@dynamic-labs-sdk/client 1.19.1 → 1.21.0

package/dist/{updateAuthFromVerifyResponse-CY0xTIXF.cjs → updateAuthFromVerifyResponse-CSqnGlh3.cjs}

@@ -1,13 +1,41 @@
-const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-CHeYEkjj.cjs');
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
+let zod_mini = require("zod/mini");
+zod_mini = __toESM(zod_mini);
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.19.1";
+var version = "1.21.0";
 var dependencies = {
 	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
-	"@dynamic-labs-wallet/browser-wallet-client": "1.0.46",
-	"@dynamic-labs-wallet/forward-mpc-client": "0.12.0",
+	"@dynamic-labs-wallet/browser-wallet-client": "1.0.73",
+	"@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
 	"@dynamic-labs/sdk-api-core": "catalog:",
 	"@simplewebauthn/browser": "13.1.0",
 	"ably": "2.17.1",
@@ -455,27 +483,91 @@ const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: as
 	return context.response;
 } });
 
+//#endregion
+//#region src/services/storage/createStorageKeySchema/createStorageKeySchema.ts
+/** @notInstrumented */
+const createStorageKeySchema = (params) => {
+	return params;
+};
+
+//#endregion
+//#region src/utils/getNonce/noncePoolStorage/schema.ts
+/**
+* Dedicated storage key for the prefetched nonce pool.
+*
+* The pool must NOT live in the synced state blob: that blob is rewritten on
+* every state change from a possibly-stale in-memory copy, which resurrects
+* already-consumed single-use nonces. This key is only ever written through
+* `updateNoncePoolStorage`'s serialized read-modify-write.
+*/
+const noncePoolStorageKeySchema = createStorageKeySchema({
+	key: "nonce-pool",
+	schema: zod_mini.object({
+		expiration: zod_mini.number(),
+		nonces: zod_mini.array(zod_mini.string())
+	})
+});
+
+//#endregion
+//#region src/utils/getNonce/noncePoolStorage/updateNoncePoolStorage/updateNoncePoolStorage.ts
+const pendingUpdates = /* @__PURE__ */ new WeakMap();
+/**
+* Updates the persisted nonce pool with a serialized read-modify-write.
+*
+* The write is awaited before resolving, so once this returns the storage
+* ledger reflects the update. Returns the pool as it was read (pre-update).
+* @notInstrumented
+*/
+const updateNoncePoolStorage = async ({ update }, client) => {
+	const core = getCore(client);
+	let storedBeforeUpdate = null;
+	const run = async () => {
+		const stored = await core.storage.getItem(noncePoolStorageKeySchema);
+		storedBeforeUpdate = stored;
+		const updated = update(stored);
+		if (updated !== null) await core.storage.setItem(noncePoolStorageKeySchema, updated);
+	};
+	const chained = (pendingUpdates.get(core) ?? Promise.resolve()).then(run, run);
+	pendingUpdates.set(core, chained);
+	await chained;
+	return storedBeforeUpdate;
+};
+
 //#endregion
 //#region src/utils/getNonce/getNonce.ts
 /**
 * Returns a nonce for wallet ownership verification.
 *
-* Pops the first nonce from the prefetched pool. When the pool is running low
-* (≤1 remaining after pop) a background refetch is triggered. If the pool is
-* empty, nonces are fetched on-demand before returning.
+* The pool lives exclusively in storage: every call pops the first nonce
+* through `updateNoncePoolStorage`'s serialized read-modify-write, so the
+* nonce is removed from storage before it is handed out and no in-memory
+* copy can go stale. Nonces are single-use server-side — a stale copy handed
+* out twice fails the second consume.
+*
+* When the pool is running low (≤1 remaining after pop) a background refetch
+* is triggered. If the pool is empty or expired, nonces are fetched on-demand
+* before returning.
 * @notInstrumented
 */
 const getNonce = async (client) => {
-	const core = getCore(client);
-	const pool = core.state.get().prefetchedNonces;
-	if (pool.length > 0) {
-		const [nonce, ...remaining] = pool;
-		core.state.set({ prefetchedNonces: remaining });
-		if (remaining.length <= 1) fetchAndStoreNonces(client);
-		return nonce;
+	let nonce;
+	let remainingCount = 0;
+	await updateNoncePoolStorage({ update: (stored) => {
+		if (!stored || stored.nonces.length === 0 || stored.expiration <= Date.now()) return null;
+		const [first, ...remaining] = stored.nonces;
+		nonce = first;
+		remainingCount = remaining.length;
+		return {
+			expiration: stored.expiration,
+			nonces: remaining
+		};
+	} }, client);
+	if (nonce === void 0) {
+		await fetchAndStoreNonces(client);
+		return getNonce(client);
 	}
-	await fetchAndStoreNonces(client);
-	return getNonce(client);
+	if (remainingCount <= 1) fetchAndStoreNonces(client);
+	return nonce;
 };
 
 //#endregion
@@ -621,17 +713,19 @@ const createApiClient = (options = {}, client) => {
 //#endregion
 //#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
 /**
-* Fetches a batch of nonces from the API.
+* Fetches a batch of nonces from the API and appends them to the pool in
+* storage.
 *
 * Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
 * redirect). On iOS, a network request (like fetching a nonce) between a user
 * action and a deeplink call will break the gesture chain, causing iOS to
 * silently ignore the deeplink. By prefetching nonces ahead of time,
-* `getNonce` can return synchronously from cache and the deeplink fires
-* without an interrupting network round-trip.
+* `getNonce` can return from the stored pool without an interrupting network
+* round-trip.
 *
-* New nonces are **appended** to the existing pool so that unconsumed entries
-* are not discarded by a background refetch.
+* New nonces are **appended** to the stored pool so that unconsumed entries
+* are not discarded by a background refetch; an expired stored pool is
+* replaced instead, since its nonces have already been evicted server-side.
 *
 * Concurrent refills are coalesced behind a single in-flight promise so that
 * simultaneous callers share one `GET /nonces` round-trip instead of each
@@ -649,11 +743,13 @@ const fetchAndStoreNonces = async (client) => {
 			count: NONCE_POOL_SIZE,
 			environmentId
 		});
-		const existing = core.state.get().prefetchedNonces;
-		core.state.set({
-			prefetchedNonces: [...existing, ...nonces],
-			prefetchedNoncesExpiration: Date.now() + NONCE_POOL_EXPIRATION_TIME
-		});
+		const expiration = Date.now() + NONCE_POOL_EXPIRATION_TIME;
+		await updateNoncePoolStorage({ update: (stored) => {
+			return {
+				expiration,
+				nonces: [...stored && stored.expiration > Date.now() ? stored.nonces : [], ...nonces]
+			};
+		} }, client);
 	})().finally(() => {
 		core.state.set({ nonceFetchInFlight: null });
 	});
@@ -800,6 +896,41 @@ const emitEvent = ({ event, args }, client) => {
 	eventEmitter.emit(event, args);
 };
 
+//#endregion
+//#region src/utils/retryOnFail/InvalidRetryOnFailCallError.ts
+/**
+* This error is thrown when the `retryOnFail` function is called with an invalid
+* number of retries (i.e. less than 0).
+*/
+var InvalidRetryOnFailCallError = class extends BaseError {
+	constructor(maxRetries) {
+		super({
+			cause: null,
+			code: "invalid_retry_on_fail_call_error",
+			docsUrl: null,
+			name: "InvalidRetryOnFailCallError",
+			shortMessage: `Invalid retries parameter for retryOnFail call: ${maxRetries}`
+		});
+	}
+};
+
+//#endregion
+//#region src/utils/retryOnFail/retryOnFail.ts
+/** @notInstrumented */
+const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
+	for (let retry = 0; retry <= maxRetries; retry++) try {
+		return await fn();
+	} catch (error) {
+		if (retry >= maxRetries) throw error;
+		if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
+	}
+	/**
+	* Reaching this point should never happen and this
+	* error is thrown to help us debug the issue.
+	*/
+	throw new InvalidRetryOnFailCallError(maxRetries);
+};
+
 //#endregion
 //#region src/errors/InvalidWalletProviderKeyError.ts
 var InvalidWalletProviderKeyError = class extends BaseError {
@@ -1118,6 +1249,115 @@ const getWalletAccounts = (client = getDefaultClient()) => {
 	}, client);
 };
 
+//#endregion
+//#region src/modules/auth/isSignedIn/isSignedIn.ts
+/**
+* Checks if the user is currently signed in to the Dynamic client.
+*
+* The client is considered to be in a signed in state if a user has
+* authenticated or if the client has at least one wallet connected.
+*
+* @deprecated What counts as "signed in" is your app's business logic, not the
+* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
+* which rarely matches every app and forces a dependency on us for every
+* variation. Compose your own check from the underlying primitives instead —
+* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
+* layer in whatever your app requires (device registration, completed
+* onboarding, satisfied MFA, a required embedded wallet, …). See the
+* "Check if signed in" guide:
+* https://www.dynamic.xyz/docs/javascript/user-session-management
+*
+* @example
+* ```ts
+* if (isSignedIn()) {
+*   console.log('User is authenticated or has a wallet connected');
+* }
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the user is signed in, false otherwise.
+* @see logout
+* @see isAnyWalletAccountConnected
+* @notInstrumented
+*/
+const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
+
+//#endregion
+//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
+/**
+* The schema to track the expiration time of the project settings.
+*/
+const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
+	key: "projectSettingsExpiration",
+	schema: zod_mini.number()
+});
+
+//#endregion
+//#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
+/**
+* Expiration time of the project settings in milliseconds.
+*/
+const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
+/**
+* Fetches and updates the project settings from the API.
+*
+* This function retrieves the latest project configuration settings
+* from Dynamic's servers, including authentication options, enabled chains,
+* and security configurations. The settings are cached for performance.
+*
+* @example
+* ```ts
+* const settings = await fetchProjectSettings();
+* console.log('Enabled chains:', settings.chains);
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the updated project settings.
+* @see createDynamicClient
+* @see initializeClient
+* @notInstrumented
+* @noHook Internal settings fetch that is not part of the public hook surface.
+*/
+const fetchProjectSettings = async (client = getDefaultClient()) => {
+	const core = getCore(client);
+	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
+	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
+	const apiClient = createApiClient({}, client);
+	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
+	const doFetch = async () => apiClient.getEnvironmentSettings({
+		environmentId: core.environmentId,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`
+	}, { credentials: "omit" });
+	const projectSettings = await retryOnFail({
+		fn: doFetch,
+		maxRetries: 2
+	});
+	core.state.set({ projectSettings: projectSettings ?? null });
+	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
+	return projectSettings;
+};
+
+//#endregion
+//#region src/modules/sessionKeys/generateSessionKeys/generateSessionKeys.ts
+/** @notInstrumented */
+const generateSessionKeys = async (client) => {
+	const core = getCore(client);
+	const currentState = core.state.get();
+	const isRotation = Boolean(currentState.sessionKeys);
+	const logContext = {
+		environmentId: core.environmentId,
+		operation: isRotation ? "rotate" : "create",
+		userId: currentState.user?.id ?? null
+	};
+	core.logger.info(isRotation ? "[generateSessionKeys] Rotating session key..." : "[generateSessionKeys] Creating session key...", logContext);
+	await core.keychain.removeKey("session");
+	const publicKey = await core.keychain.generateKey("session");
+	assertDefined(publicKey, "Public key not found");
+	core.state.set({ sessionKeys: publicKey });
+	core.logger.info(isRotation ? "[generateSessionKeys] Session key rotated" : "[generateSessionKeys] Session key created", logContext);
+	return { publicKey };
+};
+
 //#endregion
 //#region src/errors/NoWalletProviderFoundError.ts
 var NoWalletProviderFoundError = class extends BaseError {
@@ -1273,6 +1513,51 @@ const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
 	return walletProvider;
 };
 
+//#endregion
+//#region src/modules/wallets/utils/getAvailableWalletProvidersFromWalletAccounts/getAvailableWalletProvidersFromWalletAccounts.ts
+/** @notInstrumented */
+const getAvailableWalletProvidersFromWalletAccounts = (client) => {
+	const core = getCore(client);
+	const walletProvidersMap = /* @__PURE__ */ new Map();
+	getWalletAccounts(client).forEach((walletAccount) => {
+		if (walletProvidersMap.has(walletAccount.walletProviderKey)) return;
+		try {
+			const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
+			walletProvidersMap.set(walletAccount.walletProviderKey, walletProvider);
+		} catch (error) {
+			core.logger.debug("Wallet provider not found for wallet account", {
+				error,
+				walletAccount: walletAccount.address
+			});
+		}
+	});
+	return Array.from(walletProvidersMap.values());
+};
+
+//#endregion
+//#region src/modules/wallets/destroyWalletProviders/destroyWalletProviders.ts
+/**
+* Tear down every wallet provider on the client.
+*
+* Each provider's `destroy` is responsible for its own local + remote
+* cleanup. We swallow errors so a failing destroy on one provider does not
+* block teardown of the others (e.g. during logout).
+*
+* @notInstrumented
+*/
+const destroyWalletProviders = async ({ reason }, client) => {
+	const core = getCore(client);
+	const walletProviders = getAvailableWalletProvidersFromWalletAccounts(client);
+	await Promise.all(walletProviders.map(async (walletProvider) => {
+		if (!walletProvider.destroy) return;
+		try {
+			await walletProvider.destroy({ reason });
+		} catch (err) {
+			core.logger.error(`Error destroying wallet provider ${walletProvider.key}`, err);
+		}
+	}));
+};
+
 //#endregion
 //#region src/modules/auth/consts.ts
 const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
@@ -1685,6 +1970,75 @@ const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors })
 	return wrapped;
 };
 
+//#endregion
+//#region src/modules/auth/logoutWithReason/logoutWithReason.ts
+/**
+* Logs the user out with an explicit reason.
+*
+* Revokes the session, clears auth state, terminates wallet providers, and
+* emits the `logout` client event with the given reason. The reason is also
+* captured as an argument on the function-instrumentation event, which is
+* how Datadog distinguishes between different logout causes.
+*
+* Use this instead of the public `logout` when triggering a logout from
+* internal or extension code — the caller owns the reason string, so the
+* telemetry correctly attributes *why* the logout happened.
+*
+* @param params - The logout params.
+* @param params.reason - Why the logout is being triggered. Extension authors
+*   needing a reason outside the SDK catalog can cast with `as LogoutReason`.
+* @param client - The Dynamic client instance.
+* @instrumented
+*/
+const logoutWithReason = async ({ reason }, client) => {
+	const core = getCore(client);
+	core.logger.debug("[logoutWithReason] Logging out...", { reason });
+	await destroyWalletProviders({ reason }, client);
+	if (client.user !== null) {
+		const apiClient = createApiClient({}, client);
+		try {
+			await apiClient.revokeSession({ environmentId: core.environmentId });
+		} catch (error) {
+			core.logger.error("Failed to revoke session", error);
+		}
+		/**
+		* This deletes the auth cookie if it exists.
+		* If the cookie doesn't exist, this sets a new cookie that expires immediately.
+		*/
+		if (isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=; Max-Age=-99999999; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
+	}
+	await core.keychain.removeKey("session");
+	core.state.set({
+		captchaToken: null,
+		elevatedAccessTokens: [],
+		legacyToken: null,
+		mfaToken: null,
+		sessionExpiresAt: null,
+		sessionKeys: null,
+		token: null,
+		unverifiedWalletAccounts: [],
+		user: null
+	});
+	emitEvent({
+		args: { reason },
+		event: "logout"
+	}, client);
+	fetchProjectSettings(client);
+	generateSessionKeys(client);
+};
+const __logoutWithReason_impl = logoutWithReason;
+const __logoutWithReason_wrapped = instrumentFunction({
+	fn: __logoutWithReason_impl,
+	functionName: "logoutWithReason",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
 //#endregion
 //#region src/constants.ts
 const SDK_API_CORE_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
@@ -2023,12 +2377,6 @@ Object.defineProperty(exports, 'DEFAULT_WAAS_BASE_MPC_RELAY_API_URL', {
     return DEFAULT_WAAS_BASE_MPC_RELAY_API_URL;
   }
 });
-Object.defineProperty(exports, 'DYNAMIC_AUTH_COOKIE_NAME', {
-  enumerable: true,
-  get: function () {
-    return DYNAMIC_AUTH_COOKIE_NAME;
-  }
-});
 Object.defineProperty(exports, 'DYNAMIC_ICONIC_SPRITE_URL', {
   enumerable: true,
   get: function () {
@@ -2125,6 +2473,18 @@ Object.defineProperty(exports, 'WalletProviderPriority', {
     return WalletProviderPriority;
   }
 });
+Object.defineProperty(exports, '__logoutWithReason_wrapped', {
+  enumerable: true,
+  get: function () {
+    return __logoutWithReason_wrapped;
+  }
+});
+Object.defineProperty(exports, '__toESM', {
+  enumerable: true,
+  get: function () {
+    return __toESM;
+  }
+});
 Object.defineProperty(exports, 'assertDefined', {
   enumerable: true,
   get: function () {
@@ -2155,6 +2515,12 @@ Object.defineProperty(exports, 'createRuntimeServiceAccessKey', {
     return createRuntimeServiceAccessKey;
   }
 });
+Object.defineProperty(exports, 'createStorageKeySchema', {
+  enumerable: true,
+  get: function () {
+    return createStorageKeySchema;
+  }
+});
 Object.defineProperty(exports, 'emitEvent', {
   enumerable: true,
   get: function () {
@@ -2179,6 +2545,12 @@ Object.defineProperty(exports, 'fetchAndStoreNonces', {
     return fetchAndStoreNonces;
   }
 });
+Object.defineProperty(exports, 'fetchProjectSettings', {
+  enumerable: true,
+  get: function () {
+    return fetchProjectSettings;
+  }
+});
 Object.defineProperty(exports, 'findWaasWalletProviderByChain', {
   enumerable: true,
   get: function () {
@@ -2197,6 +2569,12 @@ Object.defineProperty(exports, 'formatWalletProviderKey', {
     return formatWalletProviderKey;
   }
 });
+Object.defineProperty(exports, 'generateSessionKeys', {
+  enumerable: true,
+  get: function () {
+    return generateSessionKeys;
+  }
+});
 Object.defineProperty(exports, 'getChainFromVerifiedCredentialChain', {
   enumerable: true,
   get: function () {
@@ -2251,12 +2629,6 @@ Object.defineProperty(exports, 'getPlatform', {
     return getPlatform;
   }
 });
-Object.defineProperty(exports, 'getSecureCookieAttribute', {
-  enumerable: true,
-  get: function () {
-    return getSecureCookieAttribute;
-  }
-});
 Object.defineProperty(exports, 'getSessionKeys', {
   enumerable: true,
   get: function () {
@@ -2311,6 +2683,12 @@ Object.defineProperty(exports, 'isCookieEnabled', {
     return isCookieEnabled;
   }
 });
+Object.defineProperty(exports, 'isSignedIn', {
+  enumerable: true,
+  get: function () {
+    return isSignedIn;
+  }
+});
 Object.defineProperty(exports, 'isUserMissingMfaAuth', {
   enumerable: true,
   get: function () {
@@ -2377,16 +2755,16 @@ Object.defineProperty(exports, 'randomString', {
     return randomString;
   }
 });
-Object.defineProperty(exports, 'scrubParameters', {
+Object.defineProperty(exports, 'retryOnFail', {
   enumerable: true,
   get: function () {
-    return scrubParameters;
+    return retryOnFail;
   }
 });
-Object.defineProperty(exports, 'setCookie', {
+Object.defineProperty(exports, 'scrubParameters', {
   enumerable: true,
   get: function () {
-    return setCookie;
+    return scrubParameters;
   }
 });
 Object.defineProperty(exports, 'setDefaultClient', {
@@ -2407,6 +2785,12 @@ Object.defineProperty(exports, 'updateAuthFromVerifyResponse', {
     return updateAuthFromVerifyResponse;
   }
 });
+Object.defineProperty(exports, 'updateNoncePoolStorage', {
+  enumerable: true,
+  get: function () {
+    return updateNoncePoolStorage;
+  }
+});
 Object.defineProperty(exports, 'upsertElevatedAccessToken', {
   enumerable: true,
   get: function () {
@@ -2419,4 +2803,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=updateAuthFromVerifyResponse-CY0xTIXF.cjs.map
+//# sourceMappingURL=updateAuthFromVerifyResponse-CSqnGlh3.cjs.map