@dynamic-labs-sdk/client 0.26.10 → 0.27.1

package/dist/index.esm.js

@@ -1,8 +1,8 @@
-import { A as extractSessionId, B as name, C as isCookieEnabled, D as instrumentFunction, E as __getElevatedAccessToken_wrapped, F as getDefaultClient, I as setDefaultClient, O as DEFAULT_PII_FIELDS, P as NONCE_POOL_SIZE, R as BaseError, T as ValueMustBeDefinedError, V as version, _ as MfaRateLimitedError, a as DYNAMIC_ICONIC_SPRITE_URL, b as InvalidExternalAuthError, c as CHAINS_INFO_MAP, d as UnauthorizedError, g as SandboxMaximumThresholdReachedError, h as getNonce, j as randomString, k as getUserAgent, l as fetchAndStoreNonces, o as SDK_API_CORE_VERSION, s as getChainFromVerifiedCredentialChain, t as InvalidParamError, u as createApiClient, v as MfaInvalidOtpError, w as assertDefined, x as APIError, y as LinkCredentialError, z as getCore } from "./InvalidParamError-De4xrOs4.esm.js";
-import { A as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, B as createLocalStorageAdapter, C as createCrossTabBroadcast, D as FETCH_PROJECT_SETTINGS_TRACKER_KEY, E as createDeferredPromise, F as generateSessionKeys, H as retryOnFail, I as fetchProjectSettings, L as createStorageKeySchema, M as isServerSideRendering, N as getBuffer, O as GENERATE_SESSION_KEYS_TRACKER_KEY, P as __logoutWithReason_wrapped, R as createStorage, S as createLogger, T as CannotTrackError, U as subscribeWithSelector, V as isSignedIn, W as isEqualShallow, _ as WalletAlreadyLinkedToAnotherUserError, a as updateWalletProviderKeysForVerifiedCredentials, b as createRealtimeService, c as createSignInMessageStatement, d as createVisit, f as hasExtension, g as isCaptchaRequired, h as consumeCaptchaToken, i as getNetworksData, j as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, k as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, l as formatSignInMessage, m as __setCaptchaToken_wrapped, o as verifyMessageSignatureOwnership, p as createRealtimeChannelSchema, s as removeUnverifiedWalletAccount, t as getNetworkProviderFromNetworkId, u as setUnverifiedWalletAccounts, v as NoNetworkProvidersError, x as createKeychainService, y as getKeychainIndexedDBName } from "./getNetworkProviderFromNetworkId-Cqzo1MhF.esm.js";
-import { A as onceEvent, C as formatWalletAccountId, D as emitEvent, O as offEvent, T as splitWalletProviderKey, a as parseElevatedAccessToken, b as getWalletAccounts, d as isUserMissingMfaAuth, f as checkAndRaiseWalletAccountsChangedEvent, h as getWalletProviderFromWalletAccount, i as upsertElevatedAccessToken, k as onEvent, n as getWalletProviderByKey, o as restoreUserSharesForAllWalletAccounts, p as emitWalletAccountsChangedEvent, r as updateAuthFromVerifyResponse, t as getVerifiedCredentialForWalletAccount, u as getWalletProviders, w as normalizeAddress, y as NoWalletProviderFoundError } from "./getVerifiedCredentialForWalletAccount-DqXnLSqq.esm.js";
-import { n as __refreshAuth_wrapped, t as NotWaasWalletAccountError } from "./NotWaasWalletAccountError-CdAul2Xh.esm.js";
-import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-CPlDnHuj.esm.js";
+import { A as extractSessionId, B as name, C as isCookieEnabled, D as instrumentFunction, E as __getElevatedAccessToken_wrapped, F as getDefaultClient, I as setDefaultClient, O as DEFAULT_PII_FIELDS, P as NONCE_POOL_SIZE, R as BaseError, T as ValueMustBeDefinedError, V as version, _ as MfaRateLimitedError, a as DYNAMIC_ICONIC_SPRITE_URL, b as InvalidExternalAuthError, c as CHAINS_INFO_MAP, d as UnauthorizedError, g as SandboxMaximumThresholdReachedError, h as getNonce, j as randomString, k as getUserAgent, l as fetchAndStoreNonces, o as SDK_API_CORE_VERSION, s as getChainFromVerifiedCredentialChain, t as InvalidParamError, u as createApiClient, v as MfaInvalidOtpError, w as assertDefined, x as APIError, y as LinkCredentialError, z as getCore } from "./InvalidParamError-DYMyIag5.esm.js";
+import { A as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, B as createLocalStorageAdapter, C as createCrossTabBroadcast, D as FETCH_PROJECT_SETTINGS_TRACKER_KEY, E as createDeferredPromise, F as generateSessionKeys, H as retryOnFail, I as fetchProjectSettings, L as createStorageKeySchema, M as isServerSideRendering, N as getBuffer, O as GENERATE_SESSION_KEYS_TRACKER_KEY, P as __logoutWithReason_wrapped, R as createStorage, S as createLogger, T as CannotTrackError, U as subscribeWithSelector, V as isSignedIn, W as isEqualShallow, _ as WalletAlreadyLinkedToAnotherUserError, a as updateWalletProviderKeysForVerifiedCredentials, b as createRealtimeService, c as createSignInMessageStatement, d as createVisit, f as hasExtension, g as MethodNotImplementedError, h as isCaptchaRequired, i as getNetworksData, j as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, k as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, l as formatSignInMessage, m as consumeCaptchaToken, o as verifyMessageSignatureOwnership, p as __setCaptchaToken_wrapped, s as removeUnverifiedWalletAccount, t as getNetworkProviderFromNetworkId, u as setUnverifiedWalletAccounts, v as NoNetworkProvidersError, x as createKeychainService, y as getKeychainIndexedDBName } from "./getNetworkProviderFromNetworkId-Cz2-ZCCZ.esm.js";
+import { A as onceEvent, C as formatWalletAccountId, D as emitEvent, O as offEvent, T as splitWalletProviderKey, a as parseElevatedAccessToken, b as getWalletAccounts, d as isUserMissingMfaAuth, f as checkAndRaiseWalletAccountsChangedEvent, h as getWalletProviderFromWalletAccount, i as upsertElevatedAccessToken, k as onEvent, n as getWalletProviderByKey, o as restoreUserSharesForAllWalletAccounts, p as emitWalletAccountsChangedEvent, r as updateAuthFromVerifyResponse, t as getVerifiedCredentialForWalletAccount, u as getWalletProviders, w as normalizeAddress, y as NoWalletProviderFoundError } from "./getVerifiedCredentialForWalletAccount-D_6o2B_M.esm.js";
+import { n as __refreshAuth_wrapped, t as NotWaasWalletAccountError } from "./NotWaasWalletAccountError-hJqwXt5a.esm.js";
+import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-fAw1tlUY.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { AuthModeEnum, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, TokenScope, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
@@ -947,6 +947,7 @@ const createCore = (config) => {
 	});
 	const fetch = config.coreConfig?.fetch ?? createWebFetch();
 	const openDeeplink = config.coreConfig?.openDeeplink ?? createWebDeeplinkOpener();
+	const openAuthSession = config.coreConfig?.openAuthSession;
 	const navigate = config.coreConfig?.navigate ?? createNavigationHandler();
 	const state = createObservableState(getInitialState);
 	const debouncedMutex = createDebouncedMutex();
@@ -993,6 +994,7 @@ const createCore = (config) => {
 		logger,
 		metadata,
 		navigate,
+		openAuthSession,
 		openDeeplink,
 		passkey,
 		realtime,
@@ -1149,6 +1151,34 @@ var InvalidRedirectStorageStateError = class extends BaseError {
 	}
 };
 
+//#endregion
+//#region src/errors/InvalidSocialCallbackOriginError.ts
+var InvalidSocialCallbackOriginError = class extends BaseError {
+	constructor({ actualOrigin, expectedOrigin }) {
+		super({
+			cause: null,
+			code: "invalid_social_callback_origin_error",
+			docsUrl: null,
+			name: "InvalidSocialCallbackOriginError",
+			shortMessage: `OAuth callback URL origin mismatch. Expected ${expectedOrigin}, got ${actualOrigin}. This may indicate a compromised auth session or misconfigured redirect URL.`
+		});
+	}
+};
+
+//#endregion
+//#region src/errors/UserCancelledSocialPopUpError.ts
+var UserCancelledSocialPopUpError = class extends BaseError {
+	constructor() {
+		super({
+			cause: null,
+			code: "user_cancelled_social_popup_error",
+			docsUrl: null,
+			name: "UserCancelledSocialPopUpError",
+			shortMessage: "The user cancelled (or dismissed) the social authentication pop-up."
+		});
+	}
+};
+
 //#endregion
 //#region src/errors/MissingRedirectStorageStateError.ts
 var MissingRedirectStorageStateError = class extends BaseError {
@@ -1982,6 +2012,35 @@ const __signInWithSocialRedirect_wrapped = instrumentFunction({
 	}
 });
 
+//#endregion
+//#region src/modules/auth/social/oauth/signInWithSocialPopUp/signInWithSocialPopUp.ts
+/**
+* Sign in with a social provider via an in-app popup (ASWebAuthenticationSession
+* on iOS, Chrome Custom Tabs on Android).
+*
+* This method is **only available on React Native**. On web, use
+* {@link signInWithSocialRedirect} + {@link completeSocialRedirect} instead —
+* the browser already owns the tab so there is no popup to open.
+*
+* @throws MethodNotImplementedError Always on web.
+* @instrumented
+*/
+const signInWithSocialPopUp = async ({ provider }, client = getDefaultClient()) => {
+	throw new MethodNotImplementedError("signInWithSocialPopUp (only available on React Native — use signInWithSocialRedirect on web)");
+};
+const __signInWithSocialPopUp_impl = signInWithSocialPopUp;
+const __signInWithSocialPopUp_wrapped = instrumentFunction({
+	fn: __signInWithSocialPopUp_impl,
+	functionName: "signInWithSocialPopUp",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
 //#endregion
 //#region src/modules/auth/social/oauth/detectSocialRedirectUrl/detectSocialRedirectUrl.ts
 /**
@@ -2006,23 +2065,27 @@ const detectSocialRedirectUrl = async ({ url }, client = getDefaultClient()) =>
 };
 
 //#endregion
-//#region src/modules/auth/social/oauth/completeSocialRedirect/completeSocialRedirect.ts
+//#region src/modules/auth/social/oauth/processSocialCallback/processSocialCallback.ts
 /**
-* Completes the social authentication flow after the OAuth redirect.
+* Platform-agnostic OAuth callback processor used by both the web redirect
+* flow (`completeSocialRedirect`) and the native pop-up flow
+* (`signInWithSocialPopUp`). Intentionally has no `.native.ts` variant — the
+* logic (parse URL, validate state, call oauthSignIn/oauthVerify, update auth)
+* works identically on every platform.
 *
-* Processes the OAuth callback URL with the authorization code and finishes
-* authenticating (or linking) the user with the social provider. This is the
-* final step after `signInWithSocialRedirect` + `detectSocialRedirectUrl`.
+* Not exported from the public SDK surface; public callers go through
+* `completeSocialRedirect` or `signInWithSocialPopUp` instead.
 *
 * @param params.url - The callback URL containing OAuth response parameters.
 * @param [params.requestedScopes] - Optional scopes to request an elevated access token when verifying (linking) a social account.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves to the authenticated user or null.
+* @param client - The Dynamic client instance.
+* @returns The authenticated user, or null if the verify response had none.
 * @throws MissingSocialUrlParamError If required OAuth parameters are missing.
-* @throws InvalidRedirectStorageStateError If the stored state doesn't match.
+* @throws MissingRedirectStorageStateError If no stored redirect state exists.
+* @throws InvalidRedirectStorageStateError If the stored state doesn't match the URL state.
 * @instrumented
 */
-const completeSocialRedirect = async ({ url, requestedScopes }, client = getDefaultClient()) => {
+const processSocialCallback = async ({ url, requestedScopes }, client) => {
 	const core = getCore(client);
 	const apiClient = createApiClient({}, client);
 	await core.initTrack.waitForAll();
@@ -2059,6 +2122,40 @@ const completeSocialRedirect = async ({ url, requestedScopes }, client = getDefa
 	updateAuthFromVerifyResponse({ response }, client);
 	return response.user;
 };
+const __processSocialCallback_impl = processSocialCallback;
+const __processSocialCallback_wrapped = instrumentFunction({
+	fn: __processSocialCallback_impl,
+	functionName: "processSocialCallback",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
+//#endregion
+//#region src/modules/auth/social/oauth/completeSocialRedirect/completeSocialRedirect.ts
+/**
+* Completes the social authentication flow after the OAuth redirect.
+*
+* Processes the OAuth callback URL with the authorization code and finishes
+* authenticating (or linking) the user with the social provider. This is the
+* final step after `signInWithSocialRedirect` + `detectSocialRedirectUrl`.
+*
+* @param params.url - The callback URL containing OAuth response parameters.
+* @param [params.requestedScopes] - Optional scopes to request an elevated access token when verifying (linking) a social account.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the authenticated user or null.
+* @throws MissingSocialUrlParamError If required OAuth parameters are missing.
+* @throws InvalidRedirectStorageStateError If the stored state doesn't match.
+* @instrumented
+*/
+const completeSocialRedirect = ({ url, requestedScopes }, client = getDefaultClient()) => __processSocialCallback_wrapped({
+	requestedScopes,
+	url
+}, client);
 const __completeSocialRedirect_impl = completeSocialRedirect;
 const __completeSocialRedirect_wrapped = instrumentFunction({
 	fn: __completeSocialRedirect_impl,
@@ -2379,97 +2476,6 @@ const getCheckouts = async (client) => {
 	return projectSettings.checkouts ?? [];
 };
 
-//#endregion
-//#region src/modules/checkout/utils/createCheckoutTransactionChannelSchema/createCheckoutTransactionChannelSchema.ts
-/**
-* Zod schema for realtime events published to a checkout transaction's channel.
-* Uses z.string() for axis and state fields to remain valid when new states are
-* added to the backend without requiring a SDK update.
-*/
-const checkoutTransactionEventSchema = z.object({
-	axis: z.string(),
-	newState: z.string(),
-	previousState: z.string(),
-	timestamp: z.string(),
-	transactionId: z.string()
-});
-/**
-* Creates a typed realtime channel schema for a given checkout transaction.
-* Channel name follows the backend convention: `transaction:{transactionId}`.
-* @not-instrumented
-*/
-const createCheckoutTransactionChannelSchema = (transactionId) => createRealtimeChannelSchema({
-	channel: `transaction:${transactionId}`,
-	schema: checkoutTransactionEventSchema
-});
-
-//#endregion
-//#region src/modules/checkout/utils/subscribeToCheckoutTransaction/subscribeToCheckoutTransaction.ts
-const TERMINAL_EXECUTION_STATES = new Set([
-	"cancelled",
-	"expired",
-	"failed"
-]);
-const TERMINAL_SETTLEMENT_STATES = new Set(["completed", "failed"]);
-const isTerminalEvent = (data) => {
-	if (data.axis === "execution") return TERMINAL_EXECUTION_STATES.has(data.newState);
-	if (data.axis === "settlement") return TERMINAL_SETTLEMENT_STATES.has(data.newState);
-	return false;
-};
-/**
-* Connects to the realtime service if not already connected and subscribes to
-* all state transition events for the given checkout transaction.
-*
-* Settlement and execution axis events are forwarded as public SDK events.
-* The subscription is torn down automatically when a terminal event is received.
-* @not-instrumented
-*/
-const subscribeToCheckoutTransaction = async ({ transactionId }, client) => {
-	const core = getCore(client);
-	const { realtime } = core;
-	if (realtime.getConnectionState() === "idle") {
-		const sessionToken = await core.storage.getItem(createCheckoutSessionTokenStorageKey(transactionId));
-		const headers = {};
-		if (sessionToken) {
-			headers["x-dynamic-checkout-session-token"] = sessionToken;
-			headers["x-dynamic-checkout-transaction-id"] = transactionId;
-		}
-		await realtime.connect({
-			client,
-			headers
-		});
-	}
-	const channelSchema = createCheckoutTransactionChannelSchema(transactionId);
-	const handler = ({ data }) => {
-		if (data.axis === "execution") emitEvent({
-			args: {
-				newState: data.newState,
-				previousState: data.previousState,
-				timestamp: data.timestamp,
-				transactionId: data.transactionId
-			},
-			event: "checkoutTransactionExecutionStateChanged"
-		}, client);
-		if (data.axis === "settlement") emitEvent({
-			args: {
-				newState: data.newState,
-				previousState: data.previousState,
-				timestamp: data.timestamp,
-				transactionId: data.transactionId
-			},
-			event: "checkoutTransactionSettlementStateChanged"
-		}, client);
-		if (isTerminalEvent(data)) realtime.unsubscribe({
-			callback: handler,
-			channelSchema
-		});
-	};
-	await realtime.subscribe({
-		callback: handler,
-		channelSchema
-	});
-};
-
 //#endregion
 //#region src/modules/checkout/createCheckoutTransaction/createCheckoutTransaction.ts
 /**
@@ -2501,9 +2507,6 @@ const createCheckoutTransaction = async (params, client = getDefaultClient()) =>
 		environmentId: core.environmentId
 	});
 	await core.storage.setItem(createCheckoutSessionTokenStorageKey(result.transaction.id), result.sessionToken);
-	subscribeToCheckoutTransaction({ transactionId: result.transaction.id }, client).catch((error) => {
-		core.logger.error("Failed to subscribe to checkout transaction realtime channel", error);
-	});
 	return result;
 };
 const __createCheckoutTransaction_impl = createCheckoutTransaction;
@@ -2729,11 +2732,17 @@ const __submitCheckoutTransaction_wrapped = instrumentFunction({
 * subscribed — calling this again for those is unnecessary unless the page
 * has been reloaded.
 *
+* NOTE: Temporarily a no-op while the Ably API key is being provisioned for
+* the realtime checkout transaction channel. Will be re-enabled once the
+* dashboard-api environment has the Ably wiring in place.
+*
 * @param params.transactionId - The ID of the checkout transaction to track.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @not-instrumented
 */
-const trackCheckoutTransaction = ({ transactionId }, client = getDefaultClient()) => subscribeToCheckoutTransaction({ transactionId }, client);
+const trackCheckoutTransaction = (_params, client = getDefaultClient()) => {
+	return Promise.resolve();
+};
 
 //#endregion
 //#region src/modules/checkout/utils/requiresConversion/requiresConversion.ts
@@ -5311,6 +5320,184 @@ const isUserOnboardingComplete = (client = getDefaultClient()) => {
 	return !hasMissingKycFields && !hasPendingMfaAuth && !hasPendingRecoveryCodes;
 };
 
+//#endregion
+//#region src/modules/walletBackup/googleDrive/constants.ts
+/**
+* OAuth scopes that must be granted on the user's Google account in order
+* for the keyshare backup upload to Google Drive to succeed.
+*
+* Exported so host apps can pre-flight check or display these in their own
+* UX. Kept as a `readonly` tuple to discourage mutation.
+*/
+const GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES = ["https://www.googleapis.com/auth/drive.appdata", "https://www.googleapis.com/auth/drive.file"];
+/**
+* Stable phrase the WaaS layer includes in Google Drive 401 / scope-insufficient
+* upload failure messages. Match by `.includes(...)` rather than equality
+* because the iframe message-handler fallback path rewraps the original error
+* as `new Error(String(response.error))`, which prefixes the message with
+* "Error: ". The phrase remains unique to the auth/scope case across all the
+* Drive failure reasons (rate-limit, storage-full, 5xx, network all use
+* distinct prefixes), so message-only matching is sufficient to discriminate.
+*/
+const ACCESS_DENIED_PHRASE = "Google Drive access denied";
+
+//#endregion
+//#region src/modules/walletBackup/googleDrive/findMissingGoogleDriveBackupScopes/findMissingGoogleDriveBackupScopes.ts
+/**
+* Returns the Google OAuth scopes from `GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES`
+* that are NOT present in `grantedScopes`. An empty array means all required
+* scopes have been granted.
+*
+* @param grantedScopes - Scopes the user has granted to their Google account.
+* @returns The subset of required scopes that are still missing.
+* @not-instrumented
+*/
+const findMissingGoogleDriveBackupScopes = (grantedScopes) => GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES.filter((required) => !grantedScopes.includes(required));
+
+//#endregion
+//#region src/modules/walletBackup/googleDrive/utils/fetchGoogleDriveOauthAccess/fetchGoogleDriveOauthAccess.ts
+/**
+* Fetches the user's stored Google OAuth access token together with the
+* scopes that were granted when the token was issued.
+*
+* Internal to the Google Drive backup readiness check — not exported as a
+* public API. The returned `scopes` array can be empty for legacy tokens
+* captured before the API began tracking granted scopes.
+*
+* @param params.oauthAccountId - The verified-credential id of the linked
+*   Google account (see `findGoogleOauthAccountId`).
+* @param client - The Dynamic client instance.
+* @returns The OAuth access token and granted scopes.
+* @not-instrumented
+*/
+const fetchGoogleDriveOauthAccess = async ({ oauthAccountId }, client) => {
+	const core = getCore(client);
+	return createApiClient({}, client).getEndUserOauthAccessToken({
+		environmentId: core.environmentId,
+		oauthAccountId
+	});
+};
+
+//#endregion
+//#region src/modules/walletBackup/googleDrive/utils/findGoogleOauthAccountId/findGoogleOauthAccountId.ts
+/**
+* Returns the verified-credential `id` (UUID of the user_oauth_accounts row)
+* for the user's linked Google account, or `undefined` if no Google account
+* is linked.
+*
+* The `getEndUserOauthAccessToken` API path parameter expects this UUID, NOT
+* the third-party `oauthAccountId` (Google's numeric profile ID) — those are
+* stored in the same credential under different fields.
+*
+* @param credentials - The user's verified credentials, typically from
+*   `client.user?.verifiedCredentials`.
+* @returns The credential id of the linked Google oauth account, or
+*   `undefined`.
+* @not-instrumented
+*/
+const findGoogleOauthAccountId = (credentials) => credentials?.find((cred) => cred.format === JwtVerifiedCredentialFormatEnum.Oauth && cred.oauthProvider === ProviderEnum.Google)?.id;
+
+//#endregion
+//#region src/modules/walletBackup/googleDrive/getGoogleDriveBackupReadiness/getGoogleDriveBackupReadiness.ts
+/**
+* Pre-flight readiness check for backing up MPC keyshares to Google Drive.
+*
+* Call this before initiating the keyshare backup ceremony. When the result
+* is `'needs-access'`, have the user re-link their Google account so the
+* required Drive scopes are granted, then call this again before retrying
+* the backup. This avoids spending an MPC reshare ceremony on a backup that
+* will predictably fail.
+*
+* Status values:
+* - `'ready'`: stored scopes include both required Drive scopes; backup
+*   should succeed (barring transient errors).
+* - `'needs-access'`: backup likely won't succeed without user intervention.
+*   Three sub-cases, distinguished by `missingScopes`:
+*   - No Google account linked → `missingScopes` is the full required set.
+*   - Some scopes granted but not all → `missingScopes` lists the gap.
+*   - Legacy token captured before scope tracking shipped (`scopes: []` from
+*     the API) → `missingScopes` is empty. Forcing a fresh consent will
+*     populate the scopes column for subsequent calls.
+*
+* Failures of the underlying access-token fetch propagate as Promise
+* rejections — the caller is expected to surface or retry them.
+*
+* Pair with `isInsufficientGoogleDriveScopesError` to detect post-flight
+* scope failures (e.g. for the legacy "unknown scopes" case where pre-flight
+* cannot prove failure).
+*
+* @param [client] - The Dynamic client instance. Only required when using
+*   multiple Dynamic clients.
+* @returns The readiness result.
+* @instrumented
+*/
+const getGoogleDriveBackupReadiness = async (client = getDefaultClient()) => {
+	const { user } = client;
+	const oauthAccountId = findGoogleOauthAccountId(user?.verifiedCredentials);
+	if (!oauthAccountId) return {
+		missingScopes: GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES,
+		status: "needs-access"
+	};
+	const { accessToken, scopes } = await fetchGoogleDriveOauthAccess({ oauthAccountId }, client);
+	if (scopes.length === 0) return {
+		accessToken,
+		missingScopes: [],
+		status: "needs-access"
+	};
+	const missing = findMissingGoogleDriveBackupScopes(scopes);
+	if (missing.length === 0) return {
+		accessToken,
+		missingScopes: [],
+		status: "ready"
+	};
+	return {
+		accessToken,
+		missingScopes: missing,
+		status: "needs-access"
+	};
+};
+const __getGoogleDriveBackupReadiness_impl = getGoogleDriveBackupReadiness;
+const __getGoogleDriveBackupReadiness_wrapped = instrumentFunction({
+	fn: __getGoogleDriveBackupReadiness_impl,
+	functionName: "getGoogleDriveBackupReadiness",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
+//#endregion
+//#region src/modules/walletBackup/googleDrive/hasAllGoogleDriveBackupScopes/hasAllGoogleDriveBackupScopes.ts
+/**
+* Returns whether `grantedScopes` covers every Google OAuth scope required
+* to upload a keyshare backup to Google Drive.
+*
+* @param grantedScopes - Scopes the user has granted to their Google account.
+* @returns `true` when every required scope is granted, otherwise `false`.
+* @not-instrumented
+*/
+const hasAllGoogleDriveBackupScopes = (grantedScopes) => findMissingGoogleDriveBackupScopes(grantedScopes).length === 0;
+
+//#endregion
+//#region src/modules/walletBackup/googleDrive/isInsufficientGoogleDriveScopesError/isInsufficientGoogleDriveScopesError.ts
+/**
+* Type-guard for Google Drive backup failures caused by missing or
+* insufficient OAuth scopes (or otherwise denied access).
+*
+* Recover by having the user re-link their Google account and retrying the
+* backup once the granted scopes include
+* `GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES`.
+*
+* @param err - The unknown value to check.
+* @returns `true` when `err` is an `Error` whose message indicates Google
+*   Drive access was denied.
+* @not-instrumented
+*/
+const isInsufficientGoogleDriveScopesError = (err) => err instanceof Error && err.message.includes(ACCESS_DENIED_PHRASE);
+
 //#endregion
 //#region src/modules/wallets/assertWalletAccountSigningAvailability/assertWalletAccountSigningAvailability.ts
 /**
@@ -6384,5 +6571,5 @@ const parseUserAgent = ({ userAgent }) => {
 assertPackageVersion(name, version);
 
 //#endregion
-export { BaseError, CheckoutSessionTokenMissingError, ClientAlreadyInitializedError, DeeplinkConnectAndVerifyUnsupportedError, FeeEstimationFailedError, InvalidDeviceRegistrationRedirectError, InvalidExternalAuthError, InvalidParamError, InvalidRedirectStorageStateError, LinkCredentialError, MFAAction, MfaInvalidOtpError, MfaRateLimitedError, MissingRedirectStorageStateError, MissingSocialUrlParamError, MissingUserVerificationError, NetworkAddingUnavailableError, NetworkNotAddedError, NetworkSwitchingUnavailableError, NoAddressFoundError, NoNetworkProvidersError, NoPasskeyCredentialsFoundError, NoSmartWalletAccountSignerFoundError, NoWebAuthNSupportError, NotWaasWalletAccountError, SandboxMaximumThresholdReachedError, SimulationFailedError, TokenSwapError, UnauthorizedError, UnavailableInServerSideError, UnrecognizedNetworkError, UserNotAuthenticatedError, UserRejectedError, WalletAccountAlreadyVerifiedError, WalletAccountNotSelectedError, WalletAlreadyLinkedToAnotherUserError, WalletProviderMethodUnavailableError, __acknowledgeRecoveryCodes_wrapped as acknowledgeRecoveryCodes, addCoinbaseOnrampOrderEventListener, __addNetwork_wrapped as addNetwork, assertWalletAccountSigningAvailability, assertWalletProviderMethodDefined, __attachCheckoutTransactionSource_wrapped as attachCheckoutTransactionSource, authenticateMfaRecoveryCode, authenticatePasskeyMFA, authenticateTotpMfaDevice, __authenticateWithSocial_wrapped as authenticateWithSocial, __broadcastCheckoutTransaction_wrapped as broadcastCheckoutTransaction, canConnectWithHardwareWallet, __cancelCheckoutTransaction_wrapped as cancelCheckoutTransaction, __checkStepUpAuth_wrapped as checkStepUpAuth, __completeDeviceRegistration_wrapped as completeDeviceRegistration, __completeSocialAuthentication_wrapped as completeSocialAuthentication, __completeSocialRedirect_wrapped as completeSocialRedirect, __confirmTransaction_wrapped as confirmTransaction, __connectAndVerifyWithWalletProvider_wrapped as connectAndVerifyWithWalletProvider, __connectWithWalletProvider_wrapped as connectWithWalletProvider, __consumeMfaToken_wrapped as consumeMfaToken, __createCheckoutTransaction_wrapped as createCheckoutTransaction, __createCoinbaseOnrampOrder_wrapped as createCoinbaseOnrampOrder, __createCryptoDotComPayment_wrapped as createCryptoDotComPayment, __createDynamicClient_wrapped as createDynamicClient, __createKrakenExchangeTransfer_wrapped as createKrakenExchangeTransfer, __createNewMfaRecoveryCodes_wrapped as createNewMfaRecoveryCodes, __deleteMfaDevice_wrapped as deleteMfaDevice, __deletePasskey_wrapped as deletePasskey, __deleteUser_wrapped as deleteUser, detectDeviceRegistrationRedirect, detectOAuthRedirect, detectSocialRedirectUrl, __executeSwapTransaction_wrapped as executeSwapTransaction, fetchProjectSettings, getActiveNetworkData, getActiveNetworkId, getAvailableWalletProvidersData, getBalance, getBalanceForAddress, getBalances, getCheckoutTransaction, getCheckoutTransactionQuote, getCoinbaseBuyUrl, getConnectedAddresses, getDefaultClient, getDeviceRegistrationTokenFromUrl, __getElevatedAccessToken_wrapped as getElevatedAccessToken, getKrakenAccounts, getKrakenWhitelistedAddresses, getMfaDevices, getMfaMethods, getMfaRecoveryCodes, getMissingVerificationForCoinbaseOnrampOrder, getMultichainBalances, getNetworksData, getOwnerWalletAccountForSmartWalletAccount, getPasskeys, getPrimaryWalletAccount, getRegisteredDevices, getSwapQuote, getSwapStatus, getTransactionHistory, getUserSocialAccounts, getWalletAccountAddressByType, getWalletAccountFromAddress, getWalletAccounts, getWalletConnectCatalog, getWalletConnectCatalogWalletByWalletProviderKey, getWalletProviderDataByKey, hasExtension, __initializeClient_wrapped as initializeClient, isCaptchaRequired, isDeeplinkWalletProvider, isDeviceRegistrationRequired, isHardwareWalletAccount, isMfaRequiredForAction, isMobile, isPendingRecoveryCodesAcknowledgment, isProgrammaticNetworkSwitchAvailable, isSignedIn, isUserMissingMfaAuth, isUserOnboardingComplete, isWalletAccountVerified, logout, offEvent, offWalletProviderEvent, onEvent, onWalletProviderEvent, onceEvent, parseUserAgent, __prepareCheckoutTransaction_wrapped as prepareCheckoutTransaction, __proveWalletAccountOwnership_wrapped as proveWalletAccountOwnership, __refreshAuth_wrapped as refreshAuth, __refreshUser_wrapped as refreshUser, __registerPasskey_wrapped as registerPasskey, __registerTotpMfaDevice_wrapped as registerTotpMfaDevice, __removeWalletAccount_wrapped as removeWalletAccount, __requestExternalAuthElevatedToken_wrapped as requestExternalAuthElevatedToken, requiresConversion, __revokeAllRegisteredDevices_wrapped as revokeAllRegisteredDevices, __revokeRegisteredDevice_wrapped as revokeRegisteredDevice, __selectPrimaryWalletAccount_wrapped as selectPrimaryWalletAccount, __sendEmailOTP_wrapped as sendEmailOTP, __sendSmsOTP_wrapped as sendSmsOTP, __setCaptchaToken_wrapped as setCaptchaToken, __setDefaultMfaDevice_wrapped as setDefaultMfaDevice, __setInstrumentationEnabled_wrapped as setInstrumentationEnabled, __signInWithExternalJwt_wrapped as signInWithExternalJwt, __signInWithPasskey_wrapped as signInWithPasskey, __signInWithSocialRedirect_wrapped as signInWithSocialRedirect, __signMessage_wrapped as signMessage, __submitCheckoutTransaction_wrapped as submitCheckoutTransaction, supportedCountries, __switchActiveNetwork_wrapped as switchActiveNetwork, trackCheckoutTransaction, __transferAmount_wrapped as transferAmount, __transferWalletAccount_wrapped as transferWalletAccount, __unlinkSocialAccount_wrapped as unlinkSocialAccount, __updateUser_wrapped as updateUser, __verifyOTP_wrapped as verifyOTP, __verifyWalletAccount_wrapped as verifyWalletAccount, waitForClientInitialized };
+export { BaseError, CheckoutSessionTokenMissingError, ClientAlreadyInitializedError, DeeplinkConnectAndVerifyUnsupportedError, FeeEstimationFailedError, GOOGLE_DRIVE_BACKUP_REQUIRED_SCOPES, InvalidDeviceRegistrationRedirectError, InvalidExternalAuthError, InvalidParamError, InvalidRedirectStorageStateError, InvalidSocialCallbackOriginError, LinkCredentialError, MFAAction, MfaInvalidOtpError, MfaRateLimitedError, MissingRedirectStorageStateError, MissingSocialUrlParamError, MissingUserVerificationError, NetworkAddingUnavailableError, NetworkNotAddedError, NetworkSwitchingUnavailableError, NoAddressFoundError, NoNetworkProvidersError, NoPasskeyCredentialsFoundError, NoSmartWalletAccountSignerFoundError, NoWebAuthNSupportError, NotWaasWalletAccountError, SandboxMaximumThresholdReachedError, SimulationFailedError, TokenSwapError, UnauthorizedError, UnavailableInServerSideError, UnrecognizedNetworkError, UserCancelledSocialPopUpError, UserNotAuthenticatedError, UserRejectedError, WalletAccountAlreadyVerifiedError, WalletAccountNotSelectedError, WalletAlreadyLinkedToAnotherUserError, WalletProviderMethodUnavailableError, __acknowledgeRecoveryCodes_wrapped as acknowledgeRecoveryCodes, addCoinbaseOnrampOrderEventListener, __addNetwork_wrapped as addNetwork, assertWalletAccountSigningAvailability, assertWalletProviderMethodDefined, __attachCheckoutTransactionSource_wrapped as attachCheckoutTransactionSource, authenticateMfaRecoveryCode, authenticatePasskeyMFA, authenticateTotpMfaDevice, __authenticateWithSocial_wrapped as authenticateWithSocial, __broadcastCheckoutTransaction_wrapped as broadcastCheckoutTransaction, canConnectWithHardwareWallet, __cancelCheckoutTransaction_wrapped as cancelCheckoutTransaction, __checkStepUpAuth_wrapped as checkStepUpAuth, __completeDeviceRegistration_wrapped as completeDeviceRegistration, __completeSocialAuthentication_wrapped as completeSocialAuthentication, __completeSocialRedirect_wrapped as completeSocialRedirect, __confirmTransaction_wrapped as confirmTransaction, __connectAndVerifyWithWalletProvider_wrapped as connectAndVerifyWithWalletProvider, __connectWithWalletProvider_wrapped as connectWithWalletProvider, __consumeMfaToken_wrapped as consumeMfaToken, __createCheckoutTransaction_wrapped as createCheckoutTransaction, __createCoinbaseOnrampOrder_wrapped as createCoinbaseOnrampOrder, __createCryptoDotComPayment_wrapped as createCryptoDotComPayment, __createDynamicClient_wrapped as createDynamicClient, __createKrakenExchangeTransfer_wrapped as createKrakenExchangeTransfer, __createNewMfaRecoveryCodes_wrapped as createNewMfaRecoveryCodes, __deleteMfaDevice_wrapped as deleteMfaDevice, __deletePasskey_wrapped as deletePasskey, __deleteUser_wrapped as deleteUser, detectDeviceRegistrationRedirect, detectOAuthRedirect, detectSocialRedirectUrl, __executeSwapTransaction_wrapped as executeSwapTransaction, fetchProjectSettings, findMissingGoogleDriveBackupScopes, getActiveNetworkData, getActiveNetworkId, getAvailableWalletProvidersData, getBalance, getBalanceForAddress, getBalances, getCheckoutTransaction, getCheckoutTransactionQuote, getCoinbaseBuyUrl, getConnectedAddresses, getDefaultClient, getDeviceRegistrationTokenFromUrl, __getElevatedAccessToken_wrapped as getElevatedAccessToken, __getGoogleDriveBackupReadiness_wrapped as getGoogleDriveBackupReadiness, getKrakenAccounts, getKrakenWhitelistedAddresses, getMfaDevices, getMfaMethods, getMfaRecoveryCodes, getMissingVerificationForCoinbaseOnrampOrder, getMultichainBalances, getNetworksData, getOwnerWalletAccountForSmartWalletAccount, getPasskeys, getPrimaryWalletAccount, getRegisteredDevices, getSwapQuote, getSwapStatus, getTransactionHistory, getUserSocialAccounts, getWalletAccountAddressByType, getWalletAccountFromAddress, getWalletAccounts, getWalletConnectCatalog, getWalletConnectCatalogWalletByWalletProviderKey, getWalletProviderDataByKey, hasAllGoogleDriveBackupScopes, hasExtension, __initializeClient_wrapped as initializeClient, isCaptchaRequired, isDeeplinkWalletProvider, isDeviceRegistrationRequired, isHardwareWalletAccount, isInsufficientGoogleDriveScopesError, isMfaRequiredForAction, isMobile, isPendingRecoveryCodesAcknowledgment, isProgrammaticNetworkSwitchAvailable, isSignedIn, isUserMissingMfaAuth, isUserOnboardingComplete, isWalletAccountVerified, logout, offEvent, offWalletProviderEvent, onEvent, onWalletProviderEvent, onceEvent, parseUserAgent, __prepareCheckoutTransaction_wrapped as prepareCheckoutTransaction, __proveWalletAccountOwnership_wrapped as proveWalletAccountOwnership, __refreshAuth_wrapped as refreshAuth, __refreshUser_wrapped as refreshUser, __registerPasskey_wrapped as registerPasskey, __registerTotpMfaDevice_wrapped as registerTotpMfaDevice, __removeWalletAccount_wrapped as removeWalletAccount, __requestExternalAuthElevatedToken_wrapped as requestExternalAuthElevatedToken, requiresConversion, __revokeAllRegisteredDevices_wrapped as revokeAllRegisteredDevices, __revokeRegisteredDevice_wrapped as revokeRegisteredDevice, __selectPrimaryWalletAccount_wrapped as selectPrimaryWalletAccount, __sendEmailOTP_wrapped as sendEmailOTP, __sendSmsOTP_wrapped as sendSmsOTP, __setCaptchaToken_wrapped as setCaptchaToken, __setDefaultMfaDevice_wrapped as setDefaultMfaDevice, __setInstrumentationEnabled_wrapped as setInstrumentationEnabled, __signInWithExternalJwt_wrapped as signInWithExternalJwt, __signInWithPasskey_wrapped as signInWithPasskey, __signInWithSocialPopUp_wrapped as signInWithSocialPopUp, __signInWithSocialRedirect_wrapped as signInWithSocialRedirect, __signMessage_wrapped as signMessage, __submitCheckoutTransaction_wrapped as submitCheckoutTransaction, supportedCountries, __switchActiveNetwork_wrapped as switchActiveNetwork, trackCheckoutTransaction, __transferAmount_wrapped as transferAmount, __transferWalletAccount_wrapped as transferWalletAccount, __unlinkSocialAccount_wrapped as unlinkSocialAccount, __updateUser_wrapped as updateUser, __verifyOTP_wrapped as verifyOTP, __verifyWalletAccount_wrapped as verifyWalletAccount, waitForClientInitialized };
 //# sourceMappingURL=index.esm.js.map