@dynamic-labs-sdk/client 1.24.1 → 1.26.0

package/dist/isMfaRequiredForAction-DP0kk0tY.native.esm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"isMfaRequiredForAction-DP0kk0tY.native.esm.js","names":[],"sources":["../src/modules/mfa/consumeMfaToken/consumeMfaToken.ts","../src/modules/mfa/getMfaMethods/getMfaMethods.ts","../src/modules/mfa/isMfaRequiredForAction/isMfaRequiredForAction.ts"],"sourcesContent":["import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Consumes and clears the current MFA token from the client state.\n *\n * This function retrieves the MFA token obtained from a successful MFA authentication,\n * and removes it from the client, to prevent it from being used again.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The MFA token that was consumed.\n * @throws Error if no MFA token is found.\n * @instrumented\n */\nexport const consumeMfaToken = (client = getDefaultClient()) => {\n  const core = getCore(client);\n\n  const mfaToken = core.state.get().mfaToken;\n\n  assertDefined(mfaToken, 'No MFA token found');\n\n  core.state.set({\n    mfaToken: null,\n  });\n\n  return mfaToken;\n};\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { createApiClient } from '../../apiClient';\n\n/**\n * Retrieves the available MFA methods for the current user.\n *\n * This function fetches information about which multi-factor authentication\n * methods are available and configured for the user's account.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the user's MFA methods configuration.\n  * @notInstrumented\n */\nexport const getMfaMethods = async (client = getDefaultClient()) => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const userMfaMethods = await apiClient.getUserMfaMethods({\n    environmentId: core.environmentId,\n    verifiedOnly: true,\n  });\n\n  return userMfaMethods;\n};\n","import type { MFAAction } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { getMfaMethods } from '../getMfaMethods';\n\ntype IsMfaRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/**\n * Checks if MFA is required for a specific action.\n *\n * This function determines whether multi-factor authentication is required\n * for the specified action based on project settings and user configuration.\n *\n * @param params.mfaAction - The action to check MFA requirements for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to true if MFA is required for the action, false otherwise.\n  * @notInstrumented\n */\nexport const isMfaRequiredForAction = async (\n  { mfaAction }: IsMfaRequiredForActionParams,\n  client = getDefaultClient()\n) => {\n  const projectSettings = client.projectSettings;\n\n  const isRequiredForAction = projectSettings?.security?.mfa?.actions?.some(\n    (action) => action.action === mfaAction && action.required\n  );\n\n  // if mfa is not required for the action, return false\n  // no matter if general mfa is set to required or not\n  if (!isRequiredForAction) {\n    return false;\n  }\n\n  const isMfaMethodRequired = projectSettings?.security?.mfa?.required;\n\n  // if mfa is required for the action and also set as required in general, return true\n  if (isMfaMethodRequired) {\n    return true;\n  }\n\n  const mfaMethods = await getMfaMethods(client);\n  // if general mfa is optional, but user has registered methods,\n  // then it should be required for the action\n  return mfaMethods.userHasVerifiedMfaMethods;\n};\n"],"mappings":";;;;;;;;;;;;;;AAkBA,MAAE,mBAAsB,SAAU,kBAAU,KAAA;;;AAK1C,eAAY,UAAI,qBAAA;kBAGhB,UAAO,MACR,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACbD,MAAa,gBAAgB,OAAO,SAAS,kBAAkB,KAAK;CAClE,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALuB,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,kBAAkB;EACvD,eAAe,KAAK;EACpB,cAAc;EACf,CAAC;;;;;;;;;;;;;;;;ACDJ,MAAa,yBAAyB,OACpC,EAAE,aACF,SAAS,kBAAkB,KACxB;CACH,MAAM,kBAAkB,OAAO;AAQ/B,KAAI,CANwB,iBAAiB,UAAU,KAAK,SAAS,MAClE,WAAW,OAAO,WAAW,aAAa,OAAO,SACnD,CAKC,QAAO;AAMT,KAH4B,iBAAiB,UAAU,KAAK,SAI1D,QAAO;AAMT,SAHmB,MAAM,cAAc,OAAO,EAG5B"}

package/dist/migrateFromFireblocks-BkcGdF_B.esm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"migrateFromFireblocks-BkcGdF_B.esm.js","names":["createWaasClient: CreateWaasClient","logoutWithReason","refreshAuth"],"sources":["../src/errors/NotWaasWalletProviderError.ts","../src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts","../src/modules/waas/createWaasClient/createWaasClient.ts","../src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts","../src/modules/waas/migrateFromFireblocks/migrateFromFireblocks.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NotWaasWalletProviderErrorParams = {\n  walletProviderKey: string;\n};\n\nexport class NotWaasWalletProviderError extends BaseError {\n  constructor({ walletProviderKey }: NotWaasWalletProviderErrorParams) {\n    super({\n      cause: null,\n      code: 'not_waas_wallet_provider_error',\n      docsUrl: null,\n      name: 'NotWaasWalletProviderError',\n      shortMessage: `Wallet provider ${walletProviderKey} is not a Dynamic WaaS wallet provider`,\n    });\n  }\n}\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { NotWaasWalletAccountError } from '../../../errors/NotWaasWalletAccountError';\nimport { getWalletProviderFromWalletAccount } from '../../wallets/utils/getWalletProviderFromWalletAccount';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\nimport type { WaasWalletProvider } from '../waas.types';\n\ntype GetWalletProviderFromWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getWaasWalletProviderFromWalletAccount = (\n  { walletAccount }: GetWalletProviderFromWalletAccountParams,\n  client: DynamicClient\n): WaasWalletProvider => {\n  const walletProvider = getWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  if (!isWaasWalletProvider(walletProvider)) {\n    throw new NotWaasWalletAccountError({\n      walletAddress: walletAccount.address,\n    });\n  }\n\n  return walletProvider;\n};\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport { CLIENT_SDK_NAME } from '../../apiClient/constants';\nimport { logoutWithReason } from '../../auth/logoutWithReason';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport type { CreateWaasClient } from './createWaasClient.types';\nimport {\n  DEFAULT_WAAS_BASE_API_URL,\n  DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n} from '../constants';\n\n/** @notInstrumented */\nexport const createWaasClient: CreateWaasClient = ({ chainName }, client) => {\n  const core = getCore(client);\n\n  const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;\n\n  const baseClientKeysharesRelayApiUrl =\n    client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;\n\n  return new DynamicWalletClient(\n    {\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      authToken: client.token || '',\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n      baseMPCRelayApiUrl:\n        client.projectSettings?.sdk.waas?.relayUrl ||\n        DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n      chainName,\n      // Opt into the SDK self-driving eager key-share recovery on auth-token\n      // arrival, so the client no longer restores shares itself on login.\n      eagerlyRecoverKeyShares: true,\n      environmentId: core.environmentId,\n      sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,\n      ...(additionalTrustedOrigins == undefined\n        ? {}\n        : { additionalTrustedOrigins }),\n      ...(baseClientKeysharesRelayApiUrl == undefined\n        ? {}\n        : { baseClientKeysharesRelayApiUrl }),\n      ...(core.waas?.loadTimeoutMs == undefined\n        ? {}\n        : { iframeLoadTimeout: core.waas.loadTimeoutMs }),\n      ...(core.waas?.maxLoadRetries == undefined\n        ? {}\n        : { maxRetryAttempts: core.waas.maxLoadRetries }),\n    },\n    {\n      // Lets the iframe mint a fresh signed session id over the reverse channel,\n      // which the SDK's eager key-share recovery needs.\n      getSignedSessionId: () =>\n        getSignedSessionId(client).then(({ signature }) => signature),\n      // When the WaaS iframe's own backend call returns 401 (e.g. a forcibly\n      // revoked token), the iframe notifies the host via the reverse channel\n      // and this fires — log the user out. Mirrors the session-expiry\n      // middleware that covers the SDK's own direct API 401s.\n      onUnauthorized: () => {\n        void logoutWithReason(\n          { reason: 'session-refresh-unauthorized' },\n          client\n        ).catch((error) => {\n          core.logger.error(\n            'Failed to log out after WaaS unauthorized response',\n            error\n          );\n        });\n      },\n    }\n  );\n};\n","import type { Chain } from '../../chain';\nimport { CHAINS_INFO_MAP } from '../../wallets/constants';\n\n/** @notInstrumented */\n// eslint-disable-next-line custom-rules/require-single-object-param\nexport const getWaasChainNameFromChain = (chain: Chain): string => {\n  return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;\n};\n","import type { MigrateFromFireblocksResponse } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { NotWaasWalletProviderError } from '../../../errors/NotWaasWalletProviderError';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport { getWalletProviders } from '../../wallets/getWalletProviders';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\n\ntype MigrateFromFireblocksParams = {\n  /**\n   * Optional SLIP-0044 coin types per chain name for BIP44 derivation off the\n   * Fireblocks takeover xprv (e.g. `{ EVM: 1 }` for Sepolia).\n   */\n  coinTypes?: Record<string, number>;\n  /**\n   * The Fireblocks NCW device id whose key material is being migrated.\n   */\n  deviceId: string;\n  /**\n   * Required per-chain expected wallet address (the address Fireblocks held). Its\n   * keys are the chains migration runs on, and the migration iframe verifies each\n   * imported Dynamic address matches the value, so a wrong derivation fails loudly\n   * instead of producing an unusable wallet.\n   */\n  expectedAddresses: Record<string, string>;\n  /**\n   * The Fireblocks-issued JWT authorizing the takeover.\n   */\n  jwt: string;\n  /**\n   * The password that encrypted the legacy Fireblocks NCW device storage.\n   */\n  password: string;\n  /**\n   * The serialized Fireblocks NCW device storage (the local key share backup).\n   */\n  storage: Record<string, string>;\n};\n\n/**\n * Migrates an existing Fireblocks NCW wallet into Dynamic's WaaS infrastructure.\n *\n * Migration is a single cross-chain operation: one call takes over the Fireblocks\n * key material and provisions Dynamic WaaS wallet accounts for every supported\n * chain. Because it is not per-chain, this resolves a single WaaS wallet provider\n * (any registered chain) and delegates the takeover to it.\n *\n * @param params.deviceId - The Fireblocks NCW device id being migrated.\n * @param params.jwt - The Fireblocks-issued JWT authorizing the takeover.\n * @param params.storage - The serialized Fireblocks NCW device storage.\n * @param params.password - The password that encrypted the legacy device storage.\n * @param params.expectedAddresses - Required per-chain expected address; its keys are the chains migration runs on, and each imported address is verified against it.\n * @param [params.coinTypes] - Optional SLIP-0044 coin types per chain name.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the per-chain migration results.\n * @notInstrumented\n */\nexport const migrateFromFireblocks = async (\n  {\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  }: MigrateFromFireblocksParams,\n  client = getDefaultClient()\n): Promise<MigrateFromFireblocksResponse> => {\n  const providers = getWalletProviders(client);\n\n  if (providers.length === 0) {\n    throw new NoWalletProviderFoundError({\n      walletProviderKey: DYNAMIC_WAAS_METADATA.displayName,\n    });\n  }\n\n  // Migration is cross-chain, so any registered WaaS provider can drive the\n  // takeover. Resolve the first one rather than iterating per chain.\n  const waasProvider = providers.find(isWaasWalletProvider);\n\n  if (!waasProvider) {\n    throw new NotWaasWalletProviderError({\n      walletProviderKey: providers[0].key,\n    });\n  }\n\n  const result = await waasProvider.migrateFromFireblocks({\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  });\n\n  await refreshAuth(client);\n\n  return result;\n};\n"],"mappings":";;;;;;AAMA,IAAa,6BAAb,cAAgD,UAAU;CACxD,YAAY,EAAE,qBAAuD;AACnE,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,mBAAmB,kBAAkB;GACpD,CAAC;;;;;;;ACFN,MAAa,0CACX,EAAE,iBACF,WACuB;CACvB,MAAM,iBAAiB,mCACrB,EAAE,eAAe,EACjB,OACD;AAED,KAAI,CAAC,qBAAqB,eAAe,CACvC,OAAM,IAAI,0BAA0B,EAClC,eAAe,cAAc,SAC9B,CAAC;AAGJ,QAAO;;;;;;ACZT,MAAaA,oBAAsC,EAAE,aAAa,WAAW;CAC3E,MAAM,OAAO,QAAQ,OAAO;CAE5B,MAAM,2BAA2B,KAAK,MAAM;CAE5C,MAAM,iCACJ,OAAO,iBAAiB,IAAI,MAAM;AAEpC,QAAO,IAAI,oBACT;EACE,UAAW,gBAAgB,OAAO,GAAG,WAAW;EAChD,WAAW,OAAO,SAAS;EAC3B,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;EACD,oBACE,OAAO,iBAAiB,IAAI,MAAM,YAClC;EACF;EAGA,yBAAyB;EACzB,eAAe,KAAK;EACpB,YAAY,GAAG,gBAAgB,GAAG,KAAK;EACvC,GAAI,4BAA4B,SAC5B,EAAE,GACF,EAAE,0BAA0B;EAChC,GAAI,kCAAkC,SAClC,EAAE,GACF,EAAE,gCAAgC;EACtC,GAAI,KAAK,MAAM,iBAAiB,SAC5B,EAAE,GACF,EAAE,mBAAmB,KAAK,KAAK,eAAe;EAClD,GAAI,KAAK,MAAM,kBAAkB,SAC7B,EAAE,GACF,EAAE,kBAAkB,KAAK,KAAK,gBAAgB;EACnD,EACD;EAGE,0BACE,mBAAmB,OAAO,CAAC,MAAM,EAAE,gBAAgB,UAAU;EAK/D,sBAAsB;AACpB,GAAKC,2BACH,EAAE,QAAQ,gCAAgC,EAC1C,OACD,CAAC,OAAO,UAAU;AACjB,SAAK,OAAO,MACV,sDACA,MACD;KACD;;EAEL,CACF;;;;;;ACrEH,MAAa,6BAA6B,UAAyB;AACjE,QAAO,gBAAgB,OAAO,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;ACqDzD,MAAa,wBAAwB,OACnC,EACE,WACA,UACA,mBACA,KACA,UACA,WAEF,SAAS,kBAAkB,KACgB;CAC3C,MAAM,YAAY,mBAAmB,OAAO;AAE5C,KAAI,UAAU,WAAW,EACvB,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,sBAAsB,aAC1C,CAAC;CAKJ,MAAM,eAAe,UAAU,KAAK,qBAAqB;AAEzD,KAAI,CAAC,aACH,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,UAAU,GAAG,KACjC,CAAC;CAGJ,MAAM,SAAS,MAAM,aAAa,sBAAsB;EACtD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,OAAMC,sBAAY,OAAO;AAEzB,QAAO"}

package/dist/migrateFromFireblocks-C1yQ4dm7.native.esm.js

@@ -1,321 +0,0 @@
-import { N as CHAINS_INFO_MAP, O as NoWalletProviderFoundError, St as getCore, d as DEFAULT_WAAS_BASE_MPC_RELAY_API_URL, dt as isCookieEnabled, f as DYNAMIC_WAAS_METADATA, l as isWaasWalletProvider, ot as CLIENT_SDK_NAME, p as getWalletProviders, t as NativeModuleNotLinkedError, u as DEFAULT_WAAS_BASE_API_URL, vt as getDefaultClient, w as getWalletProviderFromWalletAccount, xt as BaseError } from "./NativeModuleNotLinkedError-dFDBC524.native.esm.js";
-import { n as NotWaasWalletAccountError, r as __refreshAuth_wrapped } from "./isDynamicWaasEnabled-BmB0lQJf.native.esm.js";
-import { ACCESSIBLE, getGenericPassword, resetGenericPassword, setGenericPassword } from "react-native-keychain";
-import { NativeEventEmitter, TurboModuleRegistry } from "react-native";
-import { DynamicWalletClient } from "@dynamic-labs-wallet/browser-wallet-client";
-
-//#region src/errors/NotWaasWalletProviderError.ts
-var NotWaasWalletProviderError = class extends BaseError {
-	constructor({ walletProviderKey }) {
-		super({
-			cause: null,
-			code: "not_waas_wallet_provider_error",
-			docsUrl: null,
-			name: "NotWaasWalletProviderError",
-			shortMessage: `Wallet provider ${walletProviderKey} is not a Dynamic WaaS wallet provider`
-		});
-	}
-};
-
-//#endregion
-//#region src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts
-/** @notInstrumented */
-const getWaasWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
-	const walletProvider = getWalletProviderFromWalletAccount({ walletAccount }, client);
-	if (!isWaasWalletProvider(walletProvider)) throw new NotWaasWalletAccountError({ walletAddress: walletAccount.address });
-	return walletProvider;
-};
-
-//#endregion
-//#region src/errors/CorruptedKeyShareError.ts
-/**
-* Thrown when a persisted client key share cannot be parsed back into its
-* structured form (e.g. a partially-written or corrupted keychain entry).
-*
-* Surfaced as a typed error rather than swallowed so callers can distinguish
-* "no key share stored" (empty result) from "key share exists but is
-* unreadable" — the latter must never be silently treated as the former,
-* which could trigger an unintended re-keygen that overwrites recoverable
-* material.
-*/
-var CorruptedKeyShareError = class extends BaseError {
-	constructor({ cause = null } = {}) {
-		super({
-			cause,
-			code: "corrupted_key_share_error",
-			details: "The stored client key share could not be parsed. The secure storage entry may be partially written or corrupted.",
-			docsUrl: null,
-			name: "CorruptedKeyShareError",
-			shortMessage: "Stored client key share is corrupted and cannot be read."
-		});
-	}
-};
-
-//#endregion
-//#region src/turboModules/NativeDynamicWebView.ts
-var NativeDynamicWebView_default = TurboModuleRegistry.get("DynamicClientWebView");
-
-//#endregion
-//#region src/errors/WebViewLoadFailedError.ts
-/**
-* Thrown when `DynamicWebView.open()` (via the WaaS transport provider)
-* fails to establish a usable load. Inspect `reason` to distinguish the
-* failure mode; `statusCode` and `underlyingError` provide structured
-* metadata for the cases that have it.
-*/
-var WebViewLoadFailedError = class extends BaseError {
-	reason;
-	statusCode;
-	underlyingError;
-	constructor({ reason, shortMessage, cause = null, statusCode, underlyingError }) {
-		super({
-			cause,
-			code: "webview_load_failed_error",
-			details: underlyingError,
-			docsUrl: null,
-			name: "WebViewLoadFailedError",
-			shortMessage
-		});
-		this.reason = reason;
-		this.statusCode = statusCode;
-		this.underlyingError = underlyingError;
-	}
-};
-
-//#endregion
-//#region src/modules/waas/createWaasClient/translateNativeOpenError.ts
-const REASON_BY_NATIVE_CODE = {
-	webview_cancelled: "cancelled",
-	webview_content_process_terminated: "content_process_terminated",
-	webview_http_error: "http_error",
-	webview_instance_busy: "instance_busy",
-	webview_invalid_url: "invalid_url",
-	webview_navigation_failed: "navigation_failed",
-	webview_no_host_view: "no_host_view",
-	webview_unsupported: "unsupported"
-};
-/**
-* Translates a native `DynamicWebView.open()` rejection into a typed
-* `WebViewLoadFailedError`. Maps the native RCT reject code to the JS-level
-* `WebViewLoadFailureReason` discriminator (falling back to
-* `navigation_failed` for unrecognized codes) and carries through the
-* structured `statusCode` / `underlyingError` metadata.
-*
-* The `reason` it produces is the contract `createWaasSDKContainer` branches
-* on — notably `emitError` swallows `cancelled` because that code is only ever
-* produced by our own `close()` teardown (verified on both the iOS and Android
-* native sides). Keep `REASON_BY_NATIVE_CODE` in sync with the native reject
-* codes so that branching stays correct.
-*
-* @notInstrumented
-*/
-const translateNativeOpenError = (err) => {
-	const rejection = err ?? {};
-	const isNativeRejectionCode = (code) => code != void 0 && code in REASON_BY_NATIVE_CODE;
-	const reason = isNativeRejectionCode(rejection.code) ? REASON_BY_NATIVE_CODE[rejection.code] : "navigation_failed";
-	return new WebViewLoadFailedError({
-		cause: err instanceof Error ? err : null,
-		reason,
-		shortMessage: rejection.message ?? `DynamicWebView open failed (${reason}).`,
-		statusCode: rejection.userInfo?.DynamicWebViewStatusCode,
-		underlyingError: rejection.userInfo?.DynamicWebViewUnderlying
-	});
-};
-
-//#endregion
-//#region src/modules/waas/createWaasClient/createNativeWaasSDKContainer.native.ts
-const NATIVE_MODULE_NAME = "DynamicClientWebView";
-const MESSAGE_EVENT_NAME = "dynamicBridgeMessage";
-const generateInstanceId = () => `${Date.now().toString(36)}-${crypto.randomUUID()}`;
-/**
-* Creates a React Native `WaasSDKContainer` backed by a hidden, headless native
-* WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the
-* `DynamicClientWebView` TurboModule. Each invocation returns an isolated
-* container with its own instance ID, native WebView, and message routing.
-*
-* Used for MPC operations (signing, key-share management) where there is
-* nothing for the user to see. The VISIBLE private-key export display is no
-* longer a native overlay — it is rendered by the `ExportPrivateKey` component
-* (`@dynamic-labs-sdk/react-native-embedded-wallet-export`) on top of
-* `react-native-webview`, so it scrolls and positions like any RN view.
-*
-* @notInstrumented
-*/
-const createNativeWaasSDKContainer = () => {
-	if (!NativeDynamicWebView_default) throw new NativeModuleNotLinkedError({ moduleName: NATIVE_MODULE_NAME });
-	const nativeModule = NativeDynamicWebView_default;
-	const instanceId = generateInstanceId();
-	const emitter = new NativeEventEmitter(nativeModule);
-	const messageHandlers = [];
-	const errorHandlers = [];
-	let subscription = null;
-	let destroyed = false;
-	const emitError = (err) => {
-		if (destroyed) return;
-		const translated = translateNativeOpenError(err);
-		if (translated.reason === "cancelled") return;
-		for (const handler of errorHandlers) handler(translated);
-	};
-	return {
-		destroy() {
-			if (destroyed) return;
-			destroyed = true;
-			subscription?.remove();
-			subscription = null;
-			messageHandlers.length = 0;
-			errorHandlers.length = 0;
-			nativeModule.close(instanceId);
-		},
-		isAlive: () => !destroyed,
-		onError(handler) {
-			errorHandlers.push(handler);
-			return () => {
-				const index = errorHandlers.indexOf(handler);
-				if (index !== -1) errorHandlers.splice(index, 1);
-			};
-		},
-		onMessage(handler) {
-			messageHandlers.push(handler);
-			subscription ??= emitter.addListener(MESSAGE_EVENT_NAME, (payload) => {
-				if (payload.instanceId !== instanceId) return;
-				for (const fn of messageHandlers) fn(payload.data);
-			});
-			return () => {
-				const index = messageHandlers.indexOf(handler);
-				if (index !== -1) messageHandlers.splice(index, 1);
-				if (messageHandlers.length === 0) {
-					subscription?.remove();
-					subscription = null;
-				}
-			};
-		},
-		sendMessage(data) {
-			nativeModule.sendMessage(instanceId, data);
-		},
-		async setUrl(url) {
-			nativeModule.open(instanceId, url).catch(emitError);
-		}
-	};
-};
-
-//#endregion
-//#region src/modules/waas/createWaasClient/createWaasSDKContainer.native.ts
-/**
-* Creates a React Native `WaasSDKContainer` backed by a hidden, headless native
-* WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the
-* `DynamicClientWebView` TurboModule. Used for MPC operations (signing, key-share
-* management) where there is nothing for the user to see.
-*
-* For the private-key export display — where the hosted page must render the
-* key for the user — use the `ExportPrivateKey` component from
-* `@dynamic-labs-sdk/react-native-embedded-wallet-export`, which renders the
-* key inside a `react-native-webview` instead of a native overlay.
-*
-* @notInstrumented
-*/
-const createWaasSDKContainer = () => createNativeWaasSDKContainer();
-
-//#endregion
-//#region src/modules/waas/createWaasClient/createWaasClient.native.ts
-/**
-* Keychain security options for the client key share. The share is wallet
-* key material that cannot be re-derived locally, so the options are pinned
-* explicitly rather than inherited from `react-native-keychain` defaults
-* (which vary across versions and platforms).
-*
-* `WHEN_UNLOCKED_THIS_DEVICE_ONLY` keeps the share readable only while the
-* device is unlocked, excludes it from iCloud Keychain sync, and prevents it
-* migrating to a new device on encrypted-backup restore. It deliberately does
-* NOT set `accessControl` (e.g. biometry) — reads must not surface a Face ID /
-* passcode prompt, since the share is read on routine wallet operations.
-*/
-const KEY_SHARE_KEYCHAIN_OPTIONS = { accessible: ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY };
-/** @notInstrumented */
-const createWaasClient = ({ chainName }, client) => {
-	const core = getCore(client);
-	const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;
-	const getKeyShareService = (accountAddress) => `${core.environmentId}:${accountAddress}`;
-	return new DynamicWalletClient({
-		authMode: isCookieEnabled(client) ? "cookie" : "header",
-		authToken: client.token || "",
-		baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", ""),
-		baseMPCRelayApiUrl: client.projectSettings?.sdk.waas?.relayUrl || DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,
-		chainName,
-		environmentId: core.environmentId,
-		hostOrigin: core.metadata?.universalLink,
-		sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,
-		...additionalTrustedOrigins == void 0 ? {} : { additionalTrustedOrigins },
-		...core.waas?.loadTimeoutMs == void 0 ? {} : { iframeLoadTimeout: core.waas.loadTimeoutMs },
-		...core.waas?.maxLoadRetries == void 0 ? {} : { maxRetryAttempts: core.waas.maxLoadRetries }
-	}, {
-		createWaasSDKContainer,
-		secureStorage: {
-			getClientKeyShare: async (accountAddress) => {
-				const result = await getGenericPassword({ service: getKeyShareService(accountAddress) });
-				if (!result) return [];
-				try {
-					return JSON.parse(result.password);
-				} catch (cause) {
-					throw new CorruptedKeyShareError({ cause: cause instanceof Error ? cause : null });
-				}
-			},
-			removeClientKeyShare: async (accountAddress) => {
-				await resetGenericPassword({ service: getKeyShareService(accountAddress) });
-			},
-			setClientKeyShare: async (accountAddress, shares) => {
-				await setGenericPassword(accountAddress, JSON.stringify(shares), {
-					...KEY_SHARE_KEYCHAIN_OPTIONS,
-					service: getKeyShareService(accountAddress)
-				});
-			}
-		}
-	});
-};
-
-//#endregion
-//#region src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts
-/** @notInstrumented */
-const getWaasChainNameFromChain = (chain) => {
-	return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;
-};
-
-//#endregion
-//#region src/modules/waas/migrateFromFireblocks/migrateFromFireblocks.ts
-/**
-* Migrates an existing Fireblocks NCW wallet into Dynamic's WaaS infrastructure.
-*
-* Migration is a single cross-chain operation: one call takes over the Fireblocks
-* key material and provisions Dynamic WaaS wallet accounts for every supported
-* chain. Because it is not per-chain, this resolves a single WaaS wallet provider
-* (any registered chain) and delegates the takeover to it.
-*
-* @param params.deviceId - The Fireblocks NCW device id being migrated.
-* @param params.jwt - The Fireblocks-issued JWT authorizing the takeover.
-* @param params.storage - The serialized Fireblocks NCW device storage.
-* @param params.password - The password that encrypted the legacy device storage.
-* @param params.expectedAddresses - Required per-chain expected address; its keys are the chains migration runs on, and each imported address is verified against it.
-* @param [params.coinTypes] - Optional SLIP-0044 coin types per chain name.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise resolving to the per-chain migration results.
-* @notInstrumented
-*/
-const migrateFromFireblocks = async ({ coinTypes, deviceId, expectedAddresses, jwt, password, storage }, client = getDefaultClient()) => {
-	const providers = getWalletProviders(client);
-	if (providers.length === 0) throw new NoWalletProviderFoundError({ walletProviderKey: DYNAMIC_WAAS_METADATA.displayName });
-	const waasProvider = providers.find(isWaasWalletProvider);
-	if (!waasProvider) throw new NotWaasWalletProviderError({ walletProviderKey: providers[0].key });
-	const result = await waasProvider.migrateFromFireblocks({
-		coinTypes,
-		deviceId,
-		expectedAddresses,
-		jwt,
-		password,
-		storage
-	});
-	await __refreshAuth_wrapped(client);
-	return result;
-};
-
-//#endregion
-export { NotWaasWalletProviderError as a, getWaasWalletProviderFromWalletAccount as i, getWaasChainNameFromChain as n, createWaasClient as r, migrateFromFireblocks as t };
-//# sourceMappingURL=migrateFromFireblocks-C1yQ4dm7.native.esm.js.map

package/dist/migrateFromFireblocks-C1yQ4dm7.native.esm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"migrateFromFireblocks-C1yQ4dm7.native.esm.js","names":["REASON_BY_NATIVE_CODE: Record<string, WebViewLoadFailureReason>","reason: WebViewLoadFailureReason","NativeDynamicWebView","messageHandlers: Array<(data: unknown) => void>","errorHandlers: Array<(error: unknown) => void>","subscription: { remove: () => void } | null","createWaasClient: CreateWaasClient","refreshAuth"],"sources":["../src/errors/NotWaasWalletProviderError.ts","../src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts","../src/errors/CorruptedKeyShareError.ts","../src/turboModules/NativeDynamicWebView.ts","../src/errors/WebViewLoadFailedError.ts","../src/modules/waas/createWaasClient/translateNativeOpenError.ts","../src/modules/waas/createWaasClient/createNativeWaasSDKContainer.native.ts","../src/modules/waas/createWaasClient/createWaasSDKContainer.native.ts","../src/modules/waas/createWaasClient/createWaasClient.native.ts","../src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts","../src/modules/waas/migrateFromFireblocks/migrateFromFireblocks.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NotWaasWalletProviderErrorParams = {\n  walletProviderKey: string;\n};\n\nexport class NotWaasWalletProviderError extends BaseError {\n  constructor({ walletProviderKey }: NotWaasWalletProviderErrorParams) {\n    super({\n      cause: null,\n      code: 'not_waas_wallet_provider_error',\n      docsUrl: null,\n      name: 'NotWaasWalletProviderError',\n      shortMessage: `Wallet provider ${walletProviderKey} is not a Dynamic WaaS wallet provider`,\n    });\n  }\n}\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { NotWaasWalletAccountError } from '../../../errors/NotWaasWalletAccountError';\nimport { getWalletProviderFromWalletAccount } from '../../wallets/utils/getWalletProviderFromWalletAccount';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\nimport type { WaasWalletProvider } from '../waas.types';\n\ntype GetWalletProviderFromWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getWaasWalletProviderFromWalletAccount = (\n  { walletAccount }: GetWalletProviderFromWalletAccountParams,\n  client: DynamicClient\n): WaasWalletProvider => {\n  const walletProvider = getWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  if (!isWaasWalletProvider(walletProvider)) {\n    throw new NotWaasWalletAccountError({\n      walletAddress: walletAccount.address,\n    });\n  }\n\n  return walletProvider;\n};\n","import { BaseError } from './base';\n\ntype CorruptedKeyShareErrorParams = {\n  cause?: Error | null;\n};\n\n/**\n * Thrown when a persisted client key share cannot be parsed back into its\n * structured form (e.g. a partially-written or corrupted keychain entry).\n *\n * Surfaced as a typed error rather than swallowed so callers can distinguish\n * \"no key share stored\" (empty result) from \"key share exists but is\n * unreadable\" — the latter must never be silently treated as the former,\n * which could trigger an unintended re-keygen that overwrites recoverable\n * material.\n */\nexport class CorruptedKeyShareError extends BaseError {\n  constructor({ cause = null }: CorruptedKeyShareErrorParams = {}) {\n    super({\n      cause,\n      code: 'corrupted_key_share_error',\n      details:\n        'The stored client key share could not be parsed. The secure storage entry may be partially written or corrupted.',\n      docsUrl: null,\n      name: 'CorruptedKeyShareError',\n      shortMessage: 'Stored client key share is corrupted and cannot be read.',\n    });\n  }\n}\n","// This file is a TurboModule spec consumed by React Native codegen.\n// The `interface`, `default export`, and the `react-native` import are hard\n// requirements of the codegen parser and intentionally deviate from the\n// project's conventions. Codegen discovers specs by the `Native*` filename\n// prefix, so this file cannot be renamed to `.native.ts`.\n\nimport { type TurboModule, TurboModuleRegistry } from 'react-native';\nimport type { UnsafeObject } from 'react-native/Libraries/Types/CodegenTypes';\n\nexport interface Spec extends TurboModule {\n  addListener(eventName: string): void;\n  close(instanceId: string): void;\n  /**\n   * Creates a WKWebView for the given instanceId and begins loading `url`.\n   *\n   * Resolves on `didCommit` — i.e. the first byte of a 2xx/3xx HTTP\n   * response has been received and content parsing has started. Page-ready\n   * (e.g. the hosted iframe's `iframe-ready-*` handshake) is a separate\n   * concern and must be observed by the caller via the message bus; this\n   * Promise does not wait for it.\n   *\n   * Rejects with a `code` of `webview_<reason>` where `<reason>` is one of:\n   *   - `invalid_url` — URL string was not parseable\n   *   - `no_host_view` — no foreground window to attach the WebView\n   *   - `http_error` — response status was >= 400 (userInfo contains `DynamicWebViewStatusCode`)\n   *   - `navigation_failed` — DNS, TLS, connection failure, or post-commit abort\n   *   - `cancelled` — `close(instanceId)` was called while this open was pending\n   *   - `instance_busy` — `open` was called for an instanceId that already has an active WebView\n   *   - `content_process_terminated` — the WKWebView WebContent process died during load\n   *   - `unsupported` — the device's Android System WebView is too old to support the secure bridge (Android only)\n   *\n   * rejection codes into typed `WebViewLoadFailedError` instances.\n   */\n  open(instanceId: string, url: string): Promise<void>;\n  removeListeners(count: number): void;\n  sendMessage(instanceId: string, data: UnsafeObject): void;\n}\n\n// eslint-disable-next-line import/no-default-export\nexport default TurboModuleRegistry.get<Spec>('DynamicClientWebView');\n","import { BaseError } from './base/BaseError';\n\n/**\n * Discriminator for `WebViewLoadFailedError`. Identifies the specific\n * failure mode so callers can branch on it (e.g. retry on transient\n * navigation failures, abort on invalid URL, treat HTTP errors distinct\n * from network errors).\n */\nexport type WebViewLoadFailureReason =\n  | 'invalid_url'\n  | 'no_host_view'\n  | 'http_error'\n  | 'navigation_failed'\n  | 'cancelled'\n  | 'instance_busy'\n  | 'content_process_terminated'\n  | 'unsupported';\n\ntype WebViewLoadFailedErrorParams = {\n  cause?: Error | null;\n  reason: WebViewLoadFailureReason;\n  shortMessage: string;\n  /** HTTP response status code. Populated only when `reason === 'http_error'`. */\n  statusCode?: number;\n  /** Underlying OS-level error description (e.g. `NSURLErrorDomain`\n   *  localizedDescription). Populated for `reason === 'navigation_failed'`. */\n  underlyingError?: string;\n};\n\n/**\n * Thrown when `DynamicWebView.open()` (via the WaaS transport provider)\n * fails to establish a usable load. Inspect `reason` to distinguish the\n * failure mode; `statusCode` and `underlyingError` provide structured\n * metadata for the cases that have it.\n */\nexport class WebViewLoadFailedError extends BaseError {\n  readonly reason: WebViewLoadFailureReason;\n  readonly statusCode: number | undefined;\n  readonly underlyingError: string | undefined;\n\n  constructor({\n    reason,\n    shortMessage,\n    cause = null,\n    statusCode,\n    underlyingError,\n  }: WebViewLoadFailedErrorParams) {\n    super({\n      cause,\n      code: 'webview_load_failed_error',\n      details: underlyingError,\n      docsUrl: null,\n      name: 'WebViewLoadFailedError',\n      shortMessage,\n    });\n    this.reason = reason;\n    this.statusCode = statusCode;\n    this.underlyingError = underlyingError;\n  }\n}\n","import {\n  WebViewLoadFailedError,\n  type WebViewLoadFailureReason,\n} from '../../../errors/WebViewLoadFailedError';\n\n// Maps the native-side RCT reject codes (emitted by DynamicWebView.mm) to the\n// JS-level discriminator on `WebViewLoadFailedError`. Keys must stay in sync\n// with the `Reason.*` strings in DynamicWebViewImpl.swift.\nconst REASON_BY_NATIVE_CODE: Record<string, WebViewLoadFailureReason> = {\n  webview_cancelled: 'cancelled',\n  webview_content_process_terminated: 'content_process_terminated',\n  webview_http_error: 'http_error',\n  webview_instance_busy: 'instance_busy',\n  webview_invalid_url: 'invalid_url',\n  webview_navigation_failed: 'navigation_failed',\n  webview_no_host_view: 'no_host_view',\n  webview_unsupported: 'unsupported',\n};\n\n// React Native serializes the native NSError's userInfo onto the JS Error as\n// `userInfo`. These keys must stay in sync with the `errorStatusCodeKey` /\n// `errorUnderlyingDescriptionKey` constants in DynamicWebViewImpl.swift.\ntype NativeRejection = {\n  code?: string;\n  message?: string;\n  userInfo?: {\n    DynamicWebViewStatusCode?: number;\n    DynamicWebViewUnderlying?: string;\n  };\n};\n\n/**\n * Translates a native `DynamicWebView.open()` rejection into a typed\n * `WebViewLoadFailedError`. Maps the native RCT reject code to the JS-level\n * `WebViewLoadFailureReason` discriminator (falling back to\n * `navigation_failed` for unrecognized codes) and carries through the\n * structured `statusCode` / `underlyingError` metadata.\n *\n * The `reason` it produces is the contract `createWaasSDKContainer` branches\n * on — notably `emitError` swallows `cancelled` because that code is only ever\n * produced by our own `close()` teardown (verified on both the iOS and Android\n * native sides). Keep `REASON_BY_NATIVE_CODE` in sync with the native reject\n * codes so that branching stays correct.\n *\n * @notInstrumented\n */\nexport const translateNativeOpenError = (\n  err: unknown\n): WebViewLoadFailedError => {\n  const rejection = (err ?? {}) as NativeRejection;\n\n  // Must check the KEYS of REASON_BY_NATIVE_CODE (the `webview_*` native\n  // codes), not its values (the JS-level reasons) — this is called with the\n  // native code, so checking values made every code fall through to\n  // `navigation_failed` and silently broke the `cancelled` swallow.\n  const isNativeRejectionCode = (\n    code: string | undefined\n  ): code is keyof typeof REASON_BY_NATIVE_CODE =>\n    code != undefined && code in REASON_BY_NATIVE_CODE;\n\n  const reason: WebViewLoadFailureReason = isNativeRejectionCode(rejection.code)\n    ? REASON_BY_NATIVE_CODE[rejection.code]\n    : 'navigation_failed';\n  return new WebViewLoadFailedError({\n    cause: err instanceof Error ? err : null,\n    reason,\n    shortMessage:\n      rejection.message ?? `DynamicWebView open failed (${reason}).`,\n    statusCode: rejection.userInfo?.DynamicWebViewStatusCode,\n    underlyingError: rejection.userInfo?.DynamicWebViewUnderlying,\n  });\n};\n","import type { WaasSDKContainer } from '@dynamic-labs-wallet/core';\nimport { NativeEventEmitter } from 'react-native';\n\nimport { NativeModuleNotLinkedError } from '../../../errors/NativeModuleNotLinkedError';\nimport NativeDynamicWebView from '../../../turboModules/NativeDynamicWebView';\nimport { translateNativeOpenError } from './translateNativeOpenError';\n\nconst NATIVE_MODULE_NAME = 'DynamicClientWebView';\nconst MESSAGE_EVENT_NAME = 'dynamicBridgeMessage';\n\ntype BridgeEventPayload = {\n  data: unknown;\n  instanceId: string;\n};\n\n// The instance ID routes bridge messages to the right container, so it must be\n// globally unique. Use a crypto-random UUID (no Math.random) keyed by timestamp\n// for readability across app reloads.\nconst generateInstanceId = (): string =>\n  `${Date.now().toString(36)}-${crypto.randomUUID()}`;\n\n/**\n * Creates a React Native `WaasSDKContainer` backed by a hidden, headless native\n * WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the\n * `DynamicClientWebView` TurboModule. Each invocation returns an isolated\n * container with its own instance ID, native WebView, and message routing.\n *\n * Used for MPC operations (signing, key-share management) where there is\n * nothing for the user to see. The VISIBLE private-key export display is no\n * longer a native overlay — it is rendered by the `ExportPrivateKey` component\n * (`@dynamic-labs-sdk/react-native-embedded-wallet-export`) on top of\n * `react-native-webview`, so it scrolls and positions like any RN view.\n *\n * @notInstrumented\n */\nexport const createNativeWaasSDKContainer = (): WaasSDKContainer => {\n  if (!NativeDynamicWebView) {\n    throw new NativeModuleNotLinkedError({ moduleName: NATIVE_MODULE_NAME });\n  }\n\n  const nativeModule = NativeDynamicWebView;\n  const instanceId = generateInstanceId();\n  // Construct the emitter against the TurboModule itself — on New Arch,\n  // `NativeModules[name]` can be a different compatibility-shim object,\n  // and binding `addListener`/`removeListeners` on the wrong instance\n  // leaves `startObserving` in the native emitter never firing.\n  const emitter = new NativeEventEmitter(\n    nativeModule as unknown as ConstructorParameters<typeof NativeEventEmitter>[0]\n  );\n\n  // IframeManager on the WaaS SDK calls `container.onMessage(handler)` twice\n  // on the same container — once to wait for the `iframe-ready-*` handshake,\n  // and once later from `setupWaasSDKContainerBridge` to forward transport\n  // messages. Both handlers need to receive every message, so the container\n  // fans out to all registered handlers instead of enforcing single-register.\n  const messageHandlers: Array<(data: unknown) => void> = [];\n  const errorHandlers: Array<(error: unknown) => void> = [];\n  let subscription: { remove: () => void } | null = null;\n  let destroyed = false;\n\n  const emitError = (err: unknown): void => {\n    if (destroyed) return;\n    const translated = translateNativeOpenError(err);\n    // `cancelled` is only ever produced by our own `close()` teardown path on\n    // the native side. Surfacing it via onError would make consumers like\n    // IframeManager interpret their own destroy as a load failure and retry\n    // against a provider that no longer exists.\n    if (translated.reason === 'cancelled') return;\n    for (const handler of errorHandlers) {\n      handler(translated);\n    }\n  };\n\n  return {\n    destroy() {\n      if (destroyed) return;\n      destroyed = true;\n\n      subscription?.remove();\n      subscription = null;\n      messageHandlers.length = 0;\n      errorHandlers.length = 0;\n      nativeModule.close(instanceId);\n    },\n\n    isAlive: () => !destroyed,\n\n    // Signature is dictated by the upstream WaasSDKContainer interface.\n    // eslint-disable-next-line custom-rules/require-single-object-param\n    onError(handler: (error: unknown) => void) {\n      errorHandlers.push(handler);\n      return () => {\n        const index = errorHandlers.indexOf(handler);\n        if (index !== -1) errorHandlers.splice(index, 1);\n      };\n    },\n\n    // Signature is dictated by the upstream WaasSDKContainer interface.\n    // eslint-disable-next-line custom-rules/require-single-object-param\n    onMessage(handler: (data: unknown) => void) {\n      messageHandlers.push(handler);\n\n      subscription ??= emitter.addListener(\n        MESSAGE_EVENT_NAME,\n        (payload: BridgeEventPayload) => {\n          if (payload.instanceId !== instanceId) return;\n\n          for (const fn of messageHandlers) {\n            fn(payload.data);\n          }\n        }\n      );\n\n      // WaaS client expects onMessage to return an unsubscribe function —\n      // used e.g. to tear down the one-shot handshake handler.\n      return () => {\n        const index = messageHandlers.indexOf(handler);\n        if (index !== -1) messageHandlers.splice(index, 1);\n        if (messageHandlers.length === 0) {\n          subscription?.remove();\n          subscription = null;\n        }\n      };\n    },\n\n    sendMessage(data: Record<string, unknown>) {\n      nativeModule.sendMessage(instanceId, data);\n    },\n    /**\n     * Hands the URL off to the native WebView and resolves immediately.\n     *\n     * Per the `WaasSDKContainer` contract (see `@dynamic-labs-wallet/core`\n     * types), `setUrl` resolves once the URL has been handed off to the\n     * container — NOT when the page has finished loading. Load completion is\n     * signalled later via the `iframe-ready-*` message on `onMessage`, and\n     * navigation failures surface via `onError`. This dispatch-and-forget\n     * shape is load-bearing: the WaaS handshake sequencing expects `setUrl` to\n     * resolve before the first message arrives, so the native open is\n     * intentionally NOT awaited/returned — its rejection (HTTP errors,\n     * navigation failures, preflight errors, etc.) is routed through\n     * `emitError` instead. Do not change this to `return nativeModule.open(...)`.\n     */\n    // Signature is dictated by the upstream WaasSDKContainer interface.\n    // eslint-disable-next-line custom-rules/require-single-object-param\n    async setUrl(url: string) {\n      nativeModule.open(instanceId, url).catch(emitError);\n    },\n  };\n};\n","import type { WaasSDKContainer } from '@dynamic-labs-wallet/core';\n\nimport { createNativeWaasSDKContainer } from './createNativeWaasSDKContainer.native';\n\n/**\n * Creates a React Native `WaasSDKContainer` backed by a hidden, headless native\n * WebView (WKWebView on iOS, `android.webkit.WebView` on Android) hosted by the\n * `DynamicClientWebView` TurboModule. Used for MPC operations (signing, key-share\n * management) where there is nothing for the user to see.\n *\n * For the private-key export display — where the hosted page must render the\n * key for the user — use the `ExportPrivateKey` component from\n * `@dynamic-labs-sdk/react-native-embedded-wallet-export`, which renders the\n * key inside a `react-native-webview` instead of a native overlay.\n *\n * @notInstrumented\n */\nexport const createWaasSDKContainer = (): WaasSDKContainer =>\n  createNativeWaasSDKContainer();\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';\nimport type { SecureStorageAdapter } from '@dynamic-labs-wallet/core';\nimport {\n  ACCESSIBLE,\n  getGenericPassword,\n  resetGenericPassword,\n  setGenericPassword,\n} from 'react-native-keychain';\n\nimport { getCore } from '../../../client/core/getCore';\nimport { CorruptedKeyShareError } from '../../../errors/CorruptedKeyShareError';\nimport { CLIENT_SDK_NAME } from '../../apiClient/constants';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport {\n  DEFAULT_WAAS_BASE_API_URL,\n  DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n} from '../constants';\nimport type { CreateWaasClient } from './createWaasClient.types';\nimport { createWaasSDKContainer } from './createWaasSDKContainer.native';\n\n/**\n * Keychain security options for the client key share. The share is wallet\n * key material that cannot be re-derived locally, so the options are pinned\n * explicitly rather than inherited from `react-native-keychain` defaults\n * (which vary across versions and platforms).\n *\n * `WHEN_UNLOCKED_THIS_DEVICE_ONLY` keeps the share readable only while the\n * device is unlocked, excludes it from iCloud Keychain sync, and prevents it\n * migrating to a new device on encrypted-backup restore. It deliberately does\n * NOT set `accessControl` (e.g. biometry) — reads must not surface a Face ID /\n * passcode prompt, since the share is read on routine wallet operations.\n */\nconst KEY_SHARE_KEYCHAIN_OPTIONS = {\n  accessible: ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY,\n} as const;\n\n/** @notInstrumented */\nexport const createWaasClient: CreateWaasClient = ({ chainName }, client) => {\n  const core = getCore(client);\n\n  const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;\n\n  // Namespace the keychain service by environment so two environmentIds on the\n  // same device (or two dApps that observe the same account) can't collide and\n  // mix key shares. The account address alone is not unique across environments.\n  const getKeyShareService = (accountAddress: string): string =>\n    `${core.environmentId}:${accountAddress}`;\n\n  return new DynamicWalletClient(\n    {\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      authToken: client.token || '',\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n      baseMPCRelayApiUrl:\n        client.projectSettings?.sdk.waas?.relayUrl ||\n        DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n      chainName,\n      environmentId: core.environmentId,\n      // On React Native there is no real `window.location.origin`, so the hosted\n      // iframe is told the app's universalLink as its host origin. This must be\n      // allowlisted in the environment's CORS/allowed origins, just like a web\n      // app's domain. Without it the WaaS server rejects the iframe load (400).\n      hostOrigin: core.metadata?.universalLink,\n      sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,\n      ...(additionalTrustedOrigins == undefined\n        ? {}\n        : { additionalTrustedOrigins }),\n      ...(core.waas?.loadTimeoutMs == undefined\n        ? {}\n        : { iframeLoadTimeout: core.waas.loadTimeoutMs }),\n      ...(core.waas?.maxLoadRetries == undefined\n        ? {}\n        : { maxRetryAttempts: core.waas.maxLoadRetries }),\n    },\n    {\n      createWaasSDKContainer,\n      // Typed as the upstream SecureStorageAdapter so the key-share method\n      // signatures (and the `shares` payload type) stay compiler-enforced\n      // against the WaaS SDK contract rather than re-declared locally.\n      secureStorage: {\n        getClientKeyShare: async (accountAddress) => {\n          const result = await getGenericPassword({\n            service: getKeyShareService(accountAddress),\n          });\n\n          if (!result) {\n            return [];\n          }\n\n          // A corrupted or partially-written keychain entry makes JSON.parse\n          // throw mid key-share load. Surface a typed error instead of an\n          // unhandled rejection so callers can distinguish \"no share stored\"\n          // (empty result above) from \"share exists but is unreadable\".\n          try {\n            return JSON.parse(result.password);\n          } catch (cause) {\n            throw new CorruptedKeyShareError({\n              cause: cause instanceof Error ? cause : null,\n            });\n          }\n        },\n\n        removeClientKeyShare: async (accountAddress) => {\n          await resetGenericPassword({\n            service: getKeyShareService(accountAddress),\n          });\n        },\n\n        setClientKeyShare: async (accountAddress, shares) => {\n          await setGenericPassword(accountAddress, JSON.stringify(shares), {\n            ...KEY_SHARE_KEYCHAIN_OPTIONS,\n            service: getKeyShareService(accountAddress),\n          });\n        },\n      } satisfies SecureStorageAdapter,\n    }\n  );\n};\n","import type { Chain } from '../../chain';\nimport { CHAINS_INFO_MAP } from '../../wallets/constants';\n\n/** @notInstrumented */\n// eslint-disable-next-line custom-rules/require-single-object-param\nexport const getWaasChainNameFromChain = (chain: Chain): string => {\n  return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;\n};\n","import type { MigrateFromFireblocksResponse } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { NotWaasWalletProviderError } from '../../../errors/NotWaasWalletProviderError';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport { getWalletProviders } from '../../wallets/getWalletProviders';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\n\ntype MigrateFromFireblocksParams = {\n  /**\n   * Optional SLIP-0044 coin types per chain name for BIP44 derivation off the\n   * Fireblocks takeover xprv (e.g. `{ EVM: 1 }` for Sepolia).\n   */\n  coinTypes?: Record<string, number>;\n  /**\n   * The Fireblocks NCW device id whose key material is being migrated.\n   */\n  deviceId: string;\n  /**\n   * Required per-chain expected wallet address (the address Fireblocks held). Its\n   * keys are the chains migration runs on, and the migration iframe verifies each\n   * imported Dynamic address matches the value, so a wrong derivation fails loudly\n   * instead of producing an unusable wallet.\n   */\n  expectedAddresses: Record<string, string>;\n  /**\n   * The Fireblocks-issued JWT authorizing the takeover.\n   */\n  jwt: string;\n  /**\n   * The password that encrypted the legacy Fireblocks NCW device storage.\n   */\n  password: string;\n  /**\n   * The serialized Fireblocks NCW device storage (the local key share backup).\n   */\n  storage: Record<string, string>;\n};\n\n/**\n * Migrates an existing Fireblocks NCW wallet into Dynamic's WaaS infrastructure.\n *\n * Migration is a single cross-chain operation: one call takes over the Fireblocks\n * key material and provisions Dynamic WaaS wallet accounts for every supported\n * chain. Because it is not per-chain, this resolves a single WaaS wallet provider\n * (any registered chain) and delegates the takeover to it.\n *\n * @param params.deviceId - The Fireblocks NCW device id being migrated.\n * @param params.jwt - The Fireblocks-issued JWT authorizing the takeover.\n * @param params.storage - The serialized Fireblocks NCW device storage.\n * @param params.password - The password that encrypted the legacy device storage.\n * @param params.expectedAddresses - Required per-chain expected address; its keys are the chains migration runs on, and each imported address is verified against it.\n * @param [params.coinTypes] - Optional SLIP-0044 coin types per chain name.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the per-chain migration results.\n * @notInstrumented\n */\nexport const migrateFromFireblocks = async (\n  {\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  }: MigrateFromFireblocksParams,\n  client = getDefaultClient()\n): Promise<MigrateFromFireblocksResponse> => {\n  const providers = getWalletProviders(client);\n\n  if (providers.length === 0) {\n    throw new NoWalletProviderFoundError({\n      walletProviderKey: DYNAMIC_WAAS_METADATA.displayName,\n    });\n  }\n\n  // Migration is cross-chain, so any registered WaaS provider can drive the\n  // takeover. Resolve the first one rather than iterating per chain.\n  const waasProvider = providers.find(isWaasWalletProvider);\n\n  if (!waasProvider) {\n    throw new NotWaasWalletProviderError({\n      walletProviderKey: providers[0].key,\n    });\n  }\n\n  const result = await waasProvider.migrateFromFireblocks({\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  });\n\n  await refreshAuth(client);\n\n  return result;\n};\n"],"mappings":";;;;;;;AAMA,IAAa,6BAAb,cAAgD,UAAU;CACxD,YAAY,EAAE,qBAAuD;AACnE,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,mBAAmB,kBAAkB;GACpD,CAAC;;;;;;;ACFN,MAAa,0CACX,EAAE,iBACF,WACuB;CACvB,MAAM,iBAAiB,mCACrB,EAAE,eAAe,EACjB,OACD;AAED,KAAI,CAAC,qBAAqB,eAAe,CACvC,OAAM,IAAI,0BAA0B,EAClC,eAAe,cAAc,SAC9B,CAAC;AAGJ,QAAO;;;;;;;;;;;;;;;ACXT,IAAa,yBAAb,cAA4C,UAAU;CACpD,YAAY,EAAE,QAAQ,SAAuC,EAAE,EAAE;AAC/D,QAAM;GACJ;GACA,MAAM;GACN,SACE;GACF,SAAS;GACT,MAAM;GACN,cAAc;GACf,CAAC;;;;;;ACaN,mCAAe,oBAAoB,IAAU,uBAAuB;;;;;;;;;;ACJpE,IAAa,yBAAb,cAA4C,UAAU;CACpD,AAAS;CACT,AAAS;CACT,AAAS;CAET,YAAY,EACV,QACA,cACA,QAAQ,MACR,YACA,mBAC+B;AAC/B,QAAM;GACJ;GACA,MAAM;GACN,SAAS;GACT,SAAS;GACT,MAAM;GACN;GACD,CAAC;AACF,OAAK,SAAS;AACd,OAAK,aAAa;AAClB,OAAK,kBAAkB;;;;;;ACjD3B,MAAMA,wBAAkE;CACtE,mBAAmB;CACnB,oCAAoC;CACpC,oBAAoB;CACpB,uBAAuB;CACvB,qBAAqB;CACrB,2BAA2B;CAC3B,sBAAsB;CACtB,qBAAqB;CACtB;;;;;;;;;;;;;;;;AA6BD,MAAa,4BACX,QAC2B;CAC3B,MAAM,YAAa,OAAO,EAAE;CAM5B,MAAM,yBACJ,SAEA,QAAQ,UAAa,QAAQ;CAE/B,MAAMC,SAAmC,sBAAsB,UAAU,KAAK,GAC1E,sBAAsB,UAAU,QAChC;AACJ,QAAO,IAAI,uBAAuB;EAChC,OAAO,eAAe,QAAQ,MAAM;EACpC;EACA,cACE,UAAU,WAAW,+BAA+B,OAAO;EAC7D,YAAY,UAAU,UAAU;EAChC,iBAAiB,UAAU,UAAU;EACtC,CAAC;;;;;AC/DJ,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAU3B,MAAM,2BACJ,GAAG,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,OAAO,YAAY;;;;;;;;;;;;;;;AAgBnD,MAAa,qCAAuD;AAClE,KAAI,CAACC,6BACH,OAAM,IAAI,2BAA2B,EAAE,YAAY,oBAAoB,CAAC;CAG1E,MAAM,eAAeA;CACrB,MAAM,aAAa,oBAAoB;CAKvC,MAAM,UAAU,IAAI,mBAClB,aACD;CAOD,MAAMC,kBAAkD,EAAE;CAC1D,MAAMC,gBAAiD,EAAE;CACzD,IAAIC,eAA8C;CAClD,IAAI,YAAY;CAEhB,MAAM,aAAa,QAAuB;AACxC,MAAI,UAAW;EACf,MAAM,aAAa,yBAAyB,IAAI;AAKhD,MAAI,WAAW,WAAW,YAAa;AACvC,OAAK,MAAM,WAAW,cACpB,SAAQ,WAAW;;AAIvB,QAAO;EACL,UAAU;AACR,OAAI,UAAW;AACf,eAAY;AAEZ,iBAAc,QAAQ;AACtB,kBAAe;AACf,mBAAgB,SAAS;AACzB,iBAAc,SAAS;AACvB,gBAAa,MAAM,WAAW;;EAGhC,eAAe,CAAC;EAIhB,QAAQ,SAAmC;AACzC,iBAAc,KAAK,QAAQ;AAC3B,gBAAa;IACX,MAAM,QAAQ,cAAc,QAAQ,QAAQ;AAC5C,QAAI,UAAU,GAAI,eAAc,OAAO,OAAO,EAAE;;;EAMpD,UAAU,SAAkC;AAC1C,mBAAgB,KAAK,QAAQ;AAE7B,oBAAiB,QAAQ,YACvB,qBACC,YAAgC;AAC/B,QAAI,QAAQ,eAAe,WAAY;AAEvC,SAAK,MAAM,MAAM,gBACf,IAAG,QAAQ,KAAK;KAGrB;AAID,gBAAa;IACX,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ;AAC9C,QAAI,UAAU,GAAI,iBAAgB,OAAO,OAAO,EAAE;AAClD,QAAI,gBAAgB,WAAW,GAAG;AAChC,mBAAc,QAAQ;AACtB,oBAAe;;;;EAKrB,YAAY,MAA+B;AACzC,gBAAa,YAAY,YAAY,KAAK;;EAkB5C,MAAM,OAAO,KAAa;AACxB,gBAAa,KAAK,YAAY,IAAI,CAAC,MAAM,UAAU;;EAEtD;;;;;;;;;;;;;;;;;;AClIH,MAAa,+BACX,8BAA8B;;;;;;;;;;;;;;;;ACehC,MAAM,6BAA6B,EACjC,YAAY,WAAW,gCACxB;;AAGD,MAAaC,oBAAsC,EAAE,aAAa,WAAW;CAC3E,MAAM,OAAO,QAAQ,OAAO;CAE5B,MAAM,2BAA2B,KAAK,MAAM;CAK5C,MAAM,sBAAsB,mBAC1B,GAAG,KAAK,cAAc,GAAG;AAE3B,QAAO,IAAI,oBACT;EACE,UAAW,gBAAgB,OAAO,GAAG,WAAW;EAChD,WAAW,OAAO,SAAS;EAC3B,aAAa,KAAK,cAAc,2BAA2B,QACzD,WACA,GACD;EACD,oBACE,OAAO,iBAAiB,IAAI,MAAM,YAClC;EACF;EACA,eAAe,KAAK;EAKpB,YAAY,KAAK,UAAU;EAC3B,YAAY,GAAG,gBAAgB,GAAG,KAAK;EACvC,GAAI,4BAA4B,SAC5B,EAAE,GACF,EAAE,0BAA0B;EAChC,GAAI,KAAK,MAAM,iBAAiB,SAC5B,EAAE,GACF,EAAE,mBAAmB,KAAK,KAAK,eAAe;EAClD,GAAI,KAAK,MAAM,kBAAkB,SAC7B,EAAE,GACF,EAAE,kBAAkB,KAAK,KAAK,gBAAgB;EACnD,EACD;EACE;EAIA,eAAe;GACb,mBAAmB,OAAO,mBAAmB;IAC3C,MAAM,SAAS,MAAM,mBAAmB,EACtC,SAAS,mBAAmB,eAAe,EAC5C,CAAC;AAEF,QAAI,CAAC,OACH,QAAO,EAAE;AAOX,QAAI;AACF,YAAO,KAAK,MAAM,OAAO,SAAS;aAC3B,OAAO;AACd,WAAM,IAAI,uBAAuB,EAC/B,OAAO,iBAAiB,QAAQ,QAAQ,MACzC,CAAC;;;GAIN,sBAAsB,OAAO,mBAAmB;AAC9C,UAAM,qBAAqB,EACzB,SAAS,mBAAmB,eAAe,EAC5C,CAAC;;GAGJ,mBAAmB,OAAO,gBAAgB,WAAW;AACnD,UAAM,mBAAmB,gBAAgB,KAAK,UAAU,OAAO,EAAE;KAC/D,GAAG;KACH,SAAS,mBAAmB,eAAe;KAC5C,CAAC;;GAEL;EACF,CACF;;;;;;ACnHH,MAAa,6BAA6B,UAAyB;AACjE,QAAO,gBAAgB,OAAO,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;ACqDzD,MAAa,wBAAwB,OACnC,EACE,WACA,UACA,mBACA,KACA,UACA,WAEF,SAAS,kBAAkB,KACgB;CAC3C,MAAM,YAAY,mBAAmB,OAAO;AAE5C,KAAI,UAAU,WAAW,EACvB,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,sBAAsB,aAC1C,CAAC;CAKJ,MAAM,eAAe,UAAU,KAAK,qBAAqB;AAEzD,KAAI,CAAC,aACH,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,UAAU,GAAG,KACjC,CAAC;CAGJ,MAAM,SAAS,MAAM,aAAa,sBAAsB;EACtD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,OAAMC,sBAAY,OAAO;AAEzB,QAAO"}

package/dist/migrateFromFireblocks-CzPWPaDr.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"migrateFromFireblocks-CzPWPaDr.cjs","names":["BaseError","getWalletProviderFromWalletAccount","isWaasWalletProvider","NotWaasWalletAccountError","createWaasClient: CreateWaasClient","getCore","DynamicWalletClient","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","DEFAULT_WAAS_BASE_MPC_RELAY_API_URL","CLIENT_SDK_NAME","getSignedSessionId","logoutWithReason","CHAINS_INFO_MAP","getDefaultClient","getWalletProviders","NoWalletProviderFoundError","DYNAMIC_WAAS_METADATA","isWaasWalletProvider","refreshAuth"],"sources":["../src/errors/NotWaasWalletProviderError.ts","../src/modules/waas/getWaasWalletProviderFromWalletAccount/getWaasWalletProviderFromWalletAccount.ts","../src/modules/waas/createWaasClient/createWaasClient.ts","../src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts","../src/modules/waas/migrateFromFireblocks/migrateFromFireblocks.ts"],"sourcesContent":["import { BaseError } from './base';\n\ntype NotWaasWalletProviderErrorParams = {\n  walletProviderKey: string;\n};\n\nexport class NotWaasWalletProviderError extends BaseError {\n  constructor({ walletProviderKey }: NotWaasWalletProviderErrorParams) {\n    super({\n      cause: null,\n      code: 'not_waas_wallet_provider_error',\n      docsUrl: null,\n      name: 'NotWaasWalletProviderError',\n      shortMessage: `Wallet provider ${walletProviderKey} is not a Dynamic WaaS wallet provider`,\n    });\n  }\n}\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { NotWaasWalletAccountError } from '../../../errors/NotWaasWalletAccountError';\nimport { getWalletProviderFromWalletAccount } from '../../wallets/utils/getWalletProviderFromWalletAccount';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\nimport type { WaasWalletProvider } from '../waas.types';\n\ntype GetWalletProviderFromWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getWaasWalletProviderFromWalletAccount = (\n  { walletAccount }: GetWalletProviderFromWalletAccountParams,\n  client: DynamicClient\n): WaasWalletProvider => {\n  const walletProvider = getWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  if (!isWaasWalletProvider(walletProvider)) {\n    throw new NotWaasWalletAccountError({\n      walletAddress: walletAccount.address,\n    });\n  }\n\n  return walletProvider;\n};\n","import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport { CLIENT_SDK_NAME } from '../../apiClient/constants';\nimport { logoutWithReason } from '../../auth/logoutWithReason';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport type { CreateWaasClient } from './createWaasClient.types';\nimport {\n  DEFAULT_WAAS_BASE_API_URL,\n  DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n} from '../constants';\n\n/** @notInstrumented */\nexport const createWaasClient: CreateWaasClient = ({ chainName }, client) => {\n  const core = getCore(client);\n\n  const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;\n\n  const baseClientKeysharesRelayApiUrl =\n    client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;\n\n  return new DynamicWalletClient(\n    {\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      authToken: client.token || '',\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n      baseMPCRelayApiUrl:\n        client.projectSettings?.sdk.waas?.relayUrl ||\n        DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n      chainName,\n      // Opt into the SDK self-driving eager key-share recovery on auth-token\n      // arrival, so the client no longer restores shares itself on login.\n      eagerlyRecoverKeyShares: true,\n      environmentId: core.environmentId,\n      sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,\n      ...(additionalTrustedOrigins == undefined\n        ? {}\n        : { additionalTrustedOrigins }),\n      ...(baseClientKeysharesRelayApiUrl == undefined\n        ? {}\n        : { baseClientKeysharesRelayApiUrl }),\n      ...(core.waas?.loadTimeoutMs == undefined\n        ? {}\n        : { iframeLoadTimeout: core.waas.loadTimeoutMs }),\n      ...(core.waas?.maxLoadRetries == undefined\n        ? {}\n        : { maxRetryAttempts: core.waas.maxLoadRetries }),\n    },\n    {\n      // Lets the iframe mint a fresh signed session id over the reverse channel,\n      // which the SDK's eager key-share recovery needs.\n      getSignedSessionId: () =>\n        getSignedSessionId(client).then(({ signature }) => signature),\n      // When the WaaS iframe's own backend call returns 401 (e.g. a forcibly\n      // revoked token), the iframe notifies the host via the reverse channel\n      // and this fires — log the user out. Mirrors the session-expiry\n      // middleware that covers the SDK's own direct API 401s.\n      onUnauthorized: () => {\n        void logoutWithReason(\n          { reason: 'session-refresh-unauthorized' },\n          client\n        ).catch((error) => {\n          core.logger.error(\n            'Failed to log out after WaaS unauthorized response',\n            error\n          );\n        });\n      },\n    }\n  );\n};\n","import type { Chain } from '../../chain';\nimport { CHAINS_INFO_MAP } from '../../wallets/constants';\n\n/** @notInstrumented */\n// eslint-disable-next-line custom-rules/require-single-object-param\nexport const getWaasChainNameFromChain = (chain: Chain): string => {\n  return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;\n};\n","import type { MigrateFromFireblocksResponse } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { NotWaasWalletProviderError } from '../../../errors/NotWaasWalletProviderError';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport { getWalletProviders } from '../../wallets/getWalletProviders';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\n\ntype MigrateFromFireblocksParams = {\n  /**\n   * Optional SLIP-0044 coin types per chain name for BIP44 derivation off the\n   * Fireblocks takeover xprv (e.g. `{ EVM: 1 }` for Sepolia).\n   */\n  coinTypes?: Record<string, number>;\n  /**\n   * The Fireblocks NCW device id whose key material is being migrated.\n   */\n  deviceId: string;\n  /**\n   * Required per-chain expected wallet address (the address Fireblocks held). Its\n   * keys are the chains migration runs on, and the migration iframe verifies each\n   * imported Dynamic address matches the value, so a wrong derivation fails loudly\n   * instead of producing an unusable wallet.\n   */\n  expectedAddresses: Record<string, string>;\n  /**\n   * The Fireblocks-issued JWT authorizing the takeover.\n   */\n  jwt: string;\n  /**\n   * The password that encrypted the legacy Fireblocks NCW device storage.\n   */\n  password: string;\n  /**\n   * The serialized Fireblocks NCW device storage (the local key share backup).\n   */\n  storage: Record<string, string>;\n};\n\n/**\n * Migrates an existing Fireblocks NCW wallet into Dynamic's WaaS infrastructure.\n *\n * Migration is a single cross-chain operation: one call takes over the Fireblocks\n * key material and provisions Dynamic WaaS wallet accounts for every supported\n * chain. Because it is not per-chain, this resolves a single WaaS wallet provider\n * (any registered chain) and delegates the takeover to it.\n *\n * @param params.deviceId - The Fireblocks NCW device id being migrated.\n * @param params.jwt - The Fireblocks-issued JWT authorizing the takeover.\n * @param params.storage - The serialized Fireblocks NCW device storage.\n * @param params.password - The password that encrypted the legacy device storage.\n * @param params.expectedAddresses - Required per-chain expected address; its keys are the chains migration runs on, and each imported address is verified against it.\n * @param [params.coinTypes] - Optional SLIP-0044 coin types per chain name.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the per-chain migration results.\n * @notInstrumented\n */\nexport const migrateFromFireblocks = async (\n  {\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  }: MigrateFromFireblocksParams,\n  client = getDefaultClient()\n): Promise<MigrateFromFireblocksResponse> => {\n  const providers = getWalletProviders(client);\n\n  if (providers.length === 0) {\n    throw new NoWalletProviderFoundError({\n      walletProviderKey: DYNAMIC_WAAS_METADATA.displayName,\n    });\n  }\n\n  // Migration is cross-chain, so any registered WaaS provider can drive the\n  // takeover. Resolve the first one rather than iterating per chain.\n  const waasProvider = providers.find(isWaasWalletProvider);\n\n  if (!waasProvider) {\n    throw new NotWaasWalletProviderError({\n      walletProviderKey: providers[0].key,\n    });\n  }\n\n  const result = await waasProvider.migrateFromFireblocks({\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  });\n\n  await refreshAuth(client);\n\n  return result;\n};\n"],"mappings":";;;;;;AAMA,IAAa,6BAAb,cAAgDA,+CAAU;CACxD,YAAY,EAAE,qBAAuD;AACnE,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,mBAAmB,kBAAkB;GACpD,CAAC;;;;;;;ACFN,MAAa,0CACX,EAAE,iBACF,WACuB;CACvB,MAAM,iBAAiBC,wEACrB,EAAE,eAAe,EACjB,OACD;AAED,KAAI,CAACC,0DAAqB,eAAe,CACvC,OAAM,IAAIC,uDAA0B,EAClC,eAAe,cAAc,SAC9B,CAAC;AAGJ,QAAO;;;;;;ACZT,MAAaC,oBAAsC,EAAE,aAAa,WAAW;CAC3E,MAAM,OAAOC,6CAAQ,OAAO;CAE5B,MAAM,2BAA2B,KAAK,MAAM;CAE5C,MAAM,iCACJ,OAAO,iBAAiB,IAAI,MAAM;AAEpC,QAAO,IAAIC,+DACT;EACE,UAAWC,qDAAgB,OAAO,GAAG,WAAW;EAChD,WAAW,OAAO,SAAS;EAC3B,aAAa,KAAK,cAAcC,gEAA2B,QACzD,WACA,GACD;EACD,oBACE,OAAO,iBAAiB,IAAI,MAAM,YAClCC;EACF;EAGA,yBAAyB;EACzB,eAAe,KAAK;EACpB,YAAY,GAAGC,qDAAgB,GAAG,KAAK;EACvC,GAAI,4BAA4B,SAC5B,EAAE,GACF,EAAE,0BAA0B;EAChC,GAAI,kCAAkC,SAClC,EAAE,GACF,EAAE,gCAAgC;EACtC,GAAI,KAAK,MAAM,iBAAiB,SAC5B,EAAE,GACF,EAAE,mBAAmB,KAAK,KAAK,eAAe;EAClD,GAAI,KAAK,MAAM,kBAAkB,SAC7B,EAAE,GACF,EAAE,kBAAkB,KAAK,KAAK,gBAAgB;EACnD,EACD;EAGE,0BACEC,8CAAmB,OAAO,CAAC,MAAM,EAAE,gBAAgB,UAAU;EAK/D,sBAAsB;AACpB,GAAKC,gEACH,EAAE,QAAQ,gCAAgC,EAC1C,OACD,CAAC,OAAO,UAAU;AACjB,SAAK,OAAO,MACV,sDACA,MACD;KACD;;EAEL,CACF;;;;;;ACrEH,MAAa,6BAA6B,UAAyB;AACjE,QAAOC,qDAAgB,OAAO,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;ACqDzD,MAAa,wBAAwB,OACnC,EACE,WACA,UACA,mBACA,KACA,UACA,WAEF,SAASC,uDAAkB,KACgB;CAC3C,MAAM,YAAYC,wDAAmB,OAAO;AAE5C,KAAI,UAAU,WAAW,EACvB,OAAM,IAAIC,gEAA2B,EACnC,mBAAmBC,2DAAsB,aAC1C,CAAC;CAKJ,MAAM,eAAe,UAAU,KAAKC,0DAAqB;AAEzD,KAAI,CAAC,aACH,OAAM,IAAI,2BAA2B,EACnC,mBAAmB,UAAU,GAAG,KACjC,CAAC;CAGJ,MAAM,SAAS,MAAM,aAAa,sBAAsB;EACtD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,OAAMC,mDAAY,OAAO;AAEzB,QAAO"}