@dynamic-labs-sdk/client 1.23.1 → 1.24.1

package/dist/index.esm.js

@@ -1,13 +1,13 @@
-import { $ as UnauthorizedError, A as isSignedIn, B as retryOnFail, C as getWalletProviderFromWalletAccount, Ct as version, D as NoWalletProviderFoundError, F as CHAINS_INFO_MAP, G as createApiClient, H as offEvent, I as formatWalletAccountId, L as normalizeAddress, O as generateSessionKeys, P as getChainFromVerifiedCredentialChain, Q as createStorageKeySchema, R as splitWalletProviderKey, S as extractSessionId, St as name, T as getWalletProviderRegistry, U as onEvent, V as emitEvent, W as onceEvent, X as fetchAndStoreNonces, Y as getNonce, Z as updateNoncePoolStorage, _ as instrumentFunction, _t as getDefaultClient, a as initializeWaasClientsForEagerRecovery, at as APIError, b as getUserAgent, bt as BaseError, ct as SDK_API_CORE_VERSION, dt as assertDefined, et as SandboxMaximumThresholdReachedError, f as getWalletProviders, ft as ValueMustBeDefinedError, g as __logoutWithReason_wrapped, gt as NONCE_POOL_SIZE, ht as getPlatform, i as InvalidParamError, it as InvalidExternalAuthError, j as getWalletAccounts, k as fetchProjectSettings, m as checkAndRaiseWalletAccountsChangedEvent, mt as randomString, n as upsertElevatedAccessToken, nt as MfaInvalidOtpError, p as isUserMissingMfaAuth, pt as getElevatedAccessToken, r as parseElevatedAccessToken, rt as LinkCredentialError, st as DYNAMIC_ICONIC_SPRITE_URL, t as updateAuthFromVerifyResponse, tt as MfaRateLimitedError, ut as isCookieEnabled, v as scrubParameters, vt as setDefaultClient, w as WalletProviderPriority, x as getOperatingSystem, xt as getCore, y as DEFAULT_PII_FIELDS } from "./updateAuthFromVerifyResponse-wHGRunTk.esm.js";
-import { B as isEqualShallow, C as getKeychainIndexedDBName, E as assertSafeNavigationUrl, F as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, G as UnavailableInServerSideError, I as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, L as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, M as createDeferredPromise, N as FETCH_PROJECT_SETTINGS_TRACKER_KEY, O as createLogger, P as GENERATE_SESSION_KEYS_TRACKER_KEY, R as getBuffer, S as MergeAccountsConfirmationError, T as createKeychainService, U as createLocalStorageAdapter, V as createStorage, W as isServerSideRendering, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, j as CannotTrackError, k as createCrossTabBroadcast, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as subscribeWithSelector } from "./getNetworkProviderFromNetworkId-OfuaqHXU.esm.js";
-import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-OlDJAGIi.esm.js";
-import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-DScTOOg_.esm.js";
-import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-BIHCI8S6.esm.js";
-import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-Bn2HCYvZ.esm.js";
+import { $ as UnauthorizedError, A as isSignedIn, B as retryOnFail, C as getWalletProviderFromWalletAccount, Ct as version, D as NoWalletProviderFoundError, F as CHAINS_INFO_MAP, G as createApiClient, H as offEvent, I as formatWalletAccountId, L as normalizeAddress, O as generateSessionKeys, P as getChainFromVerifiedCredentialChain, Q as createStorageKeySchema, R as splitWalletProviderKey, S as extractSessionId, St as name, T as getWalletProviderRegistry, U as onEvent, V as emitEvent, W as onceEvent, X as fetchAndStoreNonces, Y as getNonce, Z as updateNoncePoolStorage, _ as instrumentFunction, _t as getDefaultClient, a as initializeWaasClientsForEagerRecovery, at as APIError, b as getUserAgent, bt as BaseError, ct as SDK_API_CORE_VERSION, dt as assertDefined, et as SandboxMaximumThresholdReachedError, f as getWalletProviders, ft as ValueMustBeDefinedError, g as __logoutWithReason_wrapped, gt as NONCE_POOL_SIZE, ht as getPlatform, i as InvalidParamError, it as InvalidExternalAuthError, j as getWalletAccounts, k as fetchProjectSettings, m as checkAndRaiseWalletAccountsChangedEvent, mt as randomString, n as upsertElevatedAccessToken, nt as MfaInvalidOtpError, p as isUserMissingMfaAuth, pt as getElevatedAccessToken, r as parseElevatedAccessToken, rt as LinkCredentialError, st as DYNAMIC_ICONIC_SPRITE_URL, t as updateAuthFromVerifyResponse, tt as MfaRateLimitedError, ut as isCookieEnabled, v as scrubParameters, vt as setDefaultClient, w as WalletProviderPriority, x as getOperatingSystem, xt as getCore, y as DEFAULT_PII_FIELDS } from "./updateAuthFromVerifyResponse-C_yGmd99.esm.js";
+import { A as createCrossTabBroadcast, B as subscribeWithSelector, C as getKeychainIndexedDBName, D as assertSafeNavigationUrl, E as createKeychainService, F as GENERATE_SESSION_KEYS_TRACKER_KEY, G as isServerSideRendering, H as createStorage, I as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, K as UnavailableInServerSideError, L as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, M as CannotTrackError, N as createDeferredPromise, P as FETCH_PROJECT_SETTINGS_TRACKER_KEY, R as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY, S as MergeAccountsConfirmationError, T as assertSafeDeeplinkUrl, V as isEqualShallow, W as createLocalStorageAdapter, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, k as createLogger, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as getBuffer } from "./getNetworkProviderFromNetworkId-CYONf9-8.esm.js";
+import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-BbhbghRE.esm.js";
+import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-WzXFgdor.esm.js";
+import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-Dh3JbMi6.esm.js";
+import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-DBlmv1ew.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { AuthModeEnum, CaptchaProviderEnum as CaptchaProviderEnum$1, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, JwtVerifiedCredentialFormatEnum as JwtVerifiedCredentialFormatEnum$1, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, ProviderEnum as ProviderEnum$1, TokenScope, TokenScope as TokenScope$1, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
-import EventEmitter$1, { EventEmitter } from "eventemitter3";
+import EventEmitter, { EventEmitter as EventEmitter$1 } from "eventemitter3";
 import { browserSupportsWebAuthn, startAuthentication, startRegistration } from "@simplewebauthn/browser";
 
 //#region src/modules/state/raiseStateEvents/events.ts
@@ -567,7 +567,7 @@ const createAsyncTrack = () => {
 	* This ensures no process is missed (as it would throw when tracked on a different node tick).
 	*/
 	let isTrackEnabled = true;
-	const eventEmitter = new EventEmitter();
+	const eventEmitter = new EventEmitter$1();
 	const allSettledPromise = createDeferredPromise();
 	const tracker = /* @__PURE__ */ new Map();
 	/**
@@ -614,7 +614,7 @@ const createAsyncTrack = () => {
 //#endregion
 //#region src/services/eventEmitter/createEventEmitter.ts
 /** @notInstrumented */
-const createEventEmitter = () => new EventEmitter$1();
+const createEventEmitter = () => new EventEmitter();
 
 //#endregion
 //#region src/services/fetch/createWebFetch.ts
@@ -763,66 +763,14 @@ const createNavigationHandler = () => {
 };
 
 //#endregion
-//#region src/errors/UnsafeDeeplinkUrlError.ts
-/**
-* Thrown when a deeplink is opened with a URL whose scheme can execute script
-* in the current origin (`javascript:`, `data:`, `vbscript:`). Unlike
-* navigation, deeplinks legitimately use custom app schemes (e.g. `phantom:`,
-* `metamask:`), so this guards via a denylist of dangerous schemes rather than
-* an `http(s)` allowlist, preventing DOM XSS through the `window.location.assign`
-* sink while leaving valid wallet deeplinks untouched.
-*/
-var UnsafeDeeplinkUrlError = class extends BaseError {
-	constructor({ scheme }) {
-		super({
-			cause: null,
-			code: "unsafe_deeplink_url_error",
-			docsUrl: null,
-			name: "UnsafeDeeplinkUrlError",
-			shortMessage: `Refusing to open a deeplink with an unsafe scheme "${scheme}". Script-executing schemes (javascript:, data:, vbscript:) are not allowed. This may indicate a compromised or misconfigured deeplink URL.`
-		});
-	}
-};
-
-//#endregion
-//#region src/utils/assertSafeDeeplinkUrl/assertSafeDeeplinkUrl.ts
-/**
-* Schemes that can execute script in the current origin and must never reach a
-* deeplink navigation sink. Deeplinks legitimately use arbitrary custom app
-* schemes (e.g. `phantom:`, `metamask:`), so a denylist of dangerous schemes is
-* used here instead of the `http(s)` allowlist applied to standard navigation.
-*/
-const DANGEROUS_DEEPLINK_SCHEMES = new Set([
-	"javascript:",
-	"data:",
-	"vbscript:",
-	"blob:"
-]);
-/**
-* Asserts that the given deeplink URL is safe to open, i.e. its scheme is not
-* one that can execute script (`javascript:`, `data:`, `vbscript:`, `blob:`). Used as a
-* defense-in-depth guard on the `window.location.assign` deeplink sink to
-* prevent DOM XSS, while still permitting custom wallet app schemes.
-*
-* @param url - The deeplink URL string to validate.
-* @throws {UnsafeDeeplinkUrlError} If the URL cannot be parsed or its scheme can execute script.
-* @notInstrumented
-*/
-const assertSafeDeeplinkUrl = (url) => {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new UnsafeDeeplinkUrlError({ scheme: "unknown" });
-	}
-	if (DANGEROUS_DEEPLINK_SCHEMES.has(parsed.protocol)) throw new UnsafeDeeplinkUrlError({ scheme: parsed.protocol });
-};
-
-//#endregion
-//#region src/services/openDeeplink/createWebDeeplinkOpener/createWebDeeplinkOpener.ts
+//#region src/services/openDeeplink/createDeeplinkOpener/createDeeplinkOpener.ts
 /**
 * Creates a deeplink opener that navigates the current tab to the deeplink URL.
 *
+* This is the default (web) implementation. React Native builds resolve
+* `createDeeplinkOpener.native.ts` instead, which opens the URL via RN
+* `Linking` since there is no browser navigation on device.
+*
 * Uses `window.location.assign` instead of `window.open` deliberately.
 * This matters for Phantom redirect specifically, which is the only deep link
 * provider that redirects back to the app in a new tab. With `window.open`,
@@ -834,8 +782,8 @@ const assertSafeDeeplinkUrl = (url) => {
 * entirely.
 * @notInstrumented
 */
-const createWebDeeplinkOpener = () => {
-	if (isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createWebDeeplinkOpener"));
+const createDeeplinkOpener = () => {
+	if (isServerSideRendering()) return () => Promise.reject(new UnavailableInServerSideError("createDeeplinkOpener"));
 	return async (url) => {
 		assertSafeDeeplinkUrl(url);
 		window.location.assign(url);
@@ -1027,7 +975,7 @@ const createCore = (config) => {
 		storageAdapter: config.coreConfig?.storageAdapter ?? createLocalStorageAdapter()
 	});
 	const fetch = config.coreConfig?.fetch ?? createWebFetch();
-	const openDeeplink = config.coreConfig?.openDeeplink ?? createWebDeeplinkOpener();
+	const openDeeplink = config.coreConfig?.openDeeplink ?? createDeeplinkOpener();
 	const openAuthSession = config.coreConfig?.openAuthSession;
 	const navigate = config.coreConfig?.navigate ?? createNavigationHandler();
 	const state = createObservableState(getInitialState);
@@ -3899,8 +3847,8 @@ const prepareFlowSigning = async ({ assertBalanceForGasCost, assertBalanceForTra
 			environmentId,
 			flowId,
 			flowPrepareSigningRequest: {
-				assertBalanceForGasCost: assertBalanceForGasCost ?? false,
-				assertBalanceForTransferAmount: assertBalanceForTransferAmount ?? false
+				assertBalanceForGasCost: assertBalanceForGasCost ?? true,
+				assertBalanceForTransferAmount: assertBalanceForTransferAmount ?? true
 			},
 			xDynamicFlowSessionToken: sessionToken
 		}),