@dynamic-labs-sdk/client 1.17.1 → 1.18.0

package/dist/{updateAuthFromVerifyResponse-azIi_3FB.esm.js → updateAuthFromVerifyResponse-BQes11vz.esm.js}

@@ -2,7 +2,7 @@ import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.17.1";
+var version = "1.18.0";
 var dependencies = {
 	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
 	"@dynamic-labs-wallet/browser-wallet-client": "1.0.46",
@@ -616,6 +616,28 @@ const fetchAndStoreNonces = async (client) => {
 	return fetchPromise;
 };
 
+//#endregion
+//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
+/**
+* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
+* document is running in a secure context, or an empty string otherwise.
+*
+* The `Secure` attribute prevents the browser from ever transmitting the cookie
+* over an unencrypted `http://` connection, which mitigates cleartext token
+* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
+* because browsers reject `Secure` cookies set over `http://` and that would
+* silently break local testing.
+*
+* Used when building the Dynamic auth JWT cookie string so the attribute is
+* applied consistently on both the write (sign-in/refresh) and clear (logout)
+* paths.
+*
+* @notInstrumented
+*/
+const getSecureCookieAttribute = () => {
+	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
+};
+
 //#endregion
 //#region src/utils/setCookie/setCookie.ts
 /**
@@ -1416,193 +1438,170 @@ const scrubParameters = ({ piiFields, redactAll, value }) => {
 	});
 };
 
-//#endregion
-//#region src/services/instrumentation/instrumentFunction/extractParams/extractParams.ts
-/**
-* Normalises the raw positional arguments of an instrumented function call
-* into a flat `Record<string, unknown>` suitable for structured logging.
-*
-* ## Why this is needed
-*
-* Instrumented functions are wrapped with `(...args: unknown[])`, so their
-* parameters arrive as an array. Logging a raw array loses the semantic names
-* of each argument. This function recovers a named representation:
-*
-* - **No arguments** → `{}`
-* - **Single plain-object argument** → that object is returned as-is, because
-*   SDK functions follow the single-object-parameter convention, so the object
-*   already carries named keys (`{ amount, to }`, etc.).
-* - **Everything else** (multiple args, a single primitive, a single array) →
-*   each value is indexed as `arg0`, `arg1`, …
-*
-* ## Why arrays are NOT treated as plain objects
-*
-* `typeof [] === 'object'` and `[] !== null`, so without the `Array.isArray`
-* guard a single-array argument would be returned as-is. That would produce
-* an object with numeric string keys (`{ '0': ..., '1': ... }`), which is
-* misleading and inconsistent with how multi-arg calls are handled. Instead,
-* arrays fall through to the indexed `arg0` path.
-* @notInstrumented
-*/
-const extractParams = (args) => {
-	if (args.length === 0) return {};
-	if (args.length === 1 && typeof args[0] === "object" && args[0] !== null && !Array.isArray(args[0])) return args[0];
-	const result = {};
-	for (let i = 0; i < args.length; i++) result[`arg${i}`] = args[i];
-	return result;
-};
-
-//#endregion
-//#region src/services/instrumentation/instrumentFunction/scrubResolvedValue/scrubResolvedValue.ts
-/**
-* Scrubs a resolved return value of any type before logging it.
-* Routes through `scrubParameters` by wrapping the value so that strings,
-* arrays, Dates, Errors, and all other types are handled identically to
-* nested object fields.
-* @notInstrumented
-*/
-const scrubResolvedValue = ({ piiFields, redactAll, value }) => scrubParameters({
-	piiFields,
-	redactAll,
-	value: { result: value }
-}).result;
-
 //#endregion
 //#region src/services/instrumentation/instrumentFunction/instrumentFunction.ts
-const serializeError = (error) => {
-	if (error instanceof Error) return {
-		message: error.message,
-		name: error.name,
-		stack: error.stack
+const toErrorFields = (error) => {
+	if (error instanceof BaseError) return {
+		errorCode: error.code,
+		errorName: error.name
 	};
+	if (error instanceof Error) return { errorName: error.name };
+	return { errorName: "UnknownError" };
+};
+const buildContext = (core) => {
+	const state = core.state.get();
 	return {
-		message: String(error),
-		name: "UnknownError"
+		environmentId: core.environmentId,
+		operatingSystem: getOperatingSystem(),
+		platform: getPlatform(),
+		registeredExtensionKeys: Array.from(core.extensions),
+		sdkSessionId: core.sdkSessionId,
+		sdkVersion: core.version,
+		tokenSessionId: state.token ? extractSessionId(state.token) : null,
+		userAgent: getUserAgent(),
+		userId: state.user?.id ?? null
 	};
 };
 /**
+* Runs an explicit payload selector and scrubs its output. Returns `undefined`
+* when there is no selector. Selector (and scrub) errors are swallowed so a
+* faulty selector can never break the wrapped function or fabricate a
+* 'rejected' event — instrumentation stays purely observational. The swallowed
+* error is surfaced on the `debug` logger so internal devs can still spot a
+* broken selector without it ever reaching a transport.
+*/
+const safeSelect = ({ functionName, logger, piiFields, selector, value }) => {
+	if (!selector) return;
+	try {
+		return scrubParameters({
+			piiFields,
+			value: selector(value)
+		});
+	} catch (error) {
+		logger.debug(`[instrumentFunction] payload selector for "${functionName}" threw; emitting event without payload`, error);
+		return;
+	}
+};
+/**
 * Wraps a function so that each invocation emits a structured
 * `FunctionInstrumentationEvent` at three lifecycle points:
 *
-* - **started** — immediately before the function body executes, with the
-*   PII-scrubbed call parameters.
+* - **started** — immediately before the function body executes.
 * - **resolved** — after the function (or its returned Promise) settles
-*   successfully, with the PII-scrubbed return value.
+*   successfully, with the call duration.
 * - **rejected** — if the function throws synchronously or its returned
-*   Promise rejects.
+*   Promise rejects, with the duration and the error's class name/code.
+*
+* Events carry only the safe envelope (function name, phase, timing, error
+* class, SDK/runtime metadata, identifiers). **Raw arguments and return values
+* are never captured.** A function that needs additional fields supplies
+* `selectors` that build an explicit, primitive-only {@link SafePayload} — the
+* only path from arguments/return value into a log.
 *
 * The original return value (or thrown error) is always forwarded to the
-* caller unchanged — instrumentation is purely observational.
+* caller unchanged — instrumentation is purely observational, and a throwing
+* selector cannot change that.
 *
-* ## Usage
+* ## Providing selectors
+*
+* A function opts into a payload by supplying selectors that map its arguments
+* (`started`) and/or its awaited return value (`resolved`) to a primitive-only
+* {@link SafePayload}. Pick individual known-safe fields — never spread a whole
+* object, which is exactly what the model prevents.
 *
 * ```ts
 * const transfer = instrumentFunction({
 *   fn: rawTransfer,
 *   functionName: 'transfer',
 *   getCore: () => core,
+*   selectors: {
+*     // `args` is the argument tuple the wrapped function was called with.
+*     started: ([{ chainId, amount }]) => ({ amount, chainId }),
+*     // `result` is the awaited return value (never the Promise).
+*     resolved: ({ txHash }) => ({ txHash }),
+*   },
 * });
-*
-* // When called, three events are emitted automatically:
-* await transfer({ amount: 1, to: '0xabc' });
 * ```
 *
+* A selector that throws (or whose output fails scrubbing) is swallowed: the
+* event is still emitted without a payload, and the error is logged at `debug`.
+*
 * ## How functions are wrapped
 *
-* `instrumentFunction` is not called manually in application code. Instead,
-* the esbuild instrumentation plugin (`tools/instrumentation-plugin`) injects
-* it at build time: any exported function annotated with `@instrumented` in its
-* JSDoc is automatically wrapped by the plugin during the build step.
-* The plugin strips the original `export`, renames the function, and re-exports
-* it under the original name via `instrumentFunction(...)` — so the public API
-* is unchanged and no call sites need to be updated.
+* `instrumentFunction` is not called manually in application code. The esbuild
+* instrumentation plugin (`tools/instrumentation-plugin`) injects it at build
+* time for any exported function annotated with `@instrumented` in its JSDoc.
 *
 * ## Opting out
 *
-* Instrumentation is skipped entirely when:
-* - `getCore()` returns `undefined` (SDK not initialised), or
-* - `core.instrumentation.config.enabled` is `false`.
-*
-* In both cases the original function is called directly with no overhead.
-*
-* ## PII scrubbing
-*
-* All string values whose key appears in `piiFields` are replaced with
-* `"[redacted]"` before events are emitted. Pass `redactAll: true` to redact
-* every field, regardless of key name.
+* Instrumentation is skipped entirely when `getCore()` returns `undefined`
+* (SDK not initialised) or when `core.instrumentation.config.enabled` is
+* `false`; in both cases the original function is called directly.
 * @notInstrumented
 */
-const instrumentFunction = ({ fn, functionName, getCore: getCore$1, redactAll }) => {
+const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors }) => {
 	const wrapped = (...args) => {
 		const core = getCore$1();
-		if (!core) return fn(...args);
-		if (!core.instrumentation.config.enabled) return fn(...args);
-		const instrumentation = core.instrumentation;
-		const state = core.state.get();
-		const baseEvent = {
-			environmentId: core.environmentId,
-			functionName,
-			operatingSystem: getOperatingSystem(),
-			parameters: scrubParameters({
-				piiFields: instrumentation.config.piiFields,
-				redactAll,
-				value: extractParams(args)
-			}),
-			platform: getPlatform(),
-			registeredExtensionKeys: Array.from(core.extensions),
-			sdkSessionId: core.sdkSessionId,
-			sdkVersion: core.version,
-			status: "info",
-			tokenSessionId: state.token ? extractSessionId(state.token) : null,
-			userAgent: getUserAgent(),
-			userId: state.user?.id ?? null
+		if (!core?.instrumentation.config.enabled) return fn(...args);
+		const { instrumentation, logger } = core;
+		const { piiFields } = instrumentation.config;
+		const base = {
+			...buildContext(core),
+			functionName
 		};
+		const startedAt = Date.now();
 		instrumentation.logFunction({
-			...baseEvent,
+			...base,
+			payload: safeSelect({
+				functionName,
+				logger,
+				piiFields,
+				selector: selectors?.started,
+				value: args
+			}),
 			phase: "started",
+			status: "info",
 			timestamp: (/* @__PURE__ */ new Date()).toISOString()
 		});
-		try {
-			const result = fn(...args);
-			if (result instanceof Promise) return result.then((value) => {
-				instrumentation.logFunction({
-					...baseEvent,
-					phase: "resolved",
-					resolvedValue: scrubResolvedValue({
-						piiFields: instrumentation.config.piiFields,
-						redactAll,
-						value
-					}),
-					timestamp: (/* @__PURE__ */ new Date()).toISOString()
-				});
-				return value;
-			}).catch((error) => {
-				instrumentation.logFunction({
-					...baseEvent,
-					phase: "rejected",
-					rejectedError: serializeError(error),
-					timestamp: (/* @__PURE__ */ new Date()).toISOString()
-				});
-				throw error;
-			});
+		const emitResolved = (value) => {
 			instrumentation.logFunction({
-				...baseEvent,
-				phase: "resolved",
-				resolvedValue: scrubResolvedValue({
-					piiFields: instrumentation.config.piiFields,
-					redactAll,
-					value: result
+				...base,
+				durationMs: Date.now() - startedAt,
+				payload: safeSelect({
+					functionName,
+					logger,
+					piiFields,
+					selector: selectors?.resolved,
+					value
 				}),
+				phase: "resolved",
+				status: "info",
 				timestamp: (/* @__PURE__ */ new Date()).toISOString()
 			});
-			return result;
-		} catch (error) {
+		};
+		const emitRejected = (error) => {
 			instrumentation.logFunction({
-				...baseEvent,
+				...base,
+				...toErrorFields(error),
+				durationMs: Date.now() - startedAt,
 				phase: "rejected",
-				rejectedError: serializeError(error),
+				status: "error",
 				timestamp: (/* @__PURE__ */ new Date()).toISOString()
 			});
+		};
+		try {
+			const result = fn(...args);
+			if (result instanceof Promise) return result.then((value) => {
+				emitResolved(value);
+				return value;
+			}, (error) => {
+				emitRejected(error);
+				throw error;
+			});
+			emitResolved(result);
+			return result;
+		} catch (error) {
+			emitRejected(error);
 			throw error;
 		}
 	};
@@ -1647,6 +1646,7 @@ const getWalletAccountsHash = (state, client) => getWalletAccountsFromState(stat
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns True if the user needs additional MFA authentication, false otherwise.
 * @notInstrumented
+* @hook Exposed as a hook so consumers reactively know when MFA is still required, updated when the user changes.
 */
 const isUserMissingMfaAuth = (client = getDefaultClient()) => {
 	const user = client.user;
@@ -1892,11 +1892,11 @@ const updateAuthFromVerifyResponse = ({ response }, client) => {
 	* programmatically because Redcoast won't set the cookie via headers. We set the cookie programmatically
 	* so customers can access the cookie from document.cookie consistently between sandbox and live environments.
 	*/
-	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax`);
+	if (minifiedJwt && isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=${minifiedJwt}; expires=${sessionExpiresAt.toUTCString()}; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
 	checkAndRaiseWalletAccountsChangedEvent({ previousState }, client);
 	if (!previousState.user && Boolean(newState.user)) initializeWaasClientsForEagerRecovery(client);
 };
 
 //#endregion
-export { MfaRateLimitedError as $, NoWalletProviderFoundError as A, emitEvent as B, getOperatingSystem as C, WalletProviderPriority as D, getWalletProviderFromWalletAccount as E, CHAINS_INFO_MAP as F, fetchAndStoreNonces as G, onEvent as H, formatWalletAccountId as I, createDeviceSignatureHeadersMiddleware as J, createApiClient as K, normalizeAddress as L, formatWalletProviderKey as M, normalizeWalletNameWithChain as N, getWalletProviderRegistry as O, getChainFromVerifiedCredentialChain as P, SandboxMaximumThresholdReachedError as Q, splitWalletProviderKey as R, getPlatform as S, DYNAMIC_AUTH_COOKIE_NAME as T, onceEvent as U, offEvent as V, setCookie as W, getDeviceSigner as X, getHeadersForNonceSignedByDeviceSigners as Y, getNonce as Z, SDK_API_CORE_VERSION as _, getCore as _t, initializeWaasClientsForEagerRecovery as a, isCookieEnabled as at, DEFAULT_PII_FIELDS as b, isWaasWalletProvider as c, getElevatedAccessToken as ct, DYNAMIC_WAAS_METADATA as d, DYNAMIC_SDK_API_VERSION as dt, MfaInvalidOtpError as et, getWalletProviders as f, NONCE_POOL_SIZE as ft, DYNAMIC_ICONIC_SPRITE_URL as g, BaseError as gt, emitWalletAccountsChangedEvent as h, ClientNotFoundError as ht, InvalidParamError as i, getSessionKeys as it, getWalletAccounts as j, createRuntimeServiceAccessKey as k, DEFAULT_WAAS_BASE_API_URL as l, randomString as lt, checkAndRaiseWalletAccountsChangedEvent as m, setDefaultClient as mt, upsertElevatedAccessToken as n, InvalidExternalAuthError as nt, isWaasWalletAccount as o, assertDefined as ot, isUserMissingMfaAuth as p, getDefaultClient as pt, UnauthorizedError as q, parseElevatedAccessToken as r, APIError as rt, findWaasWalletProviderByChain as s, ValueMustBeDefinedError as st, updateAuthFromVerifyResponse as t, LinkCredentialError as tt, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as u, CLIENT_SDK_NAME as ut, instrumentFunction as v, name as vt, extractSessionId as w, getUserAgent as x, scrubParameters as y, version as yt, InvalidWalletProviderKeyError as z };
-//# sourceMappingURL=updateAuthFromVerifyResponse-azIi_3FB.esm.js.map
+export { SandboxMaximumThresholdReachedError as $, NoWalletProviderFoundError as A, emitEvent as B, getOperatingSystem as C, WalletProviderPriority as D, getWalletProviderFromWalletAccount as E, CHAINS_INFO_MAP as F, getSecureCookieAttribute as G, onEvent as H, formatWalletAccountId as I, UnauthorizedError as J, fetchAndStoreNonces as K, normalizeAddress as L, formatWalletProviderKey as M, normalizeWalletNameWithChain as N, getWalletProviderRegistry as O, getChainFromVerifiedCredentialChain as P, getNonce as Q, splitWalletProviderKey as R, getPlatform as S, DYNAMIC_AUTH_COOKIE_NAME as T, onceEvent as U, offEvent as V, setCookie as W, getHeadersForNonceSignedByDeviceSigners as X, createDeviceSignatureHeadersMiddleware as Y, getDeviceSigner as Z, SDK_API_CORE_VERSION as _, BaseError as _t, initializeWaasClientsForEagerRecovery as a, getSessionKeys as at, DEFAULT_PII_FIELDS as b, version as bt, isWaasWalletProvider as c, ValueMustBeDefinedError as ct, DYNAMIC_WAAS_METADATA as d, CLIENT_SDK_NAME as dt, MfaRateLimitedError as et, getWalletProviders as f, DYNAMIC_SDK_API_VERSION as ft, DYNAMIC_ICONIC_SPRITE_URL as g, ClientNotFoundError as gt, emitWalletAccountsChangedEvent as h, setDefaultClient as ht, InvalidParamError as i, APIError as it, getWalletAccounts as j, createRuntimeServiceAccessKey as k, DEFAULT_WAAS_BASE_API_URL as l, getElevatedAccessToken as lt, checkAndRaiseWalletAccountsChangedEvent as m, getDefaultClient as mt, upsertElevatedAccessToken as n, LinkCredentialError as nt, isWaasWalletAccount as o, isCookieEnabled as ot, isUserMissingMfaAuth as p, NONCE_POOL_SIZE as pt, createApiClient as q, parseElevatedAccessToken as r, InvalidExternalAuthError as rt, findWaasWalletProviderByChain as s, assertDefined as st, updateAuthFromVerifyResponse as t, MfaInvalidOtpError as tt, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as u, randomString as ut, instrumentFunction as v, getCore as vt, extractSessionId as w, getUserAgent as x, scrubParameters as y, name as yt, InvalidWalletProviderKeyError as z };
+//# sourceMappingURL=updateAuthFromVerifyResponse-BQes11vz.esm.js.map