@dynamic-labs-sdk/client 1.28.0 → 1.29.0

package/dist/index.esm.js

@@ -1,9 +1,9 @@
-import { $ as UnauthorizedError, A as isSignedIn, B as retryOnFail, C as getWalletProviderFromWalletAccount, Ct as version, D as NoWalletProviderFoundError, F as CHAINS_INFO_MAP, G as createApiClient, H as offEvent, I as formatWalletAccountId, L as normalizeAddress, O as generateSessionKeys, P as getChainFromVerifiedCredentialChain, Q as createStorageKeySchema, R as splitWalletProviderKey, S as extractSessionId, St as name, T as getWalletProviderRegistry, U as onEvent, V as emitEvent, W as onceEvent, X as fetchAndStoreNonces, Y as getNonce, Z as updateNoncePoolStorage, _ as instrumentFunction, _t as getDefaultClient, a as initializeWaasClientsForEagerRecovery, at as APIError, b as getUserAgent, bt as BaseError, ct as SDK_API_CORE_VERSION, dt as assertDefined, et as SandboxMaximumThresholdReachedError, f as getWalletProviders, ft as ValueMustBeDefinedError, g as __logoutWithReason_wrapped, gt as NONCE_POOL_SIZE, ht as getPlatform, i as InvalidParamError, it as InvalidExternalAuthError, j as getWalletAccounts, k as fetchProjectSettings, m as checkAndRaiseWalletAccountsChangedEvent, mt as randomString, n as upsertElevatedAccessToken, nt as MfaInvalidOtpError, p as isUserMissingMfaAuth, pt as getElevatedAccessToken, r as parseElevatedAccessToken, rt as LinkCredentialError, st as DYNAMIC_ICONIC_SPRITE_URL, t as updateAuthFromVerifyResponse, tt as MfaRateLimitedError, ut as isCookieEnabled, v as scrubParameters, vt as setDefaultClient, w as WalletProviderPriority, x as getOperatingSystem, xt as getCore, y as DEFAULT_PII_FIELDS } from "./updateAuthFromVerifyResponse-DcwFCD-Y.esm.js";
-import { A as createCrossTabBroadcast, B as getBuffer, C as getKeychainIndexedDBName, D as assertSafeNavigationUrl, E as createKeychainService, F as FETCH_PROJECT_SETTINGS_TRACKER_KEY, G as createLocalStorageAdapter, H as isEqualShallow, I as GENERATE_SESSION_KEYS_TRACKER_KEY, K as isServerSideRendering, L as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, M as CannotTrackError, N as createDeferredPromise, P as createAppForegroundSubscriber, R as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, S as MergeAccountsConfirmationError, T as assertSafeDeeplinkUrl, U as createStorage, V as subscribeWithSelector, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, k as createLogger, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, q as UnavailableInServerSideError, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY } from "./getNetworkProviderFromNetworkId-DBjVmBmy.esm.js";
-import { i as __refreshAuth_wrapped, n as TransactionBroadcastError, r as NotWaasWalletAccountError } from "./isDynamicWaasEnabled-D3-nDwVw.esm.js";
-import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-OFxAxj23.esm.js";
-import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-C9TWlmDD.esm.js";
-import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-D5rzx59E.esm.js";
+import { $ as createStorageKeySchema, A as fetchProjectSettings, C as extractSessionId, Ct as name, E as getWalletProviderRegistry, F as getChainFromVerifiedCredentialChain, G as onceEvent, H as emitEvent, I as CHAINS_INFO_MAP, K as createApiClient, L as formatWalletAccountId, M as getWalletAccounts, O as NoWalletProviderFoundError, Q as updateNoncePoolStorage, R as normalizeAddress, S as getOperatingSystem, St as getCore, T as WalletProviderPriority, U as offEvent, V as retryOnFail, W as onEvent, X as getNonce, Z as fetchAndStoreNonces, _ as __logoutWithReason_wrapped, _t as NONCE_POOL_SIZE, a as InvalidParamError, at as InvalidExternalAuthError, b as DEFAULT_PII_FIELDS, ct as DYNAMIC_ICONIC_SPRITE_URL, dt as isCookieEnabled, et as UnauthorizedError, ft as assertDefined, gt as getPlatform, h as checkAndRaiseWalletAccountsChangedEvent, ht as randomString, i as decodeJwt, it as LinkCredentialError, j as isSignedIn, k as generateSessionKeys, lt as SDK_API_CORE_VERSION, m as isUserMissingMfaAuth, mt as getElevatedAccessToken, n as upsertElevatedAccessToken, nt as MfaRateLimitedError, o as initializeWaasClientsForEagerRecovery, ot as APIError, p as getWalletProviders, pt as ValueMustBeDefinedError, r as parseElevatedAccessToken, rt as MfaInvalidOtpError, t as updateAuthFromVerifyResponse, tt as SandboxMaximumThresholdReachedError, v as instrumentFunction, vt as getDefaultClient, w as getWalletProviderFromWalletAccount, wt as version, x as getUserAgent, xt as BaseError, y as scrubParameters, yt as setDefaultClient, z as splitWalletProviderKey } from "./updateAuthFromVerifyResponse-B42kkGLd.esm.js";
+import { A as createCrossTabBroadcast, B as getBuffer, C as getKeychainIndexedDBName, D as assertSafeNavigationUrl, E as createKeychainService, F as FETCH_PROJECT_SETTINGS_TRACKER_KEY, G as createLocalStorageAdapter, H as isEqualShallow, I as GENERATE_SESSION_KEYS_TRACKER_KEY, K as isServerSideRendering, L as INITIALIZE_STORAGE_SYNC_TRACKER_KEY, M as CannotTrackError, N as createDeferredPromise, P as createAppForegroundSubscriber, R as REFRESH_USER_STATE_FROM_COOKIE_TRACKER_KEY, S as MergeAccountsConfirmationError, T as assertSafeDeeplinkUrl, U as createStorage, V as subscribeWithSelector, _ as consumeCaptchaToken, a as verifyMessageSignatureOwnership, b as WalletAlreadyLinkedToAnotherUserError, c as formatSignInMessage, d as updateWalletProviderKeysForVerifiedCredentials, f as setUnverifiedWalletAccounts, g as MethodNotImplementedError, h as __setCaptchaToken_wrapped, i as getNetworksData, k as createLogger, l as getAppMetadata, m as hasExtension, o as removeUnverifiedWalletAccount, p as createVisit, q as UnavailableInServerSideError, s as createSignInMessageStatement, t as getNetworkProviderFromNetworkId, u as reconcileWalletAccountsAgainstClient, v as isCaptchaRequired, w as createRealtimeService, x as NoNetworkProvidersError, y as WalletScreeningBlockedError, z as REFRESH_USER_STATE_FROM_VALID_TOKEN_TRACKER_KEY } from "./getNetworkProviderFromNetworkId-Be2CBFTv.esm.js";
+import { i as __refreshAuth_wrapped, n as TransactionBroadcastError, r as NotWaasWalletAccountError } from "./isDynamicWaasEnabled-B8e0N7Bb.esm.js";
+import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, n as isPendingRecoveryCodesAcknowledgment, o as WaasLoadFailedError, r as isDeviceRegistrationRequired, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-Bq_7_Fck.esm.js";
+import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-FfQmRcK1.esm.js";
+import { n as getMfaMethods, r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-DRqf4xyv.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { AuthModeEnum, CaptchaProviderEnum as CaptchaProviderEnum$1, ChainEnum, ExchangeKeyEnum, JwtVerifiedCredentialFormatEnum, JwtVerifiedCredentialFormatEnum as JwtVerifiedCredentialFormatEnum$1, MFAAction, MfaBackupCodeAcknowledgement, ProviderEnum, ProviderEnum as ProviderEnum$1, TokenScope, TokenScope as TokenScope$1, WaasBackupOptionsEnum, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import * as z from "zod/mini";
@@ -405,6 +405,40 @@ var ClientAlreadyInitializedError = class extends BaseError {
 	}
 };
 
+//#endregion
+//#region src/modules/initializeClient/logoutIfSessionPublicKeyMismatched/logoutIfSessionPublicKeyMismatched.ts
+/**
+* Signs the user out when the local session key no longer matches the
+* `sessionPublicKey` claim carried by the current token.
+*
+* The claim is captured once at sign-in and carried forward unchanged on
+* every token refresh (it is not re-derived from the client's current
+* session key). If the local session key is regenerated afterwards — e.g. a
+* re-init racing a token refresh, or storage being partially cleared — every
+* subsequent request keeps signing with the new key while asserting the
+* stale claim, and is rejected server-side with `invalid_nonce_signature`
+* forever, since retrying never re-syncs the claim. Signing out forces a
+* fresh sign-in, which is the only flow that re-captures the claim from the
+* client's current key.
+* @notInstrumented
+*/
+const logoutIfSessionPublicKeyMismatched = async (client) => {
+	const core = getCore(client);
+	const { sessionKeys, token } = core.state.get();
+	if (!sessionKeys || !token) return;
+	let tokenSessionPublicKey;
+	try {
+		({sessionPublicKey: tokenSessionPublicKey} = decodeJwt(token));
+	} catch (error) {
+		core.logger.error("[logoutIfSessionPublicKeyMismatched] Failed to decode token", error);
+		return;
+	}
+	if (tokenSessionPublicKey && tokenSessionPublicKey !== sessionKeys) {
+		core.logger.error("[logoutIfSessionPublicKeyMismatched] Session key does not match token claim");
+		await __logoutWithReason_wrapped({ reason: "session-public-key-mismatch" }, client);
+	}
+};
+
 //#endregion
 //#region src/modules/initializeClient/initializeClient.ts
 /**
@@ -458,6 +492,7 @@ const initializeClient = async (client = getDefaultClient()) => {
 			storage: core.storage
 		}).catch(() => __logoutWithReason_wrapped({ reason: "keychain-migration-failed" }, client));
 		if (core.state.get().sessionKeys && !await core.keychain.hasKey("session")) await __logoutWithReason_wrapped({ reason: "keychain-key-missing" }, client);
+		await logoutIfSessionPublicKeyMismatched(client);
 	}).then(async () => {
 		if (!core.state.get().projectSettings) await fetchProjectSettings(client);
 	});