@dynamic-labs-sdk/client 1.21.2 → 1.22.1

package/dist/{updateAuthFromVerifyResponse-U7zoE0b1.esm.js → updateAuthFromVerifyResponse-BhILXMm_.esm.js}

@@ -3,10 +3,10 @@ import * as z from "zod/mini";
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.21.2";
+var version = "1.22.1";
 var dependencies = {
 	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
-	"@dynamic-labs-wallet/browser-wallet-client": "1.0.73",
+	"@dynamic-labs-wallet/browser-wallet-client": "1.0.79",
 	"@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
 	"@dynamic-labs/sdk-api-core": "catalog:",
 	"@simplewebauthn/browser": "13.1.0",
@@ -138,26 +138,6 @@ const setDefaultClient = (client) => {
 const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
 const NONCE_POOL_SIZE = 5;
 
-//#endregion
-//#region src/modules/apiClient/constants.ts
-const DYNAMIC_API_VERSION_HEADER = "x-dyn-api-version";
-const DYNAMIC_REQUEST_ID_HEADER = "x-dyn-request-id";
-const DYNAMIC_SDK_VERSION_HEADER = "x-dyn-version";
-const ELEVATED_ACCESS_TOKEN_HEADER = "x-dyn-elevated-access-token";
-const MFA_TOKEN_HEADER = "x-mfa-auth-token";
-const SESSION_PUBLIC_KEY_HEADER = "x-dyn-session-public-key";
-const DYNAMIC_SDK_API_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
-const DYNAMIC_SDK_SESSION_ID_HEADER = "x-dyn-session-id";
-/**
-* Reports the runtime platform (`web` or `react-native`) to the Dynamic API.
-*
-* Named `x-dynamic-platform` (not `x-dyn-*`) to match the header the legacy
-* webview-controller already sends, so the backend receives a consistent
-* platform signal across SDK generations.
-*/
-const DYNAMIC_PLATFORM_HEADER = "x-dynamic-platform";
-const CLIENT_SDK_NAME = "ClientSDK";
-
 //#endregion
 //#region src/utils/getPlatform/getPlatform.ts
 /**
@@ -284,6 +264,33 @@ const getSessionKeys = (client) => {
 	return { publicKey };
 };
 
+//#endregion
+//#region src/modules/apiClient/constants.ts
+const DYNAMIC_API_VERSION_HEADER = "x-dyn-api-version";
+const DYNAMIC_REQUEST_ID_HEADER = "x-dyn-request-id";
+const DYNAMIC_SDK_VERSION_HEADER = "x-dyn-version";
+/**
+* Reports *why* the SDK is logging the user out on the `revokeSession`
+* (`/sdk/{env}/revoke`) request. The backend logs it so SDK-initiated session
+* revocations are attributable in Datadog (e.g. `token-expired`,
+* `keychain-key-missing`) instead of being inferred from downstream 401s.
+*/
+const DYNAMIC_LOGOUT_REASON_HEADER = "x-dyn-logout-reason";
+const ELEVATED_ACCESS_TOKEN_HEADER = "x-dyn-elevated-access-token";
+const MFA_TOKEN_HEADER = "x-mfa-auth-token";
+const SESSION_PUBLIC_KEY_HEADER = "x-dyn-session-public-key";
+const DYNAMIC_SDK_API_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
+const DYNAMIC_SDK_SESSION_ID_HEADER = "x-dyn-session-id";
+/**
+* Reports the runtime platform (`web` or `react-native`) to the Dynamic API.
+*
+* Named `x-dynamic-platform` (not `x-dyn-*`) to match the header the legacy
+* webview-controller already sends, so the backend receives a consistent
+* platform signal across SDK generations.
+*/
+const DYNAMIC_PLATFORM_HEADER = "x-dynamic-platform";
+const CLIENT_SDK_NAME = "ClientSDK";
+
 //#endregion
 //#region src/errors/APIError/APIError.ts
 var APIError = class APIError extends BaseError {
@@ -455,6 +462,81 @@ const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: as
 	return context.response;
 } });
 
+//#endregion
+//#region src/errors/UnauthorizedError.ts
+var UnauthorizedError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "unauthorized_error",
+			docsUrl: null,
+			name: "UnauthorizedError",
+			shortMessage: "Unauthorized"
+		});
+	}
+};
+
+//#endregion
+//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
+/** @notInstrumented */
+const createUnauthorizedMiddleware = () => ({ post: async (context) => {
+	if (context.response.status === 401) {
+		let cause = null;
+		try {
+			const errorBody = await context.response.clone().json();
+			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
+		} catch {}
+		throw new UnauthorizedError({ cause });
+	}
+	return context.response;
+} });
+
+//#endregion
+//#region src/modules/apiClient/createBaseApiClient.ts
+/**
+* Creates the base SDK API client from the client's core state, applying the
+* standard headers and the always-on error-conversion and unauthorized
+* middleware. Any middleware passed via `middleware` runs before those two.
+* @notInstrumented
+*/
+const createBaseApiClient = ({ middleware = [], options = {} }, client) => {
+	const core = getCore(client);
+	const coreState = core.state.get();
+	const settings = {
+		basePath: core.apiBaseUrl,
+		headers: {
+			"Content-Type": "application/json",
+			[DYNAMIC_API_VERSION_HEADER]: `API/${DYNAMIC_SDK_API_VERSION}`,
+			[DYNAMIC_PLATFORM_HEADER]: getPlatform(),
+			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
+			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
+			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
+			...core.getApiHeaders(),
+			...options.headers
+		}
+	};
+	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
+	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
+	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
+	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
+	if (options.elevatedAccessTokenScope) {
+		const elevatedToken = getElevatedAccessToken({ scope: options.elevatedAccessTokenScope }, client);
+		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
+	}
+	const sessionPublicKey = getSessionKeys(client)?.publicKey;
+	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
+	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
+	return new SDKApi(new Configuration({
+		...settings,
+		fetchApi: core.fetch,
+		middleware: [
+			...middleware,
+			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
+			createUnauthorizedMiddleware()
+		]
+	}));
+};
+
 //#endregion
 //#region src/services/storage/createStorageKeySchema/createStorageKeySchema.ts
 /** @notInstrumented */
@@ -505,6 +587,85 @@ const updateNoncePoolStorage = async ({ update }, client) => {
 	return storedBeforeUpdate;
 };
 
+//#endregion
+//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
+/**
+* Fetches a batch of nonces from the API and appends them to the pool in
+* storage.
+*
+* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
+* redirect). On iOS, a network request (like fetching a nonce) between a user
+* action and a deeplink call will break the gesture chain, causing iOS to
+* silently ignore the deeplink. By prefetching nonces ahead of time,
+* `getNonce` can return from the stored pool without an interrupting network
+* round-trip.
+*
+* New nonces are **appended** to the stored pool so that unconsumed entries
+* are not discarded by a background refetch; an expired stored pool is
+* replaced instead, since its nonces have already been evicted server-side.
+*
+* Concurrent refills are coalesced behind a single in-flight promise so that
+* simultaneous callers share one `GET /nonces` round-trip instead of each
+* issuing their own (which would inflate the pool and hammer the backend).
+* @notInstrumented
+*/
+const fetchAndStoreNonces = async (client) => {
+	const core = getCore(client);
+	const inFlight = core.state.get().nonceFetchInFlight;
+	if (inFlight) return inFlight;
+	const { environmentId } = core;
+	const apiClient = createBaseApiClient({}, client);
+	const fetchPromise = (async () => {
+		const { nonces } = await apiClient.getNonces({
+			count: NONCE_POOL_SIZE,
+			environmentId
+		});
+		const expiration = Date.now() + NONCE_POOL_EXPIRATION_TIME;
+		await updateNoncePoolStorage({ update: (stored) => {
+			return {
+				expiration,
+				nonces: [...stored && stored.expiration > Date.now() ? stored.nonces : [], ...nonces]
+			};
+		} }, client);
+	})().finally(() => {
+		core.state.set({ nonceFetchInFlight: null });
+	});
+	core.state.set({ nonceFetchInFlight: fetchPromise });
+	return fetchPromise;
+};
+
+//#endregion
+//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
+/**
+* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
+* document is running in a secure context, or an empty string otherwise.
+*
+* The `Secure` attribute prevents the browser from ever transmitting the cookie
+* over an unencrypted `http://` connection, which mitigates cleartext token
+* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
+* because browsers reject `Secure` cookies set over `http://` and that would
+* silently break local testing.
+*
+* Used when building the Dynamic auth JWT cookie string so the attribute is
+* applied consistently on both the write (sign-in/refresh) and clear (logout)
+* paths.
+*
+* @notInstrumented
+*/
+const getSecureCookieAttribute = () => {
+	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
+};
+
+//#endregion
+//#region src/utils/setCookie/setCookie.ts
+/**
+* Sefelly sets the cookie in the browser.
+* @notInstrumented
+*/
+const setCookie = (cookie) => {
+	document.cookie = cookie;
+};
+
 //#endregion
 //#region src/utils/getNonce/getNonce.ts
 /**
@@ -607,35 +768,6 @@ const createDeviceSignatureHeadersMiddleware = (client) => {
 	} };
 };
 
-//#endregion
-//#region src/errors/UnauthorizedError.ts
-var UnauthorizedError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "unauthorized_error",
-			docsUrl: null,
-			name: "UnauthorizedError",
-			shortMessage: "Unauthorized"
-		});
-	}
-};
-
-//#endregion
-//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
-/** @notInstrumented */
-const createUnauthorizedMiddleware = () => ({ post: async (context) => {
-	if (context.response.status === 401) {
-		let cause = null;
-		try {
-			const errorBody = await context.response.clone().json();
-			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
-		} catch {}
-		throw new UnauthorizedError({ cause });
-	}
-	return context.response;
-} });
-
 //#endregion
 //#region src/modules/apiClient/createApiClient.ts
 /**
@@ -645,120 +777,10 @@ const createUnauthorizedMiddleware = () => ({ post: async (context) => {
 * @notInstrumented
 */
 const createApiClient = (options = {}, client) => {
-	const core = getCore(client);
-	const coreState = core.state.get();
-	const settings = {
-		basePath: core.apiBaseUrl,
-		headers: {
-			"Content-Type": "application/json",
-			[DYNAMIC_API_VERSION_HEADER]: `API/${DYNAMIC_SDK_API_VERSION}`,
-			[DYNAMIC_PLATFORM_HEADER]: getPlatform(),
-			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
-			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
-			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
-			...core.getApiHeaders(),
-			...options.headers
-		}
-	};
-	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
-	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
-	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
-	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
-	if (options.elevatedAccessTokenScope) {
-		const elevatedToken = getElevatedAccessToken({ scope: options.elevatedAccessTokenScope }, client);
-		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
-	}
-	const sessionPublicKey = getSessionKeys(client)?.publicKey;
-	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
-	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
-	return new SDKApi(new Configuration({
-		...settings,
-		fetchApi: core.fetch,
-		middleware: [
-			createDeviceSignatureHeadersMiddleware(client),
-			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
-			createUnauthorizedMiddleware()
-		]
-	}));
-};
-
-//#endregion
-//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
-/**
-* Fetches a batch of nonces from the API and appends them to the pool in
-* storage.
-*
-* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
-* redirect). On iOS, a network request (like fetching a nonce) between a user
-* action and a deeplink call will break the gesture chain, causing iOS to
-* silently ignore the deeplink. By prefetching nonces ahead of time,
-* `getNonce` can return from the stored pool without an interrupting network
-* round-trip.
-*
-* New nonces are **appended** to the stored pool so that unconsumed entries
-* are not discarded by a background refetch; an expired stored pool is
-* replaced instead, since its nonces have already been evicted server-side.
-*
-* Concurrent refills are coalesced behind a single in-flight promise so that
-* simultaneous callers share one `GET /nonces` round-trip instead of each
-* issuing their own (which would inflate the pool and hammer the backend).
-* @notInstrumented
-*/
-const fetchAndStoreNonces = async (client) => {
-	const core = getCore(client);
-	const inFlight = core.state.get().nonceFetchInFlight;
-	if (inFlight) return inFlight;
-	const { environmentId } = core;
-	const apiClient = createApiClient({}, client);
-	const fetchPromise = (async () => {
-		const { nonces } = await apiClient.getNonces({
-			count: NONCE_POOL_SIZE,
-			environmentId
-		});
-		const expiration = Date.now() + NONCE_POOL_EXPIRATION_TIME;
-		await updateNoncePoolStorage({ update: (stored) => {
-			return {
-				expiration,
-				nonces: [...stored && stored.expiration > Date.now() ? stored.nonces : [], ...nonces]
-			};
-		} }, client);
-	})().finally(() => {
-		core.state.set({ nonceFetchInFlight: null });
-	});
-	core.state.set({ nonceFetchInFlight: fetchPromise });
-	return fetchPromise;
-};
-
-//#endregion
-//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
-/**
-* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
-* document is running in a secure context, or an empty string otherwise.
-*
-* The `Secure` attribute prevents the browser from ever transmitting the cookie
-* over an unencrypted `http://` connection, which mitigates cleartext token
-* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
-* because browsers reject `Secure` cookies set over `http://` and that would
-* silently break local testing.
-*
-* Used when building the Dynamic auth JWT cookie string so the attribute is
-* applied consistently on both the write (sign-in/refresh) and clear (logout)
-* paths.
-*
-* @notInstrumented
-*/
-const getSecureCookieAttribute = () => {
-	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
-};
-
-//#endregion
-//#region src/utils/setCookie/setCookie.ts
-/**
-* Sefelly sets the cookie in the browser.
-* @notInstrumented
-*/
-const setCookie = (cookie) => {
-	document.cookie = cookie;
+	return createBaseApiClient({
+		middleware: [createDeviceSignatureHeadersMiddleware(client)],
+		options
+	}, client);
 };
 
 //#endregion
@@ -1147,6 +1169,7 @@ const convertVerifiedCredentialToWalletAccount = ({ verifiedCredential }, client
 	return {
 		address: verifiedCredential.address,
 		addressesWithTypes: verifiedCredential.walletAdditionalAddresses,
+		businessAccountId: verifiedCredential.walletProperties?.businessAccountId ?? verifiedCredential.businessAccountProperties?.businessAccountId,
 		chain,
 		hardwareWalletVendor: verifiedCredential.walletProperties?.hardwareWallet,
 		id: walletAccountId,
@@ -1967,7 +1990,7 @@ const logoutWithReason = async ({ reason }, client) => {
 	core.logger.debug("[logoutWithReason] Logging out...", { reason });
 	await destroyWalletProviders({ reason }, client);
 	if (client.user !== null) {
-		const apiClient = createApiClient({}, client);
+		const apiClient = createApiClient({ headers: { [DYNAMIC_LOGOUT_REASON_HEADER]: reason } }, client);
 		try {
 			await apiClient.revokeSession({ environmentId: core.environmentId });
 		} catch (error) {
@@ -2301,5 +2324,5 @@ const updateAuthFromVerifyResponse = ({ response }, client) => {
 };
 
 //#endregion
-export { getNonce as $, generateSessionKeys as A, splitWalletProviderKey as B, getOperatingSystem as C, name as Ct, getWalletProviderRegistry as D, WalletProviderPriority as E, normalizeWalletNameWithChain as F, onEvent as G, retryOnFail as H, getChainFromVerifiedCredentialChain as I, createApiClient as J, onceEvent as K, CHAINS_INFO_MAP as L, isSignedIn as M, getWalletAccounts as N, createRuntimeServiceAccessKey as O, formatWalletProviderKey as P, getDeviceSigner as Q, formatWalletAccountId as R, getUserAgent as S, getCore as St, getWalletProviderFromWalletAccount as T, emitEvent as U, InvalidWalletProviderKeyError as V, offEvent as W, createDeviceSignatureHeadersMiddleware as X, UnauthorizedError as Y, getHeadersForNonceSignedByDeviceSigners as Z, SDK_API_CORE_VERSION as _, NONCE_POOL_SIZE as _t, initializeWaasClientsForEagerRecovery as a, LinkCredentialError as at, scrubParameters as b, ClientNotFoundError as bt, isWaasWalletProvider as c, getSessionKeys as ct, DYNAMIC_WAAS_METADATA as d, ValueMustBeDefinedError as dt, updateNoncePoolStorage as et, getWalletProviders as f, getElevatedAccessToken as ft, DYNAMIC_ICONIC_SPRITE_URL as g, DYNAMIC_SDK_API_VERSION as gt, emitWalletAccountsChangedEvent as h, CLIENT_SDK_NAME as ht, InvalidParamError as i, MfaInvalidOtpError as it, fetchProjectSettings as j, NoWalletProviderFoundError as k, DEFAULT_WAAS_BASE_API_URL as l, isCookieEnabled as lt, checkAndRaiseWalletAccountsChangedEvent as m, getPlatform as mt, upsertElevatedAccessToken as n, SandboxMaximumThresholdReachedError as nt, isWaasWalletAccount as o, InvalidExternalAuthError as ot, isUserMissingMfaAuth as p, randomString as pt, fetchAndStoreNonces as q, parseElevatedAccessToken as r, MfaRateLimitedError as rt, findWaasWalletProviderByChain as s, APIError as st, updateAuthFromVerifyResponse as t, createStorageKeySchema as tt, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as u, assertDefined as ut, __logoutWithReason_wrapped as v, getDefaultClient as vt, extractSessionId as w, version as wt, DEFAULT_PII_FIELDS as x, BaseError as xt, instrumentFunction as y, setDefaultClient as yt, normalizeAddress as z };
-//# sourceMappingURL=updateAuthFromVerifyResponse-U7zoE0b1.esm.js.map
+export { updateNoncePoolStorage as $, generateSessionKeys as A, splitWalletProviderKey as B, getOperatingSystem as C, name as Ct, getWalletProviderRegistry as D, WalletProviderPriority as E, normalizeWalletNameWithChain as F, onEvent as G, retryOnFail as H, getChainFromVerifiedCredentialChain as I, createDeviceSignatureHeadersMiddleware as J, onceEvent as K, CHAINS_INFO_MAP as L, isSignedIn as M, getWalletAccounts as N, createRuntimeServiceAccessKey as O, formatWalletProviderKey as P, fetchAndStoreNonces as Q, formatWalletAccountId as R, getUserAgent as S, getCore as St, getWalletProviderFromWalletAccount as T, emitEvent as U, InvalidWalletProviderKeyError as V, offEvent as W, getDeviceSigner as X, getHeadersForNonceSignedByDeviceSigners as Y, getNonce as Z, SDK_API_CORE_VERSION as _, NONCE_POOL_SIZE as _t, initializeWaasClientsForEagerRecovery as a, LinkCredentialError as at, scrubParameters as b, ClientNotFoundError as bt, isWaasWalletProvider as c, CLIENT_SDK_NAME as ct, DYNAMIC_WAAS_METADATA as d, isCookieEnabled as dt, createStorageKeySchema as et, getWalletProviders as f, assertDefined as ft, DYNAMIC_ICONIC_SPRITE_URL as g, getPlatform as gt, emitWalletAccountsChangedEvent as h, randomString as ht, InvalidParamError as i, MfaInvalidOtpError as it, fetchProjectSettings as j, NoWalletProviderFoundError as k, DEFAULT_WAAS_BASE_API_URL as l, DYNAMIC_SDK_API_VERSION as lt, checkAndRaiseWalletAccountsChangedEvent as m, getElevatedAccessToken as mt, upsertElevatedAccessToken as n, SandboxMaximumThresholdReachedError as nt, isWaasWalletAccount as o, InvalidExternalAuthError as ot, isUserMissingMfaAuth as p, ValueMustBeDefinedError as pt, createApiClient as q, parseElevatedAccessToken as r, MfaRateLimitedError as rt, findWaasWalletProviderByChain as s, APIError as st, updateAuthFromVerifyResponse as t, UnauthorizedError as tt, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as u, getSessionKeys as ut, __logoutWithReason_wrapped as v, getDefaultClient as vt, extractSessionId as w, version as wt, DEFAULT_PII_FIELDS as x, BaseError as xt, instrumentFunction as y, setDefaultClient as yt, normalizeAddress as z };
+//# sourceMappingURL=updateAuthFromVerifyResponse-BhILXMm_.esm.js.map