@dynamic-labs-sdk/client 1.30.2 → 1.30.3

package/dist/waasCore.cjs

@@ -1,9 +1,8 @@
-const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-Dsw-eAro.cjs');
-const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-CMccs1-6.cjs');
-const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-jv_idxWY.cjs');
-require('./isMfaRequiredForAction-DKfoMhEk.cjs');
-const require_getSignedSessionId = require('./getSignedSessionId-DGa_pu-i.cjs');
-const require_migrateFromFireblocks = require('./migrateFromFireblocks-zp5Jbq2J.cjs');
+const require_logoutWithReason = require('./logoutWithReason-DEM0fiik.cjs');
+const require_migrateFromFireblocks = require('./migrateFromFireblocks-BOx3tLrP.cjs');
+const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-CwZbDdOC.cjs');
+require('./isMfaRequiredForAction-BSclknqX.cjs');
+const require_getSignedSessionId = require('./getSignedSessionId-CW2VWZxK.cjs');
 let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 let _dynamic_labs_wallet_browser_wallet_client = require("@dynamic-labs-wallet/browser-wallet-client");
@@ -11,19 +10,19 @@ let _dynamic_labs_wallet_browser_wallet_client = require("@dynamic-labs-wallet/b
 //#region src/modules/waas/createWaasClient/createWaasClient.ts
 /** @notInstrumented */
 const createWaasClient = ({ chainName }, client) => {
-	const core = require_updateAuthFromVerifyResponse.getCore(client);
+	const core = require_logoutWithReason.getCore(client);
 	const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;
 	const baseClientKeysharesRelayApiUrl = client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;
 	const sessionIdAtCreation = core.state.get().user?.sessionId;
 	return new _dynamic_labs_wallet_browser_wallet_client.DynamicWalletClient({
-		authMode: require_updateAuthFromVerifyResponse.isCookieEnabled(client) ? "cookie" : "header",
+		authMode: require_logoutWithReason.isCookieEnabled(client) ? "cookie" : "header",
 		authToken: client.token || "",
-		baseApiUrl: (core.apiBaseUrl || require_updateAuthFromVerifyResponse.DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", ""),
-		baseMPCRelayApiUrl: client.projectSettings?.sdk.waas?.relayUrl || require_updateAuthFromVerifyResponse.DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,
+		baseApiUrl: (core.apiBaseUrl || require_logoutWithReason.DEFAULT_WAAS_BASE_API_URL).replace("/api/v0", ""),
+		baseMPCRelayApiUrl: client.projectSettings?.sdk.waas?.relayUrl || require_logoutWithReason.DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,
 		chainName,
 		eagerlyRecoverKeyShares: true,
 		environmentId: core.environmentId,
-		sdkVersion: `${require_updateAuthFromVerifyResponse.CLIENT_SDK_NAME}/${core.version}`,
+		sdkVersion: `${require_logoutWithReason.CLIENT_SDK_NAME}/${core.version}`,
 		...additionalTrustedOrigins == void 0 ? {} : { additionalTrustedOrigins },
 		...baseClientKeysharesRelayApiUrl == void 0 ? {} : { baseClientKeysharesRelayApiUrl },
 		...core.waas?.loadTimeoutMs == void 0 ? {} : { iframeLoadTimeout: core.waas.loadTimeoutMs },
@@ -32,7 +31,7 @@ const createWaasClient = ({ chainName }, client) => {
 		getSignedSessionId: () => require_getSignedSessionId.getSignedSessionId(client).then(({ signature }) => signature),
 		onUnauthorized: () => {
 			if (core.state.get().user?.sessionId !== sessionIdAtCreation) return;
-			require_updateAuthFromVerifyResponse.__logoutWithReason_wrapped({ reason: "session-refresh-unauthorized" }, client).catch((error) => {
+			require_logoutWithReason.__logoutWithReason_wrapped({ reason: "session-refresh-unauthorized" }, client).catch((error) => {
 				core.logger.error("Failed to log out after WaaS unauthorized response", error);
 			});
 		}
@@ -83,7 +82,7 @@ const createTranslateRejection = ({ match, mapTo }) => (fn) => async (...args) =
 * @notInstrumented
 */
 const getActionAuthorizationTokens = async ({ mfaAction, scope }, client) => {
-	const elevatedAccessToken = require_updateAuthFromVerifyResponse.getElevatedAccessToken({ scope }, client);
+	const elevatedAccessToken = require_logoutWithReason.getElevatedAccessToken({ scope }, client);
 	if (elevatedAccessToken) return {
 		elevatedAccessToken,
 		mfaToken: void 0
@@ -119,7 +118,7 @@ const TRANSACTION_BROADCAST_SUBMISSION_STATES = new Set([
 * @notInstrumented
 */
 const transactionBroadcastErrorMapper = (error) => {
-	if (!(error instanceof require_updateAuthFromVerifyResponse.APIError)) return null;
+	if (!(error instanceof require_logoutWithReason.APIError)) return null;
 	const code = TRANSACTION_BROADCAST_ERROR_CODES[error.code];
 	if (!code) return null;
 	const payload = error.payload;
@@ -127,7 +126,7 @@ const transactionBroadcastErrorMapper = (error) => {
 	const submissionState = payload.submissionState;
 	if (!TRANSACTION_BROADCAST_SUBMISSION_STATES.has(submissionState)) return null;
 	const transactionId = typeof payload.transactionId === "string" ? payload.transactionId : void 0;
-	return new require_isDynamicWaasEnabled.TransactionBroadcastError({
+	return new require_migrateFromFireblocks.TransactionBroadcastError({
 		attempts: payload.attempts,
 		broadcastId: payload.broadcastId,
 		cause: error,
@@ -148,7 +147,7 @@ const IDEMPOTENCY_KEY_LENGTH = 50;
 * @notInstrumented
 */
 const broadcastWaasTransaction = async ({ encoding, networkId, signedTransaction, skipPreflight, walletAccount }, client) => {
-	const apiClient = require_updateAuthFromVerifyResponse.createApiClient({ errorMappers: [transactionBroadcastErrorMapper] }, client);
+	const apiClient = require_logoutWithReason.createApiClient({ errorMappers: [transactionBroadcastErrorMapper] }, client);
 	let apiEncoding = _dynamic_labs_sdk_api_core.WaasTransactionEncoding.Hex;
 	if (encoding === "base64") apiEncoding = _dynamic_labs_sdk_api_core.WaasTransactionEncoding.Base64;
 	const request = {
@@ -158,12 +157,12 @@ const broadcastWaasTransaction = async ({ encoding, networkId, signedTransaction
 	};
 	if (skipPreflight !== void 0) request.options = { skipPreflight };
 	const walletId = walletAccount.verifiedCredentialId;
-	require_updateAuthFromVerifyResponse.assertDefined(walletId, "Wallet account verified credential id is required for broadcasting");
+	require_logoutWithReason.assertDefined(walletId, "Wallet account verified credential id is required for broadcasting");
 	const response = await apiClient.broadcastWaasTransaction({
-		environmentId: require_updateAuthFromVerifyResponse.getCore(client).environmentId,
+		environmentId: require_logoutWithReason.getCore(client).environmentId,
 		waasTransactionBroadcastRequest: request,
 		walletId,
-		xIdempotencyKey: require_updateAuthFromVerifyResponse.randomString({ length: IDEMPOTENCY_KEY_LENGTH })
+		xIdempotencyKey: require_logoutWithReason.randomString({ length: IDEMPOTENCY_KEY_LENGTH })
 	});
 	let status = "submitted";
 	if (response.status === _dynamic_labs_sdk_api_core.WaasTransactionBroadcastStatus.AlreadyKnown) status = "already_known";
@@ -179,7 +178,7 @@ const broadcastWaasTransaction = async ({ encoding, networkId, signedTransaction
 //#region src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts
 /** @notInstrumented */
 const getWaasChainNameFromChain = (chain) => {
-	return require_updateAuthFromVerifyResponse.CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;
+	return require_logoutWithReason.CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;
 };
 
 //#endregion
@@ -209,7 +208,7 @@ const isWaasLoadExhaustionError = (error) => error instanceof Error && error.mes
 const RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH = 64;
 /** @notInstrumented */
 const createWaasProvider = ({ sdkClient, chain }) => {
-	const logger = require_updateAuthFromVerifyResponse.getCore(sdkClient).logger;
+	const logger = require_logoutWithReason.getCore(sdkClient).logger;
 	let _waasClient;
 	let _waasClientSessionId;
 	const resetClientIfCurrent = (client) => {
@@ -218,8 +217,39 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 			_waasClientSessionId = void 0;
 		}
 	};
+	const isRbacStaleWalletApiError = (error) => error instanceof Error && error.name === "WalletApiError" && error.status === 403 && error.code === "rbac_stale";
+	const withRbacStaleRetry = ({ operation }) => {
+		const attempt = async ({ args, isRetry }) => {
+			const stateBeforeAttempt = require_logoutWithReason.getCore(sdkClient).state.get();
+			const mfaTokenBeforeAttempt = stateBeforeAttempt.mfaToken;
+			const attemptStartedAt = /* @__PURE__ */ new Date();
+			const elevatedTokensBeforeAttempt = (stateBeforeAttempt.elevatedAccessTokens ?? []).filter((token) => !token.expiresAt || token.expiresAt > attemptStartedAt);
+			try {
+				return await operation(...args);
+			} catch (error) {
+				if (!isRbacStaleWalletApiError(error)) throw error;
+				const stateAfterAttempt = require_logoutWithReason.getCore(sdkClient).state.get();
+				const mfaTokenConsumedByAttempt = mfaTokenBeforeAttempt !== null && stateAfterAttempt.mfaToken === null;
+				const elevatedTokensAfterAttempt = stateAfterAttempt.elevatedAccessTokens ?? [];
+				const elevatedTokenConsumedByAttempt = elevatedTokensBeforeAttempt.some((before) => before.singleUse && !elevatedTokensAfterAttempt.some((after) => after.token === before.token));
+				if (mfaTokenConsumedByAttempt || elevatedTokenConsumedByAttempt) throw new require_isUserOnboardingComplete.WaasRbacStaleRetryUnsafeError({ cause: error });
+				if (isRetry) throw error;
+				const staleWaasClient = _waasClient;
+				await require_logoutWithReason.__refreshAuth_wrapped(sdkClient);
+				if (staleWaasClient) resetClientIfCurrent(staleWaasClient);
+				return attempt({
+					args,
+					isRetry: true
+				});
+			}
+		};
+		return (...args) => attempt({
+			args,
+			isRetry: false
+		});
+	};
 	const getWaasClient = async () => {
-		const currentSessionId = require_updateAuthFromVerifyResponse.getCore(sdkClient).state.get().user?.sessionId;
+		const currentSessionId = require_logoutWithReason.getCore(sdkClient).state.get().user?.sessionId;
 		if (_waasClient && currentSessionId !== _waasClientSessionId) _waasClient = void 0;
 		if (!_waasClient) {
 			if (!require_isUserOnboardingComplete.isUserOnboardingComplete(sdkClient)) throw new require_isUserOnboardingComplete.WaasOnboardingIncompleteError();
@@ -448,7 +478,7 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 		});
 	};
 	const signRawMessage = async ({ message, password, walletAccount }) => {
-		if (message.length !== RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH) throw new require_updateAuthFromVerifyResponse.InvalidParamError(`Message must be ${RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH} characters long`);
+		if (message.length !== RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH) throw new require_logoutWithReason.InvalidParamError(`Message must be ${RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH} characters long`);
 		const { signature: signedSessionId } = await require_getSignedSessionId.getSignedSessionId(sdkClient);
 		const { elevatedAccessToken, mfaToken } = await getActionAuthorizationTokens({
 			mfaAction: _dynamic_labs_sdk_api_core.MFAAction.WalletWaasSign,
@@ -560,23 +590,23 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 		backupKeySharesToGoogleDrive: translateLoadFailure(backupKeySharesToGoogleDrive),
 		broadcastTransaction,
 		createOfflineRecoveryShares: translateLoadFailure(createOfflineRecoveryShares),
-		createWalletAccount: translateLoadFailure(createWalletAccount),
+		createWalletAccount: translateLoadFailure(withRbacStaleRetry({ operation: createWalletAccount })),
 		delegateKeyShares: translateLoadFailure(delegateKeyShares),
 		destroy: translateLoadFailure(destroy),
-		exportClientKeyshares: translateLoadFailure(exportClientKeyshares),
-		exportPrivateKey: translateLoadFailure(exportPrivateKey),
+		exportClientKeyshares: translateLoadFailure(withRbacStaleRetry({ operation: exportClientKeyshares })),
+		exportPrivateKey: translateLoadFailure(withRbacStaleRetry({ operation: exportPrivateKey })),
 		getWaasClient: translateLoadFailure(getWaasClient),
 		getWalletRecoveryState: translateLoadFailure(getWalletRecoveryState),
 		importPrivateKey: translateLoadFailure(importPrivateKey),
 		migrateFromFireblocks: translateLoadFailure(migrateFromFireblocks$1),
 		refreshWalletAccountShares: translateLoadFailure(refreshWalletAccountShares),
-		reshareToNewSignerShareSet: translateLoadFailure(reshareToNewSignerShareSet),
+		reshareToNewSignerShareSet: translateLoadFailure(withRbacStaleRetry({ operation: reshareToNewSignerShareSet })),
 		restoreUserShareForWalletAccount: translateLoadFailure(restoreUserShareForWalletAccount),
 		revokeDelegation: translateLoadFailure(revokeDelegation),
 		setWaasWalletAccountPassword: translateLoadFailure(setWaasWalletAccountPassword),
-		signMessage: translateLoadFailure(signMessage),
-		signRawMessage: translateLoadFailure(signRawMessage),
-		signSerializedTransaction: translateLoadFailure(signSerializedTransaction),
+		signMessage: translateLoadFailure(withRbacStaleRetry({ operation: signMessage })),
+		signRawMessage: translateLoadFailure(withRbacStaleRetry({ operation: signRawMessage })),
+		signSerializedTransaction: translateLoadFailure(withRbacStaleRetry({ operation: signSerializedTransaction })),
 		unlockWallet: translateLoadFailure(unlockWallet),
 		updatePassword: translateLoadFailure(updatePassword)
 	};
@@ -619,15 +649,15 @@ const exportWaasPrivateKeyToContainer = async ({ container, password, walletAcco
 /** @notInstrumented */
 const getAllUserWaasAddressesForChain = ({ chain }, client) => {
 	if (!client.user) return [];
-	return (client.user.verifiedCredentials.filter((credential) => credential.walletProvider === _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet && credential.walletName?.toLowerCase().startsWith(require_updateAuthFromVerifyResponse.DYNAMIC_WAAS_METADATA.normalizedWalletName) && credential.address && credential.chain && require_updateAuthFromVerifyResponse.getChainFromVerifiedCredentialChain(credential.chain) === chain) ?? []).map((credential) => credential.address);
+	return (client.user.verifiedCredentials.filter((credential) => credential.walletProvider === _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet && credential.walletName?.toLowerCase().startsWith(require_logoutWithReason.DYNAMIC_WAAS_METADATA.normalizedWalletName) && credential.address && credential.chain && require_logoutWithReason.getChainFromVerifiedCredentialChain(credential.chain) === chain) ?? []).map((credential) => credential.address);
 };
 
 //#endregion
 //#region src/exports/waasCore.ts
-(0, _dynamic_labs_sdk_assert_package_version.assertPackageVersion)(require_updateAuthFromVerifyResponse.name, require_updateAuthFromVerifyResponse.version);
+(0, _dynamic_labs_sdk_assert_package_version.assertPackageVersion)(require_logoutWithReason.name, require_logoutWithReason.version);
 
 //#endregion
-exports.DYNAMIC_WAAS_METADATA = require_updateAuthFromVerifyResponse.DYNAMIC_WAAS_METADATA;
+exports.DYNAMIC_WAAS_METADATA = require_logoutWithReason.DYNAMIC_WAAS_METADATA;
 exports.createWaasClient = createWaasClient;
 exports.createWaasProvider = createWaasProvider;
 exports.exportWaasPrivateKeyToContainer = exportWaasPrivateKeyToContainer;

package/dist/waasCore.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"waasCore.cjs","names":["createWaasClient: CreateWaasClient","getCore","DynamicWalletClient","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","DEFAULT_WAAS_BASE_MPC_RELAY_API_URL","CLIENT_SDK_NAME","getSignedSessionId","logoutWithReason","getElevatedAccessToken","consumeMfaTokenIfRequiredForAction","transactionBroadcastErrorMapper: ErrorMapper","APIError","TransactionBroadcastError","createApiClient","WaasTransactionEncoding","request: WaasTransactionBroadcastRequest","getCore","randomString","status: WaasTransactionBroadcastResult['status']","WaasTransactionBroadcastStatus","CHAINS_INFO_MAP","getCore","_waasClient: DynamicWalletClient | undefined","_waasClientSessionId: string | undefined","getWaasClient: WaasProvider['getWaasClient']","isUserOnboardingComplete","WaasOnboardingIncompleteError","backupKeySharesToGoogleDrive: WaasProvider['backupKeySharesToGoogleDrive']","getSignedSessionId","broadcastTransaction: WaasProvider['broadcastTransaction']","createOfflineRecoveryShares: WaasProvider['createOfflineRecoveryShares']","createWalletAccount: WaasProvider['createWalletAccount']","ThresholdSignatureScheme","delegateKeyShares: WaasProvider['delegateKeyShares']","exportClientKeyshares: WaasProvider['exportClientKeyshares']","exportPrivateKey: WaasProvider['exportPrivateKey']","MFAAction","TokenScope","restoreUserShareForWalletAccount: WaasProvider['restoreUserShareForWalletAccount']","WalletOperation","importPrivateKey: WaasProvider['importPrivateKey']","migrateFromFireblocks: WaasProvider['migrateFromFireblocks']","refreshWalletAccountShares: WaasProvider['refreshWalletAccountShares']","consumeMfaTokenIfRequiredForAction","reshareToNewSignerShareSet: WaasProvider['reshareToNewSignerShareSet']","revokeDelegation: WaasProvider['revokeDelegation']","setWaasWalletAccountPassword: WaasProvider['setWaasWalletAccountPassword']","signRawMessage: WaasProvider['signRawMessage']","InvalidParamError","destroy: WaasProvider['destroy']","updatePassword: WaasProvider['updatePassword']","signMessage: WaasProvider['signMessage']","signSerializedTransaction: WaasProvider['signSerializedTransaction']","getWalletRecoveryState: WaasProvider['getWalletRecoveryState']","unlockWallet: WaasProvider['unlockWallet']","WaasLoadFailedError","migrateFromFireblocks","getWaasWalletProviderFromWalletAccount","WalletProviderEnum","DYNAMIC_WAAS_METADATA","getChainFromVerifiedCredentialChain","packageName","packageVersion"],"sources":["../src/modules/waas/createWaasClient/createWaasClient.ts","../src/utils/createTranslateRejection/createTranslateRejection.ts","../src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts","../src/modules/waas/transactionBroadcastErrorMapper/transactionBroadcastErrorMapper.ts","../src/modules/waas/broadcastWaasTransaction/broadcastWaasTransaction.ts","../src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts","../src/modules/waas/createWaasProvider/isWaasLoadExhaustionError.ts","../src/modules/waas/createWaasProvider/createWaasProvider.ts","../src/modules/waas/exportWaasPrivateKeyToContainer/exportWaasPrivateKeyToContainer.ts","../src/modules/waas/getAllUserWaasAddressesForChain/getAllUserWaasAddressesForChain.ts","../src/exports/waasCore.ts"],"sourcesContent":["import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport { CLIENT_SDK_NAME } from '../../apiClient/constants';\nimport { logoutWithReason } from '../../auth/logoutWithReason';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport type { CreateWaasClient } from './createWaasClient.types';\nimport {\n  DEFAULT_WAAS_BASE_API_URL,\n  DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n} from '../constants';\n\n/** @notInstrumented */\nexport const createWaasClient: CreateWaasClient = ({ chainName }, client) => {\n  const core = getCore(client);\n\n  const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;\n\n  const baseClientKeysharesRelayApiUrl =\n    client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;\n\n  // Capture the session at construction time so the onUnauthorized guard can\n  // ignore notifications that arrive after a step-up reauth mints a new session.\n  // A client built against session S1 should never force-logout session S2.\n  const sessionIdAtCreation = core.state.get().user?.sessionId;\n\n  return new DynamicWalletClient(\n    {\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      authToken: client.token || '',\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n      baseMPCRelayApiUrl:\n        client.projectSettings?.sdk.waas?.relayUrl ||\n        DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n      chainName,\n      // Opt into the SDK self-driving eager key-share recovery on auth-token\n      // arrival, so the client no longer restores shares itself on login.\n      eagerlyRecoverKeyShares: true,\n      environmentId: core.environmentId,\n      sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,\n      ...(additionalTrustedOrigins == undefined\n        ? {}\n        : { additionalTrustedOrigins }),\n      ...(baseClientKeysharesRelayApiUrl == undefined\n        ? {}\n        : { baseClientKeysharesRelayApiUrl }),\n      ...(core.waas?.loadTimeoutMs == undefined\n        ? {}\n        : { iframeLoadTimeout: core.waas.loadTimeoutMs }),\n      ...(core.waas?.maxLoadRetries == undefined\n        ? {}\n        : { maxRetryAttempts: core.waas.maxLoadRetries }),\n    },\n    {\n      // Lets the iframe mint a fresh signed session id over the reverse channel,\n      // which the SDK's eager key-share recovery needs.\n      getSignedSessionId: () =>\n        getSignedSessionId(client).then(({ signature }) => signature),\n      // When the WaaS iframe's own backend call returns 401 (e.g. a forcibly\n      // revoked token), the iframe notifies the host via the reverse channel\n      // and this fires — log the user out. Mirrors the session-expiry\n      // middleware that covers the SDK's own direct API 401s.\n      //\n      // Guard: after a step-up reauth the session rotates. A client built\n      // against the previous session will receive this notification but must\n      // not force-logout the new session — ignore if the session has changed.\n      onUnauthorized: () => {\n        const currentSessionId = core.state.get().user?.sessionId;\n        if (currentSessionId !== sessionIdAtCreation) {\n          return;\n        }\n        void logoutWithReason(\n          { reason: 'session-refresh-unauthorized' },\n          client\n        ).catch((error) => {\n          core.logger.error(\n            'Failed to log out after WaaS unauthorized response',\n            error\n          );\n        });\n      },\n    }\n  );\n};\n","export type CreateTranslateRejectionParams<TMatched> = {\n  /**\n   * Builds the error thrown in place of a matched rejection.\n   */\n  mapTo: (error: TMatched) => Error;\n  /**\n   * Type guard selecting which rejections to translate. Anything it does not\n   * match is rethrown untouched, so callers only translate the errors they\n   * own. Narrowing to `TMatched` lets {@link CreateTranslateRejectionParams.mapTo}\n   * receive a typed error without a cast.\n   */\n  match: (error: unknown) => error is TMatched;\n};\n\n/**\n * Builds a reusable decorator, bound once to a `match`/`mapTo` pair, that wraps\n * any async function so a matching rejection is rethrown as `mapTo(error)`\n * while every other rejection — and every resolved value — passes through\n * untouched. Unmatched errors are rethrown by reference, so the decorator can\n * never swallow or reshape an error it was not asked to translate.\n *\n * Binding `match`/`mapTo` up front keeps the generic wrapping machinery here\n * instead of at the call site: consumers get a plain `(fn) => wrappedFn`\n * decorator they can apply to many functions of differing signatures, each of\n * which keeps its own argument and return types.\n *\n * @notInstrumented\n */\nexport const createTranslateRejection =\n  <TMatched>({\n    match,\n    mapTo,\n  }: CreateTranslateRejectionParams<TMatched>): (<\n    TArgs extends unknown[],\n    TReturn\n  >(\n    fn: (...args: TArgs) => Promise<TReturn>\n  ) => (...args: TArgs) => Promise<TReturn>) =>\n  <TArgs extends unknown[], TReturn>(\n    fn: (...args: TArgs) => Promise<TReturn>\n  ) =>\n  async (...args: TArgs): Promise<TReturn> => {\n    try {\n      return await fn(...args);\n    } catch (error) {\n      if (match(error)) {\n        throw mapTo(error);\n      }\n      throw error;\n    }\n  };\n","import type { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { consumeMfaTokenIfRequiredForAction } from '../../mfa/consumeMfaTokenIfRequiredForAction';\nimport { getElevatedAccessToken } from '../getElevatedAccessToken';\n\ntype GetActionAuthorizationTokensParams = {\n  mfaAction: MFAAction;\n  scope: TokenScope;\n};\n\ntype ActionAuthorizationTokens = {\n  elevatedAccessToken: string | undefined;\n  mfaToken: string | undefined;\n};\n\n/**\n * Resolves the tokens that authorize a verification-gated wallet action.\n *\n * An elevated access token for `scope` is the current proof of verification, so\n * it takes precedence: when one has been banked, the legacy per-action MFA token\n * is left untouched. Demanding both would break every user who has a verified\n * MFA method, because satisfying the challenge with `requestedScopes` mints an\n * elevated access token and no MFA token -- leaving nothing for\n * `consumeMfaTokenIfRequiredForAction` to consume, which then throws.\n *\n * @param params.mfaAction - The action whose legacy MFA requirement to evaluate.\n * @param params.scope - The scope of the elevated access token that authorizes the action.\n * @param client - The Dynamic client instance.\n * @returns The elevated access token, or the legacy MFA token when no elevated token exists.\n * @notInstrumented\n */\nexport const getActionAuthorizationTokens = async (\n  { mfaAction, scope }: GetActionAuthorizationTokensParams,\n  client: DynamicClient\n): Promise<ActionAuthorizationTokens> => {\n  const elevatedAccessToken = getElevatedAccessToken({ scope }, client);\n\n  if (elevatedAccessToken) {\n    return { elevatedAccessToken, mfaToken: undefined };\n  }\n\n  const mfaToken = await consumeMfaTokenIfRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  return { elevatedAccessToken: undefined, mfaToken };\n};\n","import { APIError } from '../../../errors/APIError';\nimport {\n  TransactionBroadcastError,\n  type TransactionBroadcastErrorCode,\n  type TransactionBroadcastSubmissionState,\n} from '../../../errors/TransactionBroadcastError';\nimport type { ErrorMapper } from '../../apiClient/apiClient.types';\n\nconst TRANSACTION_BROADCAST_ERROR_CODES = {\n  broadcast_idempotency_conflict: 'BROADCAST_IDEMPOTENCY_CONFLICT',\n  broadcast_outcome_unknown: 'BROADCAST_OUTCOME_UNKNOWN',\n  broadcast_rate_limited: 'BROADCAST_RATE_LIMITED',\n  broadcast_rejected: 'BROADCAST_REJECTED',\n  broadcast_requires_resign: 'BROADCAST_REQUIRES_RESIGN',\n  broadcast_wallet_ineligible: 'BROADCAST_WALLET_INELIGIBLE',\n  invalid_signed_transaction: 'INVALID_SIGNED_TRANSACTION',\n  network_not_enabled: 'NETWORK_NOT_ENABLED',\n  signed_transaction_wallet_mismatch:\n    'SIGNED_TRANSACTION_WALLET_MISMATCH',\n  unsupported_waas_chain: 'UNSUPPORTED_WAAS_CHAIN',\n} as const satisfies Record<string, TransactionBroadcastErrorCode>;\n\nconst TRANSACTION_BROADCAST_SUBMISSION_STATES = new Set<\n  TransactionBroadcastSubmissionState\n>(['not_submitted', 'requires_resign', 'unknown']);\n\n/**\n * Maps structured WaaS broadcast API failures to a public SDK error.\n *\n * @notInstrumented\n */\nexport const transactionBroadcastErrorMapper: ErrorMapper = (error) => {\n  if (!(error instanceof APIError)) {\n    return null;\n  }\n\n  const apiCode = error.code as keyof typeof TRANSACTION_BROADCAST_ERROR_CODES;\n  const code = TRANSACTION_BROADCAST_ERROR_CODES[apiCode];\n  if (!code) {\n    return null;\n  }\n\n  const payload = error.payload;\n\n  if (\n    !payload ||\n    typeof payload.attempts !== 'number' ||\n    typeof payload.broadcastId !== 'string' ||\n    typeof payload.retryable !== 'boolean' ||\n    typeof payload.submissionState !== 'string'\n  ) {\n    return null;\n  }\n\n  const submissionState =\n    payload.submissionState as TransactionBroadcastSubmissionState;\n\n  if (!TRANSACTION_BROADCAST_SUBMISSION_STATES.has(submissionState)) {\n    return null;\n  }\n\n  const transactionId =\n    typeof payload.transactionId === 'string'\n      ? payload.transactionId\n      : undefined;\n\n  return new TransactionBroadcastError({\n    attempts: payload.attempts,\n    broadcastId: payload.broadcastId,\n    cause: error,\n    code,\n    message: error.message,\n    retryable: payload.retryable,\n    submissionState,\n    transactionId,\n  });\n};\n","import {\n  type WaasTransactionBroadcastRequest,\n  WaasTransactionBroadcastStatus,\n  WaasTransactionEncoding,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { randomString } from '../../../utils/randomString/randomString';\nimport { createApiClient } from '../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { transactionBroadcastErrorMapper } from '../transactionBroadcastErrorMapper/transactionBroadcastErrorMapper';\nimport type {\n  WaasTransactionBroadcastEncoding,\n  WaasTransactionBroadcastResult,\n} from '../waas.types';\n\ntype BroadcastWaasTransactionParams = {\n  encoding: WaasTransactionBroadcastEncoding;\n  networkId: string;\n  signedTransaction: string;\n  skipPreflight?: boolean;\n  walletAccount: WalletAccount;\n};\n\nconst IDEMPOTENCY_KEY_LENGTH = 50;\n\n/**\n * Broadcasts an already-signed v3 WaaS transaction through the Dynamic API.\n *\n * @notInstrumented\n */\nexport const broadcastWaasTransaction = async (\n  {\n    encoding,\n    networkId,\n    signedTransaction,\n    skipPreflight,\n    walletAccount,\n  }: BroadcastWaasTransactionParams,\n  client: DynamicClient\n): Promise<WaasTransactionBroadcastResult> => {\n  const apiClient = createApiClient(\n    { errorMappers: [transactionBroadcastErrorMapper] },\n    client\n  );\n\n  let apiEncoding = WaasTransactionEncoding.Hex;\n  if (encoding === 'base64') {\n    apiEncoding = WaasTransactionEncoding.Base64;\n  }\n\n  const request: WaasTransactionBroadcastRequest = {\n    encoding: apiEncoding,\n    networkId,\n    signedTransaction,\n  };\n  if (skipPreflight !== undefined) {\n    request.options = { skipPreflight };\n  }\n\n  // WalletAccount.id is a composite (`walletProviderKey:address`), but the\n  // broadcast endpoint is keyed by the wallet UUID stored in verifiedCredentialId.\n  const walletId = walletAccount.verifiedCredentialId;\n  assertDefined(\n    walletId,\n    'Wallet account verified credential id is required for broadcasting'\n  );\n\n  const response = await apiClient.broadcastWaasTransaction({\n    environmentId: getCore(client).environmentId,\n    waasTransactionBroadcastRequest: request,\n    walletId,\n    xIdempotencyKey: randomString({ length: IDEMPOTENCY_KEY_LENGTH }),\n  });\n\n  let status: WaasTransactionBroadcastResult['status'] = 'submitted';\n  if (response.status === WaasTransactionBroadcastStatus.AlreadyKnown) {\n    status = 'already_known';\n  }\n\n  return {\n    attempts: response.attempts,\n    broadcastId: response.broadcastId,\n    status,\n    transactionId: response.transactionId,\n  };\n};\n","import type { Chain } from '../../chain';\nimport { CHAINS_INFO_MAP } from '../../wallets/constants';\n\n/** @notInstrumented */\n// eslint-disable-next-line custom-rules/require-single-object-param\nexport const getWaasChainNameFromChain = (chain: Chain): string => {\n  return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;\n};\n","/**\n * Exact message prefix of the rejection thrown by\n * `@dynamic-labs-wallet/browser-wallet-client` when the secure container load\n * exhausts all retry attempts. The upstream library throws a plain `Error`\n * with no code, so message matching is the only detection mechanism available;\n * the dependency is pinned to an exact version and the spec pins this string\n * so drift is caught at upgrade time.\n */\nconst UPSTREAM_LOAD_EXHAUSTION_MESSAGE_PREFIX =\n  'Failed to load iframe after all retry attempts';\n\n/**\n * True when `error` is the upstream \"load retry attempts exhausted\" rejection\n * from the embedded (WaaS) wallet's secure container load. Narrows to `Error`\n * so the matched value can be forwarded as a typed error cause without a cast,\n * and guards `instanceof Error` before reading `.message` so a non-`Error`\n * rejection never throws during detection.\n *\n * @notInstrumented\n */\nexport const isWaasLoadExhaustionError = (error: unknown): error is Error =>\n  error instanceof Error &&\n  error.message.startsWith(UPSTREAM_LOAD_EXHAUSTION_MESSAGE_PREFIX);\n","import {\n  type BitcoinConfig,\n  type DynamicWalletClient,\n  ThresholdSignatureScheme,\n  WalletOperation,\n} from '@dynamic-labs-wallet/browser-wallet-client';\nimport { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { InvalidParamError } from '../../../errors/InvalidParamError';\nimport { WaasLoadFailedError } from '../../../errors/WaasLoadFailedError';\nimport { WaasOnboardingIncompleteError } from '../../../errors/WaasOnboardingIncompleteError';\nimport { createTranslateRejection } from '../../../utils/createTranslateRejection';\nimport { getActionAuthorizationTokens } from '../../auth/getActionAuthorizationTokens';\nimport type { Chain } from '../../chain';\nimport { consumeMfaTokenIfRequiredForAction } from '../../mfa/consumeMfaTokenIfRequiredForAction';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport { isUserOnboardingComplete } from '../../user/isUserOnboardingComplete';\nimport { broadcastWaasTransaction } from '../broadcastWaasTransaction/broadcastWaasTransaction';\nimport { createWaasClient } from '../createWaasClient';\nimport { getWaasChainNameFromChain } from '../getWaasChainNameFromChain';\nimport type { WaasProvider } from '../waas.types';\nimport { isWaasLoadExhaustionError } from './isWaasLoadExhaustionError';\n\nconst RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH = 64;\n\ntype CreateWaasProviderParams = {\n  chain: Chain;\n  sdkClient: DynamicClient;\n};\n\n/** @notInstrumented */\nexport const createWaasProvider = ({\n  sdkClient,\n  chain,\n}: CreateWaasProviderParams): WaasProvider => {\n  const logger = getCore(sdkClient).logger;\n\n  let _waasClient: DynamicWalletClient | undefined;\n  // The session the cached client was built against. A step-up reauth mints a\n  // NEW session (new sessionId + token); see the rebuild guard below.\n  let _waasClientSessionId: string | undefined;\n\n  // Drops the cached client only when it still points at `client`. Guarding on\n  // identity matters because a step-up reauth can mint a new session and rebuild\n  // a healthy client (via the session-change reset in getWaasClient) while an\n  // older client's initialize()/operation is still failing in flight. Clearing\n  // in that case would orphan the healthy replacement, since nothing would\n  // release its upstream shared-container reference. _waasClientSessionId is\n  // cleared alongside to keep the pair consistent.\n  const resetClientIfCurrent = (client: DynamicWalletClient): void => {\n    if (_waasClient === client) {\n      _waasClient = undefined;\n      _waasClientSessionId = undefined;\n    }\n  };\n\n  // because the waas client needs the authToken to be set, we can only create it\n  // the first time it's needed, which is after the user has logged in\n  const getWaasClient: WaasProvider['getWaasClient'] = async () => {\n    // After a step-up reauthentication a new session is minted. In header auth\n    // mode (native webview) the iframe has no cookie jar to fall back on, so a\n    // client cached against the previous session keeps presenting the stale\n    // token — its next backend call (createRooms/users) 401s and trips the\n    // iframe's onUnauthorized → forced logout. Drop the cached client when the\n    // session changes so it rebuilds + re-initializes with the fresh token and\n    // signed session id. Key shares stay in storage (only client auth resets);\n    // routine token refresh keeps the same sessionId, so it does not rebuild.\n    const currentSessionId = getCore(sdkClient).state.get().user?.sessionId;\n    if (_waasClient && currentSessionId !== _waasClientSessionId) {\n      _waasClient = undefined;\n    }\n\n    if (!_waasClient) {\n      // Chokepoint: don't build + initialize the iframe client until onboarding\n      // is complete. The iframe's init-time room-cache pre-warm fires\n      // `createRooms` using the token captured at construction — before any\n      // per-operation token resync exists to correct it. Built while the token\n      // is still pre-`user:basic` (MFA / KYC / recovery codes / device\n      // registration pending), that pre-warm 401s and trips the iframe's\n      // onUnauthorized → forced-logout. This is the single gateway to\n      // createWaasClient (web and native), so it covers every WaaS caller.\n      if (!isUserOnboardingComplete(sdkClient)) {\n        throw new WaasOnboardingIncompleteError();\n      }\n\n      const builtClient = createWaasClient(\n        { chainName: getWaasChainNameFromChain(chain) },\n        sdkClient\n      );\n      _waasClient = builtClient;\n      _waasClientSessionId = currentSessionId;\n      try {\n        await builtClient.initialize();\n      } catch (error) {\n        // A failed load (e.g. iframe retry exhaustion) leaves an unusable,\n        // never-initialized client cached. Drop it so the next getWaasClient()\n        // rebuilds and re-initializes — the fresh load cycle WaasLoadFailedError\n        // documents — instead of returning the dead client for the rest of the\n        // session. Identity-guarded (see resetClientIfCurrent).\n        resetClientIfCurrent(builtClient);\n        throw error;\n      }\n    }\n    // Read the shared var, not the locally-built client: if a concurrent\n    // session-change rebuilt a fresh client while this initialize() was pending,\n    // the caller should get that current healthy client, not this now-superseded\n    // instance built against the old session.\n    return _waasClient;\n  };\n\n  // Runs an operation against an already-fetched client and, if it fails because\n  // the container's load was exhausted mid-flight (the client built and\n  // initialized fine, then its iframe died — e.g. tab backgrounding, relogin —\n  // and its own recovery could not reload), drops the cached client so the next\n  // operation rebuilds and re-initializes. This covers the post-initialization\n  // path that getWaasClient's own load-failure reset cannot see, so the\n  // fresh-load cycle WaasLoadFailedError documents holds for every operation,\n  // not just the first load. Identity-guarded (see resetClientIfCurrent).\n  const discardClientOnLoadFailure = async <TReturn>({\n    waasClient,\n    operation,\n  }: {\n    operation: () => Promise<TReturn>;\n    waasClient: DynamicWalletClient;\n  }): Promise<TReturn> => {\n    try {\n      return await operation();\n    } catch (error) {\n      if (isWaasLoadExhaustionError(error)) {\n        resetClientIfCurrent(waasClient);\n      }\n      throw error;\n    }\n  };\n\n  const backupKeySharesToGoogleDrive: WaasProvider['backupKeySharesToGoogleDrive'] =\n    async ({ googleDriveAccessToken, password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.backupKeySharesToGoogleDrive({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            googleDriveAccessToken,\n            password,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const broadcastTransaction: WaasProvider['broadcastTransaction'] = (args) =>\n    broadcastWaasTransaction(args, sdkClient);\n\n  const createOfflineRecoveryShares: WaasProvider['createOfflineRecoveryShares'] =\n    async ({ cloudProviderAccessToken, mfaToken, password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.offlineRecovery({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            cloudProviderAccessToken,\n            mfaToken,\n            password,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const createWalletAccount: WaasProvider['createWalletAccount'] = async (\n    args = {}\n  ) => {\n    logger.debug('[createWaasProvider] createWalletAccount', {\n      bitcoinConfig: args.bitcoinConfig,\n      thresholdSignatureScheme: args.thresholdSignatureScheme,\n    });\n\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    const waasWallet = await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.createWalletAccount({\n          authToken: sdkClient.token ?? undefined,\n          bitcoinConfig: args.bitcoinConfig as BitcoinConfig | undefined,\n          businessAccountId: args.businessAccountId,\n          password: args.password,\n          signedSessionId,\n          thresholdSignatureScheme:\n            args.thresholdSignatureScheme ??\n            ThresholdSignatureScheme.TWO_OF_TWO,\n        }),\n      waasClient,\n    });\n\n    return waasWallet;\n  };\n\n  const delegateKeyShares: WaasProvider['delegateKeyShares'] = async ({\n    initialSignerRules,\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.delegateKeyShares({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          initialSignerRules,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const exportClientKeyshares: WaasProvider['exportClientKeyshares'] = async ({\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.exportClientKeyshares({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const exportPrivateKey: WaasProvider['exportPrivateKey'] = async ({\n    container,\n    displayContainer,\n    walletAccount,\n    password,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    // Forwards whichever token proves the export was verified: the elevated\n    // wallet:export token banked by step-up, or the legacy per-action MFA token.\n    const { elevatedAccessToken, mfaToken } =\n      await getActionAuthorizationTokens(\n        {\n          mfaAction: MFAAction.WalletWaasExport,\n          scope: TokenScope.Walletexport,\n        },\n        sdkClient\n      );\n\n    await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.exportPrivateKey({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          // Exactly one display surface is forwarded: `container` (a\n          // WaasSDKContainer, e.g. a React Native visible WebView) or\n          // `displayContainer` (a DOM element, web). The upstream client enforces\n          // the \"exactly one\" invariant and renders the key inside the surface's\n          // own sandboxed document — it never crosses back to the host.\n          container,\n          displayContainer,\n          elevatedAccessToken,\n          mfaToken,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const restoreUserShareForWalletAccount: WaasProvider['restoreUserShareForWalletAccount'] =\n    async ({ walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      await discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.getWallet({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            signedSessionId,\n            walletOperation: WalletOperation.SIGN_MESSAGE,\n          }),\n        waasClient,\n      });\n    };\n\n  const importPrivateKey: WaasProvider['importPrivateKey'] = async ({\n    privateKey,\n    thresholdSignatureScheme = ThresholdSignatureScheme.TWO_OF_TWO,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const walletClient = await getWaasClient();\n\n    await discardClientOnLoadFailure({\n      operation: () =>\n        walletClient.importPrivateKey({\n          authToken: sdkClient.token ?? undefined,\n          privateKey,\n          signedSessionId,\n          thresholdSignatureScheme,\n        }),\n      waasClient: walletClient,\n    });\n  };\n\n  const migrateFromFireblocks: WaasProvider['migrateFromFireblocks'] = async ({\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const walletClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        walletClient.migrateFromFireblocks({\n          authToken: sdkClient.token ?? undefined,\n          fireblocks: {\n            deviceId,\n            expectedAddresses,\n            jwt,\n            ncwStorage: storage,\n            walletPassword: password,\n            ...(coinTypes ? { coinTypes } : {}),\n          },\n          signedSessionId,\n        }),\n      waasClient: walletClient,\n    });\n  };\n\n  const refreshWalletAccountShares: WaasProvider['refreshWalletAccountShares'] =\n    async ({ password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const walletClient = await getWaasClient();\n\n      const mfaToken = await consumeMfaTokenIfRequiredForAction(\n        { mfaAction: MFAAction.WalletWaasRefresh },\n        sdkClient\n      );\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          walletClient.refreshWalletAccountShares({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            mfaToken,\n            password,\n            signedSessionId,\n          }),\n        waasClient: walletClient,\n      });\n    };\n\n  const reshareToNewSignerShareSet: WaasProvider['reshareToNewSignerShareSet'] =\n    async ({\n      businessAccountId,\n      password,\n      signerType,\n      targetSignerIdentity,\n      walletAccount,\n    }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      const { elevatedAccessToken } = await getActionAuthorizationTokens(\n        {\n          mfaAction: MFAAction.WalletWaasReshare,\n          scope: TokenScope.BusinessAccountsigneradd,\n        },\n        sdkClient\n      );\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.reshareToNewSignerShareSet({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            businessAccountId,\n            elevatedAccessToken,\n            password,\n            signedSessionId,\n            // Public API uses a string union; the client expects the core enum\n            // (identical values). Cast at this single boundary.\n            signerType: signerType as Parameters<\n              typeof waasClient.reshareToNewSignerShareSet\n            >[0]['signerType'],\n            targetSignerIdentity,\n          }),\n        waasClient,\n      });\n    };\n\n  const revokeDelegation: WaasProvider['revokeDelegation'] = async ({\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.revokeDelegation({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const setWaasWalletAccountPassword: WaasProvider['setWaasWalletAccountPassword'] =\n    async ({ password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.setPassword({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            newPassword: password,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const signRawMessage: WaasProvider['signRawMessage'] = async ({\n    message,\n    password,\n    walletAccount,\n  }) => {\n    if (message.length !== RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH) {\n      throw new InvalidParamError(\n        `Message must be ${RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH} characters long`\n      );\n    }\n\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const { elevatedAccessToken, mfaToken } =\n      await getActionAuthorizationTokens(\n        { mfaAction: MFAAction.WalletWaasSign, scope: TokenScope.Walletsign },\n        sdkClient\n      );\n\n    const walletClient = await getWaasClient();\n\n    const signature = await discardClientOnLoadFailure({\n      operation: () =>\n        walletClient.signRawMessage({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          elevatedAccessToken,\n          message,\n          mfaToken,\n          password,\n          signedSessionId,\n        }),\n      waasClient: walletClient,\n    });\n\n    return { signature };\n  };\n\n  const destroy: WaasProvider['destroy'] = async (args) => {\n    if (!_waasClient) {\n      return;\n    }\n\n    const waasClient = await getWaasClient();\n    // When a session token expires, we preserve key shares in storage instead\n    // of clearing them. Customers with short-lived sessions (minutes) were\n    // hitting excessive server-side share recovery on every re-login, which\n    // also forced users to re-enter their wallet password since the unlocked\n    // share only lives for the duration of the session.\n    //\n    // This is safe because the waas-sdk separately fingerprints the user\n    // (sub + environment_id) and clears all storage if a different user logs\n    // in. On explicit user-initiated logout, shares are always cleared for\n    // security.\n    if (args?.reason !== 'token-expired') {\n      await waasClient.cleanup();\n    }\n    _waasClient = undefined;\n  };\n\n  const updatePassword: WaasProvider['updatePassword'] = async ({\n    walletAccount,\n    currentPassword,\n    newPassword,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.updatePassword({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          existingPassword: currentPassword,\n          newPassword,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const signMessage: WaasProvider['signMessage'] = async ({\n    message,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const { elevatedAccessToken, mfaToken } =\n      await getActionAuthorizationTokens(\n        { mfaAction: MFAAction.WalletWaasSign, scope: TokenScope.Walletsign },\n        sdkClient\n      );\n\n    const waasClient = await getWaasClient();\n\n    const signature = await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.signMessage({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          elevatedAccessToken,\n          message,\n          mfaToken,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n\n    return { signature };\n  };\n\n  const signSerializedTransaction: WaasProvider['signSerializedTransaction'] =\n    async ({ chainId, serializedTransaction, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const { elevatedAccessToken, mfaToken } =\n        await getActionAuthorizationTokens(\n          { mfaAction: MFAAction.WalletWaasSign, scope: TokenScope.Walletsign },\n          sdkClient\n        );\n\n      const waasClient = await getWaasClient();\n\n      const signature = await discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.signTransaction({\n            authToken: sdkClient.token ?? undefined,\n            chainId,\n            elevatedAccessToken,\n            mfaToken,\n            senderAddress: walletAccount.address,\n            signedSessionId,\n            transaction: serializedTransaction,\n          }),\n        waasClient,\n      });\n\n      return { signature };\n    };\n\n  const getWalletRecoveryState: WaasProvider['getWalletRecoveryState'] =\n    async ({ walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.getWalletRecoveryState({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const unlockWallet: WaasProvider['unlockWallet'] = async ({\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.unlockWallet({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  // Every operation is wrapped so an exhausted container load surfaces as a\n  // typed WaasLoadFailedError no matter which call triggers it — the initial\n  // load or a mid-operation recovery. Wrapped at the operation itself (rather\n  // than a separate whole-provider pass) so the translation is visible right\n  // where the provider is assembled.\n  const translateLoadFailure = createTranslateRejection({\n    mapTo: (error) => new WaasLoadFailedError({ cause: error }),\n    match: isWaasLoadExhaustionError,\n  });\n\n  const provider: WaasProvider = {\n    backupKeySharesToGoogleDrive: translateLoadFailure(\n      backupKeySharesToGoogleDrive\n    ),\n    broadcastTransaction,\n    createOfflineRecoveryShares: translateLoadFailure(\n      createOfflineRecoveryShares\n    ),\n    createWalletAccount: translateLoadFailure(createWalletAccount),\n    delegateKeyShares: translateLoadFailure(delegateKeyShares),\n    destroy: translateLoadFailure(destroy),\n    exportClientKeyshares: translateLoadFailure(exportClientKeyshares),\n    exportPrivateKey: translateLoadFailure(exportPrivateKey),\n    getWaasClient: translateLoadFailure(getWaasClient),\n    getWalletRecoveryState: translateLoadFailure(getWalletRecoveryState),\n    importPrivateKey: translateLoadFailure(importPrivateKey),\n    migrateFromFireblocks: translateLoadFailure(migrateFromFireblocks),\n    refreshWalletAccountShares: translateLoadFailure(\n      refreshWalletAccountShares\n    ),\n    reshareToNewSignerShareSet: translateLoadFailure(\n      reshareToNewSignerShareSet\n    ),\n    restoreUserShareForWalletAccount: translateLoadFailure(\n      restoreUserShareForWalletAccount\n    ),\n    revokeDelegation: translateLoadFailure(revokeDelegation),\n    setWaasWalletAccountPassword: translateLoadFailure(\n      setWaasWalletAccountPassword\n    ),\n    signMessage: translateLoadFailure(signMessage),\n    signRawMessage: translateLoadFailure(signRawMessage),\n    signSerializedTransaction: translateLoadFailure(signSerializedTransaction),\n    unlockWallet: translateLoadFailure(unlockWallet),\n    updatePassword: translateLoadFailure(updatePassword),\n  };\n\n  return provider;\n};\n","import type { WaasSDKContainer } from '@dynamic-labs-wallet/core';\n\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype ExportWaasPrivateKeyToContainerParams = {\n  container: WaasSDKContainer;\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Exports the private key for a WaaS wallet account into a caller-provided\n * {@link WaasSDKContainer} (e.g. a visible React Native WebView) instead of a\n * DOM element.\n *\n * This is the container-based counterpart to `exportWaasPrivateKey` (which\n * injects an iframe into a DOM `displayContainer` on web). The export ceremony\n * runs — and the private key is rendered — entirely inside the container's own\n * sandboxed document; the key is never exposed to the host JS layer. The caller\n * owns the container's lifecycle and must call `container.destroy()` when the\n * display is dismissed.\n *\n * @param params.walletAccount - The WaaS wallet account to export the private key from.\n * @param params.container - The container that hosts the secure key display.\n * @param [params.password] - Optional password to decrypt the private key.\n * @param client - The Dynamic client instance. This is an internal API (exposed\n *   only via `@dynamic-labs-sdk/client/waas/core`), so the client is passed\n *   explicitly rather than defaulted — callers resolve it (e.g. via\n *   `getDefaultClient()`) and thread it in.\n * @returns A promise that resolves when the private key export is complete.\n * @notInstrumented\n */\nexport const exportWaasPrivateKeyToContainer = async (\n  { container, password, walletAccount }: ExportWaasPrivateKeyToContainerParams,\n  client: DynamicClient\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.exportPrivateKey({\n    container,\n    password,\n    walletAccount,\n  });\n};\n","import { WalletProviderEnum } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../client/types';\nimport { getChainFromVerifiedCredentialChain } from '../../../utils/getChainFromVerifiedCredentialChain';\nimport type { Chain } from '../../chain';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\n\ntype GetAllUserWaasAddressesForChainParams = {\n  chain: Chain;\n};\n\n/** @notInstrumented */\nexport const getAllUserWaasAddressesForChain = (\n  { chain }: GetAllUserWaasAddressesForChainParams,\n  client: DynamicClient\n): string[] => {\n  if (!client.user) {\n    return [];\n  }\n\n  const waasWalletCredentials =\n    client.user.verifiedCredentials.filter(\n      (credential) =>\n        credential.walletProvider === WalletProviderEnum.EmbeddedWallet &&\n        credential.walletName\n          ?.toLowerCase()\n          .startsWith(DYNAMIC_WAAS_METADATA.normalizedWalletName) &&\n        credential.address &&\n        credential.chain &&\n        getChainFromVerifiedCredentialChain(credential.chain) === chain\n    ) ?? [];\n\n  const waasAddresses: string[] = waasWalletCredentials.map(\n    // casting because we're already filtering out credentials without an address\n    (credential) => credential.address as string\n  );\n\n  return waasAddresses;\n};\n","import { assertPackageVersion } from '@dynamic-labs-sdk/assert-package-version';\n\nimport {\n  name as packageName,\n  version as packageVersion,\n} from '../../package.json';\nassertPackageVersion(packageName, packageVersion);\n\nexport type {\n  BitcoinNetwork,\n  DynamicWalletClient,\n  MigrateFromFireblocksResponse,\n  ThresholdSignatureScheme,\n} from '@dynamic-labs-wallet/browser-wallet-client';\nexport type { WaasSDKContainer } from '@dynamic-labs-wallet/core';\nexport { DYNAMIC_WAAS_METADATA } from '../modules/waas/constants';\nexport { createWaasClient } from '../modules/waas/createWaasClient';\nexport { createWaasProvider } from '../modules/waas/createWaasProvider';\nexport { exportWaasPrivateKeyToContainer } from '../modules/waas/exportWaasPrivateKeyToContainer';\nexport { getAllUserWaasAddressesForChain } from '../modules/waas/getAllUserWaasAddressesForChain';\nexport { getWaasChainNameFromChain } from '../modules/waas/getWaasChainNameFromChain';\nexport { migrateFromFireblocks } from '../modules/waas/migrateFromFireblocks';\nexport { preconnectWaasIframe } from '../modules/waas/preconnectWaasIframe';\nexport type {\n  WaasProvider,\n  WaasTransactionBroadcastEncoding,\n  WaasTransactionBroadcastResult,\n  WaasWalletProvider,\n} from '../modules/waas/waas.types';\n"],"mappings":";;;;;;;;;;;;AAeA,MAAaA,oBAAsC,EAAE,aAAa,WAAW;CAC3E,MAAM,OAAOC,6CAAQ,OAAO;CAE5B,MAAM,2BAA2B,KAAK,MAAM;CAE5C,MAAM,iCACJ,OAAO,iBAAiB,IAAI,MAAM;CAKpC,MAAM,sBAAsB,KAAK,MAAM,KAAK,CAAC,MAAM;AAEnD,QAAO,IAAIC,+DACT;EACE,UAAWC,qDAAgB,OAAO,GAAG,WAAW;EAChD,WAAW,OAAO,SAAS;EAC3B,aAAa,KAAK,cAAcC,gEAA2B,QACzD,WACA,GACD;EACD,oBACE,OAAO,iBAAiB,IAAI,MAAM,YAClCC;EACF;EAGA,yBAAyB;EACzB,eAAe,KAAK;EACpB,YAAY,GAAGC,qDAAgB,GAAG,KAAK;EACvC,GAAI,4BAA4B,SAC5B,EAAE,GACF,EAAE,0BAA0B;EAChC,GAAI,kCAAkC,SAClC,EAAE,GACF,EAAE,gCAAgC;EACtC,GAAI,KAAK,MAAM,iBAAiB,SAC5B,EAAE,GACF,EAAE,mBAAmB,KAAK,KAAK,eAAe;EAClD,GAAI,KAAK,MAAM,kBAAkB,SAC7B,EAAE,GACF,EAAE,kBAAkB,KAAK,KAAK,gBAAgB;EACnD,EACD;EAGE,0BACEC,8CAAmB,OAAO,CAAC,MAAM,EAAE,gBAAgB,UAAU;EAS/D,sBAAsB;AAEpB,OADyB,KAAK,MAAM,KAAK,CAAC,MAAM,cACvB,oBACvB;AAEF,GAAKC,gEACH,EAAE,QAAQ,gCAAgC,EAC1C,OACD,CAAC,OAAO,UAAU;AACjB,SAAK,OAAO,MACV,sDACA,MACD;KACD;;EAEL,CACF;;;;;;;;;;;;;;;;;;;AC3DH,MAAa,4BACA,EACT,OACA,aAQA,OAEF,OAAO,GAAG,SAAkC;AAC1C,KAAI;AACF,SAAO,MAAM,GAAG,GAAG,KAAK;UACjB,OAAO;AACd,MAAI,MAAM,MAAM,CACd,OAAM,MAAM,MAAM;AAEpB,QAAM;;;;;;;;;;;;;;;;;;;;;;AChBZ,MAAa,+BAA+B,OAC1C,EAAE,WAAW,SACb,WACuC;CACvC,MAAM,sBAAsBC,4DAAuB,EAAE,OAAO,EAAE,OAAO;AAErE,KAAI,oBACF,QAAO;EAAE;EAAqB,UAAU;EAAW;AAQrD,QAAO;EAAE,qBAAqB;EAAW,UALxB,MAAMC,8DACrB,EAAE,WAAW,EACb,OACD;EAEkD;;;;;ACvCrD,MAAM,oCAAoC;CACxC,gCAAgC;CAChC,2BAA2B;CAC3B,wBAAwB;CACxB,oBAAoB;CACpB,2BAA2B;CAC3B,6BAA6B;CAC7B,4BAA4B;CAC5B,qBAAqB;CACrB,oCACE;CACF,wBAAwB;CACzB;AAED,MAAM,0CAA0C,IAAI,IAElD;CAAC;CAAiB;CAAmB;CAAU,CAAC;;;;;;AAOlD,MAAaC,mCAAgD,UAAU;AACrE,KAAI,EAAE,iBAAiBC,+CACrB,QAAO;CAIT,MAAM,OAAO,kCADG,MAAM;AAEtB,KAAI,CAAC,KACH,QAAO;CAGT,MAAM,UAAU,MAAM;AAEtB,KACE,CAAC,WACD,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,gBAAgB,YAC/B,OAAO,QAAQ,cAAc,aAC7B,OAAO,QAAQ,oBAAoB,SAEnC,QAAO;CAGT,MAAM,kBACJ,QAAQ;AAEV,KAAI,CAAC,wCAAwC,IAAI,gBAAgB,CAC/D,QAAO;CAGT,MAAM,gBACJ,OAAO,QAAQ,kBAAkB,WAC7B,QAAQ,gBACR;AAEN,QAAO,IAAIC,uDAA0B;EACnC,UAAU,QAAQ;EAClB,aAAa,QAAQ;EACrB,OAAO;EACP;EACA,SAAS,MAAM;EACf,WAAW,QAAQ;EACnB;EACA;EACD,CAAC;;;;;ACjDJ,MAAM,yBAAyB;;;;;;AAO/B,MAAa,2BAA2B,OACtC,EACE,UACA,WACA,mBACA,eACA,iBAEF,WAC4C;CAC5C,MAAM,YAAYC,qDAChB,EAAE,cAAc,CAAC,gCAAgC,EAAE,EACnD,OACD;CAED,IAAI,cAAcC,mDAAwB;AAC1C,KAAI,aAAa,SACf,eAAcA,mDAAwB;CAGxC,MAAMC,UAA2C;EAC/C,UAAU;EACV;EACA;EACD;AACD,KAAI,kBAAkB,OACpB,SAAQ,UAAU,EAAE,eAAe;CAKrC,MAAM,WAAW,cAAc;AAC/B,oDACE,UACA,qEACD;CAED,MAAM,WAAW,MAAM,UAAU,yBAAyB;EACxD,eAAeC,6CAAQ,OAAO,CAAC;EAC/B,iCAAiC;EACjC;EACA,iBAAiBC,kDAAa,EAAE,QAAQ,wBAAwB,CAAC;EAClE,CAAC;CAEF,IAAIC,SAAmD;AACvD,KAAI,SAAS,WAAWC,0DAA+B,aACrD,UAAS;AAGX,QAAO;EACL,UAAU,SAAS;EACnB,aAAa,SAAS;EACtB;EACA,eAAe,SAAS;EACzB;;;;;;AClFH,MAAa,6BAA6B,UAAyB;AACjE,QAAOC,qDAAgB,OAAO,yBAAyB;;;;;;;;;;;;;ACEzD,MAAM,0CACJ;;;;;;;;;;AAWF,MAAa,6BAA6B,UACxC,iBAAiB,SACjB,MAAM,QAAQ,WAAW,wCAAwC;;;;ACGnE,MAAM,sCAAsC;;AAQ5C,MAAa,sBAAsB,EACjC,WACA,YAC4C;CAC5C,MAAM,SAASC,6CAAQ,UAAU,CAAC;CAElC,IAAIC;CAGJ,IAAIC;CASJ,MAAM,wBAAwB,WAAsC;AAClE,MAAI,gBAAgB,QAAQ;AAC1B,iBAAc;AACd,0BAAuB;;;CAM3B,MAAMC,gBAA+C,YAAY;EAS/D,MAAM,mBAAmBH,6CAAQ,UAAU,CAAC,MAAM,KAAK,CAAC,MAAM;AAC9D,MAAI,eAAe,qBAAqB,qBACtC,eAAc;AAGhB,MAAI,CAAC,aAAa;AAShB,OAAI,CAACI,0DAAyB,UAAU,CACtC,OAAM,IAAIC,gEAA+B;GAG3C,MAAM,cAAc,iBAClB,EAAE,WAAW,0BAA0B,MAAM,EAAE,EAC/C,UACD;AACD,iBAAc;AACd,0BAAuB;AACvB,OAAI;AACF,UAAM,YAAY,YAAY;YACvB,OAAO;AAMd,yBAAqB,YAAY;AACjC,UAAM;;;AAOV,SAAO;;CAWT,MAAM,6BAA6B,OAAgB,EACjD,YACA,gBAIsB;AACtB,MAAI;AACF,UAAO,MAAM,WAAW;WACjB,OAAO;AACd,OAAI,0BAA0B,MAAM,CAClC,sBAAqB,WAAW;AAElC,SAAM;;;CAIV,MAAMC,+BACJ,OAAO,EAAE,wBAAwB,UAAU,oBAAoB;EAC7D,MAAM,EAAE,WAAW,oBAAoB,MAAMC,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,6BAA6B;IACtC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMC,wBAA8D,SAClE,yBAAyB,MAAM,UAAU;CAE3C,MAAMC,8BACJ,OAAO,EAAE,0BAA0B,UAAU,UAAU,oBAAoB;EACzE,MAAM,EAAE,WAAW,oBAAoB,MAAMF,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,gBAAgB;IACzB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMG,sBAA2D,OAC/D,OAAO,EAAE,KACN;AACH,SAAO,MAAM,4CAA4C;GACvD,eAAe,KAAK;GACpB,0BAA0B,KAAK;GAChC,CAAC;EAEF,MAAM,EAAE,WAAW,oBAAoB,MAAMH,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAiBxC,SAfmB,MAAM,2BAA2B;GAClD,iBACE,WAAW,oBAAoB;IAC7B,WAAW,UAAU,SAAS;IAC9B,eAAe,KAAK;IACpB,mBAAmB,KAAK;IACxB,UAAU,KAAK;IACf;IACA,0BACE,KAAK,4BACLI,oEAAyB;IAC5B,CAAC;GACJ;GACD,CAAC;;CAKJ,MAAMC,oBAAuD,OAAO,EAClE,oBACA,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAML,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,kBAAkB;IAC3B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMM,wBAA+D,OAAO,EAC1E,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMN,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,QAAM,2BAA2B;GAC/B,iBACE,WAAW,sBAAsB;IAC/B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMO,mBAAqD,OAAO,EAChE,WACA,kBACA,eACA,eACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMP,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;EAIxC,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GACE,WAAWQ,qCAAU;GACrB,OAAOC,sCAAW;GACnB,EACD,UACD;AAEH,QAAM,2BAA2B;GAC/B,iBACE,WAAW,iBAAiB;IAC1B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAM9B;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMC,mCACJ,OAAO,EAAE,oBAAoB;EAC3B,MAAM,EAAE,WAAW,oBAAoB,MAAMV,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,QAAM,2BAA2B;GAC/B,iBACE,WAAW,UAAU;IACnB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA,iBAAiBW,2DAAgB;IAClC,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMC,mBAAqD,OAAO,EAChE,YACA,2BAA2BR,oEAAyB,iBAChD;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMJ,8CAAmB,UAAU;EAE1E,MAAM,eAAe,MAAM,eAAe;AAE1C,QAAM,2BAA2B;GAC/B,iBACE,aAAa,iBAAiB;IAC5B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ,YAAY;GACb,CAAC;;CAGJ,MAAMa,0BAA+D,OAAO,EAC1E,WACA,UACA,mBACA,KACA,UACA,cACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMb,8CAAmB,UAAU;EAE1E,MAAM,eAAe,MAAM,eAAe;AAE1C,SAAO,2BAA2B;GAChC,iBACE,aAAa,sBAAsB;IACjC,WAAW,UAAU,SAAS;IAC9B,YAAY;KACV;KACA;KACA;KACA,YAAY;KACZ,gBAAgB;KAChB,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;KACnC;IACD;IACD,CAAC;GACJ,YAAY;GACb,CAAC;;CAGJ,MAAMc,6BACJ,OAAO,EAAE,UAAU,oBAAoB;EACrC,MAAM,EAAE,WAAW,oBAAoB,MAAMd,8CAC3C,UACD;EAED,MAAM,eAAe,MAAM,eAAe;EAE1C,MAAM,WAAW,MAAMe,8DACrB,EAAE,WAAWP,qCAAU,mBAAmB,EAC1C,UACD;AAED,SAAO,2BAA2B;GAChC,iBACE,aAAa,2BAA2B;IACtC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ,YAAY;GACb,CAAC;;CAGN,MAAMQ,6BACJ,OAAO,EACL,mBACA,UACA,YACA,sBACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMhB,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;EAExC,MAAM,EAAE,wBAAwB,MAAM,6BACpC;GACE,WAAWQ,qCAAU;GACrB,OAAOC,sCAAW;GACnB,EACD,UACD;AAED,SAAO,2BAA2B;GAChC,iBACE,WAAW,2BAA2B;IACpC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IAGY;IAGZ;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMQ,mBAAqD,OAAO,EAChE,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMjB,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,iBAAiB;IAC1B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMkB,+BACJ,OAAO,EAAE,UAAU,oBAAoB;EACrC,MAAM,EAAE,WAAW,oBAAoB,MAAMlB,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,YAAY;IACrB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B,aAAa;IACb;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMmB,iBAAiD,OAAO,EAC5D,SACA,UACA,oBACI;AACJ,MAAI,QAAQ,WAAW,oCACrB,OAAM,IAAIC,uDACR,mBAAmB,oCAAoC,kBACxD;EAGH,MAAM,EAAE,WAAW,oBAAoB,MAAMpB,8CAAmB,UAAU;EAE1E,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GAAE,WAAWQ,qCAAU;GAAgB,OAAOC,sCAAW;GAAY,EACrE,UACD;EAEH,MAAM,eAAe,MAAM,eAAe;AAgB1C,SAAO,EAAE,WAdS,MAAM,2BAA2B;GACjD,iBACE,aAAa,eAAe;IAC1B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IACA;IACD,CAAC;GACJ,YAAY;GACb,CAAC,EAEkB;;CAGtB,MAAMY,UAAmC,OAAO,SAAS;AACvD,MAAI,CAAC,YACH;EAGF,MAAM,aAAa,MAAM,eAAe;AAWxC,MAAI,MAAM,WAAW,gBACnB,OAAM,WAAW,SAAS;AAE5B,gBAAc;;CAGhB,MAAMC,iBAAiD,OAAO,EAC5D,eACA,iBACA,kBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMtB,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,eAAe;IACxB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B,kBAAkB;IAClB;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMuB,cAA2C,OAAO,EACtD,SACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMvB,8CAAmB,UAAU;EAE1E,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GAAE,WAAWQ,qCAAU;GAAgB,OAAOC,sCAAW;GAAY,EACrE,UACD;EAEH,MAAM,aAAa,MAAM,eAAe;AAexC,SAAO,EAAE,WAbS,MAAM,2BAA2B;GACjD,iBACE,WAAW,YAAY;IACrB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC,EAEkB;;CAGtB,MAAMe,4BACJ,OAAO,EAAE,SAAS,uBAAuB,oBAAoB;EAC3D,MAAM,EAAE,WAAW,oBAAoB,MAAMxB,8CAC3C,UACD;EAED,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GAAE,WAAWQ,qCAAU;GAAgB,OAAOC,sCAAW;GAAY,EACrE,UACD;EAEH,MAAM,aAAa,MAAM,eAAe;AAgBxC,SAAO,EAAE,WAdS,MAAM,2BAA2B;GACjD,iBACE,WAAW,gBAAgB;IACzB,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA,eAAe,cAAc;IAC7B;IACA,aAAa;IACd,CAAC;GACJ;GACD,CAAC,EAEkB;;CAGxB,MAAMgB,yBACJ,OAAO,EAAE,oBAAoB;EAC3B,MAAM,EAAE,WAAW,oBAAoB,MAAMzB,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,uBAAuB;IAChC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAM0B,eAA6C,OAAO,EACxD,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAM1B,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,aAAa;IACtB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAQJ,MAAM,uBAAuB,yBAAyB;EACpD,QAAQ,UAAU,IAAI2B,qDAAoB,EAAE,OAAO,OAAO,CAAC;EAC3D,OAAO;EACR,CAAC;AAuCF,QArC+B;EAC7B,8BAA8B,qBAC5B,6BACD;EACD;EACA,6BAA6B,qBAC3B,4BACD;EACD,qBAAqB,qBAAqB,oBAAoB;EAC9D,mBAAmB,qBAAqB,kBAAkB;EAC1D,SAAS,qBAAqB,QAAQ;EACtC,uBAAuB,qBAAqB,sBAAsB;EAClE,kBAAkB,qBAAqB,iBAAiB;EACxD,eAAe,qBAAqB,cAAc;EAClD,wBAAwB,qBAAqB,uBAAuB;EACpE,kBAAkB,qBAAqB,iBAAiB;EACxD,uBAAuB,qBAAqBC,wBAAsB;EAClE,4BAA4B,qBAC1B,2BACD;EACD,4BAA4B,qBAC1B,2BACD;EACD,kCAAkC,qBAChC,iCACD;EACD,kBAAkB,qBAAqB,iBAAiB;EACxD,8BAA8B,qBAC5B,6BACD;EACD,aAAa,qBAAqB,YAAY;EAC9C,gBAAgB,qBAAqB,eAAe;EACpD,2BAA2B,qBAAqB,0BAA0B;EAC1E,cAAc,qBAAqB,aAAa;EAChD,gBAAgB,qBAAqB,eAAe;EACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;AC5pBH,MAAa,kCAAkC,OAC7C,EAAE,WAAW,UAAU,iBACvB,WACkB;AAMlB,QALiBC,qEACf,EAAE,eAAe,EACjB,OACD,CAEe,iBAAiB;EAC/B;EACA;EACA;EACD,CAAC;;;;;;ACnCJ,MAAa,mCACX,EAAE,SACF,WACa;AACb,KAAI,CAAC,OAAO,KACV,QAAO,EAAE;AAoBX,SAhBE,OAAO,KAAK,oBAAoB,QAC7B,eACC,WAAW,mBAAmBC,8CAAmB,kBACjD,WAAW,YACP,aAAa,CACd,WAAWC,2DAAsB,qBAAqB,IACzD,WAAW,WACX,WAAW,SACXC,yEAAoC,WAAW,MAAM,KAAK,MAC7D,IAAI,EAAE,EAE6C,KAEnD,eAAe,WAAW,QAC5B;;;;;mEC7BkBC,2CAAaC,6CAAe"}
+{"version":3,"file":"waasCore.cjs","names":["createWaasClient: CreateWaasClient","getCore","DynamicWalletClient","isCookieEnabled","DEFAULT_WAAS_BASE_API_URL","DEFAULT_WAAS_BASE_MPC_RELAY_API_URL","CLIENT_SDK_NAME","getSignedSessionId","logoutWithReason","getElevatedAccessToken","consumeMfaTokenIfRequiredForAction","transactionBroadcastErrorMapper: ErrorMapper","APIError","TransactionBroadcastError","createApiClient","WaasTransactionEncoding","request: WaasTransactionBroadcastRequest","getCore","randomString","status: WaasTransactionBroadcastResult['status']","WaasTransactionBroadcastStatus","CHAINS_INFO_MAP","getCore","_waasClient: DynamicWalletClient | undefined","_waasClientSessionId: string | undefined","WaasRbacStaleRetryUnsafeError","refreshAuth","getWaasClient: WaasProvider['getWaasClient']","isUserOnboardingComplete","WaasOnboardingIncompleteError","backupKeySharesToGoogleDrive: WaasProvider['backupKeySharesToGoogleDrive']","getSignedSessionId","broadcastTransaction: WaasProvider['broadcastTransaction']","createOfflineRecoveryShares: WaasProvider['createOfflineRecoveryShares']","createWalletAccount: WaasProvider['createWalletAccount']","ThresholdSignatureScheme","delegateKeyShares: WaasProvider['delegateKeyShares']","exportClientKeyshares: WaasProvider['exportClientKeyshares']","exportPrivateKey: WaasProvider['exportPrivateKey']","MFAAction","TokenScope","restoreUserShareForWalletAccount: WaasProvider['restoreUserShareForWalletAccount']","WalletOperation","importPrivateKey: WaasProvider['importPrivateKey']","migrateFromFireblocks: WaasProvider['migrateFromFireblocks']","refreshWalletAccountShares: WaasProvider['refreshWalletAccountShares']","consumeMfaTokenIfRequiredForAction","reshareToNewSignerShareSet: WaasProvider['reshareToNewSignerShareSet']","revokeDelegation: WaasProvider['revokeDelegation']","setWaasWalletAccountPassword: WaasProvider['setWaasWalletAccountPassword']","signRawMessage: WaasProvider['signRawMessage']","InvalidParamError","destroy: WaasProvider['destroy']","updatePassword: WaasProvider['updatePassword']","signMessage: WaasProvider['signMessage']","signSerializedTransaction: WaasProvider['signSerializedTransaction']","getWalletRecoveryState: WaasProvider['getWalletRecoveryState']","unlockWallet: WaasProvider['unlockWallet']","WaasLoadFailedError","migrateFromFireblocks","getWaasWalletProviderFromWalletAccount","WalletProviderEnum","DYNAMIC_WAAS_METADATA","getChainFromVerifiedCredentialChain","packageName","packageVersion"],"sources":["../src/modules/waas/createWaasClient/createWaasClient.ts","../src/utils/createTranslateRejection/createTranslateRejection.ts","../src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts","../src/modules/waas/transactionBroadcastErrorMapper/transactionBroadcastErrorMapper.ts","../src/modules/waas/broadcastWaasTransaction/broadcastWaasTransaction.ts","../src/modules/waas/getWaasChainNameFromChain/getWaasChainNameFromChain.ts","../src/modules/waas/createWaasProvider/isWaasLoadExhaustionError.ts","../src/modules/waas/createWaasProvider/createWaasProvider.ts","../src/modules/waas/exportWaasPrivateKeyToContainer/exportWaasPrivateKeyToContainer.ts","../src/modules/waas/getAllUserWaasAddressesForChain/getAllUserWaasAddressesForChain.ts","../src/exports/waasCore.ts"],"sourcesContent":["import type { AuthMode } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getCore } from '../../../client/core/getCore';\nimport { CLIENT_SDK_NAME } from '../../apiClient/constants';\nimport { logoutWithReason } from '../../auth/logoutWithReason';\nimport { isCookieEnabled } from '../../projectSettings/isCookieEnabled';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport type { CreateWaasClient } from './createWaasClient.types';\nimport {\n  DEFAULT_WAAS_BASE_API_URL,\n  DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n} from '../constants';\n\n/** @notInstrumented */\nexport const createWaasClient: CreateWaasClient = ({ chainName }, client) => {\n  const core = getCore(client);\n\n  const additionalTrustedOrigins = core.waas?.additionalTrustedOrigins;\n\n  const baseClientKeysharesRelayApiUrl =\n    client.projectSettings?.sdk.waas?.customKeyshareRelayBaseUrl;\n\n  // Capture the session at construction time so the onUnauthorized guard can\n  // ignore notifications that arrive after a step-up reauth mints a new session.\n  // A client built against session S1 should never force-logout session S2.\n  const sessionIdAtCreation = core.state.get().user?.sessionId;\n\n  return new DynamicWalletClient(\n    {\n      authMode: (isCookieEnabled(client) ? 'cookie' : 'header') as AuthMode,\n      authToken: client.token || '',\n      baseApiUrl: (core.apiBaseUrl || DEFAULT_WAAS_BASE_API_URL).replace(\n        '/api/v0',\n        ''\n      ),\n      baseMPCRelayApiUrl:\n        client.projectSettings?.sdk.waas?.relayUrl ||\n        DEFAULT_WAAS_BASE_MPC_RELAY_API_URL,\n      chainName,\n      // Opt into the SDK self-driving eager key-share recovery on auth-token\n      // arrival, so the client no longer restores shares itself on login.\n      eagerlyRecoverKeyShares: true,\n      environmentId: core.environmentId,\n      sdkVersion: `${CLIENT_SDK_NAME}/${core.version}`,\n      ...(additionalTrustedOrigins == undefined\n        ? {}\n        : { additionalTrustedOrigins }),\n      ...(baseClientKeysharesRelayApiUrl == undefined\n        ? {}\n        : { baseClientKeysharesRelayApiUrl }),\n      ...(core.waas?.loadTimeoutMs == undefined\n        ? {}\n        : { iframeLoadTimeout: core.waas.loadTimeoutMs }),\n      ...(core.waas?.maxLoadRetries == undefined\n        ? {}\n        : { maxRetryAttempts: core.waas.maxLoadRetries }),\n    },\n    {\n      // Lets the iframe mint a fresh signed session id over the reverse channel,\n      // which the SDK's eager key-share recovery needs.\n      getSignedSessionId: () =>\n        getSignedSessionId(client).then(({ signature }) => signature),\n      // When the WaaS iframe's own backend call returns 401 (e.g. a forcibly\n      // revoked token), the iframe notifies the host via the reverse channel\n      // and this fires — log the user out. Mirrors the session-expiry\n      // middleware that covers the SDK's own direct API 401s.\n      //\n      // Guard: after a step-up reauth the session rotates. A client built\n      // against the previous session will receive this notification but must\n      // not force-logout the new session — ignore if the session has changed.\n      onUnauthorized: () => {\n        const currentSessionId = core.state.get().user?.sessionId;\n        if (currentSessionId !== sessionIdAtCreation) {\n          return;\n        }\n        void logoutWithReason(\n          { reason: 'session-refresh-unauthorized' },\n          client\n        ).catch((error) => {\n          core.logger.error(\n            'Failed to log out after WaaS unauthorized response',\n            error\n          );\n        });\n      },\n    }\n  );\n};\n","export type CreateTranslateRejectionParams<TMatched> = {\n  /**\n   * Builds the error thrown in place of a matched rejection.\n   */\n  mapTo: (error: TMatched) => Error;\n  /**\n   * Type guard selecting which rejections to translate. Anything it does not\n   * match is rethrown untouched, so callers only translate the errors they\n   * own. Narrowing to `TMatched` lets {@link CreateTranslateRejectionParams.mapTo}\n   * receive a typed error without a cast.\n   */\n  match: (error: unknown) => error is TMatched;\n};\n\n/**\n * Builds a reusable decorator, bound once to a `match`/`mapTo` pair, that wraps\n * any async function so a matching rejection is rethrown as `mapTo(error)`\n * while every other rejection — and every resolved value — passes through\n * untouched. Unmatched errors are rethrown by reference, so the decorator can\n * never swallow or reshape an error it was not asked to translate.\n *\n * Binding `match`/`mapTo` up front keeps the generic wrapping machinery here\n * instead of at the call site: consumers get a plain `(fn) => wrappedFn`\n * decorator they can apply to many functions of differing signatures, each of\n * which keeps its own argument and return types.\n *\n * @notInstrumented\n */\nexport const createTranslateRejection =\n  <TMatched>({\n    match,\n    mapTo,\n  }: CreateTranslateRejectionParams<TMatched>): (<\n    TArgs extends unknown[],\n    TReturn\n  >(\n    fn: (...args: TArgs) => Promise<TReturn>\n  ) => (...args: TArgs) => Promise<TReturn>) =>\n  <TArgs extends unknown[], TReturn>(\n    fn: (...args: TArgs) => Promise<TReturn>\n  ) =>\n  async (...args: TArgs): Promise<TReturn> => {\n    try {\n      return await fn(...args);\n    } catch (error) {\n      if (match(error)) {\n        throw mapTo(error);\n      }\n      throw error;\n    }\n  };\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { TokenScope } from '../consts';\nimport type { MFAAction } from '../../mfa/mfa.consts';\nimport { consumeMfaTokenIfRequiredForAction } from '../../mfa/consumeMfaTokenIfRequiredForAction';\nimport { getElevatedAccessToken } from '../getElevatedAccessToken';\n\ntype GetActionAuthorizationTokensParams = {\n  mfaAction: MFAAction;\n  scope: TokenScope;\n};\n\ntype ActionAuthorizationTokens = {\n  elevatedAccessToken: string | undefined;\n  mfaToken: string | undefined;\n};\n\n/**\n * Resolves the tokens that authorize a verification-gated wallet action.\n *\n * An elevated access token for `scope` is the current proof of verification, so\n * it takes precedence: when one has been banked, the legacy per-action MFA token\n * is left untouched. Demanding both would break every user who has a verified\n * MFA method, because satisfying the challenge with `requestedScopes` mints an\n * elevated access token and no MFA token -- leaving nothing for\n * `consumeMfaTokenIfRequiredForAction` to consume, which then throws.\n *\n * @param params.mfaAction - The action whose legacy MFA requirement to evaluate.\n * @param params.scope - The scope of the elevated access token that authorizes the action.\n * @param client - The Dynamic client instance.\n * @returns The elevated access token, or the legacy MFA token when no elevated token exists.\n * @notInstrumented\n */\nexport const getActionAuthorizationTokens = async (\n  { mfaAction, scope }: GetActionAuthorizationTokensParams,\n  client: DynamicClient\n): Promise<ActionAuthorizationTokens> => {\n  const elevatedAccessToken = getElevatedAccessToken({ scope }, client);\n\n  if (elevatedAccessToken) {\n    return { elevatedAccessToken, mfaToken: undefined };\n  }\n\n  const mfaToken = await consumeMfaTokenIfRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  return { elevatedAccessToken: undefined, mfaToken };\n};\n","import { APIError } from '../../../errors/APIError';\nimport {\n  TransactionBroadcastError,\n  type TransactionBroadcastErrorCode,\n  type TransactionBroadcastSubmissionState,\n} from '../../../errors/TransactionBroadcastError';\nimport type { ErrorMapper } from '../../apiClient/apiClient.types';\n\nconst TRANSACTION_BROADCAST_ERROR_CODES = {\n  broadcast_idempotency_conflict: 'BROADCAST_IDEMPOTENCY_CONFLICT',\n  broadcast_outcome_unknown: 'BROADCAST_OUTCOME_UNKNOWN',\n  broadcast_rate_limited: 'BROADCAST_RATE_LIMITED',\n  broadcast_rejected: 'BROADCAST_REJECTED',\n  broadcast_requires_resign: 'BROADCAST_REQUIRES_RESIGN',\n  broadcast_wallet_ineligible: 'BROADCAST_WALLET_INELIGIBLE',\n  invalid_signed_transaction: 'INVALID_SIGNED_TRANSACTION',\n  network_not_enabled: 'NETWORK_NOT_ENABLED',\n  signed_transaction_wallet_mismatch:\n    'SIGNED_TRANSACTION_WALLET_MISMATCH',\n  unsupported_waas_chain: 'UNSUPPORTED_WAAS_CHAIN',\n} as const satisfies Record<string, TransactionBroadcastErrorCode>;\n\nconst TRANSACTION_BROADCAST_SUBMISSION_STATES = new Set<\n  TransactionBroadcastSubmissionState\n>(['not_submitted', 'requires_resign', 'unknown']);\n\n/**\n * Maps structured WaaS broadcast API failures to a public SDK error.\n *\n * @notInstrumented\n */\nexport const transactionBroadcastErrorMapper: ErrorMapper = (error) => {\n  if (!(error instanceof APIError)) {\n    return null;\n  }\n\n  const apiCode = error.code as keyof typeof TRANSACTION_BROADCAST_ERROR_CODES;\n  const code = TRANSACTION_BROADCAST_ERROR_CODES[apiCode];\n  if (!code) {\n    return null;\n  }\n\n  const payload = error.payload;\n\n  if (\n    !payload ||\n    typeof payload.attempts !== 'number' ||\n    typeof payload.broadcastId !== 'string' ||\n    typeof payload.retryable !== 'boolean' ||\n    typeof payload.submissionState !== 'string'\n  ) {\n    return null;\n  }\n\n  const submissionState =\n    payload.submissionState as TransactionBroadcastSubmissionState;\n\n  if (!TRANSACTION_BROADCAST_SUBMISSION_STATES.has(submissionState)) {\n    return null;\n  }\n\n  const transactionId =\n    typeof payload.transactionId === 'string'\n      ? payload.transactionId\n      : undefined;\n\n  return new TransactionBroadcastError({\n    attempts: payload.attempts,\n    broadcastId: payload.broadcastId,\n    cause: error,\n    code,\n    message: error.message,\n    retryable: payload.retryable,\n    submissionState,\n    transactionId,\n  });\n};\n","import {\n  type WaasTransactionBroadcastRequest,\n  WaasTransactionBroadcastStatus,\n  WaasTransactionEncoding,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { randomString } from '../../../utils/randomString/randomString';\nimport { createApiClient } from '../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { transactionBroadcastErrorMapper } from '../transactionBroadcastErrorMapper/transactionBroadcastErrorMapper';\nimport type {\n  WaasTransactionBroadcastEncoding,\n  WaasTransactionBroadcastResult,\n} from '../waas.types';\n\ntype BroadcastWaasTransactionParams = {\n  encoding: WaasTransactionBroadcastEncoding;\n  networkId: string;\n  signedTransaction: string;\n  skipPreflight?: boolean;\n  walletAccount: WalletAccount;\n};\n\nconst IDEMPOTENCY_KEY_LENGTH = 50;\n\n/**\n * Broadcasts an already-signed v3 WaaS transaction through the Dynamic API.\n *\n * @notInstrumented\n */\nexport const broadcastWaasTransaction = async (\n  {\n    encoding,\n    networkId,\n    signedTransaction,\n    skipPreflight,\n    walletAccount,\n  }: BroadcastWaasTransactionParams,\n  client: DynamicClient\n): Promise<WaasTransactionBroadcastResult> => {\n  const apiClient = createApiClient(\n    { errorMappers: [transactionBroadcastErrorMapper] },\n    client\n  );\n\n  let apiEncoding = WaasTransactionEncoding.Hex;\n  if (encoding === 'base64') {\n    apiEncoding = WaasTransactionEncoding.Base64;\n  }\n\n  const request: WaasTransactionBroadcastRequest = {\n    encoding: apiEncoding,\n    networkId,\n    signedTransaction,\n  };\n  if (skipPreflight !== undefined) {\n    request.options = { skipPreflight };\n  }\n\n  // WalletAccount.id is a composite (`walletProviderKey:address`), but the\n  // broadcast endpoint is keyed by the wallet UUID stored in verifiedCredentialId.\n  const walletId = walletAccount.verifiedCredentialId;\n  assertDefined(\n    walletId,\n    'Wallet account verified credential id is required for broadcasting'\n  );\n\n  const response = await apiClient.broadcastWaasTransaction({\n    environmentId: getCore(client).environmentId,\n    waasTransactionBroadcastRequest: request,\n    walletId,\n    xIdempotencyKey: randomString({ length: IDEMPOTENCY_KEY_LENGTH }),\n  });\n\n  let status: WaasTransactionBroadcastResult['status'] = 'submitted';\n  if (response.status === WaasTransactionBroadcastStatus.AlreadyKnown) {\n    status = 'already_known';\n  }\n\n  return {\n    attempts: response.attempts,\n    broadcastId: response.broadcastId,\n    status,\n    transactionId: response.transactionId,\n  };\n};\n","import type { Chain } from '../../chain';\nimport { CHAINS_INFO_MAP } from '../../wallets/constants';\n\n/** @notInstrumented */\n// eslint-disable-next-line custom-rules/require-single-object-param\nexport const getWaasChainNameFromChain = (chain: Chain): string => {\n  return CHAINS_INFO_MAP[chain].waasChainNameOverride || chain;\n};\n","/**\n * Exact message prefix of the rejection thrown by\n * `@dynamic-labs-wallet/browser-wallet-client` when the secure container load\n * exhausts all retry attempts. The upstream library throws a plain `Error`\n * with no code, so message matching is the only detection mechanism available;\n * the dependency is pinned to an exact version and the spec pins this string\n * so drift is caught at upgrade time.\n */\nconst UPSTREAM_LOAD_EXHAUSTION_MESSAGE_PREFIX =\n  'Failed to load iframe after all retry attempts';\n\n/**\n * True when `error` is the upstream \"load retry attempts exhausted\" rejection\n * from the embedded (WaaS) wallet's secure container load. Narrows to `Error`\n * so the matched value can be forwarded as a typed error cause without a cast,\n * and guards `instanceof Error` before reading `.message` so a non-`Error`\n * rejection never throws during detection.\n *\n * @notInstrumented\n */\nexport const isWaasLoadExhaustionError = (error: unknown): error is Error =>\n  error instanceof Error &&\n  error.message.startsWith(UPSTREAM_LOAD_EXHAUSTION_MESSAGE_PREFIX);\n","import {\n  type BitcoinConfig,\n  type DynamicWalletClient,\n  ThresholdSignatureScheme,\n  WalletOperation,\n} from '@dynamic-labs-wallet/browser-wallet-client';\nimport { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { InvalidParamError } from '../../../errors/InvalidParamError';\nimport { WaasLoadFailedError } from '../../../errors/WaasLoadFailedError';\nimport { WaasOnboardingIncompleteError } from '../../../errors/WaasOnboardingIncompleteError';\nimport { WaasRbacStaleRetryUnsafeError } from '../../../errors/WaasRbacStaleRetryUnsafeError';\nimport { createTranslateRejection } from '../../../utils/createTranslateRejection';\nimport { getActionAuthorizationTokens } from '../../auth/getActionAuthorizationTokens';\nimport type { Chain } from '../../chain';\nimport { consumeMfaTokenIfRequiredForAction } from '../../mfa/consumeMfaTokenIfRequiredForAction';\nimport { getSignedSessionId } from '../../sessionKeys/getSignedSessionId';\nimport { isUserOnboardingComplete } from '../../user/isUserOnboardingComplete';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport { broadcastWaasTransaction } from '../broadcastWaasTransaction/broadcastWaasTransaction';\nimport { createWaasClient } from '../createWaasClient';\nimport { getWaasChainNameFromChain } from '../getWaasChainNameFromChain';\nimport type { WaasProvider } from '../waas.types';\nimport { isWaasLoadExhaustionError } from './isWaasLoadExhaustionError';\n\nconst RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH = 64;\n\ntype CreateWaasProviderParams = {\n  chain: Chain;\n  sdkClient: DynamicClient;\n};\n\n/** @notInstrumented */\nexport const createWaasProvider = ({\n  sdkClient,\n  chain,\n}: CreateWaasProviderParams): WaasProvider => {\n  const logger = getCore(sdkClient).logger;\n\n  let _waasClient: DynamicWalletClient | undefined;\n  // The session the cached client was built against. A step-up reauth mints a\n  // NEW session (new sessionId + token); see the rebuild guard below.\n  let _waasClientSessionId: string | undefined;\n\n  // Drops the cached client only when it still points at `client`. Guarding on\n  // identity matters because a step-up reauth can mint a new session and rebuild\n  // a healthy client (via the session-change reset in getWaasClient) while an\n  // older client's initialize()/operation is still failing in flight. Clearing\n  // in that case would orphan the healthy replacement, since nothing would\n  // release its upstream shared-container reference. _waasClientSessionId is\n  // cleared alongside to keep the pair consistent.\n  const resetClientIfCurrent = (client: DynamicWalletClient): void => {\n    if (_waasClient === client) {\n      _waasClient = undefined;\n      _waasClientSessionId = undefined;\n    }\n  };\n\n  type WalletApiErrorWithCode = Error & {\n    code?: string;\n    name: 'WalletApiError';\n    status: number;\n  };\n\n  const isRbacStaleWalletApiError = (\n    error: unknown\n  ): error is WalletApiErrorWithCode =>\n    error instanceof Error &&\n    error.name === 'WalletApiError' &&\n    (error as WalletApiErrorWithCode).status === 403 &&\n    (error as WalletApiErrorWithCode).code === 'rbac_stale';\n\n  // Business account role changes can return 403 { code: 'rbac_stale' } from the\n  // WaaS iframe's backend calls. Refresh the session, drop the cached client so\n  // it rebuilds with the fresh token, and restart the ceremony once.\n  const withRbacStaleRetry = <TArgs extends unknown[], TReturn>({\n    operation,\n  }: {\n    operation: (...args: TArgs) => Promise<TReturn>;\n  }): ((...args: TArgs) => Promise<TReturn>) => {\n    // isRetry is threaded through the recursion rather than held in this\n    // closure: the wrapper is built once per provider, so a shared flag would\n    // disable retries for every later call once one had retried.\n    const attempt = async ({\n      args,\n      isRetry,\n    }: {\n      args: TArgs;\n      isRetry: boolean;\n    }): Promise<TReturn> => {\n      const stateBeforeAttempt = getCore(sdkClient).state.get();\n      const mfaTokenBeforeAttempt = stateBeforeAttempt.mfaToken;\n      // Only tokens that were still valid at attempt start count: every\n      // getElevatedAccessToken call purges expired tokens for all scopes as a\n      // side effect, and that cleanup must not read as consumption.\n      const attemptStartedAt = new Date();\n      const elevatedTokensBeforeAttempt = (\n        stateBeforeAttempt.elevatedAccessTokens ?? []\n      ).filter(\n        (token) => !token.expiresAt || token.expiresAt > attemptStartedAt\n      );\n      try {\n        return await operation(...args);\n      } catch (error) {\n        if (!isRbacStaleWalletApiError(error)) {\n          throw error;\n        }\n\n        // sign/export/reshare spend their one-time authorization inside the\n        // operation, before the backend call that 403s, so restarting would\n        // find it already consumed and fail with an unrelated \"no MFA token\"\n        // error instead of surfacing the permission change. Both forms count:\n        // the legacy mfaToken, and a single-use elevated access token, which\n        // getElevatedAccessToken drops from state without touching mfaToken.\n        // Checked ahead of the isRetry guard so a retry that spends the\n        // approval reports the same unsafe-retry error rather than a bare 403.\n        const stateAfterAttempt = getCore(sdkClient).state.get();\n        const mfaTokenConsumedByAttempt =\n          mfaTokenBeforeAttempt !== null &&\n          stateAfterAttempt.mfaToken === null;\n        const elevatedTokensAfterAttempt =\n          stateAfterAttempt.elevatedAccessTokens ?? [];\n        const elevatedTokenConsumedByAttempt =\n          elevatedTokensBeforeAttempt.some(\n            (before) =>\n              before.singleUse &&\n              !elevatedTokensAfterAttempt.some(\n                (after) => after.token === before.token\n              )\n          );\n\n        if (mfaTokenConsumedByAttempt || elevatedTokenConsumedByAttempt) {\n          throw new WaasRbacStaleRetryUnsafeError({ cause: error });\n        }\n\n        if (isRetry) {\n          throw error;\n        }\n\n        // Captured before the refresh so the reset below is identity-guarded:\n        // refreshAuth or a concurrent operation may install a healthy\n        // replacement, and clearing that would orphan it — see\n        // resetClientIfCurrent.\n        const staleWaasClient = _waasClient;\n        await refreshAuth(sdkClient);\n        if (staleWaasClient) {\n          resetClientIfCurrent(staleWaasClient);\n        }\n        return attempt({ args, isRetry: true });\n      }\n    };\n    return (...args: TArgs) => attempt({ args, isRetry: false });\n  };\n\n  // because the waas client needs the authToken to be set, we can only create it\n  // the first time it's needed, which is after the user has logged in\n  const getWaasClient: WaasProvider['getWaasClient'] = async () => {\n    // After a step-up reauthentication a new session is minted. In header auth\n    // mode (native webview) the iframe has no cookie jar to fall back on, so a\n    // client cached against the previous session keeps presenting the stale\n    // token — its next backend call (createRooms/users) 401s and trips the\n    // iframe's onUnauthorized → forced logout. Drop the cached client when the\n    // session changes so it rebuilds + re-initializes with the fresh token and\n    // signed session id. Key shares stay in storage (only client auth resets);\n    // routine token refresh keeps the same sessionId, so it does not rebuild.\n    const currentSessionId = getCore(sdkClient).state.get().user?.sessionId;\n    if (_waasClient && currentSessionId !== _waasClientSessionId) {\n      _waasClient = undefined;\n    }\n\n    if (!_waasClient) {\n      // Chokepoint: don't build + initialize the iframe client until onboarding\n      // is complete. The iframe's init-time room-cache pre-warm fires\n      // `createRooms` using the token captured at construction — before any\n      // per-operation token resync exists to correct it. Built while the token\n      // is still pre-`user:basic` (MFA / KYC / recovery codes / device\n      // registration pending), that pre-warm 401s and trips the iframe's\n      // onUnauthorized → forced-logout. This is the single gateway to\n      // createWaasClient (web and native), so it covers every WaaS caller.\n      if (!isUserOnboardingComplete(sdkClient)) {\n        throw new WaasOnboardingIncompleteError();\n      }\n\n      const builtClient = createWaasClient(\n        { chainName: getWaasChainNameFromChain(chain) },\n        sdkClient\n      );\n      _waasClient = builtClient;\n      _waasClientSessionId = currentSessionId;\n      try {\n        await builtClient.initialize();\n      } catch (error) {\n        // A failed load (e.g. iframe retry exhaustion) leaves an unusable,\n        // never-initialized client cached. Drop it so the next getWaasClient()\n        // rebuilds and re-initializes — the fresh load cycle WaasLoadFailedError\n        // documents — instead of returning the dead client for the rest of the\n        // session. Identity-guarded (see resetClientIfCurrent).\n        resetClientIfCurrent(builtClient);\n        throw error;\n      }\n    }\n    // Read the shared var, not the locally-built client: if a concurrent\n    // session-change rebuilt a fresh client while this initialize() was pending,\n    // the caller should get that current healthy client, not this now-superseded\n    // instance built against the old session.\n    return _waasClient;\n  };\n\n  // Runs an operation against an already-fetched client and, if it fails because\n  // the container's load was exhausted mid-flight (the client built and\n  // initialized fine, then its iframe died — e.g. tab backgrounding, relogin —\n  // and its own recovery could not reload), drops the cached client so the next\n  // operation rebuilds and re-initializes. This covers the post-initialization\n  // path that getWaasClient's own load-failure reset cannot see, so the\n  // fresh-load cycle WaasLoadFailedError documents holds for every operation,\n  // not just the first load. Identity-guarded (see resetClientIfCurrent).\n  const discardClientOnLoadFailure = async <TReturn>({\n    waasClient,\n    operation,\n  }: {\n    operation: () => Promise<TReturn>;\n    waasClient: DynamicWalletClient;\n  }): Promise<TReturn> => {\n    try {\n      return await operation();\n    } catch (error) {\n      if (isWaasLoadExhaustionError(error)) {\n        resetClientIfCurrent(waasClient);\n      }\n      throw error;\n    }\n  };\n\n  const backupKeySharesToGoogleDrive: WaasProvider['backupKeySharesToGoogleDrive'] =\n    async ({ googleDriveAccessToken, password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.backupKeySharesToGoogleDrive({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            googleDriveAccessToken,\n            password,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const broadcastTransaction: WaasProvider['broadcastTransaction'] = (args) =>\n    broadcastWaasTransaction(args, sdkClient);\n\n  const createOfflineRecoveryShares: WaasProvider['createOfflineRecoveryShares'] =\n    async ({ cloudProviderAccessToken, mfaToken, password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.offlineRecovery({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            cloudProviderAccessToken,\n            mfaToken,\n            password,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const createWalletAccount: WaasProvider['createWalletAccount'] = async (\n    args = {}\n  ) => {\n    logger.debug('[createWaasProvider] createWalletAccount', {\n      bitcoinConfig: args.bitcoinConfig,\n      thresholdSignatureScheme: args.thresholdSignatureScheme,\n    });\n\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    const waasWallet = await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.createWalletAccount({\n          authToken: sdkClient.token ?? undefined,\n          bitcoinConfig: args.bitcoinConfig as BitcoinConfig | undefined,\n          businessAccountId: args.businessAccountId,\n          password: args.password,\n          signedSessionId,\n          thresholdSignatureScheme:\n            args.thresholdSignatureScheme ??\n            ThresholdSignatureScheme.TWO_OF_TWO,\n        }),\n      waasClient,\n    });\n\n    return waasWallet;\n  };\n\n  const delegateKeyShares: WaasProvider['delegateKeyShares'] = async ({\n    initialSignerRules,\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.delegateKeyShares({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          initialSignerRules,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const exportClientKeyshares: WaasProvider['exportClientKeyshares'] = async ({\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.exportClientKeyshares({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const exportPrivateKey: WaasProvider['exportPrivateKey'] = async ({\n    container,\n    displayContainer,\n    walletAccount,\n    password,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    // Forwards whichever token proves the export was verified: the elevated\n    // wallet:export token banked by step-up, or the legacy per-action MFA token.\n    const { elevatedAccessToken, mfaToken } =\n      await getActionAuthorizationTokens(\n        {\n          mfaAction: MFAAction.WalletWaasExport,\n          scope: TokenScope.Walletexport,\n        },\n        sdkClient\n      );\n\n    await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.exportPrivateKey({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          // Exactly one display surface is forwarded: `container` (a\n          // WaasSDKContainer, e.g. a React Native visible WebView) or\n          // `displayContainer` (a DOM element, web). The upstream client enforces\n          // the \"exactly one\" invariant and renders the key inside the surface's\n          // own sandboxed document — it never crosses back to the host.\n          container,\n          displayContainer,\n          elevatedAccessToken,\n          mfaToken,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const restoreUserShareForWalletAccount: WaasProvider['restoreUserShareForWalletAccount'] =\n    async ({ walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      await discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.getWallet({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            signedSessionId,\n            walletOperation: WalletOperation.SIGN_MESSAGE,\n          }),\n        waasClient,\n      });\n    };\n\n  const importPrivateKey: WaasProvider['importPrivateKey'] = async ({\n    privateKey,\n    thresholdSignatureScheme = ThresholdSignatureScheme.TWO_OF_TWO,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const walletClient = await getWaasClient();\n\n    await discardClientOnLoadFailure({\n      operation: () =>\n        walletClient.importPrivateKey({\n          authToken: sdkClient.token ?? undefined,\n          privateKey,\n          signedSessionId,\n          thresholdSignatureScheme,\n        }),\n      waasClient: walletClient,\n    });\n  };\n\n  const migrateFromFireblocks: WaasProvider['migrateFromFireblocks'] = async ({\n    coinTypes,\n    deviceId,\n    expectedAddresses,\n    jwt,\n    password,\n    storage,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const walletClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        walletClient.migrateFromFireblocks({\n          authToken: sdkClient.token ?? undefined,\n          fireblocks: {\n            deviceId,\n            expectedAddresses,\n            jwt,\n            ncwStorage: storage,\n            walletPassword: password,\n            ...(coinTypes ? { coinTypes } : {}),\n          },\n          signedSessionId,\n        }),\n      waasClient: walletClient,\n    });\n  };\n\n  const refreshWalletAccountShares: WaasProvider['refreshWalletAccountShares'] =\n    async ({ password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const walletClient = await getWaasClient();\n\n      const mfaToken = await consumeMfaTokenIfRequiredForAction(\n        { mfaAction: MFAAction.WalletWaasRefresh },\n        sdkClient\n      );\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          walletClient.refreshWalletAccountShares({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            mfaToken,\n            password,\n            signedSessionId,\n          }),\n        waasClient: walletClient,\n      });\n    };\n\n  const reshareToNewSignerShareSet: WaasProvider['reshareToNewSignerShareSet'] =\n    async ({\n      businessAccountId,\n      password,\n      signerType,\n      targetSignerIdentity,\n      walletAccount,\n    }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      const { elevatedAccessToken } = await getActionAuthorizationTokens(\n        {\n          mfaAction: MFAAction.WalletWaasReshare,\n          scope: TokenScope.BusinessAccountsigneradd,\n        },\n        sdkClient\n      );\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.reshareToNewSignerShareSet({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            businessAccountId,\n            elevatedAccessToken,\n            password,\n            signedSessionId,\n            // Public API uses a string union; the client expects the core enum\n            // (identical values). Cast at this single boundary.\n            signerType: signerType as Parameters<\n              typeof waasClient.reshareToNewSignerShareSet\n            >[0]['signerType'],\n            targetSignerIdentity,\n          }),\n        waasClient,\n      });\n    };\n\n  const revokeDelegation: WaasProvider['revokeDelegation'] = async ({\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.revokeDelegation({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const setWaasWalletAccountPassword: WaasProvider['setWaasWalletAccountPassword'] =\n    async ({ password, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.setPassword({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            newPassword: password,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const signRawMessage: WaasProvider['signRawMessage'] = async ({\n    message,\n    password,\n    walletAccount,\n  }) => {\n    if (message.length !== RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH) {\n      throw new InvalidParamError(\n        `Message must be ${RAW_MESSAGE_MESSAGE_REQUIRED_LENGTH} characters long`\n      );\n    }\n\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const { elevatedAccessToken, mfaToken } =\n      await getActionAuthorizationTokens(\n        { mfaAction: MFAAction.WalletWaasSign, scope: TokenScope.Walletsign },\n        sdkClient\n      );\n\n    const walletClient = await getWaasClient();\n\n    const signature = await discardClientOnLoadFailure({\n      operation: () =>\n        walletClient.signRawMessage({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          elevatedAccessToken,\n          message,\n          mfaToken,\n          password,\n          signedSessionId,\n        }),\n      waasClient: walletClient,\n    });\n\n    return { signature };\n  };\n\n  const destroy: WaasProvider['destroy'] = async (args) => {\n    if (!_waasClient) {\n      return;\n    }\n\n    const waasClient = await getWaasClient();\n    // When a session token expires, we preserve key shares in storage instead\n    // of clearing them. Customers with short-lived sessions (minutes) were\n    // hitting excessive server-side share recovery on every re-login, which\n    // also forced users to re-enter their wallet password since the unlocked\n    // share only lives for the duration of the session.\n    //\n    // This is safe because the waas-sdk separately fingerprints the user\n    // (sub + environment_id) and clears all storage if a different user logs\n    // in. On explicit user-initiated logout, shares are always cleared for\n    // security.\n    if (args?.reason !== 'token-expired') {\n      await waasClient.cleanup();\n    }\n    _waasClient = undefined;\n  };\n\n  const updatePassword: WaasProvider['updatePassword'] = async ({\n    walletAccount,\n    currentPassword,\n    newPassword,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.updatePassword({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          existingPassword: currentPassword,\n          newPassword,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  const signMessage: WaasProvider['signMessage'] = async ({\n    message,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const { elevatedAccessToken, mfaToken } =\n      await getActionAuthorizationTokens(\n        { mfaAction: MFAAction.WalletWaasSign, scope: TokenScope.Walletsign },\n        sdkClient\n      );\n\n    const waasClient = await getWaasClient();\n\n    const signature = await discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.signMessage({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          elevatedAccessToken,\n          message,\n          mfaToken,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n\n    return { signature };\n  };\n\n  const signSerializedTransaction: WaasProvider['signSerializedTransaction'] =\n    async ({ chainId, serializedTransaction, walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const { elevatedAccessToken, mfaToken } =\n        await getActionAuthorizationTokens(\n          { mfaAction: MFAAction.WalletWaasSign, scope: TokenScope.Walletsign },\n          sdkClient\n        );\n\n      const waasClient = await getWaasClient();\n\n      const signature = await discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.signTransaction({\n            authToken: sdkClient.token ?? undefined,\n            chainId,\n            elevatedAccessToken,\n            mfaToken,\n            senderAddress: walletAccount.address,\n            signedSessionId,\n            transaction: serializedTransaction,\n          }),\n        waasClient,\n      });\n\n      return { signature };\n    };\n\n  const getWalletRecoveryState: WaasProvider['getWalletRecoveryState'] =\n    async ({ walletAccount }) => {\n      const { signature: signedSessionId } = await getSignedSessionId(\n        sdkClient\n      );\n\n      const waasClient = await getWaasClient();\n\n      return discardClientOnLoadFailure({\n        operation: () =>\n          waasClient.getWalletRecoveryState({\n            accountAddress: walletAccount.address,\n            authToken: sdkClient.token ?? undefined,\n            signedSessionId,\n          }),\n        waasClient,\n      });\n    };\n\n  const unlockWallet: WaasProvider['unlockWallet'] = async ({\n    password,\n    walletAccount,\n  }) => {\n    const { signature: signedSessionId } = await getSignedSessionId(sdkClient);\n\n    const waasClient = await getWaasClient();\n\n    return discardClientOnLoadFailure({\n      operation: () =>\n        waasClient.unlockWallet({\n          accountAddress: walletAccount.address,\n          authToken: sdkClient.token ?? undefined,\n          password,\n          signedSessionId,\n        }),\n      waasClient,\n    });\n  };\n\n  // Every operation is wrapped so an exhausted container load surfaces as a\n  // typed WaasLoadFailedError no matter which call triggers it — the initial\n  // load or a mid-operation recovery. Wrapped at the operation itself (rather\n  // than a separate whole-provider pass) so the translation is visible right\n  // where the provider is assembled.\n  const translateLoadFailure = createTranslateRejection({\n    mapTo: (error) => new WaasLoadFailedError({ cause: error }),\n    match: isWaasLoadExhaustionError,\n  });\n\n  const provider: WaasProvider = {\n    backupKeySharesToGoogleDrive: translateLoadFailure(\n      backupKeySharesToGoogleDrive\n    ),\n    broadcastTransaction,\n    createOfflineRecoveryShares: translateLoadFailure(\n      createOfflineRecoveryShares\n    ),\n    createWalletAccount: translateLoadFailure(\n      withRbacStaleRetry({ operation: createWalletAccount })\n    ),\n    delegateKeyShares: translateLoadFailure(delegateKeyShares),\n    destroy: translateLoadFailure(destroy),\n    exportClientKeyshares: translateLoadFailure(\n      withRbacStaleRetry({ operation: exportClientKeyshares })\n    ),\n    exportPrivateKey: translateLoadFailure(\n      withRbacStaleRetry({ operation: exportPrivateKey })\n    ),\n    getWaasClient: translateLoadFailure(getWaasClient),\n    getWalletRecoveryState: translateLoadFailure(getWalletRecoveryState),\n    importPrivateKey: translateLoadFailure(importPrivateKey),\n    migrateFromFireblocks: translateLoadFailure(migrateFromFireblocks),\n    refreshWalletAccountShares: translateLoadFailure(\n      refreshWalletAccountShares\n    ),\n    reshareToNewSignerShareSet: translateLoadFailure(\n      withRbacStaleRetry({ operation: reshareToNewSignerShareSet })\n    ),\n    restoreUserShareForWalletAccount: translateLoadFailure(\n      restoreUserShareForWalletAccount\n    ),\n    revokeDelegation: translateLoadFailure(revokeDelegation),\n    setWaasWalletAccountPassword: translateLoadFailure(\n      setWaasWalletAccountPassword\n    ),\n    signMessage: translateLoadFailure(\n      withRbacStaleRetry({ operation: signMessage })\n    ),\n    signRawMessage: translateLoadFailure(\n      withRbacStaleRetry({ operation: signRawMessage })\n    ),\n    signSerializedTransaction: translateLoadFailure(\n      withRbacStaleRetry({ operation: signSerializedTransaction })\n    ),\n    unlockWallet: translateLoadFailure(unlockWallet),\n    updatePassword: translateLoadFailure(updatePassword),\n  };\n\n  return provider;\n};\n","import type { WaasSDKContainer } from '@dynamic-labs-wallet/core';\n\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype ExportWaasPrivateKeyToContainerParams = {\n  container: WaasSDKContainer;\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Exports the private key for a WaaS wallet account into a caller-provided\n * {@link WaasSDKContainer} (e.g. a visible React Native WebView) instead of a\n * DOM element.\n *\n * This is the container-based counterpart to `exportWaasPrivateKey` (which\n * injects an iframe into a DOM `displayContainer` on web). The export ceremony\n * runs — and the private key is rendered — entirely inside the container's own\n * sandboxed document; the key is never exposed to the host JS layer. The caller\n * owns the container's lifecycle and must call `container.destroy()` when the\n * display is dismissed.\n *\n * @param params.walletAccount - The WaaS wallet account to export the private key from.\n * @param params.container - The container that hosts the secure key display.\n * @param [params.password] - Optional password to decrypt the private key.\n * @param client - The Dynamic client instance. This is an internal API (exposed\n *   only via `@dynamic-labs-sdk/client/waas/core`), so the client is passed\n *   explicitly rather than defaulted — callers resolve it (e.g. via\n *   `getDefaultClient()`) and thread it in.\n * @returns A promise that resolves when the private key export is complete.\n * @notInstrumented\n */\nexport const exportWaasPrivateKeyToContainer = async (\n  { container, password, walletAccount }: ExportWaasPrivateKeyToContainerParams,\n  client: DynamicClient\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.exportPrivateKey({\n    container,\n    password,\n    walletAccount,\n  });\n};\n","import { WalletProviderEnum } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../client/types';\nimport { getChainFromVerifiedCredentialChain } from '../../../utils/getChainFromVerifiedCredentialChain';\nimport type { Chain } from '../../chain';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\n\ntype GetAllUserWaasAddressesForChainParams = {\n  chain: Chain;\n};\n\n/** @notInstrumented */\nexport const getAllUserWaasAddressesForChain = (\n  { chain }: GetAllUserWaasAddressesForChainParams,\n  client: DynamicClient\n): string[] => {\n  if (!client.user) {\n    return [];\n  }\n\n  const waasWalletCredentials =\n    client.user.verifiedCredentials.filter(\n      (credential) =>\n        credential.walletProvider === WalletProviderEnum.EmbeddedWallet &&\n        credential.walletName\n          ?.toLowerCase()\n          .startsWith(DYNAMIC_WAAS_METADATA.normalizedWalletName) &&\n        credential.address &&\n        credential.chain &&\n        getChainFromVerifiedCredentialChain(credential.chain) === chain\n    ) ?? [];\n\n  const waasAddresses: string[] = waasWalletCredentials.map(\n    // casting because we're already filtering out credentials without an address\n    (credential) => credential.address as string\n  );\n\n  return waasAddresses;\n};\n","import { assertPackageVersion } from '@dynamic-labs-sdk/assert-package-version';\n\nimport {\n  name as packageName,\n  version as packageVersion,\n} from '../../package.json';\nassertPackageVersion(packageName, packageVersion);\n\nexport type {\n  BitcoinNetwork,\n  DynamicWalletClient,\n  MigrateFromFireblocksResponse,\n  ThresholdSignatureScheme,\n} from '@dynamic-labs-wallet/browser-wallet-client';\nexport type { WaasSDKContainer } from '@dynamic-labs-wallet/core';\nexport { DYNAMIC_WAAS_METADATA } from '../modules/waas/constants';\nexport { createWaasClient } from '../modules/waas/createWaasClient';\nexport { createWaasProvider } from '../modules/waas/createWaasProvider';\nexport { exportWaasPrivateKeyToContainer } from '../modules/waas/exportWaasPrivateKeyToContainer';\nexport { getAllUserWaasAddressesForChain } from '../modules/waas/getAllUserWaasAddressesForChain';\nexport { getWaasChainNameFromChain } from '../modules/waas/getWaasChainNameFromChain';\nexport { migrateFromFireblocks } from '../modules/waas/migrateFromFireblocks';\nexport { preconnectWaasIframe } from '../modules/waas/preconnectWaasIframe';\nexport type {\n  WaasProvider,\n  WaasTransactionBroadcastEncoding,\n  WaasTransactionBroadcastResult,\n  WaasWalletProvider,\n} from '../modules/waas/waas.types';\n"],"mappings":";;;;;;;;;;;AAeA,MAAaA,oBAAsC,EAAE,aAAa,WAAW;CAC3E,MAAM,OAAOC,iCAAQ,OAAO;CAE5B,MAAM,2BAA2B,KAAK,MAAM;CAE5C,MAAM,iCACJ,OAAO,iBAAiB,IAAI,MAAM;CAKpC,MAAM,sBAAsB,KAAK,MAAM,KAAK,CAAC,MAAM;AAEnD,QAAO,IAAIC,+DACT;EACE,UAAWC,yCAAgB,OAAO,GAAG,WAAW;EAChD,WAAW,OAAO,SAAS;EAC3B,aAAa,KAAK,cAAcC,oDAA2B,QACzD,WACA,GACD;EACD,oBACE,OAAO,iBAAiB,IAAI,MAAM,YAClCC;EACF;EAGA,yBAAyB;EACzB,eAAe,KAAK;EACpB,YAAY,GAAGC,yCAAgB,GAAG,KAAK;EACvC,GAAI,4BAA4B,SAC5B,EAAE,GACF,EAAE,0BAA0B;EAChC,GAAI,kCAAkC,SAClC,EAAE,GACF,EAAE,gCAAgC;EACtC,GAAI,KAAK,MAAM,iBAAiB,SAC5B,EAAE,GACF,EAAE,mBAAmB,KAAK,KAAK,eAAe;EAClD,GAAI,KAAK,MAAM,kBAAkB,SAC7B,EAAE,GACF,EAAE,kBAAkB,KAAK,KAAK,gBAAgB;EACnD,EACD;EAGE,0BACEC,8CAAmB,OAAO,CAAC,MAAM,EAAE,gBAAgB,UAAU;EAS/D,sBAAsB;AAEpB,OADyB,KAAK,MAAM,KAAK,CAAC,MAAM,cACvB,oBACvB;AAEF,GAAKC,oDACH,EAAE,QAAQ,gCAAgC,EAC1C,OACD,CAAC,OAAO,UAAU;AACjB,SAAK,OAAO,MACV,sDACA,MACD;KACD;;EAEL,CACF;;;;;;;;;;;;;;;;;;;AC3DH,MAAa,4BACA,EACT,OACA,aAQA,OAEF,OAAO,GAAG,SAAkC;AAC1C,KAAI;AACF,SAAO,MAAM,GAAG,GAAG,KAAK;UACjB,OAAO;AACd,MAAI,MAAM,MAAM,CACd,OAAM,MAAM,MAAM;AAEpB,QAAM;;;;;;;;;;;;;;;;;;;;;;AChBZ,MAAa,+BAA+B,OAC1C,EAAE,WAAW,SACb,WACuC;CACvC,MAAM,sBAAsBC,gDAAuB,EAAE,OAAO,EAAE,OAAO;AAErE,KAAI,oBACF,QAAO;EAAE;EAAqB,UAAU;EAAW;AAQrD,QAAO;EAAE,qBAAqB;EAAW,UALxB,MAAMC,8DACrB,EAAE,WAAW,EACb,OACD;EAEkD;;;;;ACvCrD,MAAM,oCAAoC;CACxC,gCAAgC;CAChC,2BAA2B;CAC3B,wBAAwB;CACxB,oBAAoB;CACpB,2BAA2B;CAC3B,6BAA6B;CAC7B,4BAA4B;CAC5B,qBAAqB;CACrB,oCACE;CACF,wBAAwB;CACzB;AAED,MAAM,0CAA0C,IAAI,IAElD;CAAC;CAAiB;CAAmB;CAAU,CAAC;;;;;;AAOlD,MAAaC,mCAAgD,UAAU;AACrE,KAAI,EAAE,iBAAiBC,mCACrB,QAAO;CAIT,MAAM,OAAO,kCADG,MAAM;AAEtB,KAAI,CAAC,KACH,QAAO;CAGT,MAAM,UAAU,MAAM;AAEtB,KACE,CAAC,WACD,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,gBAAgB,YAC/B,OAAO,QAAQ,cAAc,aAC7B,OAAO,QAAQ,oBAAoB,SAEnC,QAAO;CAGT,MAAM,kBACJ,QAAQ;AAEV,KAAI,CAAC,wCAAwC,IAAI,gBAAgB,CAC/D,QAAO;CAGT,MAAM,gBACJ,OAAO,QAAQ,kBAAkB,WAC7B,QAAQ,gBACR;AAEN,QAAO,IAAIC,wDAA0B;EACnC,UAAU,QAAQ;EAClB,aAAa,QAAQ;EACrB,OAAO;EACP;EACA,SAAS,MAAM;EACf,WAAW,QAAQ;EACnB;EACA;EACD,CAAC;;;;;ACjDJ,MAAM,yBAAyB;;;;;;AAO/B,MAAa,2BAA2B,OACtC,EACE,UACA,WACA,mBACA,eACA,iBAEF,WAC4C;CAC5C,MAAM,YAAYC,yCAChB,EAAE,cAAc,CAAC,gCAAgC,EAAE,EACnD,OACD;CAED,IAAI,cAAcC,mDAAwB;AAC1C,KAAI,aAAa,SACf,eAAcA,mDAAwB;CAGxC,MAAMC,UAA2C;EAC/C,UAAU;EACV;EACA;EACD;AACD,KAAI,kBAAkB,OACpB,SAAQ,UAAU,EAAE,eAAe;CAKrC,MAAM,WAAW,cAAc;AAC/B,wCACE,UACA,qEACD;CAED,MAAM,WAAW,MAAM,UAAU,yBAAyB;EACxD,eAAeC,iCAAQ,OAAO,CAAC;EAC/B,iCAAiC;EACjC;EACA,iBAAiBC,sCAAa,EAAE,QAAQ,wBAAwB,CAAC;EAClE,CAAC;CAEF,IAAIC,SAAmD;AACvD,KAAI,SAAS,WAAWC,0DAA+B,aACrD,UAAS;AAGX,QAAO;EACL,UAAU,SAAS;EACnB,aAAa,SAAS;EACtB;EACA,eAAe,SAAS;EACzB;;;;;;AClFH,MAAa,6BAA6B,UAAyB;AACjE,QAAOC,yCAAgB,OAAO,yBAAyB;;;;;;;;;;;;;ACEzD,MAAM,0CACJ;;;;;;;;;;AAWF,MAAa,6BAA6B,UACxC,iBAAiB,SACjB,MAAM,QAAQ,WAAW,wCAAwC;;;;ACKnE,MAAM,sCAAsC;;AAQ5C,MAAa,sBAAsB,EACjC,WACA,YAC4C;CAC5C,MAAM,SAASC,iCAAQ,UAAU,CAAC;CAElC,IAAIC;CAGJ,IAAIC;CASJ,MAAM,wBAAwB,WAAsC;AAClE,MAAI,gBAAgB,QAAQ;AAC1B,iBAAc;AACd,0BAAuB;;;CAU3B,MAAM,6BACJ,UAEA,iBAAiB,SACjB,MAAM,SAAS,oBACd,MAAiC,WAAW,OAC5C,MAAiC,SAAS;CAK7C,MAAM,sBAAwD,EAC5D,gBAG4C;EAI5C,MAAM,UAAU,OAAO,EACrB,MACA,cAIsB;GACtB,MAAM,qBAAqBF,iCAAQ,UAAU,CAAC,MAAM,KAAK;GACzD,MAAM,wBAAwB,mBAAmB;GAIjD,MAAM,mCAAmB,IAAI,MAAM;GACnC,MAAM,+BACJ,mBAAmB,wBAAwB,EAAE,EAC7C,QACC,UAAU,CAAC,MAAM,aAAa,MAAM,YAAY,iBAClD;AACD,OAAI;AACF,WAAO,MAAM,UAAU,GAAG,KAAK;YACxB,OAAO;AACd,QAAI,CAAC,0BAA0B,MAAM,CACnC,OAAM;IAWR,MAAM,oBAAoBA,iCAAQ,UAAU,CAAC,MAAM,KAAK;IACxD,MAAM,4BACJ,0BAA0B,QAC1B,kBAAkB,aAAa;IACjC,MAAM,6BACJ,kBAAkB,wBAAwB,EAAE;IAC9C,MAAM,iCACJ,4BAA4B,MACzB,WACC,OAAO,aACP,CAAC,2BAA2B,MACzB,UAAU,MAAM,UAAU,OAAO,MACnC,CACJ;AAEH,QAAI,6BAA6B,+BAC/B,OAAM,IAAIG,+DAA8B,EAAE,OAAO,OAAO,CAAC;AAG3D,QAAI,QACF,OAAM;IAOR,MAAM,kBAAkB;AACxB,UAAMC,+CAAY,UAAU;AAC5B,QAAI,gBACF,sBAAqB,gBAAgB;AAEvC,WAAO,QAAQ;KAAE;KAAM,SAAS;KAAM,CAAC;;;AAG3C,UAAQ,GAAG,SAAgB,QAAQ;GAAE;GAAM,SAAS;GAAO,CAAC;;CAK9D,MAAMC,gBAA+C,YAAY;EAS/D,MAAM,mBAAmBL,iCAAQ,UAAU,CAAC,MAAM,KAAK,CAAC,MAAM;AAC9D,MAAI,eAAe,qBAAqB,qBACtC,eAAc;AAGhB,MAAI,CAAC,aAAa;AAShB,OAAI,CAACM,0DAAyB,UAAU,CACtC,OAAM,IAAIC,gEAA+B;GAG3C,MAAM,cAAc,iBAClB,EAAE,WAAW,0BAA0B,MAAM,EAAE,EAC/C,UACD;AACD,iBAAc;AACd,0BAAuB;AACvB,OAAI;AACF,UAAM,YAAY,YAAY;YACvB,OAAO;AAMd,yBAAqB,YAAY;AACjC,UAAM;;;AAOV,SAAO;;CAWT,MAAM,6BAA6B,OAAgB,EACjD,YACA,gBAIsB;AACtB,MAAI;AACF,UAAO,MAAM,WAAW;WACjB,OAAO;AACd,OAAI,0BAA0B,MAAM,CAClC,sBAAqB,WAAW;AAElC,SAAM;;;CAIV,MAAMC,+BACJ,OAAO,EAAE,wBAAwB,UAAU,oBAAoB;EAC7D,MAAM,EAAE,WAAW,oBAAoB,MAAMC,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,6BAA6B;IACtC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMC,wBAA8D,SAClE,yBAAyB,MAAM,UAAU;CAE3C,MAAMC,8BACJ,OAAO,EAAE,0BAA0B,UAAU,UAAU,oBAAoB;EACzE,MAAM,EAAE,WAAW,oBAAoB,MAAMF,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,gBAAgB;IACzB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMG,sBAA2D,OAC/D,OAAO,EAAE,KACN;AACH,SAAO,MAAM,4CAA4C;GACvD,eAAe,KAAK;GACpB,0BAA0B,KAAK;GAChC,CAAC;EAEF,MAAM,EAAE,WAAW,oBAAoB,MAAMH,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAiBxC,SAfmB,MAAM,2BAA2B;GAClD,iBACE,WAAW,oBAAoB;IAC7B,WAAW,UAAU,SAAS;IAC9B,eAAe,KAAK;IACpB,mBAAmB,KAAK;IACxB,UAAU,KAAK;IACf;IACA,0BACE,KAAK,4BACLI,oEAAyB;IAC5B,CAAC;GACJ;GACD,CAAC;;CAKJ,MAAMC,oBAAuD,OAAO,EAClE,oBACA,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAML,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,kBAAkB;IAC3B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMM,wBAA+D,OAAO,EAC1E,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMN,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,QAAM,2BAA2B;GAC/B,iBACE,WAAW,sBAAsB;IAC/B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMO,mBAAqD,OAAO,EAChE,WACA,kBACA,eACA,eACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMP,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;EAIxC,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GACE,WAAWQ,qCAAU;GACrB,OAAOC,sCAAW;GACnB,EACD,UACD;AAEH,QAAM,2BAA2B;GAC/B,iBACE,WAAW,iBAAiB;IAC1B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAM9B;IACA;IACA;IACA;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMC,mCACJ,OAAO,EAAE,oBAAoB;EAC3B,MAAM,EAAE,WAAW,oBAAoB,MAAMV,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,QAAM,2BAA2B;GAC/B,iBACE,WAAW,UAAU;IACnB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA,iBAAiBW,2DAAgB;IAClC,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMC,mBAAqD,OAAO,EAChE,YACA,2BAA2BR,oEAAyB,iBAChD;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMJ,8CAAmB,UAAU;EAE1E,MAAM,eAAe,MAAM,eAAe;AAE1C,QAAM,2BAA2B;GAC/B,iBACE,aAAa,iBAAiB;IAC5B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ,YAAY;GACb,CAAC;;CAGJ,MAAMa,0BAA+D,OAAO,EAC1E,WACA,UACA,mBACA,KACA,UACA,cACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMb,8CAAmB,UAAU;EAE1E,MAAM,eAAe,MAAM,eAAe;AAE1C,SAAO,2BAA2B;GAChC,iBACE,aAAa,sBAAsB;IACjC,WAAW,UAAU,SAAS;IAC9B,YAAY;KACV;KACA;KACA;KACA,YAAY;KACZ,gBAAgB;KAChB,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;KACnC;IACD;IACD,CAAC;GACJ,YAAY;GACb,CAAC;;CAGJ,MAAMc,6BACJ,OAAO,EAAE,UAAU,oBAAoB;EACrC,MAAM,EAAE,WAAW,oBAAoB,MAAMd,8CAC3C,UACD;EAED,MAAM,eAAe,MAAM,eAAe;EAE1C,MAAM,WAAW,MAAMe,8DACrB,EAAE,WAAWP,qCAAU,mBAAmB,EAC1C,UACD;AAED,SAAO,2BAA2B;GAChC,iBACE,aAAa,2BAA2B;IACtC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACD,CAAC;GACJ,YAAY;GACb,CAAC;;CAGN,MAAMQ,6BACJ,OAAO,EACL,mBACA,UACA,YACA,sBACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMhB,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;EAExC,MAAM,EAAE,wBAAwB,MAAM,6BACpC;GACE,WAAWQ,qCAAU;GACrB,OAAOC,sCAAW;GACnB,EACD,UACD;AAED,SAAO,2BAA2B;GAChC,iBACE,WAAW,2BAA2B;IACpC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IAGY;IAGZ;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMQ,mBAAqD,OAAO,EAChE,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMjB,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,iBAAiB;IAC1B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMkB,+BACJ,OAAO,EAAE,UAAU,oBAAoB;EACrC,MAAM,EAAE,WAAW,oBAAoB,MAAMlB,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,YAAY;IACrB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B,aAAa;IACb;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAMmB,iBAAiD,OAAO,EAC5D,SACA,UACA,oBACI;AACJ,MAAI,QAAQ,WAAW,oCACrB,OAAM,IAAIC,2CACR,mBAAmB,oCAAoC,kBACxD;EAGH,MAAM,EAAE,WAAW,oBAAoB,MAAMpB,8CAAmB,UAAU;EAE1E,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GAAE,WAAWQ,qCAAU;GAAgB,OAAOC,sCAAW;GAAY,EACrE,UACD;EAEH,MAAM,eAAe,MAAM,eAAe;AAgB1C,SAAO,EAAE,WAdS,MAAM,2BAA2B;GACjD,iBACE,aAAa,eAAe;IAC1B,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IACA;IACD,CAAC;GACJ,YAAY;GACb,CAAC,EAEkB;;CAGtB,MAAMY,UAAmC,OAAO,SAAS;AACvD,MAAI,CAAC,YACH;EAGF,MAAM,aAAa,MAAM,eAAe;AAWxC,MAAI,MAAM,WAAW,gBACnB,OAAM,WAAW,SAAS;AAE5B,gBAAc;;CAGhB,MAAMC,iBAAiD,OAAO,EAC5D,eACA,iBACA,kBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMtB,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,eAAe;IACxB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B,kBAAkB;IAClB;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAGJ,MAAMuB,cAA2C,OAAO,EACtD,SACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAMvB,8CAAmB,UAAU;EAE1E,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GAAE,WAAWQ,qCAAU;GAAgB,OAAOC,sCAAW;GAAY,EACrE,UACD;EAEH,MAAM,aAAa,MAAM,eAAe;AAexC,SAAO,EAAE,WAbS,MAAM,2BAA2B;GACjD,iBACE,WAAW,YAAY;IACrB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA;IACD,CAAC;GACJ;GACD,CAAC,EAEkB;;CAGtB,MAAMe,4BACJ,OAAO,EAAE,SAAS,uBAAuB,oBAAoB;EAC3D,MAAM,EAAE,WAAW,oBAAoB,MAAMxB,8CAC3C,UACD;EAED,MAAM,EAAE,qBAAqB,aAC3B,MAAM,6BACJ;GAAE,WAAWQ,qCAAU;GAAgB,OAAOC,sCAAW;GAAY,EACrE,UACD;EAEH,MAAM,aAAa,MAAM,eAAe;AAgBxC,SAAO,EAAE,WAdS,MAAM,2BAA2B;GACjD,iBACE,WAAW,gBAAgB;IACzB,WAAW,UAAU,SAAS;IAC9B;IACA;IACA;IACA,eAAe,cAAc;IAC7B;IACA,aAAa;IACd,CAAC;GACJ;GACD,CAAC,EAEkB;;CAGxB,MAAMgB,yBACJ,OAAO,EAAE,oBAAoB;EAC3B,MAAM,EAAE,WAAW,oBAAoB,MAAMzB,8CAC3C,UACD;EAED,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,uBAAuB;IAChC,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACD,CAAC;GACJ;GACD,CAAC;;CAGN,MAAM0B,eAA6C,OAAO,EACxD,UACA,oBACI;EACJ,MAAM,EAAE,WAAW,oBAAoB,MAAM1B,8CAAmB,UAAU;EAE1E,MAAM,aAAa,MAAM,eAAe;AAExC,SAAO,2BAA2B;GAChC,iBACE,WAAW,aAAa;IACtB,gBAAgB,cAAc;IAC9B,WAAW,UAAU,SAAS;IAC9B;IACA;IACD,CAAC;GACJ;GACD,CAAC;;CAQJ,MAAM,uBAAuB,yBAAyB;EACpD,QAAQ,UAAU,IAAI2B,qDAAoB,EAAE,OAAO,OAAO,CAAC;EAC3D,OAAO;EACR,CAAC;AAmDF,QAjD+B;EAC7B,8BAA8B,qBAC5B,6BACD;EACD;EACA,6BAA6B,qBAC3B,4BACD;EACD,qBAAqB,qBACnB,mBAAmB,EAAE,WAAW,qBAAqB,CAAC,CACvD;EACD,mBAAmB,qBAAqB,kBAAkB;EAC1D,SAAS,qBAAqB,QAAQ;EACtC,uBAAuB,qBACrB,mBAAmB,EAAE,WAAW,uBAAuB,CAAC,CACzD;EACD,kBAAkB,qBAChB,mBAAmB,EAAE,WAAW,kBAAkB,CAAC,CACpD;EACD,eAAe,qBAAqB,cAAc;EAClD,wBAAwB,qBAAqB,uBAAuB;EACpE,kBAAkB,qBAAqB,iBAAiB;EACxD,uBAAuB,qBAAqBC,wBAAsB;EAClE,4BAA4B,qBAC1B,2BACD;EACD,4BAA4B,qBAC1B,mBAAmB,EAAE,WAAW,4BAA4B,CAAC,CAC9D;EACD,kCAAkC,qBAChC,iCACD;EACD,kBAAkB,qBAAqB,iBAAiB;EACxD,8BAA8B,qBAC5B,6BACD;EACD,aAAa,qBACX,mBAAmB,EAAE,WAAW,aAAa,CAAC,CAC/C;EACD,gBAAgB,qBACd,mBAAmB,EAAE,WAAW,gBAAgB,CAAC,CAClD;EACD,2BAA2B,qBACzB,mBAAmB,EAAE,WAAW,2BAA2B,CAAC,CAC7D;EACD,cAAc,qBAAqB,aAAa;EAChD,gBAAgB,qBAAqB,eAAe;EACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;AC1wBH,MAAa,kCAAkC,OAC7C,EAAE,WAAW,UAAU,iBACvB,WACkB;AAMlB,QALiBC,qEACf,EAAE,eAAe,EACjB,OACD,CAEe,iBAAiB;EAC/B;EACA;EACA;EACD,CAAC;;;;;;ACnCJ,MAAa,mCACX,EAAE,SACF,WACa;AACb,KAAI,CAAC,OAAO,KACV,QAAO,EAAE;AAoBX,SAhBE,OAAO,KAAK,oBAAoB,QAC7B,eACC,WAAW,mBAAmBC,8CAAmB,kBACjD,WAAW,YACP,aAAa,CACd,WAAWC,+CAAsB,qBAAqB,IACzD,WAAW,WACX,WAAW,SACXC,6DAAoC,WAAW,MAAM,KAAK,MAC7D,IAAI,EAAE,EAE6C,KAEnD,eAAe,WAAW,QAC5B;;;;;mEC7BkBC,+BAAaC,iCAAe"}

package/dist/waasCore.esm.js

@@ -1,9 +1,8 @@
-import { Ct as name, F as getChainFromVerifiedCredentialChain, I as CHAINS_INFO_MAP, K as createApiClient, St as getCore, a as InvalidParamError, d as DEFAULT_WAAS_BASE_MPC_RELAY_API_URL, dt as isCookieEnabled, f as DYNAMIC_WAAS_METADATA, ft as assertDefined, h as __logoutWithReason_wrapped, ht as randomString, mt as getElevatedAccessToken, ot as APIError, st as CLIENT_SDK_NAME, u as DEFAULT_WAAS_BASE_API_URL, wt as version } from "./updateAuthFromVerifyResponse-BLgNMqwN.esm.js";
-import { n as TransactionBroadcastError } from "./isDynamicWaasEnabled-DYORq7Jc.esm.js";
-import { a as WaasOnboardingIncompleteError, i as preconnectWaasIframe, o as WaasLoadFailedError, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-jkAQQVdP.esm.js";
-import "./isMfaRequiredForAction-CatS60F6.esm.js";
-import { n as consumeMfaTokenIfRequiredForAction, t as getSignedSessionId } from "./getSignedSessionId-DY-ietfO.esm.js";
-import { n as getWaasWalletProviderFromWalletAccount, t as migrateFromFireblocks } from "./migrateFromFireblocks-D4E9bT2H.esm.js";
+import { D as DEFAULT_WAAS_BASE_API_URL, Et as version, H as CHAINS_INFO_MAP, O as DEFAULT_WAAS_BASE_MPC_RELAY_API_URL, St as getCore, Tt as name, V as getChainFromVerifiedCredentialChain, _t as randomString, b as InvalidParamError, c as createApiClient, ct as APIError, gt as getElevatedAccessToken, k as DYNAMIC_WAAS_METADATA, l as __refreshAuth_wrapped, lt as CLIENT_SDK_NAME, mt as assertDefined, pt as isCookieEnabled, t as __logoutWithReason_wrapped } from "./logoutWithReason-CIsCVAUE.esm.js";
+import { a as TransactionBroadcastError, r as getWaasWalletProviderFromWalletAccount, t as migrateFromFireblocks } from "./migrateFromFireblocks-_Vt4cY3Y.esm.js";
+import { a as WaasRbacStaleRetryUnsafeError, i as preconnectWaasIframe, o as WaasOnboardingIncompleteError, s as WaasLoadFailedError, t as isUserOnboardingComplete } from "./isUserOnboardingComplete-DtGJK_dW.esm.js";
+import "./isMfaRequiredForAction-B0pOYhvq.esm.js";
+import { n as consumeMfaTokenIfRequiredForAction, t as getSignedSessionId } from "./getSignedSessionId-B_iFJpYg.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { MFAAction, TokenScope, WaasTransactionBroadcastStatus, WaasTransactionEncoding, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 import { DynamicWalletClient, ThresholdSignatureScheme, WalletOperation } from "@dynamic-labs-wallet/browser-wallet-client";
@@ -218,6 +217,37 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 			_waasClientSessionId = void 0;
 		}
 	};
+	const isRbacStaleWalletApiError = (error) => error instanceof Error && error.name === "WalletApiError" && error.status === 403 && error.code === "rbac_stale";
+	const withRbacStaleRetry = ({ operation }) => {
+		const attempt = async ({ args, isRetry }) => {
+			const stateBeforeAttempt = getCore(sdkClient).state.get();
+			const mfaTokenBeforeAttempt = stateBeforeAttempt.mfaToken;
+			const attemptStartedAt = /* @__PURE__ */ new Date();
+			const elevatedTokensBeforeAttempt = (stateBeforeAttempt.elevatedAccessTokens ?? []).filter((token) => !token.expiresAt || token.expiresAt > attemptStartedAt);
+			try {
+				return await operation(...args);
+			} catch (error) {
+				if (!isRbacStaleWalletApiError(error)) throw error;
+				const stateAfterAttempt = getCore(sdkClient).state.get();
+				const mfaTokenConsumedByAttempt = mfaTokenBeforeAttempt !== null && stateAfterAttempt.mfaToken === null;
+				const elevatedTokensAfterAttempt = stateAfterAttempt.elevatedAccessTokens ?? [];
+				const elevatedTokenConsumedByAttempt = elevatedTokensBeforeAttempt.some((before) => before.singleUse && !elevatedTokensAfterAttempt.some((after) => after.token === before.token));
+				if (mfaTokenConsumedByAttempt || elevatedTokenConsumedByAttempt) throw new WaasRbacStaleRetryUnsafeError({ cause: error });
+				if (isRetry) throw error;
+				const staleWaasClient = _waasClient;
+				await __refreshAuth_wrapped(sdkClient);
+				if (staleWaasClient) resetClientIfCurrent(staleWaasClient);
+				return attempt({
+					args,
+					isRetry: true
+				});
+			}
+		};
+		return (...args) => attempt({
+			args,
+			isRetry: false
+		});
+	};
 	const getWaasClient = async () => {
 		const currentSessionId = getCore(sdkClient).state.get().user?.sessionId;
 		if (_waasClient && currentSessionId !== _waasClientSessionId) _waasClient = void 0;
@@ -560,23 +590,23 @@ const createWaasProvider = ({ sdkClient, chain }) => {
 		backupKeySharesToGoogleDrive: translateLoadFailure(backupKeySharesToGoogleDrive),
 		broadcastTransaction,
 		createOfflineRecoveryShares: translateLoadFailure(createOfflineRecoveryShares),
-		createWalletAccount: translateLoadFailure(createWalletAccount),
+		createWalletAccount: translateLoadFailure(withRbacStaleRetry({ operation: createWalletAccount })),
 		delegateKeyShares: translateLoadFailure(delegateKeyShares),
 		destroy: translateLoadFailure(destroy),
-		exportClientKeyshares: translateLoadFailure(exportClientKeyshares),
-		exportPrivateKey: translateLoadFailure(exportPrivateKey),
+		exportClientKeyshares: translateLoadFailure(withRbacStaleRetry({ operation: exportClientKeyshares })),
+		exportPrivateKey: translateLoadFailure(withRbacStaleRetry({ operation: exportPrivateKey })),
 		getWaasClient: translateLoadFailure(getWaasClient),
 		getWalletRecoveryState: translateLoadFailure(getWalletRecoveryState),
 		importPrivateKey: translateLoadFailure(importPrivateKey),
 		migrateFromFireblocks: translateLoadFailure(migrateFromFireblocks$1),
 		refreshWalletAccountShares: translateLoadFailure(refreshWalletAccountShares),
-		reshareToNewSignerShareSet: translateLoadFailure(reshareToNewSignerShareSet),
+		reshareToNewSignerShareSet: translateLoadFailure(withRbacStaleRetry({ operation: reshareToNewSignerShareSet })),
 		restoreUserShareForWalletAccount: translateLoadFailure(restoreUserShareForWalletAccount),
 		revokeDelegation: translateLoadFailure(revokeDelegation),
 		setWaasWalletAccountPassword: translateLoadFailure(setWaasWalletAccountPassword),
-		signMessage: translateLoadFailure(signMessage),
-		signRawMessage: translateLoadFailure(signRawMessage),
-		signSerializedTransaction: translateLoadFailure(signSerializedTransaction),
+		signMessage: translateLoadFailure(withRbacStaleRetry({ operation: signMessage })),
+		signRawMessage: translateLoadFailure(withRbacStaleRetry({ operation: signRawMessage })),
+		signSerializedTransaction: translateLoadFailure(withRbacStaleRetry({ operation: signSerializedTransaction })),
 		unlockWallet: translateLoadFailure(unlockWallet),
 		updatePassword: translateLoadFailure(updatePassword)
 	};