@dynamic-labs-sdk/client 1.20.0 → 1.21.1

package/dist/{isUserOnboardingComplete-CsoV3ae7.cjs → isUserOnboardingComplete-D_O53a98.cjs}

@@ -1,8 +1,48 @@
-const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-B0K1VJ8b.cjs');
-const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-DXVcXa66.cjs');
+const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-Dg8THxkT.cjs');
+const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-v7x1B-0g.cjs');
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 let _dynamic_labs_wallet_browser_wallet_client = require("@dynamic-labs-wallet/browser-wallet-client");
 
+//#region src/errors/WaasLoadFailedError.ts
+/**
+* Thrown when the embedded (WaaS) wallet's secure container failed to load
+* after exhausting all of its internal retry attempts.
+*
+* This failure is transient: the next wallet operation triggers a fresh load
+* cycle, so hosts can catch this error and re-attempt the operation at their
+* own cadence (for example, when connectivity returns or the app is
+* foregrounded). Other load failures (for example, a CSP block) are not
+* wrapped by this error and their shape is not guaranteed.
+*
+* @example
+* ```ts
+* try {
+*   await signMessage({ message, walletAccount });
+* } catch (error) {
+*   if (error instanceof WaasLoadFailedError) {
+*     // transient — retry the operation at your own cadence
+*     await signMessage({ message, walletAccount });
+*   }
+* }
+* ```
+* @see WaasLoadFailedErrorReason
+* @see signMessage
+*/
+var WaasLoadFailedError = class extends require_updateAuthFromVerifyResponse.BaseError {
+	reason;
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "waas_load_failed",
+			docsUrl: null,
+			name: "WaasLoadFailedError",
+			shortMessage: "The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load."
+		});
+		this.reason = "load_attempts_exhausted";
+	}
+};
+
+//#endregion
 //#region src/errors/WaasOnboardingIncompleteError.ts
 /**
 * Thrown when the embedded (WaaS) wallet client is requested before the user
@@ -127,6 +167,12 @@ const isUserOnboardingComplete = (client = require_updateAuthFromVerifyResponse.
 };
 
 //#endregion
+Object.defineProperty(exports, 'WaasLoadFailedError', {
+  enumerable: true,
+  get: function () {
+    return WaasLoadFailedError;
+  }
+});
 Object.defineProperty(exports, 'WaasOnboardingIncompleteError', {
   enumerable: true,
   get: function () {
@@ -157,4 +203,4 @@ Object.defineProperty(exports, 'preconnectWaasIframe', {
     return preconnectWaasIframe;
   }
 });
-//# sourceMappingURL=isUserOnboardingComplete-CsoV3ae7.cjs.map
+//# sourceMappingURL=isUserOnboardingComplete-D_O53a98.cjs.map

package/dist/isUserOnboardingComplete-D_O53a98.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"isUserOnboardingComplete-D_O53a98.cjs","names":["BaseError","BaseError","getCore","isDynamicWaasEnabled","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","getDefaultClient","MfaBackupCodeAcknowledgement","getDefaultClient","isUserMissingMfaAuth"],"sources":["../src/errors/WaasLoadFailedError.ts","../src/errors/WaasOnboardingIncompleteError.ts","../src/modules/waas/preconnectWaasIframe/preconnectWaasIframe.ts","../src/modules/deviceRegistration/isDeviceRegistrationRequired/isDeviceRegistrationRequired.ts","../src/modules/mfa/isPendingRecoveryCodesAcknowledgment/isPendingRecoveryCodesAcknowledgment.ts","../src/modules/user/isUserOnboardingComplete/isUserOnboardingComplete.ts"],"sourcesContent":["import { BaseError } from './base';\n\n/**\n * Why the embedded wallet load failed. Currently only retry exhaustion is\n * reported; the union exists so new reasons can be added without a breaking\n * change to consumer `instanceof` handling.\n *\n * @example\n * ```ts\n * const reason: WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n * ```\n * @see WaasLoadFailedError\n * @see signMessage\n */\nexport type WaasLoadFailedErrorReason = 'load_attempts_exhausted';\n\n/**\n * Thrown when the embedded (WaaS) wallet's secure container failed to load\n * after exhausting all of its internal retry attempts.\n *\n * This failure is transient: the next wallet operation triggers a fresh load\n * cycle, so hosts can catch this error and re-attempt the operation at their\n * own cadence (for example, when connectivity returns or the app is\n * foregrounded). Other load failures (for example, a CSP block) are not\n * wrapped by this error and their shape is not guaranteed.\n *\n * @example\n * ```ts\n * try {\n *   await signMessage({ message, walletAccount });\n * } catch (error) {\n *   if (error instanceof WaasLoadFailedError) {\n *     // transient — retry the operation at your own cadence\n *     await signMessage({ message, walletAccount });\n *   }\n * }\n * ```\n * @see WaasLoadFailedErrorReason\n * @see signMessage\n */\nexport class WaasLoadFailedError extends BaseError {\n  readonly reason: WaasLoadFailedErrorReason;\n\n  constructor({ cause }: { cause: Error }) {\n    super({\n      cause,\n      code: 'waas_load_failed',\n      docsUrl: null,\n      name: 'WaasLoadFailedError',\n      shortMessage:\n        'The embedded wallet failed to load after exhausting its retry attempts. Retrying the wallet operation triggers a fresh load.',\n    });\n    this.reason = 'load_attempts_exhausted';\n  }\n}\n","import { BaseError } from './base';\n\n/**\n * Thrown when the embedded (WaaS) wallet client is requested before the user\n * has completed onboarding — i.e. the JWT has not upgraded to `user:basic`\n * because MFA, KYC, recovery-codes acknowledgment, or device registration is\n * still pending.\n *\n * The WaaS iframe's init-time room-cache pre-warm fires `createRooms` using the\n * token captured at client construction (before any per-operation token\n * resync). Building the client during this window lets that pre-warm fire with\n * a pre-`user:basic` token, get a 401, and the iframe's unauthorized handler\n * force-logs-out the user. Throwing here surfaces a clear, recoverable reason\n * instead — wait for onboarding to complete and retry.\n */\nexport class WaasOnboardingIncompleteError extends BaseError {\n  constructor() {\n    super({\n      cause: null,\n      code: 'waas_onboarding_incomplete',\n      docsUrl: null,\n      name: 'WaasOnboardingIncompleteError',\n      shortMessage:\n        'Cannot create or access the embedded wallet until onboarding is complete (pending MFA, KYC, recovery-codes acknowledgment, or device registration).',\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { preconnectWaasIframe as preconnectWaasIframeOrigin } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { DEFAULT_WAAS_BASE_API_URL } from '../constants';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Warms the browser's connection (DNS + TCP + TLS) to the embedded-wallet\n * iframe origin so the iframe mounted after authentication completes loads on\n * a hot connection. Called when an auth flow starts (OTP send/verify, social\n * callback). Safe to call repeatedly; no-op on React Native / SSR and when\n * Dynamic WaaS is not enabled.\n *\n * @param client - The Dynamic client instance.\n * @notInstrumented\n */\nexport const preconnectWaasIframe = (client: DynamicClient): void => {\n  const core = getCore(client);\n  try {\n    if (!isDynamicWaasEnabled(client)) return;\n\n    preconnectWaasIframeOrigin({\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n    });\n  } catch (error) {\n    // Best-effort: never break the auth flow (also swallows the assertion\n    // from isDynamicWaasEnabled when project settings are not loaded yet).\n    core.logger.warn('[preconnectWaasIframe] skipped', error);\n  }\n};\n","import type { User } from '../../user/user.types';\n\n/**\n * Checks if device registration is required for the given user.\n *\n * This function determines if the user has the deviceRegistration\n * scope, indicating that device registration is required.\n *\n * @param user - The user to check.\n * @returns True if device registration is required, false otherwise.\n  * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when this device must be registered, updated when the user changes.\n */\nexport const isDeviceRegistrationRequired = (user: User) =>\n  Boolean(user.scope?.includes('device:register'));\n","import { MfaBackupCodeAcknowledgement } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user is still pending acknowledgment of their MFA recovery codes.\n *\n * This function determines whether the user has been presented with recovery\n * codes that they have not yet acknowledged as saved or backed up.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if recovery codes are pending acknowledgment, false otherwise.\n  * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when recovery codes await acknowledgment, updated when the user changes.\n */\nexport const isPendingRecoveryCodesAcknowledgment = (\n  client = getDefaultClient()\n) => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  return (\n    user.mfaBackupCodeAcknowledgement === MfaBackupCodeAcknowledgement.Pending\n  );\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { isDeviceRegistrationRequired } from '../../deviceRegistration/isDeviceRegistrationRequired';\nimport { isPendingRecoveryCodesAcknowledgment } from '../../mfa/isPendingRecoveryCodesAcknowledgment';\nimport { isUserMissingMfaAuth } from '../../mfa/isUserMissingMfaAuth';\n\n/**\n * Checks if the user has completed all onboarding requirements.\n *\n * This function verifies whether a user has fulfilled all necessary requirements\n * including KYC fields (Know Your Customer information), MFA setup\n * (Multi-Factor Authentication including recovery codes acknowledgment), and\n * device registration.\n *\n * A `false` result means the user still has an outstanding onboarding step, so\n * any feature that requires a fully onboarded (`user:basic`) user should hold\n * off until it returns `true`. Creating or accessing an embedded (WaaS) wallet\n * is one such feature — its backend calls reject a pre-`user:basic` token — but\n * this predicate is general and not specific to embedded wallets.\n *\n * @deprecated Use {@link checkUserScopes} instead. This function conflates\n * Dynamic-controlled requirements (MFA, device registration, required fields)\n * with the concept of \"onboarding complete\", which is app-specific. Replace\n * with `checkUserScopes({ user, scopes: ['user:basic'] })` to check whether\n * Dynamic's requirements are satisfied, and compose your own logic on top for\n * any app-specific onboarding steps.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if onboarding is complete (no pending requirements), false if there are pending requirements.\n * @notInstrumented\n * @hook Exposed as a hook so consumers reactively know when onboarding is complete, updated when the user changes.\n */\nexport const isUserOnboardingComplete = (client = getDefaultClient()) => {\n  const user = client.user;\n\n  assertDefined(user, 'User not logged in');\n\n  const hasMissingKycFields = Boolean(user.missingFields?.length);\n  const hasPendingMfaAuth = isUserMissingMfaAuth(client);\n  const hasPendingRecoveryCodes = isPendingRecoveryCodesAcknowledgment(client);\n  const hasPendingDeviceRegistration = isDeviceRegistrationRequired(user);\n\n  const userOnboardingComplete =\n    !hasMissingKycFields &&\n    !hasPendingMfaAuth &&\n    !hasPendingRecoveryCodes &&\n    !hasPendingDeviceRegistration;\n\n  return userOnboardingComplete;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,sBAAb,cAAyCA,+CAAU;CACjD,AAAS;CAET,YAAY,EAAE,SAA2B;AACvC,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;AACF,OAAK,SAAS;;;;;;;;;;;;;;;;;;;ACrClB,IAAa,gCAAb,cAAmDC,+CAAU;CAC3D,cAAc;AACZ,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cACE;GACH,CAAC;;;;;;;;;;;;;;;;ACLN,MAAa,wBAAwB,WAAgC;CACnE,MAAM,OAAOC,6CAAQ,OAAO;AAC5B,KAAI;AACF,MAAI,CAACC,kDAAqB,OAAO,CAAE;AAEnC,uEAA2B;GACzB,UAAWC,qDAAgB,OAAO,GAAG,WAAW;GAChD,aAAa,KAAK,cAAcC,gEAA2B,QACzD,WACA,GACD;GACF,CAAC;UACK,OAAO;AAGd,OAAK,OAAO,KAAK,kCAAkC,MAAM;;;;;;;;;;;;;;;;;ACrB7D,MAAa,gCAAgC,SAC3C,QAAQ,KAAK,OAAO,SAAS,kBAAkB,CAAC;;;;;;;;;;;;;;;ACElD,MAAa,wCACX,SAASC,uDAAkB,KACxB;CACH,MAAM,OAAO,OAAO;AAEpB,oDAAc,MAAM,qBAAqB;AAEzC,QACE,KAAK,iCAAiCC,wDAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQvE,MAAa,4BAA4B,SAASC,uDAAkB,KAAK;CACvE,MAAM,OAAO,OAAO;AAEpB,oDAAc,MAAM,qBAAqB;CAEzC,MAAM,sBAAsB,QAAQ,KAAK,eAAe,OAAO;CAC/D,MAAM,oBAAoBC,0DAAqB,OAAO;CACtD,MAAM,0BAA0B,qCAAqC,OAAO;CAC5E,MAAM,+BAA+B,6BAA6B,KAAK;AAQvE,QALE,CAAC,uBACD,CAAC,qBACD,CAAC,2BACD,CAAC"}

package/dist/{migrateFromFireblocks-BrWXstt8.cjs → migrateFromFireblocks-BbRj_YOv.cjs}

@@ -1,5 +1,7 @@
-const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-B0K1VJ8b.cjs');
-const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-DXVcXa66.cjs');
+const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-Dg8THxkT.cjs');
+const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-v7x1B-0g.cjs');
+const require_getSignedSessionId = require('./getSignedSessionId-BWTQMtk6.cjs');
+let _dynamic_labs_wallet_browser_wallet_client = require("@dynamic-labs-wallet/browser-wallet-client");
 
 //#region src/errors/NotWaasWalletProviderError.ts
 var NotWaasWalletProviderError = class extends require_updateAuthFromVerifyResponse.BaseError {
@@ -14,6 +16,43 @@ var NotWaasWalletProviderError = class extends require_updateAuthFromVerifyRespo
 	}
 };
 
+//#endregion
+//#region src/modules/waas/createWaasClient/createWaasClient.ts
+/** @notInstrumented */
+const createWaasClient = ({ chainName }, client) => {
+	const core = require_updateAuthFromVerifyResponse.getCore(client);
+	const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;
+	const baseClientKeysharesRelayApiUrl = client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;
+	return new _dynamic_labs_wallet_browser_wallet_client.DynamicWalletClient({
+		authMode: require_updateAuthFromVerifyResponse.isCookieEnabled(client) ? "cookie" : "header",
+		authToken: client.token || "",
+		baseApiUrl: (core.apiBaseUrl || require_updateAuthFromVerifyResponse.DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", ""),
+		baseMPCRelayApiUrl: client.projectSettings?.sdk.waas?.relayUrl || require_updateAuthFromVerifyResponse.DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,
+		chainName,
+		eagerlyRecoverKeyShares: true,
+		environmentId: core.environmentId,
+		sdkVersion: `${require_updateAuthFromVerifyResponse.CLIENT_SDK_NAME}/${core.version}`,
+		...additionalTrustedOrigins == void 0 ? {} : { additionalTrustedOrigins },
+		...baseClientKeysharesRelayApiUrl == void 0 ? {} : { baseClientKeysharesRelayApiUrl },
+		...core.waas?.loadTimeoutMs == void 0 ? {} : { iframeLoadTimeout: core.waas.loadTimeoutMs },
+		...core.waas?.maxLoadRetries == void 0 ? {} : { maxRetryAttempts: core.waas.maxLoadRetries }
+	}, {
+		getSignedSessionId: () => require_getSignedSessionId.getSignedSessionId(client).then(({ signature }) => signature),
+		onUnauthorized: () => {
+			require_updateAuthFromVerifyResponse.__logoutWithReason_wrapped({ reason: "session-refresh-unauthorized" }, client).catch((error) => {
+				core.logger.error("Failed to log out after WaaS unauthorized response", error);
+			});
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts
+/** @notInstrumented */
+const getWaasChainNameFromChain = (chain) => {
+	return require_updateAuthFromVerifyResponse.CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;
+};
+
 //#endregion
 //#region src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts
 /** @notInstrumented */
@@ -67,6 +106,18 @@ Object.defineProperty(exports, 'NotWaasWalletProviderError', {
     return NotWaasWalletProviderError;
   }
 });
+Object.defineProperty(exports, 'createWaasClient', {
+  enumerable: true,
+  get: function () {
+    return createWaasClient;
+  }
+});
+Object.defineProperty(exports, 'getWaasChainNameFromChain', {
+  enumerable: true,
+  get: function () {
+    return getWaasChainNameFromChain;
+  }
+});
 Object.defineProperty(exports, 'getWaasWalletProviderFromWalletAccount', {
   enumerable: true,
   get: function () {
@@ -79,4 +130,4 @@ Object.defineProperty(exports, 'migrateFromFireblocks', {
     return migrateFromFireblocks;
   }
 });
-//# sourceMappingURL=migrateFromFireblocks-BrWXstt8.cjs.map
+//# sourceMappingURL=migrateFromFireblocks-BbRj_YOv.cjs.map

package/dist/migrateFromFireblocks-BbRj_YOv.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrateFromFireblocks-BbRj_YOv.cjs","names":["BaseError","createWaasClient: CreateWaasClient","getCore","DynamicWalletClient","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","DEFAULT_WAAS_BASE_MPC_RELAY_API_URL","CLIENT_SDK_NAME","getSignedSessionId","logoutWithReason","CHAINS_INFO_MAP","getWalletProviderFromWalletAccount","isWaasWalletProvider","NotWaasWalletAccountError","getDefaultClient","getWalletProviders","NoWalletProviderFoundError","DYNAMIC_WAAS_METADATA","isWaasWalletProvider","refreshAuth"],"sources":["../src/errors/NotWaasWalletProviderError.ts","../src/modules/waas/createWaasClient/createWaasClient.ts","../src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts","../src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts","../src/modules/waas/migrateFromFireblocks/migrateFromFireblocks.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NotWaasWalletProviderErrorParams = {\n  walletProviderKey: string;\n};\n\nexport class NotWaasWalletProviderError extends BaseError {\n  constructor({ walletProviderKey }: NotWaasWalletProviderErrorParams) {\n    super({\n      cause: null,\n      code: 'not_waas_wallet_provider_error',\n      docsUrl: null,\n      name: 'NotWaasWalletProviderError',\n      shortMessage: `Wallet provider ${walletProviderKey} is not a Dynamic WaaS wallet provider`,\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport { CLIENT_SDK_NAME } from '../../apiClient/constants';\nimport { logoutWithReason } from '../../auth/logoutWithReason';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport type { CreateWaasClient } from './createWaasClient.types';\nimport {\n  DEFAULT_WAAS_BASE_API_URL,\n  DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n} from '../constants';\n\n/** @notInstrumented */\nexport const createWaasClient: CreateWaasClient = ({ chainName }, client) => {\n  const core = getCore(client);\n\n  const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;\n\n  const baseClientKeysharesRelayApiUrl =\n    client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;\n\n  return new DynamicWalletClient(\n    {\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      authToken: client.token || '',\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n      baseMPCRelayApiUrl:\n        client.projectSettings?.sdk.waas?.relayUrl ||\n        DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n      chainName,\n      // Opt into the SDK self-driving eager key-share recovery on auth-token\n      // arrival, so the client no longer restores shares itself on login.\n      eagerlyRecoverKeyShares: true,\n      environmentId: core.environmentId,\n      sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,\n      ...(additionalTrustedOrigins == undefined\n        ? {}\n        : { additionalTrustedOrigins }),\n      ...(baseClientKeysharesRelayApiUrl == undefined\n        ? {}\n        : { baseClientKeysharesRelayApiUrl }),\n      ...(core.waas?.loadTimeoutMs == undefined\n        ? {}\n        : { iframeLoadTimeout: core.waas.loadTimeoutMs }),\n      ...(core.waas?.maxLoadRetries == undefined\n        ? {}\n        : { maxRetryAttempts: core.waas.maxLoadRetries }),\n    },\n    {\n      // Lets the iframe mint a fresh signed session id over the reverse channel,\n      // which the SDK's eager key-share recovery needs.\n      getSignedSessionId: () =>\n        getSignedSessionId(client).then(({ signature }) => signature),\n      // When the WaaS iframe's own backend call returns 401 (e.g. a forcibly\n      // revoked token), the iframe notifies the host via the reverse channel\n      // and this fires — log the user out. Mirrors the session-expiry\n      // middleware that covers the SDK's own direct API 401s.\n      onUnauthorized: () => {\n        void logoutWithReason(\n          { reason: 'session-refresh-unauthorized' },\n          client\n        ).catch((error) => {\n          core.logger.error(\n            'Failed to log out after WaaS unauthorized response',\n            error\n          );\n        });\n      },\n    }\n  );\n};\n","import type { Chain } from '../../chain';\nimport { CHAINS_INFO_MAP } from '../../wallets/constants';\n\n/** @notInstrumented */\n// eslint-disable-next-line custom-rules/require-single-object-param\nexport const getWaasChainNameFromChain = (chain: Chain): string => {\n  return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;\n};\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { NotWaasWalletAccountError } from '../../../errors/NotWaasWalletAccountError';\nimport { getWalletProviderFromWalletAccount } from '../../wallets/utils/getWalletProviderFromWalletAccount';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\nimport type { WaasWalletProvider } from '../waas.types';\n\ntype GetWalletProviderFromWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getWaasWalletProviderFromWalletAccount = (\n  { walletAccount }: GetWalletProviderFromWalletAccountParams,\n  client: DynamicClient\n): WaasWalletProvider => {\n  const walletProvider = getWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  if (!isWaasWalletProvider(walletProvider)) {\n    throw new NotWaasWalletAccountError({\n      walletAddress: walletAccount.address,\n    });\n  }\n\n  return walletProvider;\n};\n","import type { MigrateFromFireblocksResponse } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { NotWaasWalletProviderError } from '../../../errors/NotWaasWalletProviderError';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport { getWalletProviders } from '../../wallets/getWalletProviders';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\n\ntype MigrateFromFireblocksParams = {\n  /**\n   * Optional SLIP-0044 coin types per chain name for BIP44 derivation off the\n   * Fireblocks takeover xprv (e.g. `{ EVM: 1 }` for Sepolia).\n   */\n  coinTypes?: Record<string, number>;\n  /**\n   * The Fireblocks NCW device id whose key material is being migrated.\n   */\n  deviceId: string;\n  /**\n   * Required per-chain expected wallet address (the address Fireblocks held). Its\n   * keys are the chains migration runs on, and the migration iframe verifies each\n   * imported Dynamic address matches the value, so a wrong derivation fails loudly\n   * instead of producing an unusable wallet.\n   */\n  expectedAddresses: Record<string, string>;\n  /**\n   * The Fireblocks-issued JWT authorizing the takeover.\n   */\n  jwt: string;\n  /**\n   * The password that encrypted the legacy Fireblocks NCW device storage.\n   */\n  password: string;\n  /**\n   * The serialized Fireblocks NCW device storage (the local key share backup).\n   */\n  storage: Record<string, string>;\n};\n\n/**\n * Migrates an existing Fireblocks NCW wallet into Dynamic's WaaS infrastructure.\n *\n * Migration is a single cross-chain operation: one call takes over the Fireblocks\n * key material and provisions Dynamic WaaS wallet accounts for every supported\n * chain. Because it is not per-chain, this resolves a single WaaS wallet provider\n * (any registered chain) and delegates the takeover to it.\n *\n * @param params.deviceId - The Fireblocks NCW device id being migrated.\n * @param params.jwt - The Fireblocks-issued JWT authorizing the takeover.\n * @param params.storage - The serialized Fireblocks NCW device storage.\n * @param params.password - The password that encrypted the legacy device storage.\n * @param params.expectedAddresses - Required per-chain expected address; its keys are the chains migration runs on, and each imported address is verified against it.\n * @param [params.coinTypes] - Optional SLIP-0044 coin types per chain name.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the per-chain migration results.\n * @notInstrumented\n */\nexport const migrateFromFireblocks = async (\n  {\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  }: MigrateFromFireblocksParams,\n  client = getDefaultClient()\n): Promise<MigrateFromFireblocksResponse> => {\n  const providers = getWalletProviders(client);\n\n  if (providers.length === 0) {\n    throw new NoWalletProviderFoundError({\n      walletProviderKey: DYNAMIC_WAAS_METADATA.displayName,\n    });\n  }\n\n  // Migration is cross-chain, so any registered WaaS provider can drive the\n  // takeover. Resolve the first one rather than iterating per chain.\n  const waasProvider = providers.find(isWaasWalletProvider);\n\n  if (!waasProvider) {\n    throw new NotWaasWalletProviderError({\n      walletProviderKey: providers[0].key,\n    });\n  }\n\n  const result = await waasProvider.migrateFromFireblocks({\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  });\n\n  await refreshAuth(client);\n\n  return result;\n};\n"],"mappings":";;;;;;AAMA,IAAa,6BAAb,cAAgDA,+CAAU;CACxD,YAAY,EAAE,qBAAuD;AACnE,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,mBAAmB,kBAAkB;GACpD,CAAC;;;;;;;ACCN,MAAaC,oBAAsC,EAAE,aAAa,WAAW;CAC3E,MAAM,OAAOC,6CAAQ,OAAO;CAE5B,MAAM,2BAA2B,KAAK,MAAM;CAE5C,MAAM,iCACJ,OAAO,iBAAiB,IAAI,MAAM;AAEpC,QAAO,IAAIC,+DACT;EACE,UAAWC,qDAAgB,OAAO,GAAG,WAAW;EAChD,WAAW,OAAO,SAAS;EAC3B,aAAa,KAAK,cAAcC,gEAA2B,QACzD,WACA,GACD;EACD,oBACE,OAAO,iBAAiB,IAAI,MAAM,YAClCC;EACF;EAGA,yBAAyB;EACzB,eAAe,KAAK;EACpB,YAAY,GAAGC,qDAAgB,GAAG,KAAK;EACvC,GAAI,4BAA4B,SAC5B,EAAE,GACF,EAAE,0BAA0B;EAChC,GAAI,kCAAkC,SAClC,EAAE,GACF,EAAE,gCAAgC;EACtC,GAAI,KAAK,MAAM,iBAAiB,SAC5B,EAAE,GACF,EAAE,mBAAmB,KAAK,KAAK,eAAe;EAClD,GAAI,KAAK,MAAM,kBAAkB,SAC7B,EAAE,GACF,EAAE,kBAAkB,KAAK,KAAK,gBAAgB;EACnD,EACD;EAGE,0BACEC,8CAAmB,OAAO,CAAC,MAAM,EAAE,gBAAgB,UAAU;EAK/D,sBAAsB;AACpB,GAAKC,gEACH,EAAE,QAAQ,gCAAgC,EAC1C,OACD,CAAC,OAAO,UAAU;AACjB,SAAK,OAAO,MACV,sDACA,MACD;KACD;;EAEL,CACF;;;;;;ACrEH,MAAa,6BAA6B,UAAyB;AACjE,QAAOC,qDAAgB,OAAO,yBAAyB;;;;;;ACMzD,MAAa,0CACX,EAAE,iBACF,WACuB;CACvB,MAAM,iBAAiBC,wEACrB,EAAE,eAAe,EACjB,OACD;AAED,KAAI,CAACC,0DAAqB,eAAe,CACvC,OAAM,IAAIC,uDAA0B,EAClC,eAAe,cAAc,SAC9B,CAAC;AAGJ,QAAO;;;;;;;;;;;;;;;;;;;;;;;ACgCT,MAAa,wBAAwB,OACnC,EACE,WACA,UACA,mBACA,KACA,UACA,WAEF,SAASC,uDAAkB,KACgB;CAC3C,MAAM,YAAYC,wDAAmB,OAAO;AAE5C,KAAI,UAAU,WAAW,EACvB,OAAM,IAAIC,gEAA2B,EACnC,mBAAmBC,2DAAsB,aAC1C,CAAC;CAKJ,MAAM,eAAe,UAAU,KAAKC,0DAAqB;AAEzD,KAAI,CAAC,aACH,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,UAAU,GAAG,KACjC,CAAC;CAGJ,MAAM,SAAS,MAAM,aAAa,sBAAsB;EACtD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,OAAMC,mDAAY,OAAO;AAEzB,QAAO"}

package/dist/{migrateFromFireblocks-CqL5l58Q.native.esm.js → migrateFromFireblocks-Vic3tb61.esm.js}

@@ -1,5 +1,7 @@
-import { T as getWalletProviderFromWalletAccount, _t as getDefaultClient, bt as BaseError, c as isWaasWalletProvider, d as DYNAMIC_WAAS_METADATA, f as getWalletProviders, k as NoWalletProviderFoundError } from "./updateAuthFromVerifyResponse-DGrmo9MJ.native.esm.js";
-import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-C4oPJ0fw.native.esm.js";
+import { L as CHAINS_INFO_MAP, St as getCore, T as getWalletProviderFromWalletAccount, c as isWaasWalletProvider, d as DYNAMIC_WAAS_METADATA, f as getWalletProviders, ht as CLIENT_SDK_NAME, k as NoWalletProviderFoundError, l as DEFAULT_WAAS_BASE_API_URL, lt as isCookieEnabled, u as DEFAULT_WAAS_BASE_MPC_RELAY_API_URL, v as __logoutWithReason_wrapped, vt as getDefaultClient, xt as BaseError } from "./updateAuthFromVerifyResponse-BEoc7f0m.esm.js";
+import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-DwY38pjA.esm.js";
+import { t as getSignedSessionId } from "./getSignedSessionId-C4igTuKk.esm.js";
+import { DynamicWalletClient } from "@dynamic-labs-wallet/browser-wallet-client";
 
 //#region src/errors/NotWaasWalletProviderError.ts
 var NotWaasWalletProviderError = class extends BaseError {
@@ -14,6 +16,43 @@ var NotWaasWalletProviderError = class extends BaseError {
 	}
 };
 
+//#endregion
+//#region src/modules/waas/createWaasClient/createWaasClient.ts
+/** @notInstrumented */
+const createWaasClient = ({ chainName }, client) => {
+	const core = getCore(client);
+	const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;
+	const baseClientKeysharesRelayApiUrl = client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;
+	return new DynamicWalletClient({
+		authMode: isCookieEnabled(client) ? "cookie" : "header",
+		authToken: client.token || "",
+		baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", ""),
+		baseMPCRelayApiUrl: client.projectSettings?.sdk.waas?.relayUrl || DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,
+		chainName,
+		eagerlyRecoverKeyShares: true,
+		environmentId: core.environmentId,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,
+		...additionalTrustedOrigins == void 0 ? {} : { additionalTrustedOrigins },
+		...baseClientKeysharesRelayApiUrl == void 0 ? {} : { baseClientKeysharesRelayApiUrl },
+		...core.waas?.loadTimeoutMs == void 0 ? {} : { iframeLoadTimeout: core.waas.loadTimeoutMs },
+		...core.waas?.maxLoadRetries == void 0 ? {} : { maxRetryAttempts: core.waas.maxLoadRetries }
+	}, {
+		getSignedSessionId: () => getSignedSessionId(client).then(({ signature }) => signature),
+		onUnauthorized: () => {
+			__logoutWithReason_wrapped({ reason: "session-refresh-unauthorized" }, client).catch((error) => {
+				core.logger.error("Failed to log out after WaaS unauthorized response", error);
+			});
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts
+/** @notInstrumented */
+const getWaasChainNameFromChain = (chain) => {
+	return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;
+};
+
 //#endregion
 //#region src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts
 /** @notInstrumented */
@@ -61,5 +100,5 @@ const migrateFromFireblocks = async ({ coinTypes, deviceId, expectedAddresses, j
 };
 
 //#endregion
-export { getWaasWalletProviderFromWalletAccount as n, NotWaasWalletProviderError as r, migrateFromFireblocks as t };
-//# sourceMappingURL=migrateFromFireblocks-CqL5l58Q.native.esm.js.map
+export { NotWaasWalletProviderError as a, createWaasClient as i, getWaasWalletProviderFromWalletAccount as n, getWaasChainNameFromChain as r, migrateFromFireblocks as t };
+//# sourceMappingURL=migrateFromFireblocks-Vic3tb61.esm.js.map

package/dist/migrateFromFireblocks-Vic3tb61.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrateFromFireblocks-Vic3tb61.esm.js","names":["createWaasClient: CreateWaasClient","logoutWithReason","refreshAuth"],"sources":["../src/errors/NotWaasWalletProviderError.ts","../src/modules/waas/createWaasClient/createWaasClient.ts","../src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts","../src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts","../src/modules/waas/migrateFromFireblocks/migrateFromFireblocks.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NotWaasWalletProviderErrorParams = {\n  walletProviderKey: string;\n};\n\nexport class NotWaasWalletProviderError extends BaseError {\n  constructor({ walletProviderKey }: NotWaasWalletProviderErrorParams) {\n    super({\n      cause: null,\n      code: 'not_waas_wallet_provider_error',\n      docsUrl: null,\n      name: 'NotWaasWalletProviderError',\n      shortMessage: `Wallet provider ${walletProviderKey} is not a Dynamic WaaS wallet provider`,\n    });\n  }\n}\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport { CLIENT_SDK_NAME } from '../../apiClient/constants';\nimport { logoutWithReason } from '../../auth/logoutWithReason';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport type { CreateWaasClient } from './createWaasClient.types';\nimport {\n  DEFAULT_WAAS_BASE_API_URL,\n  DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n} from '../constants';\n\n/** @notInstrumented */\nexport const createWaasClient: CreateWaasClient = ({ chainName }, client) => {\n  const core = getCore(client);\n\n  const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;\n\n  const baseClientKeysharesRelayApiUrl =\n    client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;\n\n  return new DynamicWalletClient(\n    {\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      authToken: client.token || '',\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n      baseMPCRelayApiUrl:\n        client.projectSettings?.sdk.waas?.relayUrl ||\n        DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n      chainName,\n      // Opt into the SDK self-driving eager key-share recovery on auth-token\n      // arrival, so the client no longer restores shares itself on login.\n      eagerlyRecoverKeyShares: true,\n      environmentId: core.environmentId,\n      sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,\n      ...(additionalTrustedOrigins == undefined\n        ? {}\n        : { additionalTrustedOrigins }),\n      ...(baseClientKeysharesRelayApiUrl == undefined\n        ? {}\n        : { baseClientKeysharesRelayApiUrl }),\n      ...(core.waas?.loadTimeoutMs == undefined\n        ? {}\n        : { iframeLoadTimeout: core.waas.loadTimeoutMs }),\n      ...(core.waas?.maxLoadRetries == undefined\n        ? {}\n        : { maxRetryAttempts: core.waas.maxLoadRetries }),\n    },\n    {\n      // Lets the iframe mint a fresh signed session id over the reverse channel,\n      // which the SDK's eager key-share recovery needs.\n      getSignedSessionId: () =>\n        getSignedSessionId(client).then(({ signature }) => signature),\n      // When the WaaS iframe's own backend call returns 401 (e.g. a forcibly\n      // revoked token), the iframe notifies the host via the reverse channel\n      // and this fires — log the user out. Mirrors the session-expiry\n      // middleware that covers the SDK's own direct API 401s.\n      onUnauthorized: () => {\n        void logoutWithReason(\n          { reason: 'session-refresh-unauthorized' },\n          client\n        ).catch((error) => {\n          core.logger.error(\n            'Failed to log out after WaaS unauthorized response',\n            error\n          );\n        });\n      },\n    }\n  );\n};\n","import type { Chain } from '../../chain';\nimport { CHAINS_INFO_MAP } from '../../wallets/constants';\n\n/** @notInstrumented */\n// eslint-disable-next-line custom-rules/require-single-object-param\nexport const getWaasChainNameFromChain = (chain: Chain): string => {\n  return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;\n};\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { NotWaasWalletAccountError } from '../../../errors/NotWaasWalletAccountError';\nimport { getWalletProviderFromWalletAccount } from '../../wallets/utils/getWalletProviderFromWalletAccount';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\nimport type { WaasWalletProvider } from '../waas.types';\n\ntype GetWalletProviderFromWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getWaasWalletProviderFromWalletAccount = (\n  { walletAccount }: GetWalletProviderFromWalletAccountParams,\n  client: DynamicClient\n): WaasWalletProvider => {\n  const walletProvider = getWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  if (!isWaasWalletProvider(walletProvider)) {\n    throw new NotWaasWalletAccountError({\n      walletAddress: walletAccount.address,\n    });\n  }\n\n  return walletProvider;\n};\n","import type { MigrateFromFireblocksResponse } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { NotWaasWalletProviderError } from '../../../errors/NotWaasWalletProviderError';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport { getWalletProviders } from '../../wallets/getWalletProviders';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\n\ntype MigrateFromFireblocksParams = {\n  /**\n   * Optional SLIP-0044 coin types per chain name for BIP44 derivation off the\n   * Fireblocks takeover xprv (e.g. `{ EVM: 1 }` for Sepolia).\n   */\n  coinTypes?: Record<string, number>;\n  /**\n   * The Fireblocks NCW device id whose key material is being migrated.\n   */\n  deviceId: string;\n  /**\n   * Required per-chain expected wallet address (the address Fireblocks held). Its\n   * keys are the chains migration runs on, and the migration iframe verifies each\n   * imported Dynamic address matches the value, so a wrong derivation fails loudly\n   * instead of producing an unusable wallet.\n   */\n  expectedAddresses: Record<string, string>;\n  /**\n   * The Fireblocks-issued JWT authorizing the takeover.\n   */\n  jwt: string;\n  /**\n   * The password that encrypted the legacy Fireblocks NCW device storage.\n   */\n  password: string;\n  /**\n   * The serialized Fireblocks NCW device storage (the local key share backup).\n   */\n  storage: Record<string, string>;\n};\n\n/**\n * Migrates an existing Fireblocks NCW wallet into Dynamic's WaaS infrastructure.\n *\n * Migration is a single cross-chain operation: one call takes over the Fireblocks\n * key material and provisions Dynamic WaaS wallet accounts for every supported\n * chain. Because it is not per-chain, this resolves a single WaaS wallet provider\n * (any registered chain) and delegates the takeover to it.\n *\n * @param params.deviceId - The Fireblocks NCW device id being migrated.\n * @param params.jwt - The Fireblocks-issued JWT authorizing the takeover.\n * @param params.storage - The serialized Fireblocks NCW device storage.\n * @param params.password - The password that encrypted the legacy device storage.\n * @param params.expectedAddresses - Required per-chain expected address; its keys are the chains migration runs on, and each imported address is verified against it.\n * @param [params.coinTypes] - Optional SLIP-0044 coin types per chain name.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the per-chain migration results.\n * @notInstrumented\n */\nexport const migrateFromFireblocks = async (\n  {\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  }: MigrateFromFireblocksParams,\n  client = getDefaultClient()\n): Promise<MigrateFromFireblocksResponse> => {\n  const providers = getWalletProviders(client);\n\n  if (providers.length === 0) {\n    throw new NoWalletProviderFoundError({\n      walletProviderKey: DYNAMIC_WAAS_METADATA.displayName,\n    });\n  }\n\n  // Migration is cross-chain, so any registered WaaS provider can drive the\n  // takeover. Resolve the first one rather than iterating per chain.\n  const waasProvider = providers.find(isWaasWalletProvider);\n\n  if (!waasProvider) {\n    throw new NotWaasWalletProviderError({\n      walletProviderKey: providers[0].key,\n    });\n  }\n\n  const result = await waasProvider.migrateFromFireblocks({\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  });\n\n  await refreshAuth(client);\n\n  return result;\n};\n"],"mappings":";;;;;;AAMA,IAAa,6BAAb,cAAgD,UAAU;CACxD,YAAY,EAAE,qBAAuD;AACnE,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,mBAAmB,kBAAkB;GACpD,CAAC;;;;;;;ACCN,MAAaA,oBAAsC,EAAE,aAAa,WAAW;CAC3E,MAAM,OAAO,QAAQ,OAAO;CAE5B,MAAM,2BAA2B,KAAK,MAAM;CAE5C,MAAM,iCACJ,OAAO,iBAAiB,IAAI,MAAM;AAEpC,QAAO,IAAI,oBACT;EACE,UAAW,gBAAgB,OAAO,GAAG,WAAW;EAChD,WAAW,OAAO,SAAS;EAC3B,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;EACD,oBACE,OAAO,iBAAiB,IAAI,MAAM,YAClC;EACF;EAGA,yBAAyB;EACzB,eAAe,KAAK;EACpB,YAAY,GAAG,gBAAgB,GAAG,KAAK;EACvC,GAAI,4BAA4B,SAC5B,EAAE,GACF,EAAE,0BAA0B;EAChC,GAAI,kCAAkC,SAClC,EAAE,GACF,EAAE,gCAAgC;EACtC,GAAI,KAAK,MAAM,iBAAiB,SAC5B,EAAE,GACF,EAAE,mBAAmB,KAAK,KAAK,eAAe;EAClD,GAAI,KAAK,MAAM,kBAAkB,SAC7B,EAAE,GACF,EAAE,kBAAkB,KAAK,KAAK,gBAAgB;EACnD,EACD;EAGE,0BACE,mBAAmB,OAAO,CAAC,MAAM,EAAE,gBAAgB,UAAU;EAK/D,sBAAsB;AACpB,GAAKC,2BACH,EAAE,QAAQ,gCAAgC,EAC1C,OACD,CAAC,OAAO,UAAU;AACjB,SAAK,OAAO,MACV,sDACA,MACD;KACD;;EAEL,CACF;;;;;;ACrEH,MAAa,6BAA6B,UAAyB;AACjE,QAAO,gBAAgB,OAAO,yBAAyB;;;;;;ACMzD,MAAa,0CACX,EAAE,iBACF,WACuB;CACvB,MAAM,iBAAiB,mCACrB,EAAE,eAAe,EACjB,OACD;AAED,KAAI,CAAC,qBAAqB,eAAe,CACvC,OAAM,IAAI,0BAA0B,EAClC,eAAe,cAAc,SAC9B,CAAC;AAGJ,QAAO;;;;;;;;;;;;;;;;;;;;;;;ACgCT,MAAa,wBAAwB,OACnC,EACE,WACA,UACA,mBACA,KACA,UACA,WAEF,SAAS,kBAAkB,KACgB;CAC3C,MAAM,YAAY,mBAAmB,OAAO;AAE5C,KAAI,UAAU,WAAW,EACvB,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,sBAAsB,aAC1C,CAAC;CAKJ,MAAM,eAAe,UAAU,KAAK,qBAAqB;AAEzD,KAAI,CAAC,aACH,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,UAAU,GAAG,KACjC,CAAC;CAGJ,MAAM,SAAS,MAAM,aAAa,sBAAsB;EACtD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,OAAMC,sBAAY,OAAO;AAEzB,QAAO"}

package/dist/migrateFromFireblocks-hfh_j7wm.native.esm.js

@@ -0,0 +1,321 @@
+import { A as NoWalletProviderFoundError, E as getWalletProviderFromWalletAccount, F as CHAINS_INFO_MAP, St as getCore, d as DEFAULT_WAAS_BASE_MPC_RELAY_API_URL, f as DYNAMIC_WAAS_METADATA, ht as CLIENT_SDK_NAME, l as isWaasWalletProvider, lt as isCookieEnabled, p as getWalletProviders, t as NativeModuleNotLinkedError, u as DEFAULT_WAAS_BASE_API_URL, vt as getDefaultClient, xt as BaseError } from "./NativeModuleNotLinkedError-DsfdAti9.native.esm.js";
+import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-CsNM4kzO.native.esm.js";
+import { ACCESSIBLE, getGenericPassword, resetGenericPassword, setGenericPassword } from "react-native-keychain";
+import { NativeEventEmitter, TurboModuleRegistry } from "react-native";
+import { DynamicWalletClient } from "@dynamic-labs-wallet/browser-wallet-client";
+
+//#region src/errors/NotWaasWalletProviderError.ts
+var NotWaasWalletProviderError = class extends BaseError {
+	constructor({ walletProviderKey }) {
+		super({
+			cause: null,
+			code: "not_waas_wallet_provider_error",
+			docsUrl: null,
+			name: "NotWaasWalletProviderError",
+			shortMessage: `Wallet provider ${walletProviderKey} is not a Dynamic WaaS wallet provider`
+		});
+	}
+};
+
+//#endregion
+//#region src/errors/CorruptedKeyShareError.ts
+/**
+* Thrown when a persisted client key share cannot be parsed back into its
+* structured form (e.g. a partially-written or corrupted keychain entry).
+*
+* Surfaced as a typed error rather than swallowed so callers can distinguish
+* "no key share stored" (empty result) from "key share exists but is
+* unreadable" — the latter must never be silently treated as the former,
+* which could trigger an unintended re-keygen that overwrites recoverable
+* material.
+*/
+var CorruptedKeyShareError = class extends BaseError {
+	constructor({ cause = null } = {}) {
+		super({
+			cause,
+			code: "corrupted_key_share_error",
+			details: "The stored client key share could not be parsed. The secure storage entry may be partially written or corrupted.",
+			docsUrl: null,
+			name: "CorruptedKeyShareError",
+			shortMessage: "Stored client key share is corrupted and cannot be read."
+		});
+	}
+};
+
+//#endregion
+//#region src/turboModules/NativeDynamicWebView.ts
+var NativeDynamicWebView_default = TurboModuleRegistry.get("DynamicClientWebView");
+
+//#endregion
+//#region src/errors/WebViewLoadFailedError.ts
+/**
+* Thrown when `DynamicWebView.open()` (via the WaaS transport provider)
+* fails to establish a usable load. Inspect `reason` to distinguish the
+* failure mode; `statusCode` and `underlyingError` provide structured
+* metadata for the cases that have it.
+*/
+var WebViewLoadFailedError = class extends BaseError {
+	reason;
+	statusCode;
+	underlyingError;
+	constructor({ reason, shortMessage, cause = null, statusCode, underlyingError }) {
+		super({
+			cause,
+			code: "webview_load_failed_error",
+			details: underlyingError,
+			docsUrl: null,
+			name: "WebViewLoadFailedError",
+			shortMessage
+		});
+		this.reason = reason;
+		this.statusCode = statusCode;
+		this.underlyingError = underlyingError;
+	}
+};
+
+//#endregion
+//#region src/modules/waas/createWaasClient/translateNativeOpenError.ts
+const REASON_BY_NATIVE_CODE = {
+	webview_cancelled: "cancelled",
+	webview_content_process_terminated: "content_process_terminated",
+	webview_http_error: "http_error",
+	webview_instance_busy: "instance_busy",
+	webview_invalid_url: "invalid_url",
+	webview_navigation_failed: "navigation_failed",
+	webview_no_host_view: "no_host_view",
+	webview_unsupported: "unsupported"
+};
+/**
+* Translates a native `DynamicWebView.open()` rejection into a typed
+* `WebViewLoadFailedError`. Maps the native RCT reject code to the JS-level
+* `WebViewLoadFailureReason` discriminator (falling back to
+* `navigation_failed` for unrecognized codes) and carries through the
+* structured `statusCode` / `underlyingError` metadata.
+*
+* The `reason` it produces is the contract `createWaasSDKContainer` branches
+* on — notably `emitError` swallows `cancelled` because that code is only ever
+* produced by our own `close()` teardown (verified on both the iOS and Android
+* native sides). Keep `REASON_BY_NATIVE_CODE` in sync with the native reject
+* codes so that branching stays correct.
+*
+* @notInstrumented
+*/
+const translateNativeOpenError = (err) => {
+	const rejection = err ?? {};
+	const isNativeRejectionCode = (code) => code != void 0 && code in REASON_BY_NATIVE_CODE;
+	const reason = isNativeRejectionCode(rejection.code) ? REASON_BY_NATIVE_CODE[rejection.code] : "navigation_failed";
+	return new WebViewLoadFailedError({
+		cause: err instanceof Error ? err : null,
+		reason,
+		shortMessage: rejection.message ?? `DynamicWebView open failed (${reason}).`,
+		statusCode: rejection.userInfo?.DynamicWebViewStatusCode,
+		underlyingError: rejection.userInfo?.DynamicWebViewUnderlying
+	});
+};
+
+//#endregion
+//#region src/modules/waas/createWaasClient/createNativeWaasSDKContainer.native.ts
+const NATIVE_MODULE_NAME = "DynamicClientWebView";
+const MESSAGE_EVENT_NAME = "dynamicBridgeMessage";
+const generateInstanceId = () => `${Date.now().toString(36)}-${crypto.randomUUID()}`;
+/**
+* Creates a React Native `WaasSDKContainer` backed by a hidden, headless native
+* WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the
+* `DynamicClientWebView` TurboModule. Each invocation returns an isolated
+* container with its own instance ID, native WebView, and message routing.
+*
+* Used for MPC operations (signing, key-share management) where there is
+* nothing for the user to see. The VISIBLE private-key export display is no
+* longer a native overlay — it is rendered by the `ExportPrivateKey` component
+* (`@dynamic-labs-sdk/react-native-embedded-wallet-export`) on top of
+* `react-native-webview`, so it scrolls and positions like any RN view.
+*
+* @notInstrumented
+*/
+const createNativeWaasSDKContainer = () => {
+	if (!NativeDynamicWebView_default) throw new NativeModuleNotLinkedError({ moduleName: NATIVE_MODULE_NAME });
+	const nativeModule = NativeDynamicWebView_default;
+	const instanceId = generateInstanceId();
+	const emitter = new NativeEventEmitter(nativeModule);
+	const messageHandlers = [];
+	const errorHandlers = [];
+	let subscription = null;
+	let destroyed = false;
+	const emitError = (err) => {
+		if (destroyed) return;
+		const translated = translateNativeOpenError(err);
+		if (translated.reason === "cancelled") return;
+		for (const handler of errorHandlers) handler(translated);
+	};
+	return {
+		destroy() {
+			if (destroyed) return;
+			destroyed = true;
+			subscription?.remove();
+			subscription = null;
+			messageHandlers.length = 0;
+			errorHandlers.length = 0;
+			nativeModule.close(instanceId);
+		},
+		isAlive: () => !destroyed,
+		onError(handler) {
+			errorHandlers.push(handler);
+			return () => {
+				const index = errorHandlers.indexOf(handler);
+				if (index !== -1) errorHandlers.splice(index, 1);
+			};
+		},
+		onMessage(handler) {
+			messageHandlers.push(handler);
+			subscription ??= emitter.addListener(MESSAGE_EVENT_NAME, (payload) => {
+				if (payload.instanceId !== instanceId) return;
+				for (const fn of messageHandlers) fn(payload.data);
+			});
+			return () => {
+				const index = messageHandlers.indexOf(handler);
+				if (index !== -1) messageHandlers.splice(index, 1);
+				if (messageHandlers.length === 0) {
+					subscription?.remove();
+					subscription = null;
+				}
+			};
+		},
+		sendMessage(data) {
+			nativeModule.sendMessage(instanceId, data);
+		},
+		async setUrl(url) {
+			nativeModule.open(instanceId, url).catch(emitError);
+		}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/createWaasClient/createWaasSDKContainer.native.ts
+/**
+* Creates a React Native `WaasSDKContainer` backed by a hidden, headless native
+* WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the
+* `DynamicClientWebView` TurboModule. Used for MPC operations (signing, key-share
+* management) where there is nothing for the user to see.
+*
+* For the private-key export display — where the hosted page must render the
+* key for the user — use the `ExportPrivateKey` component from
+* `@dynamic-labs-sdk/react-native-embedded-wallet-export`, which renders the
+* key inside a `react-native-webview` instead of a native overlay.
+*
+* @notInstrumented
+*/
+const createWaasSDKContainer = () => createNativeWaasSDKContainer();
+
+//#endregion
+//#region src/modules/waas/createWaasClient/createWaasClient.native.ts
+/**
+* Keychain security options for the client key share. The share is wallet
+* key material that cannot be re-derived locally, so the options are pinned
+* explicitly rather than inherited from `react-native-keychain` defaults
+* (which vary across versions and platforms).
+*
+* `WHEN_UNLOCKED_THIS_DEVICE_ONLY` keeps the share readable only while the
+* device is unlocked, excludes it from iCloud Keychain sync, and prevents it
+* migrating to a new device on encrypted-backup restore. It deliberately does
+* NOT set `accessControl` (e.g. biometry) — reads must not surface a Face ID /
+* passcode prompt, since the share is read on routine wallet operations.
+*/
+const KEY_SHARE_KEYCHAIN_OPTIONS = { accessible: ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY };
+/** @notInstrumented */
+const createWaasClient = ({ chainName }, client) => {
+	const core = getCore(client);
+	const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;
+	const getKeyShareService = (accountAddress) => `${core.environmentId}:${accountAddress}`;
+	return new DynamicWalletClient({
+		authMode: isCookieEnabled(client) ? "cookie" : "header",
+		authToken: client.token || "",
+		baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", ""),
+		baseMPCRelayApiUrl: client.projectSettings?.sdk.waas?.relayUrl || DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,
+		chainName,
+		environmentId: core.environmentId,
+		hostOrigin: core.metadata?.universalLink,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,
+		...additionalTrustedOrigins == void 0 ? {} : { additionalTrustedOrigins },
+		...core.waas?.loadTimeoutMs == void 0 ? {} : { iframeLoadTimeout: core.waas.loadTimeoutMs },
+		...core.waas?.maxLoadRetries == void 0 ? {} : { maxRetryAttempts: core.waas.maxLoadRetries }
+	}, {
+		createWaasSDKContainer,
+		secureStorage: {
+			getClientKeyShare: async (accountAddress) => {
+				const result = await getGenericPassword({ service: getKeyShareService(accountAddress) });
+				if (!result) return [];
+				try {
+					return JSON.parse(result.password);
+				} catch (cause) {
+					throw new CorruptedKeyShareError({ cause: cause instanceof Error ? cause : null });
+				}
+			},
+			removeClientKeyShare: async (accountAddress) => {
+				await resetGenericPassword({ service: getKeyShareService(accountAddress) });
+			},
+			setClientKeyShare: async (accountAddress, shares) => {
+				await setGenericPassword(accountAddress, JSON.stringify(shares), {
+					...KEY_SHARE_KEYCHAIN_OPTIONS,
+					service: getKeyShareService(accountAddress)
+				});
+			}
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts
+/** @notInstrumented */
+const getWaasChainNameFromChain = (chain) => {
+	return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;
+};
+
+//#endregion
+//#region src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts
+/** @notInstrumented */
+const getWaasWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
+	const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
+	if (!isWaasWalletProvider(walletProvider)) throw new NotWaasWalletAccountError({ walletAddress: walletAccount.address });
+	return walletProvider;
+};
+
+//#endregion
+//#region src/modules/waas/migrateFromFireblocks/migrateFromFireblocks.ts
+/**
+* Migrates an existing Fireblocks NCW wallet into Dynamic's WaaS infrastructure.
+*
+* Migration is a single cross-chain operation: one call takes over the Fireblocks
+* key material and provisions Dynamic WaaS wallet accounts for every supported
+* chain. Because it is not per-chain, this resolves a single WaaS wallet provider
+* (any registered chain) and delegates the takeover to it.
+*
+* @param params.deviceId - The Fireblocks NCW device id being migrated.
+* @param params.jwt - The Fireblocks-issued JWT authorizing the takeover.
+* @param params.storage - The serialized Fireblocks NCW device storage.
+* @param params.password - The password that encrypted the legacy device storage.
+* @param params.expectedAddresses - Required per-chain expected address; its keys are the chains migration runs on, and each imported address is verified against it.
+* @param [params.coinTypes] - Optional SLIP-0044 coin types per chain name.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise resolving to the per-chain migration results.
+* @notInstrumented
+*/
+const migrateFromFireblocks = async ({ coinTypes, deviceId, expectedAddresses, jwt, password, storage }, client = getDefaultClient()) => {
+	const providers = getWalletProviders(client);
+	if (providers.length === 0) throw new NoWalletProviderFoundError({ walletProviderKey: DYNAMIC_WAAS_METADATA.displayName });
+	const waasProvider = providers.find(isWaasWalletProvider);
+	if (!waasProvider) throw new NotWaasWalletProviderError({ walletProviderKey: providers[0].key });
+	const result = await waasProvider.migrateFromFireblocks({
+		coinTypes,
+		deviceId,
+		expectedAddresses,
+		jwt,
+		password,
+		storage
+	});
+	await __refreshAuth_wrapped(client);
+	return result;
+};
+
+//#endregion
+export { NotWaasWalletProviderError as a, createWaasClient as i, getWaasWalletProviderFromWalletAccount as n, getWaasChainNameFromChain as r, migrateFromFireblocks as t };
+//# sourceMappingURL=migrateFromFireblocks-hfh_j7wm.native.esm.js.map