@dynamic-labs-sdk/client 1.31.0 → 1.31.2

package/dist/{getSignedSessionId-DxpqG4pv.esm.js → getSignedSessionId-5q4uyZsv.native.esm.js}

@@ -1,5 +1,5 @@
-import { St as getCore, Z as getNonce, mt as assertDefined } from "./logoutWithReason-DV89zJmJ.esm.js";
-import { r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-BIBmJbV9.esm.js";
+import { J as getNonce, ht as getElevatedAccessToken, pt as assertDefined, xt as getCore } from "./apiClient-d2qJyIvx.native.esm.js";
+import { r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-BrRCSvEX.native.esm.js";
 
 //#region src/modules/mfa/consumeMfaTokenIfRequiredForAction/consumeMfaTokenIfRequiredForAction.ts
 /** @notInstrumented */
@@ -8,6 +8,36 @@ const consumeMfaTokenIfRequiredForAction = async ({ mfaAction }, client) => {
 	return __consumeMfaToken_wrapped(client);
 };
 
+//#endregion
+//#region src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts
+/**
+* Resolves the tokens that authorize a verification-gated wallet action.
+*
+* An elevated access token for `scope` is the current proof of verification, so
+* it takes precedence: when one has been banked, the legacy per-action MFA token
+* is left untouched. Demanding both would break every user who has a verified
+* MFA method, because satisfying the challenge with `requestedScopes` mints an
+* elevated access token and no MFA token -- leaving nothing for
+* `consumeMfaTokenIfRequiredForAction` to consume, which then throws.
+*
+* @param params.mfaAction - The action whose legacy MFA requirement to evaluate.
+* @param params.scope - The scope of the elevated access token that authorizes the action.
+* @param client - The Dynamic client instance.
+* @returns The elevated access token, or the legacy MFA token when no elevated token exists.
+* @notInstrumented
+*/
+const getActionAuthorizationTokens = async ({ mfaAction, scope }, client) => {
+	const elevatedAccessToken = getElevatedAccessToken({ scope }, client);
+	if (elevatedAccessToken) return {
+		elevatedAccessToken,
+		mfaToken: void 0
+	};
+	return {
+		elevatedAccessToken: void 0,
+		mfaToken: await consumeMfaTokenIfRequiredForAction({ mfaAction }, client)
+	};
+};
+
 //#endregion
 //#region src/modules/sessionKeys/generateNonceSignature/generateNonceSignature.ts
 /** @notInstrumented */
@@ -39,5 +69,5 @@ const getSignedSessionId = async (client) => {
 };
 
 //#endregion
-export { consumeMfaTokenIfRequiredForAction as n, getSignedSessionId as t };
-//# sourceMappingURL=getSignedSessionId-DxpqG4pv.esm.js.map
+export { getActionAuthorizationTokens as n, consumeMfaTokenIfRequiredForAction as r, getSignedSessionId as t };
+//# sourceMappingURL=getSignedSessionId-5q4uyZsv.native.esm.js.map

package/dist/getSignedSessionId-5q4uyZsv.native.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSignedSessionId-5q4uyZsv.native.esm.js","names":["consumeMfaToken"],"sources":["../src/modules/mfa/consumeMfaTokenIfRequiredForAction/consumeMfaTokenIfRequiredForAction.ts","../src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts","../src/modules/sessionKeys/generateNonceSignature/generateNonceSignature.ts","../src/modules/sessionKeys/generateSessionSignature/generateSessionSignature.ts","../src/modules/sessionKeys/getSignedSessionId/getSignedSessionId.ts"],"sourcesContent":["import type { MFAAction } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { consumeMfaToken } from '../consumeMfaToken';\nimport { isMfaRequiredForAction } from '../isMfaRequiredForAction';\n\ntype ConsumeMfaTokenIfRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/** @notInstrumented */\nexport const consumeMfaTokenIfRequiredForAction = async (\n  { mfaAction }: ConsumeMfaTokenIfRequiredForActionParams,\n  client: DynamicClient\n): Promise<string | undefined> => {\n  const isRequiredForAction = await isMfaRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  if (!isRequiredForAction) {\n    return;\n  }\n\n  return consumeMfaToken(client);\n};\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { TokenScope } from '../consts';\nimport type { MFAAction } from '../../mfa/mfa.consts';\nimport { consumeMfaTokenIfRequiredForAction } from '../../mfa/consumeMfaTokenIfRequiredForAction';\nimport { getElevatedAccessToken } from '../getElevatedAccessToken';\n\ntype GetActionAuthorizationTokensParams = {\n  mfaAction: MFAAction;\n  scope: TokenScope;\n};\n\ntype ActionAuthorizationTokens = {\n  elevatedAccessToken: string | undefined;\n  mfaToken: string | undefined;\n};\n\n/**\n * Resolves the tokens that authorize a verification-gated wallet action.\n *\n * An elevated access token for `scope` is the current proof of verification, so\n * it takes precedence: when one has been banked, the legacy per-action MFA token\n * is left untouched. Demanding both would break every user who has a verified\n * MFA method, because satisfying the challenge with `requestedScopes` mints an\n * elevated access token and no MFA token -- leaving nothing for\n * `consumeMfaTokenIfRequiredForAction` to consume, which then throws.\n *\n * @param params.mfaAction - The action whose legacy MFA requirement to evaluate.\n * @param params.scope - The scope of the elevated access token that authorizes the action.\n * @param client - The Dynamic client instance.\n * @returns The elevated access token, or the legacy MFA token when no elevated token exists.\n * @notInstrumented\n */\nexport const getActionAuthorizationTokens = async (\n  { mfaAction, scope }: GetActionAuthorizationTokensParams,\n  client: DynamicClient\n): Promise<ActionAuthorizationTokens> => {\n  const elevatedAccessToken = getElevatedAccessToken({ scope }, client);\n\n  if (elevatedAccessToken) {\n    return { elevatedAccessToken, mfaToken: undefined };\n  }\n\n  const mfaToken = await consumeMfaTokenIfRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  return { elevatedAccessToken: undefined, mfaToken };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { assertDefined } from '../../../utils/assertDefined';\n\ntype GenerateNonceSignatureParams = {\n  nonce: string;\n};\n\ntype GenerateNonceSignatureResult = { signature: string };\n\n/** @notInstrumented */\nexport const generateNonceSignature = async (\n  { nonce }: GenerateNonceSignatureParams,\n  client: DynamicClient\n): Promise<GenerateNonceSignatureResult> => {\n  const core = getCore(client);\n\n  assertDefined(core.keychain, 'Keychain service not available');\n\n  const signature = await core.keychain.sign('session', nonce);\n\n  return { signature };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\n\ntype GenerateSessionSignatureParams = {\n  sessionId: string;\n};\n\ntype GenerateSessionSignatureResult = { signature: string };\n\n/** @notInstrumented */\nexport const generateSessionSignature = async (\n  { sessionId }: GenerateSessionSignatureParams,\n  client: DynamicClient\n): Promise<GenerateSessionSignatureResult> => {\n  const core = getCore(client);\n\n  const signature = await core.keychain.sign('session', sessionId);\n\n  return { signature };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { getNonce } from '../../../utils/getNonce';\nimport { generateNonceSignature } from '../generateNonceSignature';\nimport { generateSessionSignature } from '../generateSessionSignature';\n\ntype GetSignedSessionIdResult = { signature: string };\n\n/** @notInstrumented */\nexport const getSignedSessionId = async (\n  client: DynamicClient\n): Promise<GetSignedSessionIdResult> => {\n  const core = getCore(client);\n\n  const sessionId = core.state.get().user?.sessionId;\n  assertDefined(sessionId, 'Session ID is required');\n\n  const { signature: signedSessionId } = await generateSessionSignature(\n    {\n      sessionId,\n    },\n    client\n  );\n\n  assertDefined(signedSessionId, 'Signed session ID is required');\n\n  const nonce = await getNonce(client);\n\n  const { signature: nonceSignature } = await generateNonceSignature(\n    {\n      nonce,\n    },\n    client\n  );\n\n  assertDefined(nonceSignature, 'Nonce signature is required');\n\n  const signature = `${signedSessionId}/${nonceSignature}/${nonce}`;\n\n  return { signature };\n};\n"],"mappings":";;;;;AAWA,MAAa,qCAAqC,OAChD,EAAE,aACF,WACgC;AAMhC,KAAI,CALwB,MAAM,uBAChC,EAAE,WAAW,EACb,OACD,CAGC;AAGF,QAAOA,0BAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;ACQhC,MAAa,+BAA+B,OAC1C,EAAE,WAAW,SACb,WACuC;CACvC,MAAM,sBAAsB,uBAAuB,EAAE,OAAO,EAAE,OAAO;AAErE,KAAI,oBACF,QAAO;EAAE;EAAqB,UAAU;EAAW;AAQrD,QAAO;EAAE,qBAAqB;EAAW,UALxB,MAAM,mCACrB,EAAE,WAAW,EACb,OACD;EAEkD;;;;;;ACpCrD,MAAa,yBAAyB,OACpC,EAAE,SACF,WAC0C;CAC1C,MAAM,OAAO,QAAQ,OAAO;AAE5B,eAAc,KAAK,UAAU,iCAAiC;AAI9D,QAAO,EAAE,WAFS,MAAM,KAAK,SAAS,KAAK,WAAW,MAAM,EAExC;;;;;;ACXtB,MAAa,2BAA2B,OACtC,EAAE,aACF,WAC4C;AAK5C,QAAO,EAAE,WAFS,MAFL,QAAQ,OAAO,CAEC,SAAS,KAAK,WAAW,UAAU,EAE5C;;;;;;ACRtB,MAAa,qBAAqB,OAChC,WACsC;CAGtC,MAAM,YAFO,QAAQ,OAAO,CAEL,MAAM,KAAK,CAAC,MAAM;AACzC,eAAc,WAAW,yBAAyB;CAElD,MAAM,EAAE,WAAW,oBAAoB,MAAM,yBAC3C,EACE,WACD,EACD,OACD;AAED,eAAc,iBAAiB,gCAAgC;CAE/D,MAAM,QAAQ,MAAM,SAAS,OAAO;CAEpC,MAAM,EAAE,WAAW,mBAAmB,MAAM,uBAC1C,EACE,OACD,EACD,OACD;AAED,eAAc,gBAAgB,8BAA8B;AAI5D,QAAO,EAAE,WAFS,GAAG,gBAAgB,GAAG,eAAe,GAAG,SAEtC"}

package/dist/{getSignedSessionId-9ADIJCl1.cjs → getSignedSessionId-B5oxmSTs.cjs}

@@ -1,5 +1,5 @@
-const require_logoutWithReason = require('./logoutWithReason-DlA15deT.cjs');
-const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-yM84r7l7.cjs');
+const require_logoutWithReason = require('./logoutWithReason-C_T7KddM.cjs');
+const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-DnKzPDZk.cjs');
 
 //#region src/modules/mfa/consumeMfaTokenIfRequiredForAction/consumeMfaTokenIfRequiredForAction.ts
 /** @notInstrumented */
@@ -8,6 +8,36 @@ const consumeMfaTokenIfRequiredForAction = async ({ mfaAction }, client) => {
 	return require_isMfaRequiredForAction.__consumeMfaToken_wrapped(client);
 };
 
+//#endregion
+//#region src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts
+/**
+* Resolves the tokens that authorize a verification-gated wallet action.
+*
+* An elevated access token for `scope` is the current proof of verification, so
+* it takes precedence: when one has been banked, the legacy per-action MFA token
+* is left untouched. Demanding both would break every user who has a verified
+* MFA method, because satisfying the challenge with `requestedScopes` mints an
+* elevated access token and no MFA token -- leaving nothing for
+* `consumeMfaTokenIfRequiredForAction` to consume, which then throws.
+*
+* @param params.mfaAction - The action whose legacy MFA requirement to evaluate.
+* @param params.scope - The scope of the elevated access token that authorizes the action.
+* @param client - The Dynamic client instance.
+* @returns The elevated access token, or the legacy MFA token when no elevated token exists.
+* @notInstrumented
+*/
+const getActionAuthorizationTokens = async ({ mfaAction, scope }, client) => {
+	const elevatedAccessToken = require_logoutWithReason.getElevatedAccessToken({ scope }, client);
+	if (elevatedAccessToken) return {
+		elevatedAccessToken,
+		mfaToken: void 0
+	};
+	return {
+		elevatedAccessToken: void 0,
+		mfaToken: await consumeMfaTokenIfRequiredForAction({ mfaAction }, client)
+	};
+};
+
 //#endregion
 //#region src/modules/sessionKeys/generateNonceSignature/generateNonceSignature.ts
 /** @notInstrumented */
@@ -45,10 +75,16 @@ Object.defineProperty(exports, 'consumeMfaTokenIfRequiredForAction', {
     return consumeMfaTokenIfRequiredForAction;
   }
 });
+Object.defineProperty(exports, 'getActionAuthorizationTokens', {
+  enumerable: true,
+  get: function () {
+    return getActionAuthorizationTokens;
+  }
+});
 Object.defineProperty(exports, 'getSignedSessionId', {
   enumerable: true,
   get: function () {
     return getSignedSessionId;
   }
 });
-//# sourceMappingURL=getSignedSessionId-9ADIJCl1.cjs.map
+//# sourceMappingURL=getSignedSessionId-B5oxmSTs.cjs.map

package/dist/getSignedSessionId-B5oxmSTs.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSignedSessionId-B5oxmSTs.cjs","names":["isMfaRequiredForAction","consumeMfaToken","getElevatedAccessToken","getCore","getCore","getCore","getNonce"],"sources":["../src/modules/mfa/consumeMfaTokenIfRequiredForAction/consumeMfaTokenIfRequiredForAction.ts","../src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts","../src/modules/sessionKeys/generateNonceSignature/generateNonceSignature.ts","../src/modules/sessionKeys/generateSessionSignature/generateSessionSignature.ts","../src/modules/sessionKeys/getSignedSessionId/getSignedSessionId.ts"],"sourcesContent":["import type { MFAAction } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { consumeMfaToken } from '../consumeMfaToken';\nimport { isMfaRequiredForAction } from '../isMfaRequiredForAction';\n\ntype ConsumeMfaTokenIfRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/** @notInstrumented */\nexport const consumeMfaTokenIfRequiredForAction = async (\n  { mfaAction }: ConsumeMfaTokenIfRequiredForActionParams,\n  client: DynamicClient\n): Promise<string | undefined> => {\n  const isRequiredForAction = await isMfaRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  if (!isRequiredForAction) {\n    return;\n  }\n\n  return consumeMfaToken(client);\n};\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { TokenScope } from '../consts';\nimport type { MFAAction } from '../../mfa/mfa.consts';\nimport { consumeMfaTokenIfRequiredForAction } from '../../mfa/consumeMfaTokenIfRequiredForAction';\nimport { getElevatedAccessToken } from '../getElevatedAccessToken';\n\ntype GetActionAuthorizationTokensParams = {\n  mfaAction: MFAAction;\n  scope: TokenScope;\n};\n\ntype ActionAuthorizationTokens = {\n  elevatedAccessToken: string | undefined;\n  mfaToken: string | undefined;\n};\n\n/**\n * Resolves the tokens that authorize a verification-gated wallet action.\n *\n * An elevated access token for `scope` is the current proof of verification, so\n * it takes precedence: when one has been banked, the legacy per-action MFA token\n * is left untouched. Demanding both would break every user who has a verified\n * MFA method, because satisfying the challenge with `requestedScopes` mints an\n * elevated access token and no MFA token -- leaving nothing for\n * `consumeMfaTokenIfRequiredForAction` to consume, which then throws.\n *\n * @param params.mfaAction - The action whose legacy MFA requirement to evaluate.\n * @param params.scope - The scope of the elevated access token that authorizes the action.\n * @param client - The Dynamic client instance.\n * @returns The elevated access token, or the legacy MFA token when no elevated token exists.\n * @notInstrumented\n */\nexport const getActionAuthorizationTokens = async (\n  { mfaAction, scope }: GetActionAuthorizationTokensParams,\n  client: DynamicClient\n): Promise<ActionAuthorizationTokens> => {\n  const elevatedAccessToken = getElevatedAccessToken({ scope }, client);\n\n  if (elevatedAccessToken) {\n    return { elevatedAccessToken, mfaToken: undefined };\n  }\n\n  const mfaToken = await consumeMfaTokenIfRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  return { elevatedAccessToken: undefined, mfaToken };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { assertDefined } from '../../../utils/assertDefined';\n\ntype GenerateNonceSignatureParams = {\n  nonce: string;\n};\n\ntype GenerateNonceSignatureResult = { signature: string };\n\n/** @notInstrumented */\nexport const generateNonceSignature = async (\n  { nonce }: GenerateNonceSignatureParams,\n  client: DynamicClient\n): Promise<GenerateNonceSignatureResult> => {\n  const core = getCore(client);\n\n  assertDefined(core.keychain, 'Keychain service not available');\n\n  const signature = await core.keychain.sign('session', nonce);\n\n  return { signature };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\n\ntype GenerateSessionSignatureParams = {\n  sessionId: string;\n};\n\ntype GenerateSessionSignatureResult = { signature: string };\n\n/** @notInstrumented */\nexport const generateSessionSignature = async (\n  { sessionId }: GenerateSessionSignatureParams,\n  client: DynamicClient\n): Promise<GenerateSessionSignatureResult> => {\n  const core = getCore(client);\n\n  const signature = await core.keychain.sign('session', sessionId);\n\n  return { signature };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { getNonce } from '../../../utils/getNonce';\nimport { generateNonceSignature } from '../generateNonceSignature';\nimport { generateSessionSignature } from '../generateSessionSignature';\n\ntype GetSignedSessionIdResult = { signature: string };\n\n/** @notInstrumented */\nexport const getSignedSessionId = async (\n  client: DynamicClient\n): Promise<GetSignedSessionIdResult> => {\n  const core = getCore(client);\n\n  const sessionId = core.state.get().user?.sessionId;\n  assertDefined(sessionId, 'Session ID is required');\n\n  const { signature: signedSessionId } = await generateSessionSignature(\n    {\n      sessionId,\n    },\n    client\n  );\n\n  assertDefined(signedSessionId, 'Signed session ID is required');\n\n  const nonce = await getNonce(client);\n\n  const { signature: nonceSignature } = await generateNonceSignature(\n    {\n      nonce,\n    },\n    client\n  );\n\n  assertDefined(nonceSignature, 'Nonce signature is required');\n\n  const signature = `${signedSessionId}/${nonceSignature}/${nonce}`;\n\n  return { signature };\n};\n"],"mappings":";;;;;AAWA,MAAa,qCAAqC,OAChD,EAAE,aACF,WACgC;AAMhC,KAAI,CALwB,MAAMA,sDAChC,EAAE,WAAW,EACb,OACD,CAGC;AAGF,QAAOC,yDAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;ACQhC,MAAa,+BAA+B,OAC1C,EAAE,WAAW,SACb,WACuC;CACvC,MAAM,sBAAsBC,gDAAuB,EAAE,OAAO,EAAE,OAAO;AAErE,KAAI,oBACF,QAAO;EAAE;EAAqB,UAAU;EAAW;AAQrD,QAAO;EAAE,qBAAqB;EAAW,UALxB,MAAM,mCACrB,EAAE,WAAW,EACb,OACD;EAEkD;;;;;;ACpCrD,MAAa,yBAAyB,OACpC,EAAE,SACF,WAC0C;CAC1C,MAAM,OAAOC,iCAAQ,OAAO;AAE5B,wCAAc,KAAK,UAAU,iCAAiC;AAI9D,QAAO,EAAE,WAFS,MAAM,KAAK,SAAS,KAAK,WAAW,MAAM,EAExC;;;;;;ACXtB,MAAa,2BAA2B,OACtC,EAAE,aACF,WAC4C;AAK5C,QAAO,EAAE,WAFS,MAFLC,iCAAQ,OAAO,CAEC,SAAS,KAAK,WAAW,UAAU,EAE5C;;;;;;ACRtB,MAAa,qBAAqB,OAChC,WACsC;CAGtC,MAAM,YAFOC,iCAAQ,OAAO,CAEL,MAAM,KAAK,CAAC,MAAM;AACzC,wCAAc,WAAW,yBAAyB;CAElD,MAAM,EAAE,WAAW,oBAAoB,MAAM,yBAC3C,EACE,WACD,EACD,OACD;AAED,wCAAc,iBAAiB,gCAAgC;CAE/D,MAAM,QAAQ,MAAMC,kCAAS,OAAO;CAEpC,MAAM,EAAE,WAAW,mBAAmB,MAAM,uBAC1C,EACE,OACD,EACD,OACD;AAED,wCAAc,gBAAgB,8BAA8B;AAI5D,QAAO,EAAE,WAFS,GAAG,gBAAgB,GAAG,eAAe,GAAG,SAEtC"}

package/dist/{getSignedSessionId-Dr4Ic68X.native.esm.js → getSignedSessionId-BKfQycNo.esm.js}

@@ -1,5 +1,5 @@
-import { J as getNonce, pt as assertDefined, xt as getCore } from "./apiClient-DpzKqY39.native.esm.js";
-import { r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-DuSU67yq.native.esm.js";
+import { St as getCore, Z as getNonce, gt as getElevatedAccessToken, mt as assertDefined } from "./logoutWithReason-CHyuBHdx.esm.js";
+import { r as __consumeMfaToken_wrapped, t as isMfaRequiredForAction } from "./isMfaRequiredForAction-BDmY2_Sj.esm.js";
 
 //#region src/modules/mfa/consumeMfaTokenIfRequiredForAction/consumeMfaTokenIfRequiredForAction.ts
 /** @notInstrumented */
@@ -8,6 +8,36 @@ const consumeMfaTokenIfRequiredForAction = async ({ mfaAction }, client) => {
 	return __consumeMfaToken_wrapped(client);
 };
 
+//#endregion
+//#region src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts
+/**
+* Resolves the tokens that authorize a verification-gated wallet action.
+*
+* An elevated access token for `scope` is the current proof of verification, so
+* it takes precedence: when one has been banked, the legacy per-action MFA token
+* is left untouched. Demanding both would break every user who has a verified
+* MFA method, because satisfying the challenge with `requestedScopes` mints an
+* elevated access token and no MFA token -- leaving nothing for
+* `consumeMfaTokenIfRequiredForAction` to consume, which then throws.
+*
+* @param params.mfaAction - The action whose legacy MFA requirement to evaluate.
+* @param params.scope - The scope of the elevated access token that authorizes the action.
+* @param client - The Dynamic client instance.
+* @returns The elevated access token, or the legacy MFA token when no elevated token exists.
+* @notInstrumented
+*/
+const getActionAuthorizationTokens = async ({ mfaAction, scope }, client) => {
+	const elevatedAccessToken = getElevatedAccessToken({ scope }, client);
+	if (elevatedAccessToken) return {
+		elevatedAccessToken,
+		mfaToken: void 0
+	};
+	return {
+		elevatedAccessToken: void 0,
+		mfaToken: await consumeMfaTokenIfRequiredForAction({ mfaAction }, client)
+	};
+};
+
 //#endregion
 //#region src/modules/sessionKeys/generateNonceSignature/generateNonceSignature.ts
 /** @notInstrumented */
@@ -39,5 +69,5 @@ const getSignedSessionId = async (client) => {
 };
 
 //#endregion
-export { consumeMfaTokenIfRequiredForAction as n, getSignedSessionId as t };
-//# sourceMappingURL=getSignedSessionId-Dr4Ic68X.native.esm.js.map
+export { getActionAuthorizationTokens as n, consumeMfaTokenIfRequiredForAction as r, getSignedSessionId as t };
+//# sourceMappingURL=getSignedSessionId-BKfQycNo.esm.js.map

package/dist/getSignedSessionId-BKfQycNo.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSignedSessionId-BKfQycNo.esm.js","names":["consumeMfaToken"],"sources":["../src/modules/mfa/consumeMfaTokenIfRequiredForAction/consumeMfaTokenIfRequiredForAction.ts","../src/modules/auth/getActionAuthorizationTokens/getActionAuthorizationTokens.ts","../src/modules/sessionKeys/generateNonceSignature/generateNonceSignature.ts","../src/modules/sessionKeys/generateSessionSignature/generateSessionSignature.ts","../src/modules/sessionKeys/getSignedSessionId/getSignedSessionId.ts"],"sourcesContent":["import type { MFAAction } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { consumeMfaToken } from '../consumeMfaToken';\nimport { isMfaRequiredForAction } from '../isMfaRequiredForAction';\n\ntype ConsumeMfaTokenIfRequiredForActionParams = {\n  mfaAction: MFAAction;\n};\n\n/** @notInstrumented */\nexport const consumeMfaTokenIfRequiredForAction = async (\n  { mfaAction }: ConsumeMfaTokenIfRequiredForActionParams,\n  client: DynamicClient\n): Promise<string | undefined> => {\n  const isRequiredForAction = await isMfaRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  if (!isRequiredForAction) {\n    return;\n  }\n\n  return consumeMfaToken(client);\n};\n","import type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { TokenScope } from '../consts';\nimport type { MFAAction } from '../../mfa/mfa.consts';\nimport { consumeMfaTokenIfRequiredForAction } from '../../mfa/consumeMfaTokenIfRequiredForAction';\nimport { getElevatedAccessToken } from '../getElevatedAccessToken';\n\ntype GetActionAuthorizationTokensParams = {\n  mfaAction: MFAAction;\n  scope: TokenScope;\n};\n\ntype ActionAuthorizationTokens = {\n  elevatedAccessToken: string | undefined;\n  mfaToken: string | undefined;\n};\n\n/**\n * Resolves the tokens that authorize a verification-gated wallet action.\n *\n * An elevated access token for `scope` is the current proof of verification, so\n * it takes precedence: when one has been banked, the legacy per-action MFA token\n * is left untouched. Demanding both would break every user who has a verified\n * MFA method, because satisfying the challenge with `requestedScopes` mints an\n * elevated access token and no MFA token -- leaving nothing for\n * `consumeMfaTokenIfRequiredForAction` to consume, which then throws.\n *\n * @param params.mfaAction - The action whose legacy MFA requirement to evaluate.\n * @param params.scope - The scope of the elevated access token that authorizes the action.\n * @param client - The Dynamic client instance.\n * @returns The elevated access token, or the legacy MFA token when no elevated token exists.\n * @notInstrumented\n */\nexport const getActionAuthorizationTokens = async (\n  { mfaAction, scope }: GetActionAuthorizationTokensParams,\n  client: DynamicClient\n): Promise<ActionAuthorizationTokens> => {\n  const elevatedAccessToken = getElevatedAccessToken({ scope }, client);\n\n  if (elevatedAccessToken) {\n    return { elevatedAccessToken, mfaToken: undefined };\n  }\n\n  const mfaToken = await consumeMfaTokenIfRequiredForAction(\n    { mfaAction },\n    client\n  );\n\n  return { elevatedAccessToken: undefined, mfaToken };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { assertDefined } from '../../../utils/assertDefined';\n\ntype GenerateNonceSignatureParams = {\n  nonce: string;\n};\n\ntype GenerateNonceSignatureResult = { signature: string };\n\n/** @notInstrumented */\nexport const generateNonceSignature = async (\n  { nonce }: GenerateNonceSignatureParams,\n  client: DynamicClient\n): Promise<GenerateNonceSignatureResult> => {\n  const core = getCore(client);\n\n  assertDefined(core.keychain, 'Keychain service not available');\n\n  const signature = await core.keychain.sign('session', nonce);\n\n  return { signature };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\n\ntype GenerateSessionSignatureParams = {\n  sessionId: string;\n};\n\ntype GenerateSessionSignatureResult = { signature: string };\n\n/** @notInstrumented */\nexport const generateSessionSignature = async (\n  { sessionId }: GenerateSessionSignatureParams,\n  client: DynamicClient\n): Promise<GenerateSessionSignatureResult> => {\n  const core = getCore(client);\n\n  const signature = await core.keychain.sign('session', sessionId);\n\n  return { signature };\n};\n","import { getCore } from '../../../client/core/getCore';\nimport type { DynamicClient } from '../../../client/types';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { getNonce } from '../../../utils/getNonce';\nimport { generateNonceSignature } from '../generateNonceSignature';\nimport { generateSessionSignature } from '../generateSessionSignature';\n\ntype GetSignedSessionIdResult = { signature: string };\n\n/** @notInstrumented */\nexport const getSignedSessionId = async (\n  client: DynamicClient\n): Promise<GetSignedSessionIdResult> => {\n  const core = getCore(client);\n\n  const sessionId = core.state.get().user?.sessionId;\n  assertDefined(sessionId, 'Session ID is required');\n\n  const { signature: signedSessionId } = await generateSessionSignature(\n    {\n      sessionId,\n    },\n    client\n  );\n\n  assertDefined(signedSessionId, 'Signed session ID is required');\n\n  const nonce = await getNonce(client);\n\n  const { signature: nonceSignature } = await generateNonceSignature(\n    {\n      nonce,\n    },\n    client\n  );\n\n  assertDefined(nonceSignature, 'Nonce signature is required');\n\n  const signature = `${signedSessionId}/${nonceSignature}/${nonce}`;\n\n  return { signature };\n};\n"],"mappings":";;;;;AAWA,MAAa,qCAAqC,OAChD,EAAE,aACF,WACgC;AAMhC,KAAI,CALwB,MAAM,uBAChC,EAAE,WAAW,EACb,OACD,CAGC;AAGF,QAAOA,0BAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;ACQhC,MAAa,+BAA+B,OAC1C,EAAE,WAAW,SACb,WACuC;CACvC,MAAM,sBAAsB,uBAAuB,EAAE,OAAO,EAAE,OAAO;AAErE,KAAI,oBACF,QAAO;EAAE;EAAqB,UAAU;EAAW;AAQrD,QAAO;EAAE,qBAAqB;EAAW,UALxB,MAAM,mCACrB,EAAE,WAAW,EACb,OACD;EAEkD;;;;;;ACpCrD,MAAa,yBAAyB,OACpC,EAAE,SACF,WAC0C;CAC1C,MAAM,OAAO,QAAQ,OAAO;AAE5B,eAAc,KAAK,UAAU,iCAAiC;AAI9D,QAAO,EAAE,WAFS,MAAM,KAAK,SAAS,KAAK,WAAW,MAAM,EAExC;;;;;;ACXtB,MAAa,2BAA2B,OACtC,EAAE,aACF,WAC4C;AAK5C,QAAO,EAAE,WAFS,MAFL,QAAQ,OAAO,CAEC,SAAS,KAAK,WAAW,UAAU,EAE5C;;;;;;ACRtB,MAAa,qBAAqB,OAChC,WACsC;CAGtC,MAAM,YAFO,QAAQ,OAAO,CAEL,MAAM,KAAK,CAAC,MAAM;AACzC,eAAc,WAAW,yBAAyB;CAElD,MAAM,EAAE,WAAW,oBAAoB,MAAM,yBAC3C,EACE,WACD,EACD,OACD;AAED,eAAc,iBAAiB,gCAAgC;CAE/D,MAAM,QAAQ,MAAM,SAAS,OAAO;CAEpC,MAAM,EAAE,WAAW,mBAAmB,MAAM,uBAC1C,EACE,OACD,EACD,OACD;AAED,eAAc,gBAAgB,8BAA8B;AAI5D,QAAO,EAAE,WAFS,GAAG,gBAAgB,GAAG,eAAe,GAAG,SAEtC"}

package/dist/{getVerifiedCredentialForWalletAccount-C2o5idph.cjs → getVerifiedCredentialForWalletAccount-Bx0HlvfW.cjs}

@@ -1,4 +1,4 @@
-const require_logoutWithReason = require('./logoutWithReason-DlA15deT.cjs');
+const require_logoutWithReason = require('./logoutWithReason-C_T7KddM.cjs');
 
 //#region src/modules/wallets/getWalletProviderByKey/getWalletProviderByKey.ts
 /** @notInstrumented */
@@ -28,4 +28,4 @@ Object.defineProperty(exports, 'getWalletProviderByKey', {
     return getWalletProviderByKey;
   }
 });
-//# sourceMappingURL=getVerifiedCredentialForWalletAccount-C2o5idph.cjs.map
+//# sourceMappingURL=getVerifiedCredentialForWalletAccount-Bx0HlvfW.cjs.map

package/dist/{getVerifiedCredentialForWalletAccount-C2o5idph.cjs.map → getVerifiedCredentialForWalletAccount-Bx0HlvfW.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"getVerifiedCredentialForWalletAccount-C2o5idph.cjs","names":["getWalletProviders","walletProvider","NoWalletProviderFoundError"],"sources":["../src/modules/wallets/getWalletProviderByKey/getWalletProviderByKey.ts","../src/modules/wallets/utils/getVerifiedCredentialForWalletAccount/getVerifiedCredentialForWalletAccount.ts"],"sourcesContent":["import type { DynamicClient } from '../../../client/types';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { getWalletProviders } from '../getWalletProviders';\nimport type { WalletProvider } from '../walletProvider';\n\ntype GetWalletProviderByKeyParams = {\n  walletProviderKey: string;\n};\n\n/** @notInstrumented */\nexport const getWalletProviderByKey = (\n  { walletProviderKey }: GetWalletProviderByKeyParams,\n  client: DynamicClient\n): WalletProvider => {\n  const walletProviders = getWalletProviders(client);\n\n  const walletProvider = walletProviders.find(\n    (walletProvider) => walletProvider.key === walletProviderKey\n  );\n\n  if (!walletProvider) {\n    throw new NoWalletProviderFoundError({ walletProviderKey });\n  }\n\n  return walletProvider;\n};\n","import type { JwtVerifiedCredential } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../walletAccount';\n\ntype GetVerifiedCredentialForWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getVerifiedCredentialForWalletAccount = (\n  { walletAccount }: GetVerifiedCredentialForWalletAccountParams,\n  client: DynamicClient\n): JwtVerifiedCredential | undefined => {\n  return client.user?.verifiedCredentials.find(\n    (vc) => vc.id === walletAccount.verifiedCredentialId\n  );\n};\n"],"mappings":";;;;AAUA,MAAa,0BACX,EAAE,qBACF,WACmB;CAGnB,MAAM,iBAFkBA,4CAAmB,OAAO,CAEX,MACpC,qBAAmBC,iBAAe,QAAQ,kBAC5C;AAED,KAAI,CAAC,eACH,OAAM,IAAIC,oDAA2B,EAAE,mBAAmB,CAAC;AAG7D,QAAO;;;;;;ACdT,MAAa,yCACX,EAAE,iBACF,WACsC;AACtC,QAAO,OAAO,MAAM,oBAAoB,MACrC,OAAO,GAAG,OAAO,cAAc,qBACjC"}
+{"version":3,"file":"getVerifiedCredentialForWalletAccount-Bx0HlvfW.cjs","names":["getWalletProviders","walletProvider","NoWalletProviderFoundError"],"sources":["../src/modules/wallets/getWalletProviderByKey/getWalletProviderByKey.ts","../src/modules/wallets/utils/getVerifiedCredentialForWalletAccount/getVerifiedCredentialForWalletAccount.ts"],"sourcesContent":["import type { DynamicClient } from '../../../client/types';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { getWalletProviders } from '../getWalletProviders';\nimport type { WalletProvider } from '../walletProvider';\n\ntype GetWalletProviderByKeyParams = {\n  walletProviderKey: string;\n};\n\n/** @notInstrumented */\nexport const getWalletProviderByKey = (\n  { walletProviderKey }: GetWalletProviderByKeyParams,\n  client: DynamicClient\n): WalletProvider => {\n  const walletProviders = getWalletProviders(client);\n\n  const walletProvider = walletProviders.find(\n    (walletProvider) => walletProvider.key === walletProviderKey\n  );\n\n  if (!walletProvider) {\n    throw new NoWalletProviderFoundError({ walletProviderKey });\n  }\n\n  return walletProvider;\n};\n","import type { JwtVerifiedCredential } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../walletAccount';\n\ntype GetVerifiedCredentialForWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getVerifiedCredentialForWalletAccount = (\n  { walletAccount }: GetVerifiedCredentialForWalletAccountParams,\n  client: DynamicClient\n): JwtVerifiedCredential | undefined => {\n  return client.user?.verifiedCredentials.find(\n    (vc) => vc.id === walletAccount.verifiedCredentialId\n  );\n};\n"],"mappings":";;;;AAUA,MAAa,0BACX,EAAE,qBACF,WACmB;CAGnB,MAAM,iBAFkBA,4CAAmB,OAAO,CAEX,MACpC,qBAAmBC,iBAAe,QAAQ,kBAC5C;AAED,KAAI,CAAC,eACH,OAAM,IAAIC,oDAA2B,EAAE,mBAAmB,CAAC;AAG7D,QAAO;;;;;;ACdT,MAAa,yCACX,EAAE,iBACF,WACsC;AACtC,QAAO,OAAO,MAAM,oBAAoB,MACrC,OAAO,GAAG,OAAO,cAAc,qBACjC"}

package/dist/{getVerifiedCredentialForWalletAccount-Cjwoeej7.esm.js → getVerifiedCredentialForWalletAccount-_3MExyld.esm.js}

@@ -1,4 +1,4 @@
-import { A as getWalletProviders, s as NoWalletProviderFoundError } from "./logoutWithReason-DV89zJmJ.esm.js";
+import { A as getWalletProviders, s as NoWalletProviderFoundError } from "./logoutWithReason-CHyuBHdx.esm.js";
 
 //#region src/modules/wallets/getWalletProviderByKey/getWalletProviderByKey.ts
 /** @notInstrumented */
@@ -17,4 +17,4 @@ const getVerifiedCredentialForWalletAccount = ({ walletAccount }, client) => {
 
 //#endregion
 export { getWalletProviderByKey as n, getVerifiedCredentialForWalletAccount as t };
-//# sourceMappingURL=getVerifiedCredentialForWalletAccount-Cjwoeej7.esm.js.map
+//# sourceMappingURL=getVerifiedCredentialForWalletAccount-_3MExyld.esm.js.map

package/dist/{getVerifiedCredentialForWalletAccount-Cjwoeej7.esm.js.map → getVerifiedCredentialForWalletAccount-_3MExyld.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"getVerifiedCredentialForWalletAccount-Cjwoeej7.esm.js","names":["walletProvider"],"sources":["../src/modules/wallets/getWalletProviderByKey/getWalletProviderByKey.ts","../src/modules/wallets/utils/getVerifiedCredentialForWalletAccount/getVerifiedCredentialForWalletAccount.ts"],"sourcesContent":["import type { DynamicClient } from '../../../client/types';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { getWalletProviders } from '../getWalletProviders';\nimport type { WalletProvider } from '../walletProvider';\n\ntype GetWalletProviderByKeyParams = {\n  walletProviderKey: string;\n};\n\n/** @notInstrumented */\nexport const getWalletProviderByKey = (\n  { walletProviderKey }: GetWalletProviderByKeyParams,\n  client: DynamicClient\n): WalletProvider => {\n  const walletProviders = getWalletProviders(client);\n\n  const walletProvider = walletProviders.find(\n    (walletProvider) => walletProvider.key === walletProviderKey\n  );\n\n  if (!walletProvider) {\n    throw new NoWalletProviderFoundError({ walletProviderKey });\n  }\n\n  return walletProvider;\n};\n","import type { JwtVerifiedCredential } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../walletAccount';\n\ntype GetVerifiedCredentialForWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getVerifiedCredentialForWalletAccount = (\n  { walletAccount }: GetVerifiedCredentialForWalletAccountParams,\n  client: DynamicClient\n): JwtVerifiedCredential | undefined => {\n  return client.user?.verifiedCredentials.find(\n    (vc) => vc.id === walletAccount.verifiedCredentialId\n  );\n};\n"],"mappings":";;;;AAUA,MAAa,0BACX,EAAE,qBACF,WACmB;CAGnB,MAAM,iBAFkB,mBAAmB,OAAO,CAEX,MACpC,qBAAmBA,iBAAe,QAAQ,kBAC5C;AAED,KAAI,CAAC,eACH,OAAM,IAAI,2BAA2B,EAAE,mBAAmB,CAAC;AAG7D,QAAO;;;;;;ACdT,MAAa,yCACX,EAAE,iBACF,WACsC;AACtC,QAAO,OAAO,MAAM,oBAAoB,MACrC,OAAO,GAAG,OAAO,cAAc,qBACjC"}
+{"version":3,"file":"getVerifiedCredentialForWalletAccount-_3MExyld.esm.js","names":["walletProvider"],"sources":["../src/modules/wallets/getWalletProviderByKey/getWalletProviderByKey.ts","../src/modules/wallets/utils/getVerifiedCredentialForWalletAccount/getVerifiedCredentialForWalletAccount.ts"],"sourcesContent":["import type { DynamicClient } from '../../../client/types';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport { getWalletProviders } from '../getWalletProviders';\nimport type { WalletProvider } from '../walletProvider';\n\ntype GetWalletProviderByKeyParams = {\n  walletProviderKey: string;\n};\n\n/** @notInstrumented */\nexport const getWalletProviderByKey = (\n  { walletProviderKey }: GetWalletProviderByKeyParams,\n  client: DynamicClient\n): WalletProvider => {\n  const walletProviders = getWalletProviders(client);\n\n  const walletProvider = walletProviders.find(\n    (walletProvider) => walletProvider.key === walletProviderKey\n  );\n\n  if (!walletProvider) {\n    throw new NoWalletProviderFoundError({ walletProviderKey });\n  }\n\n  return walletProvider;\n};\n","import type { JwtVerifiedCredential } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../walletAccount';\n\ntype GetVerifiedCredentialForWalletAccountParams = {\n  walletAccount: WalletAccount;\n};\n\n/** @notInstrumented */\nexport const getVerifiedCredentialForWalletAccount = (\n  { walletAccount }: GetVerifiedCredentialForWalletAccountParams,\n  client: DynamicClient\n): JwtVerifiedCredential | undefined => {\n  return client.user?.verifiedCredentials.find(\n    (vc) => vc.id === walletAccount.verifiedCredentialId\n  );\n};\n"],"mappings":";;;;AAUA,MAAa,0BACX,EAAE,qBACF,WACmB;CAGnB,MAAM,iBAFkB,mBAAmB,OAAO,CAEX,MACpC,qBAAmBA,iBAAe,QAAQ,kBAC5C;AAED,KAAI,CAAC,eACH,OAAM,IAAI,2BAA2B,EAAE,mBAAmB,CAAC;AAG7D,QAAO;;;;;;ACdT,MAAa,yCACX,EAAE,iBACF,WACsC;AACtC,QAAO,OAAO,MAAM,oBAAoB,MACrC,OAAO,GAAG,OAAO,cAAc,qBACjC"}