFSMediaRenderer_1.IPFSMediaRenderer, { src: avatarSrc, alt: "Profile Avatar", className: "h-full w-full object-cover", onError: handleImgError })) : ((0, jsx_runtime_1.jsx)(boring_avatars_1.default, { name: avatarSeed, variant: "beam", size: 56, colors: constants_1.AVATAR_COLORS })) }), (0, jsx_runtime_1.jsx)("button", { onClick: handleEditAvatar, className: "border-b3-background hover:bg-b3-grey/80 absolute -bottom-1 -right-1 flex size-6 items-center justify-center rounded-full border-4 bg-[#a0a0ab] transition-colors", children: (0, jsx_runtime_1.jsx)(lucide_react_1.Pencil, { size: 10, className: "text-b3-background" }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "global-account-profile-info flex flex-col gap-1", children: [!isBetterAuth && ((0, jsx_runtime_1.jsxs)("h2", { className: "text-b3-grey font-neue-montreal-semibold flex h-[38px] items-center gap-1 text-xl", children: [(0, jsx_runtime_1.jsx)("div", { className: "text-b3-foreground-muted", children: " $" }), (0, jsx_runtime_1.jsx)("div", { className: "text-[30px]", children: (0, number_1.formatDisplayNumber)(totalBalanceUsd, { fractionDigits: 2 }) })] })), (0, jsx_runtime_1.jsx)("div", { className: "b3-modal-username font-neue-montreal-semibold text-base leading-none text-[#0B57C2]", children: currentUsername }), isBetterAuth && user?.email && ((0, jsx_runtime_1.jsx)("div", { className: "text-b3-foreground-muted font-neue-montreal-medium text-sm", children: user.email }))] })] }) }));
+    return ((0, jsx_runtime_1.jsx)("div", { className: "flex items-center justify-between px-5 py-6", children: (0, jsx_runtime_1.jsxs)("div", { className: "global-account-profile flex items-center gap-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: "global-account-profile-avatar relative", children: [(0, jsx_runtime_1.jsx)("div", { className: "border-b3-line border-1 bg-b3-primary-wash size-14 overflow-hidden rounded-full border", children: avatarSrc && !imgError ? ((0, jsx_runtime_1.jsx)(IPFSMediaRenderer_1.IPFSMediaRenderer, { src: avatarSrc, alt: "Profile Avatar", className: "h-full w-full object-cover", onError: handleImgError })) : ((0, jsx_runtime_1.jsx)(boring_avatars_1.default, { name: avatarSeed, variant: "beam", size: 56, colors: constants_1.AVATAR_COLORS })) }), (0, jsx_runtime_1.jsx)("button", { onClick: handleEditAvatar, className: "border-b3-background hover:bg-b3-grey/80 absolute -bottom-1 -right-1 flex size-6 items-center justify-center rounded-full border-4 bg-[#a0a0ab] transition-colors", children: (0, jsx_runtime_1.jsx)(lucide_react_1.Pencil, { size: 10, className: "text-b3-background" }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "global-account-profile-info flex flex-col gap-1", children: [!isBetterAuth && ((0, jsx_runtime_1.jsxs)("h2", { className: "text-b3-grey font-neue-montreal-semibold flex h-[38px] items-center gap-1 text-xl", children: [(0, jsx_runtime_1.jsx)("div", { className: "text-b3-foreground-muted", children: " $" }), (0, jsx_runtime_1.jsx)("div", { className: "text-[30px]", children: totalBalanceUsd === null ? "—" : (0, number_1.formatDisplayNumber)(totalBalanceUsd, { fractionDigits: 2 }) })] })), (0, jsx_runtime_1.jsx)("div", { className: "b3-modal-username font-neue-montreal-semibold text-base leading-none text-[#0B57C2]", children: currentUsername }), isBetterAuth && user?.email && ((0, jsx_runtime_1.jsx)("div", { className: "text-b3-foreground-muted font-neue-montreal-medium text-sm", children: user.email }))] })] }) }));
 };
 exports.default = ProfileSection;

package/dist/cjs/global-account/react/components/ManageAccount/SettingsProfileCard.js

@@ -77,7 +77,7 @@ const SettingsProfileCard = () => {
                 // Better Auth: register username without wallet signing (DB-only, no ENS)
                 // Skip ens_normalize — it rejects underscores/mixed-case that are valid non-ENS usernames
                 const sanitizedUsername = editedUsername.trim().toLowerCase();
-                // Type assertion needed: b3-mono now accepts message/hash as optional for Better Auth users
+                // Type assertion needed: API now accepts message/hash as optional for Better Auth users
                 updatedUser = (await app_1.default
                     .service("users")
                     .registerUsername({ username: sanitizedUsername }, {}));