@dynamic-labs-sdk/client 1.19.1 → 1.21.0

package/dist/{updateAuthFromVerifyResponse-inxvMWJB.esm.js → updateAuthFromVerifyResponse-C_YKKAIX.esm.js}

@@ -1,12 +1,13 @@
 import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi, WalletProviderEnum, isDeviceNonceSignatureRequiredForUrl } from "@dynamic-labs/sdk-api-core";
+import * as z from "zod/mini";
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.19.1";
+var version = "1.21.0";
 var dependencies = {
 	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
-	"@dynamic-labs-wallet/browser-wallet-client": "1.0.46",
-	"@dynamic-labs-wallet/forward-mpc-client": "0.12.0",
+	"@dynamic-labs-wallet/browser-wallet-client": "1.0.73",
+	"@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
 	"@dynamic-labs/sdk-api-core": "catalog:",
 	"@simplewebauthn/browser": "13.1.0",
 	"ably": "2.17.1",
@@ -454,27 +455,91 @@ const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: as
 	return context.response;
 } });
 
+//#endregion
+//#region src/services/storage/createStorageKeySchema/createStorageKeySchema.ts
+/** @notInstrumented */
+const createStorageKeySchema = (params) => {
+	return params;
+};
+
+//#endregion
+//#region src/utils/getNonce/noncePoolStorage/schema.ts
+/**
+* Dedicated storage key for the prefetched nonce pool.
+*
+* The pool must NOT live in the synced state blob: that blob is rewritten on
+* every state change from a possibly-stale in-memory copy, which resurrects
+* already-consumed single-use nonces. This key is only ever written through
+* `updateNoncePoolStorage`'s serialized read-modify-write.
+*/
+const noncePoolStorageKeySchema = createStorageKeySchema({
+	key: "nonce-pool",
+	schema: z.object({
+		expiration: z.number(),
+		nonces: z.array(z.string())
+	})
+});
+
+//#endregion
+//#region src/utils/getNonce/noncePoolStorage/updateNoncePoolStorage/updateNoncePoolStorage.ts
+const pendingUpdates = /* @__PURE__ */ new WeakMap();
+/**
+* Updates the persisted nonce pool with a serialized read-modify-write.
+*
+* The write is awaited before resolving, so once this returns the storage
+* ledger reflects the update. Returns the pool as it was read (pre-update).
+* @notInstrumented
+*/
+const updateNoncePoolStorage = async ({ update }, client) => {
+	const core = getCore(client);
+	let storedBeforeUpdate = null;
+	const run = async () => {
+		const stored = await core.storage.getItem(noncePoolStorageKeySchema);
+		storedBeforeUpdate = stored;
+		const updated = update(stored);
+		if (updated !== null) await core.storage.setItem(noncePoolStorageKeySchema, updated);
+	};
+	const chained = (pendingUpdates.get(core) ?? Promise.resolve()).then(run, run);
+	pendingUpdates.set(core, chained);
+	await chained;
+	return storedBeforeUpdate;
+};
+
 //#endregion
 //#region src/utils/getNonce/getNonce.ts
 /**
 * Returns a nonce for wallet ownership verification.
 *
-* Pops the first nonce from the prefetched pool. When the pool is running low
-* (≤1 remaining after pop) a background refetch is triggered. If the pool is
-* empty, nonces are fetched on-demand before returning.
+* The pool lives exclusively in storage: every call pops the first nonce
+* through `updateNoncePoolStorage`'s serialized read-modify-write, so the
+* nonce is removed from storage before it is handed out and no in-memory
+* copy can go stale. Nonces are single-use server-side — a stale copy handed
+* out twice fails the second consume.
+*
+* When the pool is running low (≤1 remaining after pop) a background refetch
+* is triggered. If the pool is empty or expired, nonces are fetched on-demand
+* before returning.
 * @notInstrumented
 */
 const getNonce = async (client) => {
-	const core = getCore(client);
-	const pool = core.state.get().prefetchedNonces;
-	if (pool.length > 0) {
-		const [nonce, ...remaining] = pool;
-		core.state.set({ prefetchedNonces: remaining });
-		if (remaining.length <= 1) fetchAndStoreNonces(client);
-		return nonce;
+	let nonce;
+	let remainingCount = 0;
+	await updateNoncePoolStorage({ update: (stored) => {
+		if (!stored || stored.nonces.length === 0 || stored.expiration <= Date.now()) return null;
+		const [first, ...remaining] = stored.nonces;
+		nonce = first;
+		remainingCount = remaining.length;
+		return {
+			expiration: stored.expiration,
+			nonces: remaining
+		};
+	} }, client);
+	if (nonce === void 0) {
+		await fetchAndStoreNonces(client);
+		return getNonce(client);
 	}
-	await fetchAndStoreNonces(client);
-	return getNonce(client);
+	if (remainingCount <= 1) fetchAndStoreNonces(client);
+	return nonce;
 };
 
 //#endregion
@@ -620,17 +685,19 @@ const createApiClient = (options = {}, client) => {
 //#endregion
 //#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
 /**
-* Fetches a batch of nonces from the API.
+* Fetches a batch of nonces from the API and appends them to the pool in
+* storage.
 *
 * Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
 * redirect). On iOS, a network request (like fetching a nonce) between a user
 * action and a deeplink call will break the gesture chain, causing iOS to
 * silently ignore the deeplink. By prefetching nonces ahead of time,
-* `getNonce` can return synchronously from cache and the deeplink fires
-* without an interrupting network round-trip.
+* `getNonce` can return from the stored pool without an interrupting network
+* round-trip.
 *
-* New nonces are **appended** to the existing pool so that unconsumed entries
-* are not discarded by a background refetch.
+* New nonces are **appended** to the stored pool so that unconsumed entries
+* are not discarded by a background refetch; an expired stored pool is
+* replaced instead, since its nonces have already been evicted server-side.
 *
 * Concurrent refills are coalesced behind a single in-flight promise so that
 * simultaneous callers share one `GET /nonces` round-trip instead of each
@@ -648,11 +715,13 @@ const fetchAndStoreNonces = async (client) => {
 			count: NONCE_POOL_SIZE,
 			environmentId
 		});
-		const existing = core.state.get().prefetchedNonces;
-		core.state.set({
-			prefetchedNonces: [...existing, ...nonces],
-			prefetchedNoncesExpiration: Date.now() + NONCE_POOL_EXPIRATION_TIME
-		});
+		const expiration = Date.now() + NONCE_POOL_EXPIRATION_TIME;
+		await updateNoncePoolStorage({ update: (stored) => {
+			return {
+				expiration,
+				nonces: [...stored && stored.expiration > Date.now() ? stored.nonces : [], ...nonces]
+			};
+		} }, client);
 	})().finally(() => {
 		core.state.set({ nonceFetchInFlight: null });
 	});
@@ -799,6 +868,41 @@ const emitEvent = ({ event, args }, client) => {
 	eventEmitter.emit(event, args);
 };
 
+//#endregion
+//#region src/utils/retryOnFail/InvalidRetryOnFailCallError.ts
+/**
+* This error is thrown when the `retryOnFail` function is called with an invalid
+* number of retries (i.e. less than 0).
+*/
+var InvalidRetryOnFailCallError = class extends BaseError {
+	constructor(maxRetries) {
+		super({
+			cause: null,
+			code: "invalid_retry_on_fail_call_error",
+			docsUrl: null,
+			name: "InvalidRetryOnFailCallError",
+			shortMessage: `Invalid retries parameter for retryOnFail call: ${maxRetries}`
+		});
+	}
+};
+
+//#endregion
+//#region src/utils/retryOnFail/retryOnFail.ts
+/** @notInstrumented */
+const retryOnFail = async ({ delay = 0, fn, maxRetries }) => {
+	for (let retry = 0; retry <= maxRetries; retry++) try {
+		return await fn();
+	} catch (error) {
+		if (retry >= maxRetries) throw error;
+		if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
+	}
+	/**
+	* Reaching this point should never happen and this
+	* error is thrown to help us debug the issue.
+	*/
+	throw new InvalidRetryOnFailCallError(maxRetries);
+};
+
 //#endregion
 //#region src/errors/InvalidWalletProviderKeyError.ts
 var InvalidWalletProviderKeyError = class extends BaseError {
@@ -1117,6 +1221,115 @@ const getWalletAccounts = (client = getDefaultClient()) => {
 	}, client);
 };
 
+//#endregion
+//#region src/modules/auth/isSignedIn/isSignedIn.ts
+/**
+* Checks if the user is currently signed in to the Dynamic client.
+*
+* The client is considered to be in a signed in state if a user has
+* authenticated or if the client has at least one wallet connected.
+*
+* @deprecated What counts as "signed in" is your app's business logic, not the
+* SDK's. This helper bakes in one opinion (a user OR any connected wallet),
+* which rarely matches every app and forces a dependency on us for every
+* variation. Compose your own check from the underlying primitives instead —
+* e.g. `Boolean(client.user) || isAnyWalletAccountConnected(client)` — and
+* layer in whatever your app requires (device registration, completed
+* onboarding, satisfied MFA, a required embedded wallet, …). See the
+* "Check if signed in" guide:
+* https://www.dynamic.xyz/docs/javascript/user-session-management
+*
+* @example
+* ```ts
+* if (isSignedIn()) {
+*   console.log('User is authenticated or has a wallet connected');
+* }
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the user is signed in, false otherwise.
+* @see logout
+* @see isAnyWalletAccountConnected
+* @notInstrumented
+*/
+const isSignedIn = (client = getDefaultClient()) => Boolean(client.user || getWalletAccounts(client).length > 0);
+
+//#endregion
+//#region src/modules/projectSettings/fetchProjectSettings/projectSettingsExpirationScheme.ts
+/**
+* The schema to track the expiration time of the project settings.
+*/
+const projectSettingsExpirationStorageKeySchema = createStorageKeySchema({
+	key: "projectSettingsExpiration",
+	schema: z.number()
+});
+
+//#endregion
+//#region src/modules/projectSettings/fetchProjectSettings/fetchProjectSettings.ts
+/**
+* Expiration time of the project settings in milliseconds.
+*/
+const PROJECT_SETTINGS_EXPIRATION_TIME = 1e3 * 60 * 5;
+/**
+* Fetches and updates the project settings from the API.
+*
+* This function retrieves the latest project configuration settings
+* from Dynamic's servers, including authentication options, enabled chains,
+* and security configurations. The settings are cached for performance.
+*
+* @example
+* ```ts
+* const settings = await fetchProjectSettings();
+* console.log('Enabled chains:', settings.chains);
+* ```
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the updated project settings.
+* @see createDynamicClient
+* @see initializeClient
+* @notInstrumented
+* @noHook Internal settings fetch that is not part of the public hook surface.
+*/
+const fetchProjectSettings = async (client = getDefaultClient()) => {
+	const core = getCore(client);
+	const currentExpiration = await core.storage.getItem(projectSettingsExpirationStorageKeySchema);
+	if (Boolean(client.projectSettings) && !(currentExpiration && currentExpiration < Date.now()) && isSignedIn(client)) return client.projectSettings;
+	const apiClient = createApiClient({}, client);
+	core.logger.debug("[fetchProjectSettings] Fetching project settings...");
+	const doFetch = async () => apiClient.getEnvironmentSettings({
+		environmentId: core.environmentId,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`
+	}, { credentials: "omit" });
+	const projectSettings = await retryOnFail({
+		fn: doFetch,
+		maxRetries: 2
+	});
+	core.state.set({ projectSettings: projectSettings ?? null });
+	await core.storage.setItem(projectSettingsExpirationStorageKeySchema, Date.now() + PROJECT_SETTINGS_EXPIRATION_TIME);
+	return projectSettings;
+};
+
+//#endregion
+//#region src/modules/sessionKeys/generateSessionKeys/generateSessionKeys.ts
+/** @notInstrumented */
+const generateSessionKeys = async (client) => {
+	const core = getCore(client);
+	const currentState = core.state.get();
+	const isRotation = Boolean(currentState.sessionKeys);
+	const logContext = {
+		environmentId: core.environmentId,
+		operation: isRotation ? "rotate" : "create",
+		userId: currentState.user?.id ?? null
+	};
+	core.logger.info(isRotation ? "[generateSessionKeys] Rotating session key..." : "[generateSessionKeys] Creating session key...", logContext);
+	await core.keychain.removeKey("session");
+	const publicKey = await core.keychain.generateKey("session");
+	assertDefined(publicKey, "Public key not found");
+	core.state.set({ sessionKeys: publicKey });
+	core.logger.info(isRotation ? "[generateSessionKeys] Session key rotated" : "[generateSessionKeys] Session key created", logContext);
+	return { publicKey };
+};
+
 //#endregion
 //#region src/errors/NoWalletProviderFoundError.ts
 var NoWalletProviderFoundError = class extends BaseError {
@@ -1272,6 +1485,51 @@ const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
 	return walletProvider;
 };
 
+//#endregion
+//#region src/modules/wallets/utils/getAvailableWalletProvidersFromWalletAccounts/getAvailableWalletProvidersFromWalletAccounts.ts
+/** @notInstrumented */
+const getAvailableWalletProvidersFromWalletAccounts = (client) => {
+	const core = getCore(client);
+	const walletProvidersMap = /* @__PURE__ */ new Map();
+	getWalletAccounts(client).forEach((walletAccount) => {
+		if (walletProvidersMap.has(walletAccount.walletProviderKey)) return;
+		try {
+			const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
+			walletProvidersMap.set(walletAccount.walletProviderKey, walletProvider);
+		} catch (error) {
+			core.logger.debug("Wallet provider not found for wallet account", {
+				error,
+				walletAccount: walletAccount.address
+			});
+		}
+	});
+	return Array.from(walletProvidersMap.values());
+};
+
+//#endregion
+//#region src/modules/wallets/destroyWalletProviders/destroyWalletProviders.ts
+/**
+* Tear down every wallet provider on the client.
+*
+* Each provider's `destroy` is responsible for its own local + remote
+* cleanup. We swallow errors so a failing destroy on one provider does not
+* block teardown of the others (e.g. during logout).
+*
+* @notInstrumented
+*/
+const destroyWalletProviders = async ({ reason }, client) => {
+	const core = getCore(client);
+	const walletProviders = getAvailableWalletProvidersFromWalletAccounts(client);
+	await Promise.all(walletProviders.map(async (walletProvider) => {
+		if (!walletProvider.destroy) return;
+		try {
+			await walletProvider.destroy({ reason });
+		} catch (err) {
+			core.logger.error(`Error destroying wallet provider ${walletProvider.key}`, err);
+		}
+	}));
+};
+
 //#endregion
 //#region src/modules/auth/consts.ts
 const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
@@ -1684,6 +1942,75 @@ const instrumentFunction = ({ fn, functionName, getCore: getCore$1, selectors })
 	return wrapped;
 };
 
+//#endregion
+//#region src/modules/auth/logoutWithReason/logoutWithReason.ts
+/**
+* Logs the user out with an explicit reason.
+*
+* Revokes the session, clears auth state, terminates wallet providers, and
+* emits the `logout` client event with the given reason. The reason is also
+* captured as an argument on the function-instrumentation event, which is
+* how Datadog distinguishes between different logout causes.
+*
+* Use this instead of the public `logout` when triggering a logout from
+* internal or extension code — the caller owns the reason string, so the
+* telemetry correctly attributes *why* the logout happened.
+*
+* @param params - The logout params.
+* @param params.reason - Why the logout is being triggered. Extension authors
+*   needing a reason outside the SDK catalog can cast with `as LogoutReason`.
+* @param client - The Dynamic client instance.
+* @instrumented
+*/
+const logoutWithReason = async ({ reason }, client) => {
+	const core = getCore(client);
+	core.logger.debug("[logoutWithReason] Logging out...", { reason });
+	await destroyWalletProviders({ reason }, client);
+	if (client.user !== null) {
+		const apiClient = createApiClient({}, client);
+		try {
+			await apiClient.revokeSession({ environmentId: core.environmentId });
+		} catch (error) {
+			core.logger.error("Failed to revoke session", error);
+		}
+		/**
+		* This deletes the auth cookie if it exists.
+		* If the cookie doesn't exist, this sets a new cookie that expires immediately.
+		*/
+		if (isCookieEnabled(client)) setCookie(`${DYNAMIC_AUTH_COOKIE_NAME}=; Max-Age=-99999999; path=/; SameSite=Lax${getSecureCookieAttribute()}`);
+	}
+	await core.keychain.removeKey("session");
+	core.state.set({
+		captchaToken: null,
+		elevatedAccessTokens: [],
+		legacyToken: null,
+		mfaToken: null,
+		sessionExpiresAt: null,
+		sessionKeys: null,
+		token: null,
+		unverifiedWalletAccounts: [],
+		user: null
+	});
+	emitEvent({
+		args: { reason },
+		event: "logout"
+	}, client);
+	fetchProjectSettings(client);
+	generateSessionKeys(client);
+};
+const __logoutWithReason_impl = logoutWithReason;
+const __logoutWithReason_wrapped = instrumentFunction({
+	fn: __logoutWithReason_impl,
+	functionName: "logoutWithReason",
+	getCore: () => {
+		try {
+			return getCore(getDefaultClient());
+		} catch {
+			return;
+		}
+	}
+});
+
 //#endregion
 //#region src/constants.ts
 const SDK_API_CORE_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
@@ -1974,5 +2301,5 @@ const updateAuthFromVerifyResponse = ({ response }, client) => {
 };
 
 //#endregion
-export { MfaRateLimitedError as $, getWalletAccounts as A, offEvent as B, extractSessionId as C, getWalletProviderRegistry as D, WalletProviderPriority as E, formatWalletAccountId as F, fetchAndStoreNonces as G, onceEvent as H, normalizeAddress as I, createDeviceSignatureHeadersMiddleware as J, createApiClient as K, splitWalletProviderKey as L, normalizeWalletNameWithChain as M, getChainFromVerifiedCredentialChain as N, createRuntimeServiceAccessKey as O, CHAINS_INFO_MAP as P, SandboxMaximumThresholdReachedError as Q, InvalidWalletProviderKeyError as R, getOperatingSystem as S, getWalletProviderFromWalletAccount as T, setCookie as U, onEvent as V, getSecureCookieAttribute as W, getDeviceSigner as X, getHeadersForNonceSignedByDeviceSigners as Y, getNonce as Z, SDK_API_CORE_VERSION as _, BaseError as _t, initializeWaasClientsForEagerRecovery as a, isCookieEnabled as at, DEFAULT_PII_FIELDS as b, version as bt, isWaasWalletProvider as c, getElevatedAccessToken as ct, DYNAMIC_WAAS_METADATA as d, CLIENT_SDK_NAME as dt, MfaInvalidOtpError as et, getWalletProviders as f, DYNAMIC_SDK_API_VERSION as ft, DYNAMIC_ICONIC_SPRITE_URL as g, ClientNotFoundError as gt, emitWalletAccountsChangedEvent as h, setDefaultClient as ht, InvalidParamError as i, getSessionKeys as it, formatWalletProviderKey as j, NoWalletProviderFoundError as k, DEFAULT_WAAS_BASE_API_URL as l, randomString as lt, checkAndRaiseWalletAccountsChangedEvent as m, getDefaultClient as mt, upsertElevatedAccessToken as n, InvalidExternalAuthError as nt, isWaasWalletAccount as o, assertDefined as ot, isUserMissingMfaAuth as p, NONCE_POOL_SIZE as pt, UnauthorizedError as q, parseElevatedAccessToken as r, APIError as rt, findWaasWalletProviderByChain as s, ValueMustBeDefinedError as st, updateAuthFromVerifyResponse as t, LinkCredentialError as tt, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as u, getPlatform as ut, instrumentFunction as v, getCore as vt, DYNAMIC_AUTH_COOKIE_NAME as w, getUserAgent as x, scrubParameters as y, name as yt, emitEvent as z };
-//# sourceMappingURL=updateAuthFromVerifyResponse-inxvMWJB.esm.js.map
+export { getNonce as $, generateSessionKeys as A, splitWalletProviderKey as B, getOperatingSystem as C, name as Ct, getWalletProviderRegistry as D, WalletProviderPriority as E, normalizeWalletNameWithChain as F, onEvent as G, retryOnFail as H, getChainFromVerifiedCredentialChain as I, createApiClient as J, onceEvent as K, CHAINS_INFO_MAP as L, isSignedIn as M, getWalletAccounts as N, createRuntimeServiceAccessKey as O, formatWalletProviderKey as P, getDeviceSigner as Q, formatWalletAccountId as R, getUserAgent as S, getCore as St, getWalletProviderFromWalletAccount as T, emitEvent as U, InvalidWalletProviderKeyError as V, offEvent as W, createDeviceSignatureHeadersMiddleware as X, UnauthorizedError as Y, getHeadersForNonceSignedByDeviceSigners as Z, SDK_API_CORE_VERSION as _, NONCE_POOL_SIZE as _t, initializeWaasClientsForEagerRecovery as a, LinkCredentialError as at, scrubParameters as b, ClientNotFoundError as bt, isWaasWalletProvider as c, getSessionKeys as ct, DYNAMIC_WAAS_METADATA as d, ValueMustBeDefinedError as dt, updateNoncePoolStorage as et, getWalletProviders as f, getElevatedAccessToken as ft, DYNAMIC_ICONIC_SPRITE_URL as g, DYNAMIC_SDK_API_VERSION as gt, emitWalletAccountsChangedEvent as h, CLIENT_SDK_NAME as ht, InvalidParamError as i, MfaInvalidOtpError as it, fetchProjectSettings as j, NoWalletProviderFoundError as k, DEFAULT_WAAS_BASE_API_URL as l, isCookieEnabled as lt, checkAndRaiseWalletAccountsChangedEvent as m, getPlatform as mt, upsertElevatedAccessToken as n, SandboxMaximumThresholdReachedError as nt, isWaasWalletAccount as o, InvalidExternalAuthError as ot, isUserMissingMfaAuth as p, randomString as pt, fetchAndStoreNonces as q, parseElevatedAccessToken as r, MfaRateLimitedError as rt, findWaasWalletProviderByChain as s, APIError as st, updateAuthFromVerifyResponse as t, createStorageKeySchema as tt, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as u, assertDefined as ut, __logoutWithReason_wrapped as v, getDefaultClient as vt, extractSessionId as w, version as wt, DEFAULT_PII_FIELDS as x, BaseError as xt, instrumentFunction as y, setDefaultClient as yt, normalizeAddress as z };
+//# sourceMappingURL=updateAuthFromVerifyResponse-C_YKKAIX.esm.js.map