@dynamic-labs-sdk/client 1.28.0 → 1.29.0

package/dist/index.native.esm.js

@@ -1,14 +1,14 @@
-import { $ as SandboxMaximumThresholdReachedError, B as onceEvent, C as getWalletProviderFromWalletAccount, Ct as version, D as NoWalletProviderFoundError, F as splitWalletProviderKey, G as getNonce, J as fetchAndStoreNonces, L as emitEvent, M as CHAINS_INFO_MAP, N as formatWalletAccountId, O as getWalletAccounts, P as normalizeAddress, Q as UnauthorizedError, R as offEvent, St as name, T as getWalletProviderRegistry, V as createApiClient, X as createStorageKeySchema, Y as updateNoncePoolStorage, Z as createLocalStorageAdapter, _ as scrubParameters, _t as getDefaultClient, a as initializeWaasClientsForEagerRecovery, b as getOperatingSystem, bt as BaseError, ct as SDK_API_CORE_VERSION, dt as assertDefined, et as MfaRateLimitedError, f as getWalletProviders, ft as ValueMustBeDefinedError, g as instrumentFunction, gt as NONCE_POOL_SIZE, ht as getPlatform, i as InvalidParamError, it as APIError, j as getChainFromVerifiedCredentialChain, m as checkAndRaiseWalletAccountsChangedEvent, mt as randomString, n as upsertElevatedAccessToken, nt as LinkCredentialError, p as isUserMissingMfaAuth, pt as getElevatedAccessToken, r as parseElevatedAccessToken, rt as InvalidExternalAuthError, st as DYNAMIC_ICONIC_SPRITE_URL, t as updateAuthFromVerifyResponse, tt as MfaInvalidOtpError, ut as isCookieEnabled, v as DEFAULT_PII_FIELDS, vt as setDefaultClient, w as WalletProviderPriority, x as extractSessionId, xt as getCore, y as getUserAgent, z as onEvent } from "./updateAuthFromVerifyResponse-DtnQfhJ1.native.esm.js";
-import { A as createCrossTabBroadcast, B as isServerSideRendering, C as getKeychainIndexedDBName, D as assertSafeNavigationUrl, E as createKeychainService, F as FETCH_PROJECT_SETTINGS_TRACKER_KEY, H as subscribeWithSelector, I as GENERATE_SESSION_KEYS_TRACKER_KEY, L as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, M as CannotTrackError, N as createDeferredPromise, P as createAppForegroundSubscriber, R as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, S as MergeAccountsConfirmationError, T as assertSafeDeeplinkUrl, U as isEqualShallow, V as getBuffer, W as createStorage, _ as getAppMetadata, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as setUnverifiedWalletAccounts, f as createVisit, g as isCaptchaRequired, h as consumeCaptchaToken, i as getNetworksData, k as createLogger, l as reconcileWalletAccountsAgainstClient, m as __setCaptchaToken_wrapped, o as removeUnverifiedWalletAccount, p as hasExtension, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as updateWalletProviderKeysForVerifiedCredentials, v as MethodNotImplementedError, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY } from "./getNetworkProviderFromNetworkId-CKWQLHSE.native.esm.js";
-import { a as fetchProjectSettings, i as generateSessionKeys, n as getVerifiedCredentialForWalletAccount, o as isSignedIn, r as __logoutWithReason_wrapped, s as retryOnFail, t as getWalletProviderByKey } from "./getWalletProviderByKey-Dh1slnTF.native.esm.js";
-import { i as __refreshAuth_wrapped, n as TransactionBroadcastError, r as NotWaasWalletAccountError } from "./isDynamicWaasEnabled-CvxVdfKf.native.esm.js";
-import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-BJGirRfD.native.esm.js";
-import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-B3cHYyNI.native.esm.js";
+import { $ as UnauthorizedError, B as onEvent, Ct as name, E as getWalletProviderRegistry, F as normalizeAddress, H as createApiClient, I as splitWalletProviderKey, K as getNonce, M as getChainFromVerifiedCredentialChain, N as CHAINS_INFO_MAP, O as NoWalletProviderFoundError, P as formatWalletAccountId, Q as createLocalStorageAdapter, R as emitEvent, S as extractSessionId, St as getCore, T as WalletProviderPriority, V as onceEvent, X as updateNoncePoolStorage, Y as fetchAndStoreNonces, Z as createStorageKeySchema, _ as instrumentFunction, _t as NONCE_POOL_SIZE, a as InvalidParamError, at as APIError, b as getUserAgent, ct as DYNAMIC_ICONIC_SPRITE_URL, dt as isCookieEnabled, et as SandboxMaximumThresholdReachedError, ft as assertDefined, gt as getPlatform, h as checkAndRaiseWalletAccountsChangedEvent, ht as randomString, i as decodeJwt, it as InvalidExternalAuthError, k as getWalletAccounts, lt as SDK_API_CORE_VERSION, m as isUserMissingMfaAuth, mt as getElevatedAccessToken, n as upsertElevatedAccessToken, nt as MfaInvalidOtpError, o as initializeWaasClientsForEagerRecovery, p as getWalletProviders, pt as ValueMustBeDefinedError, r as parseElevatedAccessToken, rt as LinkCredentialError, t as updateAuthFromVerifyResponse, tt as MfaRateLimitedError, v as scrubParameters, vt as getDefaultClient, w as getWalletProviderFromWalletAccount, wt as version, x as getOperatingSystem, xt as BaseError, y as DEFAULT_PII_FIELDS, yt as setDefaultClient, z as offEvent } from "./updateAuthFromVerifyResponse-Dd0q0rPX.native.esm.js";
+import { A as createCrossTabBroadcast, B as isServerSideRendering, C as getKeychainIndexedDBName, D as assertSafeNavigationUrl, E as createKeychainService, F as FETCH_PROJECT_SETTINGS_TRACKER_KEY, H as subscribeWithSelector, I as GENERATE_SESSION_KEYS_TRACKER_KEY, L as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, M as CannotTrackError, N as createDeferredPromise, P as createAppForegroundSubscriber, R as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, S as MergeAccountsConfirmationError, T as assertSafeDeeplinkUrl, U as isEqualShallow, V as getBuffer, W as createStorage, _ as getAppMetadata, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as setUnverifiedWalletAccounts, f as createVisit, g as isCaptchaRequired, h as consumeCaptchaToken, i as getNetworksData, k as createLogger, l as reconcileWalletAccountsAgainstClient, m as __setCaptchaToken_wrapped, o as removeUnverifiedWalletAccount, p as hasExtension, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as updateWalletProviderKeysForVerifiedCredentials, v as MethodNotImplementedError, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY } from "./getNetworkProviderFromNetworkId-DReHSnab.native.esm.js";
+import { a as fetchProjectSettings, i as generateSessionKeys, n as getVerifiedCredentialForWalletAccount, o as isSignedIn, r as __logoutWithReason_wrapped, s as retryOnFail, t as getWalletProviderByKey } from "./getWalletProviderByKey-BtcGKhh6.native.esm.js";
+import { i as __refreshAuth_wrapped, n as TransactionBroadcastError, r as NotWaasWalletAccountError } from "./isDynamicWaasEnabled-GTkHpRu6.native.esm.js";
+import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-e4Bdq2tD.native.esm.js";
+import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-DKt0bwXg.native.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { AuthModeEnum, CaptchaProviderEnum as CaptchaProviderEnum$1, ChainEnum, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, JwtVerifiedCredentialFormatEnum as JwtVerifiedCredentialFormatEnum$1, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, ProviderEnum as ProviderEnum$1, TokenScope, TokenScope as TokenScope$1, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
 import { Linking } from "react-native";
-import EventEmitter$1, { EventEmitter } from "eventemitter3";
+import EventEmitter, { EventEmitter as EventEmitter$1 } from "eventemitter3";
 import { Passkey } from "react-native-passkey";
 
 //#region src/modules/state/raiseStateEvents/events.ts
@@ -406,6 +406,40 @@ var ClientAlreadyInitializedError = class extends BaseError {
 	}
 };
 
+//#endregion
+//#region src/modules/initializeClient/logoutIfSessionPublicKeyMismatched/logoutIfSessionPublicKeyMismatched.ts
+/**
+* Signs the user out when the local session key no longer matches the
+* `sessionPublicKey` claim carried by the current token.
+*
+* The claim is captured once at sign-in and carried forward unchanged on
+* every token refresh (it is not re-derived from the client's current
+* session key). If the local session key is regenerated afterwards — e.g. a
+* re-init racing a token refresh, or storage being partially cleared — every
+* subsequent request keeps signing with the new key while asserting the
+* stale claim, and is rejected server-side with `invalid_nonce_signature`
+* forever, since retrying never re-syncs the claim. Signing out forces a
+* fresh sign-in, which is the only flow that re-captures the claim from the
+* client's current key.
+* @notInstrumented
+*/
+const logoutIfSessionPublicKeyMismatched = async (client) => {
+	const core = getCore(client);
+	const { sessionKeys, token } = core.state.get();
+	if (!sessionKeys || !token) return;
+	let tokenSessionPublicKey;
+	try {
+		({sessionPublicKey: tokenSessionPublicKey} = decodeJwt(token));
+	} catch (error) {
+		core.logger.error("[logoutIfSessionPublicKeyMismatched] Failed to decode token", error);
+		return;
+	}
+	if (tokenSessionPublicKey && tokenSessionPublicKey !== sessionKeys) {
+		core.logger.error("[logoutIfSessionPublicKeyMismatched] Session key does not match token claim");
+		await __logoutWithReason_wrapped({ reason: "session-public-key-mismatch" }, client);
+	}
+};
+
 //#endregion
 //#region src/modules/initializeClient/initializeClient.ts
 /**
@@ -459,6 +493,7 @@ const initializeClient = async (client = getDefaultClient()) => {
 			storage: core.storage
 		}).catch(() => __logoutWithReason_wrapped({ reason: "keychain-migration-failed" }, client));
 		if (core.state.get().sessionKeys && !await core.keychain.hasKey("session")) await __logoutWithReason_wrapped({ reason: "keychain-key-missing" }, client);
+		await logoutIfSessionPublicKeyMismatched(client);
 	}).then(async () => {
 		if (!core.state.get().projectSettings) await fetchProjectSettings(client);
 	});
@@ -568,7 +603,7 @@ const createAsyncTrack = () => {
 	* This ensures no process is missed (as it would throw when tracked on a different node tick).
 	*/
 	let isTrackEnabled = true;
-	const eventEmitter = new EventEmitter();
+	const eventEmitter = new EventEmitter$1();
 	const allSettledPromise = createDeferredPromise();
 	const tracker = /* @__PURE__ */ new Map();
 	/**
@@ -615,7 +650,7 @@ const createAsyncTrack = () => {
 //#endregion
 //#region src/services/eventEmitter/createEventEmitter.ts
 /** @notInstrumented */
-const createEventEmitter = () => new EventEmitter$1();
+const createEventEmitter = () => new EventEmitter();
 
 //#endregion
 //#region src/errors/UnavailableInServerSideError.ts