@dynamic-labs-sdk/client 1.23.0 → 1.24.0

package/dist/index.esm.js

@@ -1,9 +1,9 @@
-import { $ as UnauthorizedError, A as isSignedIn, B as retryOnFail, C as getWalletProviderFromWalletAccount, Ct as version, D as NoWalletProviderFoundError, F as CHAINS_INFO_MAP, G as createApiClient, H as offEvent, I as formatWalletAccountId, L as normalizeAddress, O as generateSessionKeys, P as getChainFromVerifiedCredentialChain, Q as createStorageKeySchema, R as splitWalletProviderKey, S as extractSessionId, St as name, T as getWalletProviderRegistry, U as onEvent, V as emitEvent, W as onceEvent, X as fetchAndStoreNonces, Y as getNonce, Z as updateNoncePoolStorage, _ as instrumentFunction, _t as getDefaultClient, a as initializeWaasClientsForEagerRecovery, at as APIError, b as getUserAgent, bt as BaseError, ct as SDK_API_CORE_VERSION, dt as assertDefined, et as SandboxMaximumThresholdReachedError, f as getWalletProviders, ft as ValueMustBeDefinedError, g as __logoutWithReason_wrapped, gt as NONCE_POOL_SIZE, ht as getPlatform, i as InvalidParamError, it as InvalidExternalAuthError, j as getWalletAccounts, k as fetchProjectSettings, m as checkAndRaiseWalletAccountsChangedEvent, mt as randomString, n as upsertElevatedAccessToken, nt as MfaInvalidOtpError, p as isUserMissingMfaAuth, pt as getElevatedAccessToken, r as parseElevatedAccessToken, rt as LinkCredentialError, st as DYNAMIC_ICONIC_SPRITE_URL, t as updateAuthFromVerifyResponse, tt as MfaRateLimitedError, ut as isCookieEnabled, v as scrubParameters, vt as setDefaultClient, w as WalletProviderPriority, x as getOperatingSystem, xt as getCore, y as DEFAULT_PII_FIELDS } from "./updateAuthFromVerifyResponse-Ct1Y6O_T.esm.js";
-import { B as isEqualShallow, C as getKeychainIndexedDBName, E as assertSafeNavigationUrl, F as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, G as UnavailableInServerSideError, I as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, L as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, M as createDeferredPromise, N as FETCH_PROJECT_SETTINGS_TRACKER_KEY, O as createLogger, P as GENERATE_SESSION_KEYS_TRACKER_KEY, R as getBuffer, S as MergeAccountsConfirmationError, T as createKeychainService, U as createLocalStorageAdapter, V as createStorage, W as isServerSideRendering, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, j as CannotTrackError, k as createCrossTabBroadcast, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as subscribeWithSelector } from "./getNetworkProviderFromNetworkId-DTNPpR5H.esm.js";
-import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-sI3vpWvA.esm.js";
-import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-OvzVH1rg.esm.js";
-import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-5sZK6kAJ.esm.js";
-import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-DJ2UX11y.esm.js";
+import { $ as UnauthorizedError, A as isSignedIn, B as retryOnFail, C as getWalletProviderFromWalletAccount, Ct as version, D as NoWalletProviderFoundError, F as CHAINS_INFO_MAP, G as createApiClient, H as offEvent, I as formatWalletAccountId, L as normalizeAddress, O as generateSessionKeys, P as getChainFromVerifiedCredentialChain, Q as createStorageKeySchema, R as splitWalletProviderKey, S as extractSessionId, St as name, T as getWalletProviderRegistry, U as onEvent, V as emitEvent, W as onceEvent, X as fetchAndStoreNonces, Y as getNonce, Z as updateNoncePoolStorage, _ as instrumentFunction, _t as getDefaultClient, a as initializeWaasClientsForEagerRecovery, at as APIError, b as getUserAgent, bt as BaseError, ct as SDK_API_CORE_VERSION, dt as assertDefined, et as SandboxMaximumThresholdReachedError, f as getWalletProviders, ft as ValueMustBeDefinedError, g as __logoutWithReason_wrapped, gt as NONCE_POOL_SIZE, ht as getPlatform, i as InvalidParamError, it as InvalidExternalAuthError, j as getWalletAccounts, k as fetchProjectSettings, m as checkAndRaiseWalletAccountsChangedEvent, mt as randomString, n as upsertElevatedAccessToken, nt as MfaInvalidOtpError, p as isUserMissingMfaAuth, pt as getElevatedAccessToken, r as parseElevatedAccessToken, rt as LinkCredentialError, st as DYNAMIC_ICONIC_SPRITE_URL, t as updateAuthFromVerifyResponse, tt as MfaRateLimitedError, ut as isCookieEnabled, v as scrubParameters, vt as setDefaultClient, w as WalletProviderPriority, x as getOperatingSystem, xt as getCore, y as DEFAULT_PII_FIELDS } from "./updateAuthFromVerifyResponse-D0Tt9-Z-.esm.js";
+import { A as createCrossTabBroadcast, B as subscribeWithSelector, C as getKeychainIndexedDBName, D as assertSafeNavigationUrl, E as createKeychainService, F as GENERATE_SESSION_KEYS_TRACKER_KEY, G as isServerSideRendering, H as createStorage, I as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, K as UnavailableInServerSideError, L as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, M as CannotTrackError, N as createDeferredPromise, P as FETCH_PROJECT_SETTINGS_TRACKER_KEY, R as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, S as MergeAccountsConfirmationError, T as assertSafeDeeplinkUrl, V as isEqualShallow, W as createLocalStorageAdapter, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, k as createLogger, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as getBuffer } from "./getNetworkProviderFromNetworkId-CjdC5HjA.esm.js";
+import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-Ck0VFh7Z.esm.js";
+import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-DZk1nVHO.esm.js";
+import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-BVVFLnfy.esm.js";
+import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-CnO4g-V0.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { AuthModeEnum, CaptchaProviderEnum as CaptchaProviderEnum$1, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, JwtVerifiedCredentialFormatEnum as JwtVerifiedCredentialFormatEnum$1, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, ProviderEnum as ProviderEnum$1, TokenScope, TokenScope as TokenScope$1, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
@@ -762,62 +762,6 @@ const createNavigationHandler = () => {
 	};
 };
 
-//#endregion
-//#region src/errors/UnsafeDeeplinkUrlError.ts
-/**
-* Thrown when a deeplink is opened with a URL whose scheme can execute script
-* in the current origin (`javascript:`, `data:`, `vbscript:`). Unlike
-* navigation, deeplinks legitimately use custom app schemes (e.g. `phantom:`,
-* `metamask:`), so this guards via a denylist of dangerous schemes rather than
-* an `http(s)` allowlist, preventing DOM XSS through the `window.location.assign`
-* sink while leaving valid wallet deeplinks untouched.
-*/
-var UnsafeDeeplinkUrlError = class extends BaseError {
-	constructor({ scheme }) {
-		super({
-			cause: null,
-			code: "unsafe_deeplink_url_error",
-			docsUrl: null,
-			name: "UnsafeDeeplinkUrlError",
-			shortMessage: `Refusing to open a deeplink with an unsafe scheme "${scheme}". Script-executing schemes (javascript:, data:, vbscript:) are not allowed. This may indicate a compromised or misconfigured deeplink URL.`
-		});
-	}
-};
-
-//#endregion
-//#region src/utils/assertSafeDeeplinkUrl/assertSafeDeeplinkUrl.ts
-/**
-* Schemes that can execute script in the current origin and must never reach a
-* deeplink navigation sink. Deeplinks legitimately use arbitrary custom app
-* schemes (e.g. `phantom:`, `metamask:`), so a denylist of dangerous schemes is
-* used here instead of the `http(s)` allowlist applied to standard navigation.
-*/
-const DANGEROUS_DEEPLINK_SCHEMES = new Set([
-	"javascript:",
-	"data:",
-	"vbscript:",
-	"blob:"
-]);
-/**
-* Asserts that the given deeplink URL is safe to open, i.e. its scheme is not
-* one that can execute script (`javascript:`, `data:`, `vbscript:`, `blob:`). Used as a
-* defense-in-depth guard on the `window.location.assign` deeplink sink to
-* prevent DOM XSS, while still permitting custom wallet app schemes.
-*
-* @param url - The deeplink URL string to validate.
-* @throws {UnsafeDeeplinkUrlError} If the URL cannot be parsed or its scheme can execute script.
-* @notInstrumented
-*/
-const assertSafeDeeplinkUrl = (url) => {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new UnsafeDeeplinkUrlError({ scheme: "unknown" });
-	}
-	if (DANGEROUS_DEEPLINK_SCHEMES.has(parsed.protocol)) throw new UnsafeDeeplinkUrlError({ scheme: parsed.protocol });
-};
-
 //#endregion
 //#region src/services/openDeeplink/createWebDeeplinkOpener/createWebDeeplinkOpener.ts
 /**
@@ -3899,8 +3843,8 @@ const prepareFlowSigning = async ({ assertBalanceForGasCost, assertBalanceForTra
 			environmentId,
 			flowId,
 			flowPrepareSigningRequest: {
-				assertBalanceForGasCost: assertBalanceForGasCost ?? false,
-				assertBalanceForTransferAmount: assertBalanceForTransferAmount ?? false
+				assertBalanceForGasCost: assertBalanceForGasCost ?? true,
+				assertBalanceForTransferAmount: assertBalanceForTransferAmount ?? true
 			},
 			xDynamicFlowSessionToken: sessionToken
 		}),
@@ -8157,7 +8101,13 @@ const isSameAddress = ({ chain, left, right }) => normalizeAddress({
 //#region src/modules/wallets/verifyWalletAccountForSignInOrTransfer/verifyWalletAccountForSignInOrTransfer.ts
 /** @notInstrumented */
 const verifyWalletAccountForSignInOrTransfer = async ({ walletAccount, isTransfer, requestedScopes }, client) => {
-	if (walletAccount.verifiedCredentialId) throw new WalletAccountAlreadyVerifiedError(walletAccount.address);
+	/**
+	* A wallet that is already verified can still be used for step-up
+	* authentication: the user proves ownership again to mint an elevated
+	* access token for the requested scope. Skip the already-verified guard
+	* when scopes are provided so the call reaches walletsVerify.
+	*/
+	if (walletAccount.verifiedCredentialId && !requestedScopes) throw new WalletAccountAlreadyVerifiedError(walletAccount.address);
 	const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
 	const { messageToSign, signature } = await __proveWalletAccountOwnership_wrapped({ walletAccount }, client);
 	const formattedSignature = walletAccount.hardwareWalletVendor ? formatSignatureForHardwareWallet({
@@ -8226,7 +8176,7 @@ const verifyWalletAccountForSignInOrTransfer = async ({ walletAccount, isTransfe
 * @param [params.requestedScopes] - Optional token scopes to request during verification.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns A promise that resolves to the verified wallet account.
-* @throws WalletAccountAlreadyVerifiedError If the wallet is already verified.
+* @throws WalletAccountAlreadyVerifiedError If the wallet is already verified and no requestedScopes are provided.
 * @throws WalletAlreadyLinkedToAnotherUserError If the wallet is linked to another user.
 * @see connectWithWalletProvider
 * @see connectAndVerifyWithWalletProvider