@dynamic-labs-sdk/client 1.22.0 → 1.23.0

package/dist/{updateAuthFromVerifyResponse-CNfUcLNC.cjs → updateAuthFromVerifyResponse-ChnvPY0m.cjs}

@@ -31,18 +31,7 @@ zod_mini = __toESM(zod_mini);
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.22.0";
-var dependencies = {
-	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
-	"@dynamic-labs-wallet/browser-wallet-client": "1.0.79",
-	"@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
-	"@dynamic-labs/sdk-api-core": "catalog:",
-	"@simplewebauthn/browser": "13.1.0",
-	"ably": "2.17.1",
-	"buffer": "6.0.3",
-	"eventemitter3": "5.0.1",
-	"zod": "4.0.5"
-};
+var version = "1.23.0";
 
 //#endregion
 //#region src/client/core/getCore/getCore.ts
@@ -166,26 +155,6 @@ const setDefaultClient = (client) => {
 const NONCE_POOL_EXPIRATION_TIME = 6e4 * 60 * 24;
 const NONCE_POOL_SIZE = 5;
 
-//#endregion
-//#region src/modules/apiClient/constants.ts
-const DYNAMIC_API_VERSION_HEADER = "x-dyn-api-version";
-const DYNAMIC_REQUEST_ID_HEADER = "x-dyn-request-id";
-const DYNAMIC_SDK_VERSION_HEADER = "x-dyn-version";
-const ELEVATED_ACCESS_TOKEN_HEADER = "x-dyn-elevated-access-token";
-const MFA_TOKEN_HEADER = "x-mfa-auth-token";
-const SESSION_PUBLIC_KEY_HEADER = "x-dyn-session-public-key";
-const DYNAMIC_SDK_API_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
-const DYNAMIC_SDK_SESSION_ID_HEADER = "x-dyn-session-id";
-/**
-* Reports the runtime platform (`web` or `react-native`) to the Dynamic API.
-*
-* Named `x-dynamic-platform` (not `x-dyn-*`) to match the header the legacy
-* webview-controller already sends, so the backend receives a consistent
-* platform signal across SDK generations.
-*/
-const DYNAMIC_PLATFORM_HEADER = "x-dynamic-platform";
-const CLIENT_SDK_NAME = "ClientSDK";
-
 //#endregion
 //#region src/utils/getPlatform/getPlatform.ts
 /**
@@ -312,6 +281,41 @@ const getSessionKeys = (client) => {
 	return { publicKey };
 };
 
+//#endregion
+//#region src/generated/dependencyCatalog.ts
+const dependencyCatalog = { "@dynamic-labs/sdk-api-core": "0.0.1083" };
+
+//#endregion
+//#region src/constants.ts
+const SDK_API_CORE_VERSION = dependencyCatalog["@dynamic-labs/sdk-api-core"];
+const DYNAMIC_ICONIC_SPRITE_URL = "https://iconic.dynamic-static-assets.com/icons/sprite.svg";
+
+//#endregion
+//#region src/modules/apiClient/constants.ts
+const DYNAMIC_API_VERSION_HEADER = "x-dyn-api-version";
+const DYNAMIC_REQUEST_ID_HEADER = "x-dyn-request-id";
+const DYNAMIC_SDK_VERSION_HEADER = "x-dyn-version";
+/**
+* Reports *why* the SDK is logging the user out on the `revokeSession`
+* (`/sdk/{env}/revoke`) request. The backend logs it so SDK-initiated session
+* revocations are attributable in Datadog (e.g. `token-expired`,
+* `keychain-key-missing`) instead of being inferred from downstream 401s.
+*/
+const DYNAMIC_LOGOUT_REASON_HEADER = "x-dyn-logout-reason";
+const ELEVATED_ACCESS_TOKEN_HEADER = "x-dyn-elevated-access-token";
+const MFA_TOKEN_HEADER = "x-mfa-auth-token";
+const SESSION_PUBLIC_KEY_HEADER = "x-dyn-session-public-key";
+const DYNAMIC_SDK_SESSION_ID_HEADER = "x-dyn-session-id";
+/**
+* Reports the runtime platform (`web` or `react-native`) to the Dynamic API.
+*
+* Named `x-dynamic-platform` (not `x-dyn-*`) to match the header the legacy
+* webview-controller already sends, so the backend receives a consistent
+* platform signal across SDK generations.
+*/
+const DYNAMIC_PLATFORM_HEADER = "x-dynamic-platform";
+const CLIENT_SDK_NAME = "ClientSDK";
+
 //#endregion
 //#region src/errors/APIError/APIError.ts
 var APIError = class APIError extends BaseError {
@@ -483,6 +487,81 @@ const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: as
 	return context.response;
 } });
 
+//#endregion
+//#region src/errors/UnauthorizedError.ts
+var UnauthorizedError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "unauthorized_error",
+			docsUrl: null,
+			name: "UnauthorizedError",
+			shortMessage: "Unauthorized"
+		});
+	}
+};
+
+//#endregion
+//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
+/** @notInstrumented */
+const createUnauthorizedMiddleware = () => ({ post: async (context) => {
+	if (context.response.status === 401) {
+		let cause = null;
+		try {
+			const errorBody = await context.response.clone().json();
+			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
+		} catch {}
+		throw new UnauthorizedError({ cause });
+	}
+	return context.response;
+} });
+
+//#endregion
+//#region src/modules/apiClient/createBaseApiClient.ts
+/**
+* Creates the base SDK API client from the client's core state, applying the
+* standard headers and the always-on error-conversion and unauthorized
+* middleware. Any middleware passed via `middleware` runs before those two.
+* @notInstrumented
+*/
+const createBaseApiClient = ({ middleware = [], options = {} }, client) => {
+	const core = getCore(client);
+	const coreState = core.state.get();
+	const settings = {
+		basePath: core.apiBaseUrl,
+		headers: {
+			"Content-Type": "application/json",
+			[DYNAMIC_API_VERSION_HEADER]: `API/${SDK_API_CORE_VERSION}`,
+			[DYNAMIC_PLATFORM_HEADER]: getPlatform(),
+			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
+			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
+			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
+			...core.getApiHeaders(),
+			...options.headers
+		}
+	};
+	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
+	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
+	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
+	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
+	if (options.elevatedAccessTokenScope) {
+		const elevatedToken = getElevatedAccessToken({ scope: options.elevatedAccessTokenScope }, client);
+		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
+	}
+	const sessionPublicKey = getSessionKeys(client)?.publicKey;
+	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
+	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
+	return new _dynamic_labs_sdk_api_core.SDKApi(new _dynamic_labs_sdk_api_core.Configuration({
+		...settings,
+		fetchApi: core.fetch,
+		middleware: [
+			...middleware,
+			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
+			createUnauthorizedMiddleware()
+		]
+	}));
+};
+
 //#endregion
 //#region src/services/storage/createStorageKeySchema/createStorageKeySchema.ts
 /** @notInstrumented */
@@ -533,6 +612,85 @@ const updateNoncePoolStorage = async ({ update }, client) => {
 	return storedBeforeUpdate;
 };
 
+//#endregion
+//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
+/**
+* Fetches a batch of nonces from the API and appends them to the pool in
+* storage.
+*
+* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
+* redirect). On iOS, a network request (like fetching a nonce) between a user
+* action and a deeplink call will break the gesture chain, causing iOS to
+* silently ignore the deeplink. By prefetching nonces ahead of time,
+* `getNonce` can return from the stored pool without an interrupting network
+* round-trip.
+*
+* New nonces are **appended** to the stored pool so that unconsumed entries
+* are not discarded by a background refetch; an expired stored pool is
+* replaced instead, since its nonces have already been evicted server-side.
+*
+* Concurrent refills are coalesced behind a single in-flight promise so that
+* simultaneous callers share one `GET /nonces` round-trip instead of each
+* issuing their own (which would inflate the pool and hammer the backend).
+* @notInstrumented
+*/
+const fetchAndStoreNonces = async (client) => {
+	const core = getCore(client);
+	const inFlight = core.state.get().nonceFetchInFlight;
+	if (inFlight) return inFlight;
+	const { environmentId } = core;
+	const apiClient = createBaseApiClient({}, client);
+	const fetchPromise = (async () => {
+		const { nonces } = await apiClient.getNonces({
+			count: NONCE_POOL_SIZE,
+			environmentId
+		});
+		const expiration = Date.now() + NONCE_POOL_EXPIRATION_TIME;
+		await updateNoncePoolStorage({ update: (stored) => {
+			return {
+				expiration,
+				nonces: [...stored && stored.expiration > Date.now() ? stored.nonces : [], ...nonces]
+			};
+		} }, client);
+	})().finally(() => {
+		core.state.set({ nonceFetchInFlight: null });
+	});
+	core.state.set({ nonceFetchInFlight: fetchPromise });
+	return fetchPromise;
+};
+
+//#endregion
+//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
+/**
+* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
+* document is running in a secure context, or an empty string otherwise.
+*
+* The `Secure` attribute prevents the browser from ever transmitting the cookie
+* over an unencrypted `http://` connection, which mitigates cleartext token
+* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
+* because browsers reject `Secure` cookies set over `http://` and that would
+* silently break local testing.
+*
+* Used when building the Dynamic auth JWT cookie string so the attribute is
+* applied consistently on both the write (sign-in/refresh) and clear (logout)
+* paths.
+*
+* @notInstrumented
+*/
+const getSecureCookieAttribute = () => {
+	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
+};
+
+//#endregion
+//#region src/utils/setCookie/setCookie.ts
+/**
+* Sefelly sets the cookie in the browser.
+* @notInstrumented
+*/
+const setCookie = (cookie) => {
+	document.cookie = cookie;
+};
+
 //#endregion
 //#region src/utils/getNonce/getNonce.ts
 /**
@@ -635,35 +793,6 @@ const createDeviceSignatureHeadersMiddleware = (client) => {
 	} };
 };
 
-//#endregion
-//#region src/errors/UnauthorizedError.ts
-var UnauthorizedError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "unauthorized_error",
-			docsUrl: null,
-			name: "UnauthorizedError",
-			shortMessage: "Unauthorized"
-		});
-	}
-};
-
-//#endregion
-//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
-/** @notInstrumented */
-const createUnauthorizedMiddleware = () => ({ post: async (context) => {
-	if (context.response.status === 401) {
-		let cause = null;
-		try {
-			const errorBody = await context.response.clone().json();
-			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
-		} catch {}
-		throw new UnauthorizedError({ cause });
-	}
-	return context.response;
-} });
-
 //#endregion
 //#region src/modules/apiClient/createApiClient.ts
 /**
@@ -673,120 +802,10 @@ const createUnauthorizedMiddleware = () => ({ post: async (context) => {
 * @notInstrumented
 */
 const createApiClient = (options = {}, client) => {
-	const core = getCore(client);
-	const coreState = core.state.get();
-	const settings = {
-		basePath: core.apiBaseUrl,
-		headers: {
-			"Content-Type": "application/json",
-			[DYNAMIC_API_VERSION_HEADER]: `API/${DYNAMIC_SDK_API_VERSION}`,
-			[DYNAMIC_PLATFORM_HEADER]: getPlatform(),
-			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
-			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
-			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
-			...core.getApiHeaders(),
-			...options.headers
-		}
-	};
-	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
-	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
-	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
-	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
-	if (options.elevatedAccessTokenScope) {
-		const elevatedToken = getElevatedAccessToken({ scope: options.elevatedAccessTokenScope }, client);
-		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
-	}
-	const sessionPublicKey = getSessionKeys(client)?.publicKey;
-	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
-	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
-	return new _dynamic_labs_sdk_api_core.SDKApi(new _dynamic_labs_sdk_api_core.Configuration({
-		...settings,
-		fetchApi: core.fetch,
-		middleware: [
-			createDeviceSignatureHeadersMiddleware(client),
-			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
-			createUnauthorizedMiddleware()
-		]
-	}));
-};
-
-//#endregion
-//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
-/**
-* Fetches a batch of nonces from the API and appends them to the pool in
-* storage.
-*
-* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
-* redirect). On iOS, a network request (like fetching a nonce) between a user
-* action and a deeplink call will break the gesture chain, causing iOS to
-* silently ignore the deeplink. By prefetching nonces ahead of time,
-* `getNonce` can return from the stored pool without an interrupting network
-* round-trip.
-*
-* New nonces are **appended** to the stored pool so that unconsumed entries
-* are not discarded by a background refetch; an expired stored pool is
-* replaced instead, since its nonces have already been evicted server-side.
-*
-* Concurrent refills are coalesced behind a single in-flight promise so that
-* simultaneous callers share one `GET /nonces` round-trip instead of each
-* issuing their own (which would inflate the pool and hammer the backend).
-* @notInstrumented
-*/
-const fetchAndStoreNonces = async (client) => {
-	const core = getCore(client);
-	const inFlight = core.state.get().nonceFetchInFlight;
-	if (inFlight) return inFlight;
-	const { environmentId } = core;
-	const apiClient = createApiClient({}, client);
-	const fetchPromise = (async () => {
-		const { nonces } = await apiClient.getNonces({
-			count: NONCE_POOL_SIZE,
-			environmentId
-		});
-		const expiration = Date.now() + NONCE_POOL_EXPIRATION_TIME;
-		await updateNoncePoolStorage({ update: (stored) => {
-			return {
-				expiration,
-				nonces: [...stored && stored.expiration > Date.now() ? stored.nonces : [], ...nonces]
-			};
-		} }, client);
-	})().finally(() => {
-		core.state.set({ nonceFetchInFlight: null });
-	});
-	core.state.set({ nonceFetchInFlight: fetchPromise });
-	return fetchPromise;
-};
-
-//#endregion
-//#region src/utils/getSecureCookieAttribute/getSecureCookieAttribute.ts
-/**
-* Returns the cookie `Secure` attribute suffix (`'; Secure'`) when the current
-* document is running in a secure context, or an empty string otherwise.
-*
-* The `Secure` attribute prevents the browser from ever transmitting the cookie
-* over an unencrypted `http://` connection, which mitigates cleartext token
-* capture (CWE-614). It is intentionally omitted on insecure/localhost dev,
-* because browsers reject `Secure` cookies set over `http://` and that would
-* silently break local testing.
-*
-* Used when building the Dynamic auth JWT cookie string so the attribute is
-* applied consistently on both the write (sign-in/refresh) and clear (logout)
-* paths.
-*
-* @notInstrumented
-*/
-const getSecureCookieAttribute = () => {
-	return Boolean(globalThis.window?.isSecureContext) || globalThis.location?.protocol === "https:" ? "; Secure" : "";
-};
-
-//#endregion
-//#region src/utils/setCookie/setCookie.ts
-/**
-* Sefelly sets the cookie in the browser.
-* @notInstrumented
-*/
-const setCookie = (cookie) => {
-	document.cookie = cookie;
+	return createBaseApiClient({
+		middleware: [createDeviceSignatureHeadersMiddleware(client)],
+		options
+	}, client);
 };
 
 //#endregion
@@ -1996,7 +2015,7 @@ const logoutWithReason = async ({ reason }, client) => {
 	core.logger.debug("[logoutWithReason] Logging out...", { reason });
 	await destroyWalletProviders({ reason }, client);
 	if (client.user !== null) {
-		const apiClient = createApiClient({}, client);
+		const apiClient = createApiClient({ headers: { [DYNAMIC_LOGOUT_REASON_HEADER]: reason } }, client);
 		try {
 			await apiClient.revokeSession({ environmentId: core.environmentId });
 		} catch (error) {
@@ -2040,11 +2059,6 @@ const __logoutWithReason_wrapped = instrumentFunction({
 	}
 });
 
-//#endregion
-//#region src/constants.ts
-const SDK_API_CORE_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
-const DYNAMIC_ICONIC_SPRITE_URL = "https://iconic.dynamic-static-assets.com/icons/sprite.svg";
-
 //#endregion
 //#region src/modules/wallets/emitWalletAccountsChangedEvent/emitWalletAccountsChangedEvent.ts
 /**
@@ -2384,12 +2398,6 @@ Object.defineProperty(exports, 'DYNAMIC_ICONIC_SPRITE_URL', {
     return DYNAMIC_ICONIC_SPRITE_URL;
   }
 });
-Object.defineProperty(exports, 'DYNAMIC_SDK_API_VERSION', {
-  enumerable: true,
-  get: function () {
-    return DYNAMIC_SDK_API_VERSION;
-  }
-});
 Object.defineProperty(exports, 'DYNAMIC_WAAS_METADATA', {
   enumerable: true,
   get: function () {
@@ -2804,4 +2812,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=updateAuthFromVerifyResponse-CNfUcLNC.cjs.map
+//# sourceMappingURL=updateAuthFromVerifyResponse-ChnvPY0m.cjs.map