@dynamic-labs-sdk/client 1.24.1 → 1.26.0

package/dist/waasCore.native.esm.js

@@ -1,13 +1,261 @@
-import { Ct as name, M as getChainFromVerifiedCredentialChain, St as getCore, a as InvalidParamError, f as DYNAMIC_WAAS_METADATA, mt as getElevatedAccessToken, wt as version } from "./NativeModuleNotLinkedError-dFDBC524.native.esm.js";
-import "./isDynamicWaasEnabled-BmB0lQJf.native.esm.js";
-import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, o as WaasLoadFailedError, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-Ebw4x90F.native.esm.js";
-import "./isMfaRequiredForAction-DP0kk0tY.native.esm.js";
-import { n as consumeMfaTokenIfRequiredForAction, t as getSignedSessionId } from "./getSignedSessionId-DV0hK3Tu.native.esm.js";
-import { i as getWaasWalletProviderFromWalletAccount, n as getWaasChainNameFromChain, r as createWaasClient, t as migrateFromFireblocks } from "./migrateFromFireblocks-C1yQ4dm7.native.esm.js";
+import { Ct as version, M as CHAINS_INFO_MAP, St as name, V as createApiClient, at as CLIENT_SDK_NAME, bt as BaseError, d as DYNAMIC_WAAS_METADATA, dt as assertDefined, i as InvalidParamError, it as APIError, j as getChainFromVerifiedCredentialChain, l as DEFAULT_WAAS_BASE_API_URL, mt as randomString, pt as getElevatedAccessToken, u as DEFAULT_WAAS_BASE_MPC_RELAY_API_URL, ut as isCookieEnabled, xt as getCore } from "./updateAuthFromVerifyResponse-CTfG6oZa.native.esm.js";
+import { n as TransactionBroadcastError } from "./isDynamicWaasEnabled-d82cX7j9.native.esm.js";
+import { i as NativeModuleNotLinkedError } from "./isMfaRequiredForAction-1O_rFiPN.native.esm.js";
+import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, o as WaasLoadFailedError, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-bR7jwdjO.native.esm.js";
+import { n as consumeMfaTokenIfRequiredForAction, t as getSignedSessionId } from "./getSignedSessionId-B5Dijw-8.native.esm.js";
+import { n as getWaasWalletProviderFromWalletAccount, t as migrateFromFireblocks } from "./migrateFromFireblocks-DVP5tGv_.native.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
-import { MFAAction, TokenScope, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
-import { ThresholdSignatureScheme, WalletOperation } from "@dynamic-labs-wallet/browser-wallet-client";
+import { MFAAction, TokenScope, WaasTransactionBroadcastStatus, WaasTransactionEncoding, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
+import { ACCESSIBLE, getGenericPassword, resetGenericPassword, setGenericPassword } from "react-native-keychain";
+import { NativeEventEmitter, TurboModuleRegistry } from "react-native";
+import { DynamicWalletClient, ThresholdSignatureScheme, WalletOperation } from "@dynamic-labs-wallet/browser-wallet-client";
 
+//#region src/errors/CorruptedKeyShareError.ts
+/**
+* Thrown when a persisted client key share cannot be parsed back into its
+* structured form (e.g. a partially-written or corrupted keychain entry).
+*
+* Surfaced as a typed error rather than swallowed so callers can distinguish
+* "no key share stored" (empty result) from "key share exists but is
+* unreadable" — the latter must never be silently treated as the former,
+* which could trigger an unintended re-keygen that overwrites recoverable
+* material.
+*/
+var CorruptedKeyShareError = class extends BaseError {
+	constructor({ cause = null } = {}) {
+		super({
+			cause,
+			code: "corrupted_key_share_error",
+			details: "The stored client key share could not be parsed. The secure storage entry may be partially written or corrupted.",
+			docsUrl: null,
+			name: "CorruptedKeyShareError",
+			shortMessage: "Stored client key share is corrupted and cannot be read."
+		});
+	}
+};
+
+//#endregion
+//#region src/turboModules/NativeDynamicWebView.ts
+var NativeDynamicWebView_default = TurboModuleRegistry.get("DynamicClientWebView");
+
+//#endregion
+//#region src/errors/WebViewLoadFailedError.ts
+/**
+* Thrown when `DynamicWebView.open()` (via the WaaS transport provider)
+* fails to establish a usable load. Inspect `reason` to distinguish the
+* failure mode; `statusCode` and `underlyingError` provide structured
+* metadata for the cases that have it.
+*/
+var WebViewLoadFailedError = class extends BaseError {
+	reason;
+	statusCode;
+	underlyingError;
+	constructor({ reason, shortMessage, cause = null, statusCode, underlyingError }) {
+		super({
+			cause,
+			code: "webview_load_failed_error",
+			details: underlyingError,
+			docsUrl: null,
+			name: "WebViewLoadFailedError",
+			shortMessage
+		});
+		this.reason = reason;
+		this.statusCode = statusCode;
+		this.underlyingError = underlyingError;
+	}
+};
+
+//#endregion
+//#region src/modules/waas/createWaasClient/translateNativeOpenError.ts
+const REASON_BY_NATIVE_CODE = {
+	webview_cancelled: "cancelled",
+	webview_content_process_terminated: "content_process_terminated",
+	webview_http_error: "http_error",
+	webview_instance_busy: "instance_busy",
+	webview_invalid_url: "invalid_url",
+	webview_navigation_failed: "navigation_failed",
+	webview_no_host_view: "no_host_view",
+	webview_unsupported: "unsupported"
+};
+/**
+* Translates a native `DynamicWebView.open()` rejection into a typed
+* `WebViewLoadFailedError`. Maps the native RCT reject code to the JS-level
+* `WebViewLoadFailureReason` discriminator (falling back to
+* `navigation_failed` for unrecognized codes) and carries through the
+* structured `statusCode` / `underlyingError` metadata.
+*
+* The `reason` it produces is the contract `createWaasSDKContainer` branches
+* on — notably `emitError` swallows `cancelled` because that code is only ever
+* produced by our own `close()` teardown (verified on both the iOS and Android
+* native sides). Keep `REASON_BY_NATIVE_CODE` in sync with the native reject
+* codes so that branching stays correct.
+*
+* @notInstrumented
+*/
+const translateNativeOpenError = (err) => {
+	const rejection = err ?? {};
+	const isNativeRejectionCode = (code) => code != void 0 && code in REASON_BY_NATIVE_CODE;
+	const reason = isNativeRejectionCode(rejection.code) ? REASON_BY_NATIVE_CODE[rejection.code] : "navigation_failed";
+	return new WebViewLoadFailedError({
+		cause: err instanceof Error ? err : null,
+		reason,
+		shortMessage: rejection.message ?? `DynamicWebView open failed (${reason}).`,
+		statusCode: rejection.userInfo?.DynamicWebViewStatusCode,
+		underlyingError: rejection.userInfo?.DynamicWebViewUnderlying
+	});
+};
+
+//#endregion
+//#region src/modules/waas/createWaasClient/createNativeWaasSDKContainer.native.ts
+const NATIVE_MODULE_NAME = "DynamicClientWebView";
+const MESSAGE_EVENT_NAME = "dynamicBridgeMessage";
+const generateInstanceId = () => `${Date.now().toString(36)}-${crypto.randomUUID()}`;
+/**
+* Creates a React Native `WaasSDKContainer` backed by a hidden, headless native
+* WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the
+* `DynamicClientWebView` TurboModule. Each invocation returns an isolated
+* container with its own instance ID, native WebView, and message routing.
+*
+* Used for MPC operations (signing, key-share management) where there is
+* nothing for the user to see. The VISIBLE private-key export display is no
+* longer a native overlay — it is rendered by the `ExportPrivateKey` component
+* (`@dynamic-labs-sdk/react-native-embedded-wallet-export`) on top of
+* `react-native-webview`, so it scrolls and positions like any RN view.
+*
+* @notInstrumented
+*/
+const createNativeWaasSDKContainer = () => {
+	if (!NativeDynamicWebView_default) throw new NativeModuleNotLinkedError({ moduleName: NATIVE_MODULE_NAME });
+	const nativeModule = NativeDynamicWebView_default;
+	const instanceId = generateInstanceId();
+	const emitter = new NativeEventEmitter(nativeModule);
+	const messageHandlers = [];
+	const errorHandlers = [];
+	let subscription = null;
+	let destroyed = false;
+	const emitError = (err) => {
+		if (destroyed) return;
+		const translated = translateNativeOpenError(err);
+		if (translated.reason === "cancelled") return;
+		for (const handler of errorHandlers) handler(translated);
+	};
+	return {
+		destroy() {
+			if (destroyed) return;
+			destroyed = true;
+			subscription?.remove();
+			subscription = null;
+			messageHandlers.length = 0;
+			errorHandlers.length = 0;
+			nativeModule.close(instanceId);
+		},
+		isAlive: () => !destroyed,
+		onError(handler) {
+			errorHandlers.push(handler);
+			return () => {
+				const index = errorHandlers.indexOf(handler);
+				if (index !== -1) errorHandlers.splice(index, 1);
+			};
+		},
+		onMessage(handler) {
+			messageHandlers.push(handler);
+			subscription ??= emitter.addListener(MESSAGE_EVENT_NAME, (payload) => {
+				if (payload.instanceId !== instanceId) return;
+				for (const fn of messageHandlers) fn(payload.data);
+			});
+			return () => {
+				const index = messageHandlers.indexOf(handler);
+				if (index !== -1) messageHandlers.splice(index, 1);
+				if (messageHandlers.length === 0) {
+					subscription?.remove();
+					subscription = null;
+				}
+			};
+		},
+		sendMessage(data) {
+			nativeModule.sendMessage(instanceId, data);
+		},
+		async setUrl(url) {
+			nativeModule.open(instanceId, url).catch(emitError);
+		}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/createWaasClient/createWaasSDKContainer.native.ts
+/**
+* Creates a React Native `WaasSDKContainer` backed by a hidden, headless native
+* WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the
+* `DynamicClientWebView` TurboModule. Used for MPC operations (signing, key-share
+* management) where there is nothing for the user to see.
+*
+* For the private-key export display — where the hosted page must render the
+* key for the user — use the `ExportPrivateKey` component from
+* `@dynamic-labs-sdk/react-native-embedded-wallet-export`, which renders the
+* key inside a `react-native-webview` instead of a native overlay.
+*
+* @notInstrumented
+*/
+const createWaasSDKContainer = () => createNativeWaasSDKContainer();
+
+//#endregion
+//#region src/modules/waas/createWaasClient/createWaasClient.native.ts
+/**
+* Keychain security options for the client key share. The share is wallet
+* key material that cannot be re-derived locally, so the options are pinned
+* explicitly rather than inherited from `react-native-keychain` defaults
+* (which vary across versions and platforms).
+*
+* `WHEN_UNLOCKED_THIS_DEVICE_ONLY` keeps the share readable only while the
+* device is unlocked, excludes it from iCloud Keychain sync, and prevents it
+* migrating to a new device on encrypted-backup restore. It deliberately does
+* NOT set `accessControl` (e.g. biometry) — reads must not surface a Face ID /
+* passcode prompt, since the share is read on routine wallet operations.
+*/
+const KEY_SHARE_KEYCHAIN_OPTIONS = { accessible: ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY };
+/** @notInstrumented */
+const createWaasClient = ({ chainName }, client) => {
+	const core = getCore(client);
+	const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;
+	const getKeyShareService = (accountAddress) => `${core.environmentId}:${accountAddress}`;
+	return new DynamicWalletClient({
+		authMode: isCookieEnabled(client) ? "cookie" : "header",
+		authToken: client.token || "",
+		baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", ""),
+		baseMPCRelayApiUrl: client.projectSettings?.sdk.waas?.relayUrl || DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,
+		chainName,
+		environmentId: core.environmentId,
+		hostOrigin: core.metadata?.universalLink,
+		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,
+		...additionalTrustedOrigins == void 0 ? {} : { additionalTrustedOrigins },
+		...core.waas?.loadTimeoutMs == void 0 ? {} : { iframeLoadTimeout: core.waas.loadTimeoutMs },
+		...core.waas?.maxLoadRetries == void 0 ? {} : { maxRetryAttempts: core.waas.maxLoadRetries }
+	}, {
+		createWaasSDKContainer,
+		secureStorage: {
+			getClientKeyShare: async (accountAddress) => {
+				const result = await getGenericPassword({ service: getKeyShareService(accountAddress) });
+				if (!result) return [];
+				try {
+					return JSON.parse(result.password);
+				} catch (cause) {
+					throw new CorruptedKeyShareError({ cause: cause instanceof Error ? cause : null });
+				}
+			},
+			removeClientKeyShare: async (accountAddress) => {
+				await resetGenericPassword({ service: getKeyShareService(accountAddress) });
+			},
+			setClientKeyShare: async (accountAddress, shares) => {
+				await setGenericPassword(accountAddress, JSON.stringify(shares), {
+					...KEY_SHARE_KEYCHAIN_OPTIONS,
+					service: getKeyShareService(accountAddress)
+				});
+			}
+		}
+	});
+};
+
+//#endregion
 //#region src/utils/createTranslateRejection/createTranslateRejection.ts
 /**
 * Builds a reusable decorator, bound once to a `match`/`mapTo` pair, that wraps
@@ -62,6 +310,94 @@ const getActionAuthorizationTokens = async ({ mfaAction, scope }, client) => {
 	};
 };
 
+//#endregion
+//#region src/modules/waas/transactionBroadcastErrorMapper/transactionBroadcastErrorMapper.ts
+const TRANSACTION_BROADCAST_ERROR_CODES = {
+	broadcast_idempotency_conflict: "BROADCAST_IDEMPOTENCY_CONFLICT",
+	broadcast_outcome_unknown: "BROADCAST_OUTCOME_UNKNOWN",
+	broadcast_rate_limited: "BROADCAST_RATE_LIMITED",
+	broadcast_rejected: "BROADCAST_REJECTED",
+	broadcast_requires_resign: "BROADCAST_REQUIRES_RESIGN",
+	broadcast_wallet_ineligible: "BROADCAST_WALLET_INELIGIBLE",
+	invalid_signed_transaction: "INVALID_SIGNED_TRANSACTION",
+	network_not_enabled: "NETWORK_NOT_ENABLED",
+	signed_transaction_wallet_mismatch: "SIGNED_TRANSACTION_WALLET_MISMATCH",
+	unsupported_waas_chain: "UNSUPPORTED_WAAS_CHAIN"
+};
+const TRANSACTION_BROADCAST_SUBMISSION_STATES = new Set([
+	"not_submitted",
+	"requires_resign",
+	"unknown"
+]);
+/**
+* Maps structured WaaS broadcast API failures to a public SDK error.
+*
+* @notInstrumented
+*/
+const transactionBroadcastErrorMapper = (error) => {
+	if (!(error instanceof APIError)) return null;
+	const code = TRANSACTION_BROADCAST_ERROR_CODES[error.code];
+	if (!code) return null;
+	const payload = error.payload;
+	if (!payload || typeof payload.attempts !== "number" || typeof payload.broadcastId !== "string" || typeof payload.retryable !== "boolean" || typeof payload.submissionState !== "string") return null;
+	const submissionState = payload.submissionState;
+	if (!TRANSACTION_BROADCAST_SUBMISSION_STATES.has(submissionState)) return null;
+	const transactionId = typeof payload.transactionId === "string" ? payload.transactionId : void 0;
+	return new TransactionBroadcastError({
+		attempts: payload.attempts,
+		broadcastId: payload.broadcastId,
+		cause: error,
+		code,
+		message: error.message,
+		retryable: payload.retryable,
+		submissionState,
+		transactionId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/broadcastWaasTransaction/broadcastWaasTransaction.ts
+const IDEMPOTENCY_KEY_LENGTH = 50;
+/**
+* Broadcasts an already-signed v3 WaaS transaction through the Dynamic API.
+*
+* @notInstrumented
+*/
+const broadcastWaasTransaction = async ({ encoding, networkId, signedTransaction, skipPreflight, walletAccount }, client) => {
+	const apiClient = createApiClient({ errorMappers: [transactionBroadcastErrorMapper] }, client);
+	let apiEncoding = WaasTransactionEncoding.Hex;
+	if (encoding === "base64") apiEncoding = WaasTransactionEncoding.Base64;
+	const request = {
+		encoding: apiEncoding,
+		networkId,
+		signedTransaction
+	};
+	if (skipPreflight !== void 0) request.options = { skipPreflight };
+	const walletId = walletAccount.verifiedCredentialId;
+	assertDefined(walletId, "Wallet account verified credential id is required for broadcasting");
+	const response = await apiClient.broadcastWaasTransaction({
+		environmentId: getCore(client).environmentId,
+		waasTransactionBroadcastRequest: request,
+		walletId,
+		xIdempotencyKey: randomString({ length: IDEMPOTENCY_KEY_LENGTH })
+	});
+	let status = "submitted";
+	if (response.status === WaasTransactionBroadcastStatus.AlreadyKnown) status = "already_known";
+	return {
+		attempts: response.attempts,
+		broadcastId: response.broadcastId,
+		status,
+		transactionId: response.transactionId
+	};
+};
+
+//#endregion
+//#region src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts
+/** @notInstrumented */
+const getWaasChainNameFromChain = (chain) => {
+	return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;
+};
+
 //#endregion
 //#region src/modules/waas/createWaasProvider/isWaasLoadExhaustionError.ts
 /**
@@ -137,6 +473,7 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 			waasClient
 		});
 	};
+	const broadcastTransaction = (args) => broadcastWaasTransaction(args, sdkClient);
 	const createWalletAccount = async (args = {}) => {
 		logger.debug("[createWaasProvider] createWalletAccount", {
 			bitcoinConfig: args.bitcoinConfig,
@@ -267,11 +604,16 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 	const reshareToNewSignerShareSet = async ({ businessAccountId, password, signerType, targetSignerIdentity, walletAccount }) => {
 		const { signature: signedSessionId } = await getSignedSessionId(sdkClient);
 		const waasClient = await getWaasClient();
+		const { elevatedAccessToken } = await getActionAuthorizationTokens({
+			mfaAction: MFAAction.WalletWaasReshare,
+			scope: TokenScope.BusinessAccountsigneradd
+		}, sdkClient);
 		return discardClientOnLoadFailure({
 			operation: () => waasClient.reshareToNewSignerShareSet({
 				accountAddress: walletAccount.address,
 				authToken: sdkClient.token ?? void 0,
 				businessAccountId,
+				elevatedAccessToken,
 				password,
 				signedSessionId,
 				signerType,
@@ -417,6 +759,7 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 	});
 	return {
 		backupKeySharesToGoogleDrive: translateLoadFailure(backupKeySharesToGoogleDrive),
+		broadcastTransaction,
 		createWalletAccount: translateLoadFailure(createWalletAccount),
 		delegateKeyShares: translateLoadFailure(delegateKeyShares),
 		destroy: translateLoadFailure(destroy),