@dynamic-labs-sdk/legacy-embedded-wallet-upgrade 1.22.0 → 1.22.1

package/dist/index.cjs

@@ -1,4 +1,4 @@
-const require_subscribeToUpgradeCompletion = require('./subscribeToUpgradeCompletion-CfKOBwip.cjs');
+const require_subscribeToUpgradeCompletion = require('./subscribeToUpgradeCompletion-CjqiLYs5.cjs');
 let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
 let _dynamic_labs_sdk_client = require("@dynamic-labs-sdk/client");
 let _dynamic_labs_sdk_client_core = require("@dynamic-labs-sdk/client/core");

package/dist/index.esm.js

@@ -1,4 +1,4 @@
-import { i as buildUpgradeUrl, n as consumeUpgradeRedirect, o as name, r as getWalletsRequiringUpgrade, s as version, t as subscribeToUpgradeCompletion } from "./subscribeToUpgradeCompletion-D7xhWUn8.esm.js";
+import { i as buildUpgradeUrl, n as consumeUpgradeRedirect, o as name, r as getWalletsRequiringUpgrade, s as version, t as subscribeToUpgradeCompletion } from "./subscribeToUpgradeCompletion-BuoizMF2.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { BaseError, getDefaultClient } from "@dynamic-labs-sdk/client";
 import { getCore } from "@dynamic-labs-sdk/client/core";

package/dist/index.native.esm.js

@@ -4,7 +4,7 @@ import { getCore } from "@dynamic-labs-sdk/client/core";
 
 //#region package.json
 var name = "@dynamic-labs-sdk/legacy-embedded-wallet-upgrade";
-var version = "1.22.0";
+var version = "1.22.1";
 
 //#endregion
 //#region src/errors/InvalidUpgradeBaseUrlError.ts

package/dist/react.cjs

@@ -1,4 +1,4 @@
-const require_subscribeToUpgradeCompletion = require('./subscribeToUpgradeCompletion-CfKOBwip.cjs');
+const require_subscribeToUpgradeCompletion = require('./subscribeToUpgradeCompletion-CjqiLYs5.cjs');
 let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
 let _dynamic_labs_sdk_react_hooks_core = require("@dynamic-labs-sdk/react-hooks/core");
 let react = require("react");

package/dist/react.esm.js

@@ -1,4 +1,4 @@
-import { a as UPGRADE_STATUS_PARAM, i as buildUpgradeUrl, n as consumeUpgradeRedirect, o as name, r as getWalletsRequiringUpgrade, s as version, t as subscribeToUpgradeCompletion } from "./subscribeToUpgradeCompletion-D7xhWUn8.esm.js";
+import { a as UPGRADE_STATUS_PARAM, i as buildUpgradeUrl, n as consumeUpgradeRedirect, o as name, r as getWalletsRequiringUpgrade, s as version, t as subscribeToUpgradeCompletion } from "./subscribeToUpgradeCompletion-BuoizMF2.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
 import { useBaseMutation, useBaseState, useDynamicClient } from "@dynamic-labs-sdk/react-hooks/core";
 import { useEffect, useMemo, useRef } from "react";

package/dist/{subscribeToUpgradeCompletion-D7xhWUn8.esm.js → subscribeToUpgradeCompletion-BuoizMF2.esm.js}

@@ -3,7 +3,7 @@ import { getCore } from "@dynamic-labs-sdk/client/core";
 
 //#region package.json
 var name = "@dynamic-labs-sdk/legacy-embedded-wallet-upgrade";
-var version = "1.22.0";
+var version = "1.22.1";
 
 //#endregion
 //#region src/errors/InvalidUpgradeBaseUrlError.ts
@@ -267,4 +267,4 @@ const subscribeToUpgradeCompletion = ({ onComplete, onReceived, baseUrl = UPGRAD
 
 //#endregion
 export { UPGRADE_STATUS_PARAM as a, buildUpgradeUrl as i, consumeUpgradeRedirect as n, name as o, getWalletsRequiringUpgrade as r, version as s, subscribeToUpgradeCompletion as t };
-//# sourceMappingURL=subscribeToUpgradeCompletion-D7xhWUn8.esm.js.map
+//# sourceMappingURL=subscribeToUpgradeCompletion-BuoizMF2.esm.js.map

package/dist/{subscribeToUpgradeCompletion-D7xhWUn8.esm.js.map → subscribeToUpgradeCompletion-BuoizMF2.esm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"subscribeToUpgradeCompletion-D7xhWUn8.esm.js","names":["outcome: WalletUpgradeOutcome"],"sources":["../package.json","../src/errors/InvalidUpgradeBaseUrlError.ts","../src/errors/InvalidUpgradeRedirectUrlError.ts","../src/upgradeAppContract.ts","../src/buildUpgradeUrl/buildUpgradeUrl.ts","../src/walletAccountRequiresUpgrade/walletAccountRequiresUpgrade.ts","../src/getWalletsRequiringUpgrade/getWalletsRequiringUpgrade.ts","../src/consumeUpgradeRedirect/consumeUpgradeRedirect.ts","../src/subscribeToUpgradeCompletion/subscribeToUpgradeCompletion.ts"],"sourcesContent":["","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeBaseUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(baseUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_base_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeBaseUrlError',\n      shortMessage: `Upgrade baseUrl must be an absolute https URL, received: ${baseUrl}`,\n    });\n  }\n}\n","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeRedirectUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(redirectUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_redirect_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeRedirectUrlError',\n      shortMessage: `Upgrade redirectUrl must be an absolute https URL, received: ${redirectUrl}`,\n    });\n  }\n}\n","// Contract shared with the standalone WaaS upgrade app\n// (dynamic-labs-oss/waas-migration). Every identifier below MUST stay\n// byte-for-byte identical to the ones the upgrade app reads/emits in its\n// `migrationConfig.ts`, otherwise the redirect round-trip and the iframe\n// postMessage handshake break silently.\n\n/**\n * Default base URL of the hosted WaaS upgrade app. Both upgrade paths point at\n * this origin and append `environmentId` + `redirectUrl` query params. Callers\n * can override it (e.g. to target a local or preview build during QA) via the\n * `baseUrl` option on the public functions.\n */\nexport const UPGRADE_APP_BASE_URL =\n  'https://waas-migration-dynamic-xyz.vercel.app';\n\n/**\n * Query param the upgrade app requires: which Dynamic environment to\n * authenticate the user against. Derived from the Dynamic client so callers\n * never pass it explicitly.\n */\nexport const UPGRADE_ENVIRONMENT_ID_PARAM = 'environmentId';\n\n/**\n * Query param the upgrade app requires: where to send the user (redirect flow)\n * or which origin it postMessages to (iframe flow) once the upgrade finishes.\n * The upgrade app rejects anything that is not an absolute https URL.\n */\nexport const UPGRADE_REDIRECT_URL_PARAM = 'redirectUrl';\n\n/**\n * postMessage `type` the upgrade app emits to its iframe parent on completion.\n */\nexport const UPGRADE_COMPLETE_MESSAGE_TYPE = 'dynamic-waas-migration:complete';\n\n/**\n * Query param the upgrade app appends to `redirectUrl` when it runs top-level\n * (redirect flow), carrying the outcome back to the app after navigation.\n */\nexport const UPGRADE_STATUS_PARAM = 'dynamicWaasMigrationStatus';\n\n/** Outcome value the upgrade app reports when the upgrade succeeded. */\nexport const UPGRADE_STATUS_SUCCESS = 'success';\n\n/** Outcome value the upgrade app reports when the upgrade failed. */\nexport const UPGRADE_STATUS_ERROR = 'error';\n\n/**\n * The outcome of a legacy embedded wallet upgrade attempt: `success` when the\n * wallet was upgraded to Dynamic WaaS, `error` when it failed. These are the\n * only two values the upgrade app ever reports, on both the redirect and the\n * iframe paths.\n *\n * @example\n * ```ts\n * const isSuccess = (status: WalletUpgradeStatus) => status === 'success';\n * ```\n * @see WalletUpgradeOutcome\n * @see consumeUpgradeRedirect\n */\nexport type WalletUpgradeStatus =\n  | typeof UPGRADE_STATUS_SUCCESS\n  | typeof UPGRADE_STATUS_ERROR;\n\n/**\n * The resolved result of an upgrade flow, carrying the reported\n * {@link WalletUpgradeStatus}. Returned by the redirect-result consumer and\n * handed to the iframe completion callback so callers can react (toast,\n * refetch, close a sheet, etc.).\n *\n * @example\n * ```ts\n * const onComplete = (outcome: WalletUpgradeOutcome) => {\n *   if (outcome.status === 'success') showSuccessToast();\n * };\n * ```\n * @see WalletUpgradeStatus\n * @see subscribeToUpgradeCompletion\n */\nexport type WalletUpgradeOutcome = {\n  status: WalletUpgradeStatus;\n};\n\n/**\n * Shape of the completion message the upgrade app posts to its parent window\n * in the iframe flow. Internal to the message handshake — consumers receive the\n * parsed {@link WalletUpgradeOutcome} instead.\n */\nexport type UpgradeCompleteMessage = {\n  status: WalletUpgradeStatus;\n  type: typeof UPGRADE_COMPLETE_MESSAGE_TYPE;\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n} from '@dynamic-labs-sdk/client';\nimport { getCore } from '@dynamic-labs-sdk/client/core';\n\nimport { InvalidUpgradeBaseUrlError } from '../errors/InvalidUpgradeBaseUrlError';\nimport { InvalidUpgradeRedirectUrlError } from '../errors/InvalidUpgradeRedirectUrlError';\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_ENVIRONMENT_ID_PARAM,\n  UPGRADE_REDIRECT_URL_PARAM,\n} from '../upgradeAppContract';\n\nconst HTTPS_PROTOCOL = 'https:';\n\ntype BuildUpgradeUrlParams = {\n  /**\n   * Base URL of the hosted upgrade app. Defaults to the production upgrade app;\n   * override it to target a local or preview build (e.g. during QA).\n   */\n  baseUrl?: string;\n  /**\n   * Absolute https URL the upgrade app returns to (redirect flow) or\n   * postMessages (iframe flow) on completion. Defaults to the current page\n   * (`window.location.href`). The upgrade app rejects any non-https URL.\n   */\n  redirectUrl?: string;\n};\n\n/**\n * Builds the URL that drives the hosted upgrade app for the client's Dynamic\n * environment and a return target.\n *\n * This is the low-level primitive behind every upgrade path: the redirect flow\n * navigates the top-level window to it, the iframe flow loads it as the iframe\n * `src`, and a React Native WebView can load it directly. The environment id is\n * read from the client, and `redirectUrl` defaults to the current page, so the\n * common call is zero-arg. Prefer {@link startUpgradeRedirect} or\n * {@link openUpgradeIframe} unless you are mounting the upgrade app yourself.\n *\n * @example\n * ```ts\n * const src = buildUpgradeUrl();\n * // or target a local upgrade app during QA:\n * const localSrc = buildUpgradeUrl({ baseUrl: 'https://localhost:3000' });\n * ```\n * @param [params] - Options for the generated URL.\n * @param [params.redirectUrl] - Absolute https return URL; defaults to `window.location.href`.\n * @param [params.baseUrl] - Upgrade app base URL; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The fully-qualified upgrade app URL to load.\n * @throws {InvalidUpgradeRedirectUrlError} When `redirectUrl` is not an absolute https URL.\n * @throws {InvalidUpgradeBaseUrlError} When `baseUrl` is not an absolute https URL.\n * @throws {UnavailableInServerSideError} When called during SSR without an explicit `redirectUrl`.\n * @see startUpgradeRedirect\n * @see openUpgradeIframe\n */\nexport const buildUpgradeUrl = (\n  { redirectUrl, baseUrl = UPGRADE_APP_BASE_URL }: BuildUpgradeUrlParams = {},\n  client = getDefaultClient()\n): string => {\n  // The default return target is the current page, which only exists in the\n  // browser; fail loudly during SSR rather than dereferencing an absent window.\n  if (redirectUrl === undefined && typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('buildUpgradeUrl');\n  }\n\n  const resolvedRedirectUrl = redirectUrl ?? window.location.href;\n\n  // Validate the return target up front: the upgrade app only accepts an\n  // absolute https URL, so reject anything else (relative, http, other schemes)\n  // here rather than letting it be silently refused after navigation. `new URL`\n  // throws on non-absolute input, so the explicit check only guards the scheme.\n  const parsedRedirectUrl = new URL(resolvedRedirectUrl);\n\n  if (parsedRedirectUrl.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeRedirectUrlError(resolvedRedirectUrl);\n  }\n\n  // Validate the upgrade app origin before we ever load it in an iframe or\n  // navigate to it. The default is a trusted https app, but `baseUrl` is an\n  // override (custom deployments, forks, local QA), so enforce the https scheme\n  // to reject non-secure or dangerous schemes (`http:`, `javascript:`, `data:`)\n  // rather than mounting an untrusted origin. Any https host is allowed on\n  // purpose — customers self-host the upgrade app on their own domains.\n  const url = new URL(baseUrl);\n\n  if (url.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeBaseUrlError(baseUrl);\n  }\n\n  const { environmentId } = getCore(client);\n\n  url.searchParams.set(UPGRADE_ENVIRONMENT_ID_PARAM, environmentId);\n  url.searchParams.set(UPGRADE_REDIRECT_URL_PARAM, resolvedRedirectUrl);\n\n  return url.toString();\n};\n","import type { WalletAccount } from '@dynamic-labs-sdk/client';\n\n/**\n * Provider-key substring shared by every Dynamic embedded wallet that predates\n * Dynamic WaaS and can therefore be upgraded to it. A wallet account's\n * `walletProviderKey` is a composite backend value (e.g. `<provider>evm` /\n * `<provider>hdsolana` suffixed with `:embeddedWallet`); both the standard and\n * HD variants contain this marker, so matching it as a substring identifies all\n * of them. This is an opaque backend value, matched verbatim — not a user-facing\n * concept.\n */\nconst LEGACY_EMBEDDED_WALLET_PROVIDER_KEY = 'turnkey';\n\n/**\n * Returns whether a wallet account is a legacy Dynamic embedded wallet that\n * requires an upgrade to Dynamic WaaS.\n *\n * Shared predicate behind both the imperative {@link getWalletsRequiringUpgrade}\n * getter and the reactive `useWalletsRequiringUpgrade` hook, so the definition\n * of \"requires upgrade\" lives in exactly one place.\n *\n * @example\n * ```ts\n * const upgradeable = walletAccounts.filter(walletAccountRequiresUpgrade);\n * ```\n * @param walletAccount - The wallet account to test.\n * @returns True when the account is a legacy embedded wallet requiring an upgrade.\n * @see getWalletsRequiringUpgrade\n * @see hasWalletsRequiringUpgrade\n */\nexport const walletAccountRequiresUpgrade = (\n  walletAccount: WalletAccount\n): boolean =>\n  walletAccount.walletProviderKey.includes(\n    LEGACY_EMBEDDED_WALLET_PROVIDER_KEY\n  );\n","import {\n  type WalletAccount,\n  getDefaultClient,\n  getWalletAccounts,\n} from '@dynamic-labs-sdk/client';\n\nimport { walletAccountRequiresUpgrade } from '../walletAccountRequiresUpgrade';\n\n/**\n * Returns the current session's wallet accounts that are legacy Dynamic\n * embedded wallets requiring an upgrade to Dynamic WaaS.\n *\n * These are earlier-generation Dynamic embedded wallets that predate Dynamic\n * WaaS (the current TSS-MPC embedded wallet) and can be upgraded to it. Use this\n * when you need the accounts themselves — for example to render only the\n * upgrade entry points on those wallets. Already-upgraded Dynamic WaaS accounts\n * are never returned. For a simple boolean check, use\n * {@link hasWalletsRequiringUpgrade}.\n *\n * @example\n * ```ts\n * const walletsRequiringUpgrade = getWalletsRequiringUpgrade();\n * if (walletsRequiringUpgrade.length > 0) {\n *   promptUpgrade(walletsRequiringUpgrade);\n * }\n * ```\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The wallet accounts requiring an upgrade to Dynamic WaaS (empty when none).\n * @see hasWalletsRequiringUpgrade\n * @see startUpgradeRedirect\n */\nexport const getWalletsRequiringUpgrade = (\n  client = getDefaultClient()\n): WalletAccount[] =>\n  getWalletAccounts(client).filter(walletAccountRequiresUpgrade);\n","import { getDefaultClient, refreshAuth } from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_PARAM,\n  UPGRADE_STATUS_SUCCESS,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\n/**\n * Options for {@link consumeUpgradeRedirect}.\n *\n * @example\n * ```ts\n * // Browser: read the outcome from the current page.\n * await consumeUpgradeRedirect({ url: window.location.href });\n * ```\n * @see consumeUpgradeRedirect\n * @see startUpgradeRedirect\n */\nexport type ConsumeUpgradeRedirectParams = {\n  /**\n   * The return URL to read the upgrade outcome from. Pass the URL yourself so\n   * the flow works everywhere: in the browser pass `window.location.href`; in\n   * React Native pass the deep-link URL you received. This mirrors how social\n   * sign-in and device registration consume their redirects, and keeps the\n   * function free of any implicit `window` dependency.\n   */\n  url: string;\n};\n\n/**\n * Handles the return leg of the redirect upgrade path.\n *\n * The upgrade app sends the user back with the outcome in the\n * `dynamicWaasMigrationStatus` query param. Call this once on app load with the\n * return URL: it reads the param, and when it is present refreshes the session\n * on success (so the upgraded wallet appears). Returns the outcome, or `null`\n * when the URL carries no upgrade result — so callers can drive their own\n * toast/UI.\n *\n * You always pass the URL (`window.location.href` in the browser, the deep-link\n * URL in React Native), matching how social sign-in and device registration\n * consume their redirects. The function never touches browser history, so you\n * own clearing the param from your navigation state once you have the outcome.\n *\n * @example\n * ```ts\n * // Browser\n * const outcome = await consumeUpgradeRedirect({ url: window.location.href });\n * if (outcome?.status === 'error') showRetryToast();\n * ```\n * @example\n * ```ts\n * // React Native: pass the deep-link URL you received.\n * const outcome = await consumeUpgradeRedirect({ url: deepLinkUrl });\n * ```\n * @param params - Options.\n * @param params.url - Return URL to read the outcome from (e.g. `window.location.href`).\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the upgrade outcome, or `null` when there was no upgrade result to consume.\n * @see startUpgradeRedirect\n * @see subscribeToUpgradeCompletion\n */\nexport const consumeUpgradeRedirect = async (\n  { url }: ConsumeUpgradeRedirectParams,\n  client = getDefaultClient()\n): Promise<WalletUpgradeOutcome | null> => {\n  const status = new URL(url).searchParams.get(UPGRADE_STATUS_PARAM);\n\n  // The param is user-controlled, so only ever act on the two values the\n  // upgrade app emits and ignore anything else (including tampered values).\n  const isKnownStatus =\n    status === UPGRADE_STATUS_SUCCESS || status === UPGRADE_STATUS_ERROR;\n\n  if (!isKnownStatus) {\n    return null;\n  }\n\n  if (status === UPGRADE_STATUS_SUCCESS) {\n    await refreshAuth(client);\n\n    return { status: UPGRADE_STATUS_SUCCESS };\n  }\n\n  return { status: UPGRADE_STATUS_ERROR };\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n  refreshAuth,\n} from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_COMPLETE_MESSAGE_TYPE,\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_SUCCESS,\n  type UpgradeCompleteMessage,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\ntype SubscribeToUpgradeCompletionParams = {\n  /**\n   * Base URL of the upgrade app the message is expected from. Its origin is\n   * used to reject completion messages from any other window. Defaults to the\n   * production upgrade app; must match the URL the app is loaded from.\n   */\n  baseUrl?: string;\n  /**\n   * Called once with the outcome when the upgrade app reports completion. On\n   * success the session has already been refreshed by the time this runs.\n   */\n  onComplete: (outcome: WalletUpgradeOutcome) => void;\n  /**\n   * Called synchronously the moment a valid completion message is received,\n   * before the (async) success session refresh runs — so `onComplete` still\n   * fires after the refresh. Use it to treat the upgrade as already finished\n   * (e.g. so dismissing the surface during the refresh is not mistaken for a\n   * cancellation, or to show a \"finalizing\" state).\n   */\n  onReceived?: (outcome: WalletUpgradeOutcome) => void;\n};\n\n// Fully validate the incoming postMessage before acting on it: even though the\n// origin check already gates who can send, the payload shape is still untrusted\n// input, so we verify both the message type AND that `status` is one of the\n// known outcomes rather than trusting whatever `status` string arrives.\nconst isUpgradeCompleteMessage = (\n  data: unknown\n): data is UpgradeCompleteMessage =>\n  typeof data === 'object' &&\n  data !== null &&\n  'type' in data &&\n  (data as { type: unknown }).type === UPGRADE_COMPLETE_MESSAGE_TYPE &&\n  'status' in data &&\n  ((data as { status: unknown }).status === UPGRADE_STATUS_SUCCESS ||\n    (data as { status: unknown }).status === UPGRADE_STATUS_ERROR);\n\n/**\n * Subscribes to the upgrade app's completion signal for an embedded upgrade\n * (iframe or WebView).\n *\n * This is the DOM-agnostic primitive behind {@link openUpgradeIframe}: use it\n * directly when you mount the upgrade app yourself (e.g. a React Native\n * `WebView` or a custom iframe). It listens for the app's origin-checked\n * completion postMessage, refreshes the session on success, then invokes\n * `onComplete` with the outcome. Returns an unsubscribe function that detaches\n * the listener — always call it when your surface unmounts.\n *\n * @example\n * ```ts\n * const unsubscribe = subscribeToUpgradeCompletion({\n *   onComplete: ({ status }) => closeSheet(status),\n * });\n * // later, on unmount:\n * unsubscribe();\n * ```\n * @param params - Subscription options.\n * @param params.onComplete - Invoked once with the resolved outcome on completion.\n * @param [params.baseUrl] - Upgrade app base URL whose origin gates messages; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A function that removes the completion listener.\n * @throws {UnavailableInServerSideError} When called during SSR (no window to listen on).\n * @see openUpgradeIframe\n * @see buildUpgradeUrl\n */\nexport const subscribeToUpgradeCompletion = (\n  {\n    onComplete,\n    onReceived,\n    baseUrl = UPGRADE_APP_BASE_URL,\n  }: SubscribeToUpgradeCompletionParams,\n  client = getDefaultClient()\n): (() => void) => {\n  // The completion handshake relies on the browser's postMessage; there is no\n  // window to listen on during SSR.\n  if (typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('subscribeToUpgradeCompletion');\n  }\n\n  const expectedOrigin = new URL(baseUrl).origin;\n\n  const handleMessage = async (event: MessageEvent) => {\n    // Ignore messages from any other window so a random page cannot fake an\n    // upgrade result.\n    if (event.origin !== expectedOrigin) {\n      return;\n    }\n\n    if (!isUpgradeCompleteMessage(event.data)) {\n      return;\n    }\n\n    // Only the first valid completion is honored. Detach synchronously, before\n    // the async session refresh, so a duplicate message cannot trigger a second\n    // refresh or a second `onComplete` call.\n    window.removeEventListener('message', handleMessage);\n\n    let outcome: WalletUpgradeOutcome;\n    if (event.data.status === UPGRADE_STATUS_SUCCESS) {\n      outcome = { status: UPGRADE_STATUS_SUCCESS };\n    } else {\n      outcome = { status: UPGRADE_STATUS_ERROR };\n    }\n\n    // Signal receipt synchronously, before the async refresh below, so a\n    // consumer can lock in that the upgrade already finished — otherwise a\n    // surface dismissed during the refresh window would look like a cancel.\n    onReceived?.(outcome);\n\n    if (outcome.status === UPGRADE_STATUS_SUCCESS) {\n      // The upgrade already succeeded on the backend; refreshing the local\n      // session is best-effort. Swallow a refresh failure (it reconciles on the\n      // next auth refresh) so completion is always reported — otherwise, since\n      // this runs in an event handler with no caller to catch it, a rejected\n      // refresh would hang openUpgradeIframe's `completed` promise forever.\n      try {\n        await refreshAuth(client);\n      } catch {\n        // ignore: report success anyway, the refresh will reconcile later\n      }\n    }\n\n    onComplete(outcome);\n  };\n\n  window.addEventListener('message', handleMessage);\n\n  return () => window.removeEventListener('message', handleMessage);\n};\n"],"mappings":";;;;;;;;;ACEA,IAAa,6BAAb,cAAgD,UAAU;CAExD,YAAY,SAAiB;AAC3B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,4DAA4D;GAC3E,CAAC;;;;;;ACTN,IAAa,iCAAb,cAAoD,UAAU;CAE5D,YAAY,aAAqB;AAC/B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,gEAAgE;GAC/E,CAAC;;;;;;;;;;;;ACCN,MAAa,uBACX;;;;;;AAOF,MAAa,+BAA+B;;;;;;AAO5C,MAAa,6BAA6B;;;;AAK1C,MAAa,gCAAgC;;;;;AAM7C,MAAa,uBAAuB;;AAGpC,MAAa,yBAAyB;;AAGtC,MAAa,uBAAuB;;;;AC5BpC,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CvB,MAAa,mBACX,EAAE,aAAa,UAAU,yBAAgD,EAAE,EAC3E,SAAS,kBAAkB,KAChB;AAGX,KAAI,gBAAgB,UAAa,OAAO,WAAW,YACjD,OAAM,IAAI,6BAA6B,kBAAkB;CAG3D,MAAM,sBAAsB,eAAe,OAAO,SAAS;AAQ3D,KAF0B,IAAI,IAAI,oBAAoB,CAEhC,aAAa,eACjC,OAAM,IAAI,+BAA+B,oBAAoB;CAS/D,MAAM,MAAM,IAAI,IAAI,QAAQ;AAE5B,KAAI,IAAI,aAAa,eACnB,OAAM,IAAI,2BAA2B,QAAQ;CAG/C,MAAM,EAAE,kBAAkB,QAAQ,OAAO;AAEzC,KAAI,aAAa,IAAI,8BAA8B,cAAc;AACjE,KAAI,aAAa,IAAI,4BAA4B,oBAAoB;AAErE,QAAO,IAAI,UAAU;;;;;;;;;;;;;;ACxFvB,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;AAmB5C,MAAa,gCACX,kBAEA,cAAc,kBAAkB,SAC9B,oCACD;;;;;;;;;;;;;;;;;;;;;;;;;;;ACJH,MAAa,8BACX,SAAS,kBAAkB,KAE3B,kBAAkB,OAAO,CAAC,OAAO,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BhE,MAAa,yBAAyB,OACpC,EAAE,OACF,SAAS,kBAAkB,KACc;CACzC,MAAM,SAAS,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,qBAAqB;AAOlE,KAAI,EAFF,WAAW,0BAA0B,WAAW,sBAGhD,QAAO;AAGT,KAAI,WAAW,wBAAwB;AACrC,QAAM,YAAY,OAAO;AAEzB,SAAO,EAAE,QAAQ,wBAAwB;;AAG3C,QAAO,EAAE,QAAQ,sBAAsB;;;;;AC1CzC,MAAM,4BACJ,SAEA,OAAO,SAAS,YAChB,SAAS,QACT,UAAU,QACT,KAA2B,SAAS,iCACrC,YAAY,SACV,KAA6B,WAAW,0BACvC,KAA6B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B7C,MAAa,gCACX,EACE,YACA,YACA,UAAU,wBAEZ,SAAS,kBAAkB,KACV;AAGjB,KAAI,OAAO,WAAW,YACpB,OAAM,IAAI,6BAA6B,+BAA+B;CAGxE,MAAM,iBAAiB,IAAI,IAAI,QAAQ,CAAC;CAExC,MAAM,gBAAgB,OAAO,UAAwB;AAGnD,MAAI,MAAM,WAAW,eACnB;AAGF,MAAI,CAAC,yBAAyB,MAAM,KAAK,CACvC;AAMF,SAAO,oBAAoB,WAAW,cAAc;EAEpD,IAAIA;AACJ,MAAI,MAAM,KAAK,WAAW,uBACxB,WAAU,EAAE,QAAQ,wBAAwB;MAE5C,WAAU,EAAE,QAAQ,sBAAsB;AAM5C,eAAa,QAAQ;AAErB,MAAI,QAAQ,WAAW,uBAMrB,KAAI;AACF,SAAM,YAAY,OAAO;UACnB;AAKV,aAAW,QAAQ;;AAGrB,QAAO,iBAAiB,WAAW,cAAc;AAEjD,cAAa,OAAO,oBAAoB,WAAW,cAAc"}
+{"version":3,"file":"subscribeToUpgradeCompletion-BuoizMF2.esm.js","names":["outcome: WalletUpgradeOutcome"],"sources":["../package.json","../src/errors/InvalidUpgradeBaseUrlError.ts","../src/errors/InvalidUpgradeRedirectUrlError.ts","../src/upgradeAppContract.ts","../src/buildUpgradeUrl/buildUpgradeUrl.ts","../src/walletAccountRequiresUpgrade/walletAccountRequiresUpgrade.ts","../src/getWalletsRequiringUpgrade/getWalletsRequiringUpgrade.ts","../src/consumeUpgradeRedirect/consumeUpgradeRedirect.ts","../src/subscribeToUpgradeCompletion/subscribeToUpgradeCompletion.ts"],"sourcesContent":["","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeBaseUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(baseUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_base_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeBaseUrlError',\n      shortMessage: `Upgrade baseUrl must be an absolute https URL, received: ${baseUrl}`,\n    });\n  }\n}\n","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeRedirectUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(redirectUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_redirect_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeRedirectUrlError',\n      shortMessage: `Upgrade redirectUrl must be an absolute https URL, received: ${redirectUrl}`,\n    });\n  }\n}\n","// Contract shared with the standalone WaaS upgrade app\n// (dynamic-labs-oss/waas-migration). Every identifier below MUST stay\n// byte-for-byte identical to the ones the upgrade app reads/emits in its\n// `migrationConfig.ts`, otherwise the redirect round-trip and the iframe\n// postMessage handshake break silently.\n\n/**\n * Default base URL of the hosted WaaS upgrade app. Both upgrade paths point at\n * this origin and append `environmentId` + `redirectUrl` query params. Callers\n * can override it (e.g. to target a local or preview build during QA) via the\n * `baseUrl` option on the public functions.\n */\nexport const UPGRADE_APP_BASE_URL =\n  'https://waas-migration-dynamic-xyz.vercel.app';\n\n/**\n * Query param the upgrade app requires: which Dynamic environment to\n * authenticate the user against. Derived from the Dynamic client so callers\n * never pass it explicitly.\n */\nexport const UPGRADE_ENVIRONMENT_ID_PARAM = 'environmentId';\n\n/**\n * Query param the upgrade app requires: where to send the user (redirect flow)\n * or which origin it postMessages to (iframe flow) once the upgrade finishes.\n * The upgrade app rejects anything that is not an absolute https URL.\n */\nexport const UPGRADE_REDIRECT_URL_PARAM = 'redirectUrl';\n\n/**\n * postMessage `type` the upgrade app emits to its iframe parent on completion.\n */\nexport const UPGRADE_COMPLETE_MESSAGE_TYPE = 'dynamic-waas-migration:complete';\n\n/**\n * Query param the upgrade app appends to `redirectUrl` when it runs top-level\n * (redirect flow), carrying the outcome back to the app after navigation.\n */\nexport const UPGRADE_STATUS_PARAM = 'dynamicWaasMigrationStatus';\n\n/** Outcome value the upgrade app reports when the upgrade succeeded. */\nexport const UPGRADE_STATUS_SUCCESS = 'success';\n\n/** Outcome value the upgrade app reports when the upgrade failed. */\nexport const UPGRADE_STATUS_ERROR = 'error';\n\n/**\n * The outcome of a legacy embedded wallet upgrade attempt: `success` when the\n * wallet was upgraded to Dynamic WaaS, `error` when it failed. These are the\n * only two values the upgrade app ever reports, on both the redirect and the\n * iframe paths.\n *\n * @example\n * ```ts\n * const isSuccess = (status: WalletUpgradeStatus) => status === 'success';\n * ```\n * @see WalletUpgradeOutcome\n * @see consumeUpgradeRedirect\n */\nexport type WalletUpgradeStatus =\n  | typeof UPGRADE_STATUS_SUCCESS\n  | typeof UPGRADE_STATUS_ERROR;\n\n/**\n * The resolved result of an upgrade flow, carrying the reported\n * {@link WalletUpgradeStatus}. Returned by the redirect-result consumer and\n * handed to the iframe completion callback so callers can react (toast,\n * refetch, close a sheet, etc.).\n *\n * @example\n * ```ts\n * const onComplete = (outcome: WalletUpgradeOutcome) => {\n *   if (outcome.status === 'success') showSuccessToast();\n * };\n * ```\n * @see WalletUpgradeStatus\n * @see subscribeToUpgradeCompletion\n */\nexport type WalletUpgradeOutcome = {\n  status: WalletUpgradeStatus;\n};\n\n/**\n * Shape of the completion message the upgrade app posts to its parent window\n * in the iframe flow. Internal to the message handshake — consumers receive the\n * parsed {@link WalletUpgradeOutcome} instead.\n */\nexport type UpgradeCompleteMessage = {\n  status: WalletUpgradeStatus;\n  type: typeof UPGRADE_COMPLETE_MESSAGE_TYPE;\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n} from '@dynamic-labs-sdk/client';\nimport { getCore } from '@dynamic-labs-sdk/client/core';\n\nimport { InvalidUpgradeBaseUrlError } from '../errors/InvalidUpgradeBaseUrlError';\nimport { InvalidUpgradeRedirectUrlError } from '../errors/InvalidUpgradeRedirectUrlError';\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_ENVIRONMENT_ID_PARAM,\n  UPGRADE_REDIRECT_URL_PARAM,\n} from '../upgradeAppContract';\n\nconst HTTPS_PROTOCOL = 'https:';\n\ntype BuildUpgradeUrlParams = {\n  /**\n   * Base URL of the hosted upgrade app. Defaults to the production upgrade app;\n   * override it to target a local or preview build (e.g. during QA).\n   */\n  baseUrl?: string;\n  /**\n   * Absolute https URL the upgrade app returns to (redirect flow) or\n   * postMessages (iframe flow) on completion. Defaults to the current page\n   * (`window.location.href`). The upgrade app rejects any non-https URL.\n   */\n  redirectUrl?: string;\n};\n\n/**\n * Builds the URL that drives the hosted upgrade app for the client's Dynamic\n * environment and a return target.\n *\n * This is the low-level primitive behind every upgrade path: the redirect flow\n * navigates the top-level window to it, the iframe flow loads it as the iframe\n * `src`, and a React Native WebView can load it directly. The environment id is\n * read from the client, and `redirectUrl` defaults to the current page, so the\n * common call is zero-arg. Prefer {@link startUpgradeRedirect} or\n * {@link openUpgradeIframe} unless you are mounting the upgrade app yourself.\n *\n * @example\n * ```ts\n * const src = buildUpgradeUrl();\n * // or target a local upgrade app during QA:\n * const localSrc = buildUpgradeUrl({ baseUrl: 'https://localhost:3000' });\n * ```\n * @param [params] - Options for the generated URL.\n * @param [params.redirectUrl] - Absolute https return URL; defaults to `window.location.href`.\n * @param [params.baseUrl] - Upgrade app base URL; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The fully-qualified upgrade app URL to load.\n * @throws {InvalidUpgradeRedirectUrlError} When `redirectUrl` is not an absolute https URL.\n * @throws {InvalidUpgradeBaseUrlError} When `baseUrl` is not an absolute https URL.\n * @throws {UnavailableInServerSideError} When called during SSR without an explicit `redirectUrl`.\n * @see startUpgradeRedirect\n * @see openUpgradeIframe\n */\nexport const buildUpgradeUrl = (\n  { redirectUrl, baseUrl = UPGRADE_APP_BASE_URL }: BuildUpgradeUrlParams = {},\n  client = getDefaultClient()\n): string => {\n  // The default return target is the current page, which only exists in the\n  // browser; fail loudly during SSR rather than dereferencing an absent window.\n  if (redirectUrl === undefined && typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('buildUpgradeUrl');\n  }\n\n  const resolvedRedirectUrl = redirectUrl ?? window.location.href;\n\n  // Validate the return target up front: the upgrade app only accepts an\n  // absolute https URL, so reject anything else (relative, http, other schemes)\n  // here rather than letting it be silently refused after navigation. `new URL`\n  // throws on non-absolute input, so the explicit check only guards the scheme.\n  const parsedRedirectUrl = new URL(resolvedRedirectUrl);\n\n  if (parsedRedirectUrl.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeRedirectUrlError(resolvedRedirectUrl);\n  }\n\n  // Validate the upgrade app origin before we ever load it in an iframe or\n  // navigate to it. The default is a trusted https app, but `baseUrl` is an\n  // override (custom deployments, forks, local QA), so enforce the https scheme\n  // to reject non-secure or dangerous schemes (`http:`, `javascript:`, `data:`)\n  // rather than mounting an untrusted origin. Any https host is allowed on\n  // purpose — customers self-host the upgrade app on their own domains.\n  const url = new URL(baseUrl);\n\n  if (url.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeBaseUrlError(baseUrl);\n  }\n\n  const { environmentId } = getCore(client);\n\n  url.searchParams.set(UPGRADE_ENVIRONMENT_ID_PARAM, environmentId);\n  url.searchParams.set(UPGRADE_REDIRECT_URL_PARAM, resolvedRedirectUrl);\n\n  return url.toString();\n};\n","import type { WalletAccount } from '@dynamic-labs-sdk/client';\n\n/**\n * Provider-key substring shared by every Dynamic embedded wallet that predates\n * Dynamic WaaS and can therefore be upgraded to it. A wallet account's\n * `walletProviderKey` is a composite backend value (e.g. `<provider>evm` /\n * `<provider>hdsolana` suffixed with `:embeddedWallet`); both the standard and\n * HD variants contain this marker, so matching it as a substring identifies all\n * of them. This is an opaque backend value, matched verbatim — not a user-facing\n * concept.\n */\nconst LEGACY_EMBEDDED_WALLET_PROVIDER_KEY = 'turnkey';\n\n/**\n * Returns whether a wallet account is a legacy Dynamic embedded wallet that\n * requires an upgrade to Dynamic WaaS.\n *\n * Shared predicate behind both the imperative {@link getWalletsRequiringUpgrade}\n * getter and the reactive `useWalletsRequiringUpgrade` hook, so the definition\n * of \"requires upgrade\" lives in exactly one place.\n *\n * @example\n * ```ts\n * const upgradeable = walletAccounts.filter(walletAccountRequiresUpgrade);\n * ```\n * @param walletAccount - The wallet account to test.\n * @returns True when the account is a legacy embedded wallet requiring an upgrade.\n * @see getWalletsRequiringUpgrade\n * @see hasWalletsRequiringUpgrade\n */\nexport const walletAccountRequiresUpgrade = (\n  walletAccount: WalletAccount\n): boolean =>\n  walletAccount.walletProviderKey.includes(\n    LEGACY_EMBEDDED_WALLET_PROVIDER_KEY\n  );\n","import {\n  type WalletAccount,\n  getDefaultClient,\n  getWalletAccounts,\n} from '@dynamic-labs-sdk/client';\n\nimport { walletAccountRequiresUpgrade } from '../walletAccountRequiresUpgrade';\n\n/**\n * Returns the current session's wallet accounts that are legacy Dynamic\n * embedded wallets requiring an upgrade to Dynamic WaaS.\n *\n * These are earlier-generation Dynamic embedded wallets that predate Dynamic\n * WaaS (the current TSS-MPC embedded wallet) and can be upgraded to it. Use this\n * when you need the accounts themselves — for example to render only the\n * upgrade entry points on those wallets. Already-upgraded Dynamic WaaS accounts\n * are never returned. For a simple boolean check, use\n * {@link hasWalletsRequiringUpgrade}.\n *\n * @example\n * ```ts\n * const walletsRequiringUpgrade = getWalletsRequiringUpgrade();\n * if (walletsRequiringUpgrade.length > 0) {\n *   promptUpgrade(walletsRequiringUpgrade);\n * }\n * ```\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The wallet accounts requiring an upgrade to Dynamic WaaS (empty when none).\n * @see hasWalletsRequiringUpgrade\n * @see startUpgradeRedirect\n */\nexport const getWalletsRequiringUpgrade = (\n  client = getDefaultClient()\n): WalletAccount[] =>\n  getWalletAccounts(client).filter(walletAccountRequiresUpgrade);\n","import { getDefaultClient, refreshAuth } from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_PARAM,\n  UPGRADE_STATUS_SUCCESS,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\n/**\n * Options for {@link consumeUpgradeRedirect}.\n *\n * @example\n * ```ts\n * // Browser: read the outcome from the current page.\n * await consumeUpgradeRedirect({ url: window.location.href });\n * ```\n * @see consumeUpgradeRedirect\n * @see startUpgradeRedirect\n */\nexport type ConsumeUpgradeRedirectParams = {\n  /**\n   * The return URL to read the upgrade outcome from. Pass the URL yourself so\n   * the flow works everywhere: in the browser pass `window.location.href`; in\n   * React Native pass the deep-link URL you received. This mirrors how social\n   * sign-in and device registration consume their redirects, and keeps the\n   * function free of any implicit `window` dependency.\n   */\n  url: string;\n};\n\n/**\n * Handles the return leg of the redirect upgrade path.\n *\n * The upgrade app sends the user back with the outcome in the\n * `dynamicWaasMigrationStatus` query param. Call this once on app load with the\n * return URL: it reads the param, and when it is present refreshes the session\n * on success (so the upgraded wallet appears). Returns the outcome, or `null`\n * when the URL carries no upgrade result — so callers can drive their own\n * toast/UI.\n *\n * You always pass the URL (`window.location.href` in the browser, the deep-link\n * URL in React Native), matching how social sign-in and device registration\n * consume their redirects. The function never touches browser history, so you\n * own clearing the param from your navigation state once you have the outcome.\n *\n * @example\n * ```ts\n * // Browser\n * const outcome = await consumeUpgradeRedirect({ url: window.location.href });\n * if (outcome?.status === 'error') showRetryToast();\n * ```\n * @example\n * ```ts\n * // React Native: pass the deep-link URL you received.\n * const outcome = await consumeUpgradeRedirect({ url: deepLinkUrl });\n * ```\n * @param params - Options.\n * @param params.url - Return URL to read the outcome from (e.g. `window.location.href`).\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the upgrade outcome, or `null` when there was no upgrade result to consume.\n * @see startUpgradeRedirect\n * @see subscribeToUpgradeCompletion\n */\nexport const consumeUpgradeRedirect = async (\n  { url }: ConsumeUpgradeRedirectParams,\n  client = getDefaultClient()\n): Promise<WalletUpgradeOutcome | null> => {\n  const status = new URL(url).searchParams.get(UPGRADE_STATUS_PARAM);\n\n  // The param is user-controlled, so only ever act on the two values the\n  // upgrade app emits and ignore anything else (including tampered values).\n  const isKnownStatus =\n    status === UPGRADE_STATUS_SUCCESS || status === UPGRADE_STATUS_ERROR;\n\n  if (!isKnownStatus) {\n    return null;\n  }\n\n  if (status === UPGRADE_STATUS_SUCCESS) {\n    await refreshAuth(client);\n\n    return { status: UPGRADE_STATUS_SUCCESS };\n  }\n\n  return { status: UPGRADE_STATUS_ERROR };\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n  refreshAuth,\n} from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_COMPLETE_MESSAGE_TYPE,\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_SUCCESS,\n  type UpgradeCompleteMessage,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\ntype SubscribeToUpgradeCompletionParams = {\n  /**\n   * Base URL of the upgrade app the message is expected from. Its origin is\n   * used to reject completion messages from any other window. Defaults to the\n   * production upgrade app; must match the URL the app is loaded from.\n   */\n  baseUrl?: string;\n  /**\n   * Called once with the outcome when the upgrade app reports completion. On\n   * success the session has already been refreshed by the time this runs.\n   */\n  onComplete: (outcome: WalletUpgradeOutcome) => void;\n  /**\n   * Called synchronously the moment a valid completion message is received,\n   * before the (async) success session refresh runs — so `onComplete` still\n   * fires after the refresh. Use it to treat the upgrade as already finished\n   * (e.g. so dismissing the surface during the refresh is not mistaken for a\n   * cancellation, or to show a \"finalizing\" state).\n   */\n  onReceived?: (outcome: WalletUpgradeOutcome) => void;\n};\n\n// Fully validate the incoming postMessage before acting on it: even though the\n// origin check already gates who can send, the payload shape is still untrusted\n// input, so we verify both the message type AND that `status` is one of the\n// known outcomes rather than trusting whatever `status` string arrives.\nconst isUpgradeCompleteMessage = (\n  data: unknown\n): data is UpgradeCompleteMessage =>\n  typeof data === 'object' &&\n  data !== null &&\n  'type' in data &&\n  (data as { type: unknown }).type === UPGRADE_COMPLETE_MESSAGE_TYPE &&\n  'status' in data &&\n  ((data as { status: unknown }).status === UPGRADE_STATUS_SUCCESS ||\n    (data as { status: unknown }).status === UPGRADE_STATUS_ERROR);\n\n/**\n * Subscribes to the upgrade app's completion signal for an embedded upgrade\n * (iframe or WebView).\n *\n * This is the DOM-agnostic primitive behind {@link openUpgradeIframe}: use it\n * directly when you mount the upgrade app yourself (e.g. a React Native\n * `WebView` or a custom iframe). It listens for the app's origin-checked\n * completion postMessage, refreshes the session on success, then invokes\n * `onComplete` with the outcome. Returns an unsubscribe function that detaches\n * the listener — always call it when your surface unmounts.\n *\n * @example\n * ```ts\n * const unsubscribe = subscribeToUpgradeCompletion({\n *   onComplete: ({ status }) => closeSheet(status),\n * });\n * // later, on unmount:\n * unsubscribe();\n * ```\n * @param params - Subscription options.\n * @param params.onComplete - Invoked once with the resolved outcome on completion.\n * @param [params.baseUrl] - Upgrade app base URL whose origin gates messages; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A function that removes the completion listener.\n * @throws {UnavailableInServerSideError} When called during SSR (no window to listen on).\n * @see openUpgradeIframe\n * @see buildUpgradeUrl\n */\nexport const subscribeToUpgradeCompletion = (\n  {\n    onComplete,\n    onReceived,\n    baseUrl = UPGRADE_APP_BASE_URL,\n  }: SubscribeToUpgradeCompletionParams,\n  client = getDefaultClient()\n): (() => void) => {\n  // The completion handshake relies on the browser's postMessage; there is no\n  // window to listen on during SSR.\n  if (typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('subscribeToUpgradeCompletion');\n  }\n\n  const expectedOrigin = new URL(baseUrl).origin;\n\n  const handleMessage = async (event: MessageEvent) => {\n    // Ignore messages from any other window so a random page cannot fake an\n    // upgrade result.\n    if (event.origin !== expectedOrigin) {\n      return;\n    }\n\n    if (!isUpgradeCompleteMessage(event.data)) {\n      return;\n    }\n\n    // Only the first valid completion is honored. Detach synchronously, before\n    // the async session refresh, so a duplicate message cannot trigger a second\n    // refresh or a second `onComplete` call.\n    window.removeEventListener('message', handleMessage);\n\n    let outcome: WalletUpgradeOutcome;\n    if (event.data.status === UPGRADE_STATUS_SUCCESS) {\n      outcome = { status: UPGRADE_STATUS_SUCCESS };\n    } else {\n      outcome = { status: UPGRADE_STATUS_ERROR };\n    }\n\n    // Signal receipt synchronously, before the async refresh below, so a\n    // consumer can lock in that the upgrade already finished — otherwise a\n    // surface dismissed during the refresh window would look like a cancel.\n    onReceived?.(outcome);\n\n    if (outcome.status === UPGRADE_STATUS_SUCCESS) {\n      // The upgrade already succeeded on the backend; refreshing the local\n      // session is best-effort. Swallow a refresh failure (it reconciles on the\n      // next auth refresh) so completion is always reported — otherwise, since\n      // this runs in an event handler with no caller to catch it, a rejected\n      // refresh would hang openUpgradeIframe's `completed` promise forever.\n      try {\n        await refreshAuth(client);\n      } catch {\n        // ignore: report success anyway, the refresh will reconcile later\n      }\n    }\n\n    onComplete(outcome);\n  };\n\n  window.addEventListener('message', handleMessage);\n\n  return () => window.removeEventListener('message', handleMessage);\n};\n"],"mappings":";;;;;;;;;ACEA,IAAa,6BAAb,cAAgD,UAAU;CAExD,YAAY,SAAiB;AAC3B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,4DAA4D;GAC3E,CAAC;;;;;;ACTN,IAAa,iCAAb,cAAoD,UAAU;CAE5D,YAAY,aAAqB;AAC/B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,gEAAgE;GAC/E,CAAC;;;;;;;;;;;;ACCN,MAAa,uBACX;;;;;;AAOF,MAAa,+BAA+B;;;;;;AAO5C,MAAa,6BAA6B;;;;AAK1C,MAAa,gCAAgC;;;;;AAM7C,MAAa,uBAAuB;;AAGpC,MAAa,yBAAyB;;AAGtC,MAAa,uBAAuB;;;;AC5BpC,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CvB,MAAa,mBACX,EAAE,aAAa,UAAU,yBAAgD,EAAE,EAC3E,SAAS,kBAAkB,KAChB;AAGX,KAAI,gBAAgB,UAAa,OAAO,WAAW,YACjD,OAAM,IAAI,6BAA6B,kBAAkB;CAG3D,MAAM,sBAAsB,eAAe,OAAO,SAAS;AAQ3D,KAF0B,IAAI,IAAI,oBAAoB,CAEhC,aAAa,eACjC,OAAM,IAAI,+BAA+B,oBAAoB;CAS/D,MAAM,MAAM,IAAI,IAAI,QAAQ;AAE5B,KAAI,IAAI,aAAa,eACnB,OAAM,IAAI,2BAA2B,QAAQ;CAG/C,MAAM,EAAE,kBAAkB,QAAQ,OAAO;AAEzC,KAAI,aAAa,IAAI,8BAA8B,cAAc;AACjE,KAAI,aAAa,IAAI,4BAA4B,oBAAoB;AAErE,QAAO,IAAI,UAAU;;;;;;;;;;;;;;ACxFvB,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;AAmB5C,MAAa,gCACX,kBAEA,cAAc,kBAAkB,SAC9B,oCACD;;;;;;;;;;;;;;;;;;;;;;;;;;;ACJH,MAAa,8BACX,SAAS,kBAAkB,KAE3B,kBAAkB,OAAO,CAAC,OAAO,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BhE,MAAa,yBAAyB,OACpC,EAAE,OACF,SAAS,kBAAkB,KACc;CACzC,MAAM,SAAS,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,qBAAqB;AAOlE,KAAI,EAFF,WAAW,0BAA0B,WAAW,sBAGhD,QAAO;AAGT,KAAI,WAAW,wBAAwB;AACrC,QAAM,YAAY,OAAO;AAEzB,SAAO,EAAE,QAAQ,wBAAwB;;AAG3C,QAAO,EAAE,QAAQ,sBAAsB;;;;;AC1CzC,MAAM,4BACJ,SAEA,OAAO,SAAS,YAChB,SAAS,QACT,UAAU,QACT,KAA2B,SAAS,iCACrC,YAAY,SACV,KAA6B,WAAW,0BACvC,KAA6B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B7C,MAAa,gCACX,EACE,YACA,YACA,UAAU,wBAEZ,SAAS,kBAAkB,KACV;AAGjB,KAAI,OAAO,WAAW,YACpB,OAAM,IAAI,6BAA6B,+BAA+B;CAGxE,MAAM,iBAAiB,IAAI,IAAI,QAAQ,CAAC;CAExC,MAAM,gBAAgB,OAAO,UAAwB;AAGnD,MAAI,MAAM,WAAW,eACnB;AAGF,MAAI,CAAC,yBAAyB,MAAM,KAAK,CACvC;AAMF,SAAO,oBAAoB,WAAW,cAAc;EAEpD,IAAIA;AACJ,MAAI,MAAM,KAAK,WAAW,uBACxB,WAAU,EAAE,QAAQ,wBAAwB;MAE5C,WAAU,EAAE,QAAQ,sBAAsB;AAM5C,eAAa,QAAQ;AAErB,MAAI,QAAQ,WAAW,uBAMrB,KAAI;AACF,SAAM,YAAY,OAAO;UACnB;AAKV,aAAW,QAAQ;;AAGrB,QAAO,iBAAiB,WAAW,cAAc;AAEjD,cAAa,OAAO,oBAAoB,WAAW,cAAc"}

package/dist/{subscribeToUpgradeCompletion-CfKOBwip.cjs → subscribeToUpgradeCompletion-CjqiLYs5.cjs}

@@ -3,7 +3,7 @@ let _dynamic_labs_sdk_client_core = require("@dynamic-labs-sdk/client/core");
 
 //#region package.json
 var name = "@dynamic-labs-sdk/legacy-embedded-wallet-upgrade";
-var version = "1.22.0";
+var version = "1.22.1";
 
 //#endregion
 //#region src/errors/InvalidUpgradeBaseUrlError.ts
@@ -308,4 +308,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=subscribeToUpgradeCompletion-CfKOBwip.cjs.map
+//# sourceMappingURL=subscribeToUpgradeCompletion-CjqiLYs5.cjs.map

package/dist/{subscribeToUpgradeCompletion-CfKOBwip.cjs.map → subscribeToUpgradeCompletion-CjqiLYs5.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"subscribeToUpgradeCompletion-CfKOBwip.cjs","names":["BaseError","BaseError","UnavailableInServerSideError","UnavailableInServerSideError","outcome: WalletUpgradeOutcome"],"sources":["../package.json","../src/errors/InvalidUpgradeBaseUrlError.ts","../src/errors/InvalidUpgradeRedirectUrlError.ts","../src/upgradeAppContract.ts","../src/buildUpgradeUrl/buildUpgradeUrl.ts","../src/walletAccountRequiresUpgrade/walletAccountRequiresUpgrade.ts","../src/getWalletsRequiringUpgrade/getWalletsRequiringUpgrade.ts","../src/consumeUpgradeRedirect/consumeUpgradeRedirect.ts","../src/subscribeToUpgradeCompletion/subscribeToUpgradeCompletion.ts"],"sourcesContent":["","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeBaseUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(baseUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_base_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeBaseUrlError',\n      shortMessage: `Upgrade baseUrl must be an absolute https URL, received: ${baseUrl}`,\n    });\n  }\n}\n","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeRedirectUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(redirectUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_redirect_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeRedirectUrlError',\n      shortMessage: `Upgrade redirectUrl must be an absolute https URL, received: ${redirectUrl}`,\n    });\n  }\n}\n","// Contract shared with the standalone WaaS upgrade app\n// (dynamic-labs-oss/waas-migration). Every identifier below MUST stay\n// byte-for-byte identical to the ones the upgrade app reads/emits in its\n// `migrationConfig.ts`, otherwise the redirect round-trip and the iframe\n// postMessage handshake break silently.\n\n/**\n * Default base URL of the hosted WaaS upgrade app. Both upgrade paths point at\n * this origin and append `environmentId` + `redirectUrl` query params. Callers\n * can override it (e.g. to target a local or preview build during QA) via the\n * `baseUrl` option on the public functions.\n */\nexport const UPGRADE_APP_BASE_URL =\n  'https://waas-migration-dynamic-xyz.vercel.app';\n\n/**\n * Query param the upgrade app requires: which Dynamic environment to\n * authenticate the user against. Derived from the Dynamic client so callers\n * never pass it explicitly.\n */\nexport const UPGRADE_ENVIRONMENT_ID_PARAM = 'environmentId';\n\n/**\n * Query param the upgrade app requires: where to send the user (redirect flow)\n * or which origin it postMessages to (iframe flow) once the upgrade finishes.\n * The upgrade app rejects anything that is not an absolute https URL.\n */\nexport const UPGRADE_REDIRECT_URL_PARAM = 'redirectUrl';\n\n/**\n * postMessage `type` the upgrade app emits to its iframe parent on completion.\n */\nexport const UPGRADE_COMPLETE_MESSAGE_TYPE = 'dynamic-waas-migration:complete';\n\n/**\n * Query param the upgrade app appends to `redirectUrl` when it runs top-level\n * (redirect flow), carrying the outcome back to the app after navigation.\n */\nexport const UPGRADE_STATUS_PARAM = 'dynamicWaasMigrationStatus';\n\n/** Outcome value the upgrade app reports when the upgrade succeeded. */\nexport const UPGRADE_STATUS_SUCCESS = 'success';\n\n/** Outcome value the upgrade app reports when the upgrade failed. */\nexport const UPGRADE_STATUS_ERROR = 'error';\n\n/**\n * The outcome of a legacy embedded wallet upgrade attempt: `success` when the\n * wallet was upgraded to Dynamic WaaS, `error` when it failed. These are the\n * only two values the upgrade app ever reports, on both the redirect and the\n * iframe paths.\n *\n * @example\n * ```ts\n * const isSuccess = (status: WalletUpgradeStatus) => status === 'success';\n * ```\n * @see WalletUpgradeOutcome\n * @see consumeUpgradeRedirect\n */\nexport type WalletUpgradeStatus =\n  | typeof UPGRADE_STATUS_SUCCESS\n  | typeof UPGRADE_STATUS_ERROR;\n\n/**\n * The resolved result of an upgrade flow, carrying the reported\n * {@link WalletUpgradeStatus}. Returned by the redirect-result consumer and\n * handed to the iframe completion callback so callers can react (toast,\n * refetch, close a sheet, etc.).\n *\n * @example\n * ```ts\n * const onComplete = (outcome: WalletUpgradeOutcome) => {\n *   if (outcome.status === 'success') showSuccessToast();\n * };\n * ```\n * @see WalletUpgradeStatus\n * @see subscribeToUpgradeCompletion\n */\nexport type WalletUpgradeOutcome = {\n  status: WalletUpgradeStatus;\n};\n\n/**\n * Shape of the completion message the upgrade app posts to its parent window\n * in the iframe flow. Internal to the message handshake — consumers receive the\n * parsed {@link WalletUpgradeOutcome} instead.\n */\nexport type UpgradeCompleteMessage = {\n  status: WalletUpgradeStatus;\n  type: typeof UPGRADE_COMPLETE_MESSAGE_TYPE;\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n} from '@dynamic-labs-sdk/client';\nimport { getCore } from '@dynamic-labs-sdk/client/core';\n\nimport { InvalidUpgradeBaseUrlError } from '../errors/InvalidUpgradeBaseUrlError';\nimport { InvalidUpgradeRedirectUrlError } from '../errors/InvalidUpgradeRedirectUrlError';\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_ENVIRONMENT_ID_PARAM,\n  UPGRADE_REDIRECT_URL_PARAM,\n} from '../upgradeAppContract';\n\nconst HTTPS_PROTOCOL = 'https:';\n\ntype BuildUpgradeUrlParams = {\n  /**\n   * Base URL of the hosted upgrade app. Defaults to the production upgrade app;\n   * override it to target a local or preview build (e.g. during QA).\n   */\n  baseUrl?: string;\n  /**\n   * Absolute https URL the upgrade app returns to (redirect flow) or\n   * postMessages (iframe flow) on completion. Defaults to the current page\n   * (`window.location.href`). The upgrade app rejects any non-https URL.\n   */\n  redirectUrl?: string;\n};\n\n/**\n * Builds the URL that drives the hosted upgrade app for the client's Dynamic\n * environment and a return target.\n *\n * This is the low-level primitive behind every upgrade path: the redirect flow\n * navigates the top-level window to it, the iframe flow loads it as the iframe\n * `src`, and a React Native WebView can load it directly. The environment id is\n * read from the client, and `redirectUrl` defaults to the current page, so the\n * common call is zero-arg. Prefer {@link startUpgradeRedirect} or\n * {@link openUpgradeIframe} unless you are mounting the upgrade app yourself.\n *\n * @example\n * ```ts\n * const src = buildUpgradeUrl();\n * // or target a local upgrade app during QA:\n * const localSrc = buildUpgradeUrl({ baseUrl: 'https://localhost:3000' });\n * ```\n * @param [params] - Options for the generated URL.\n * @param [params.redirectUrl] - Absolute https return URL; defaults to `window.location.href`.\n * @param [params.baseUrl] - Upgrade app base URL; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The fully-qualified upgrade app URL to load.\n * @throws {InvalidUpgradeRedirectUrlError} When `redirectUrl` is not an absolute https URL.\n * @throws {InvalidUpgradeBaseUrlError} When `baseUrl` is not an absolute https URL.\n * @throws {UnavailableInServerSideError} When called during SSR without an explicit `redirectUrl`.\n * @see startUpgradeRedirect\n * @see openUpgradeIframe\n */\nexport const buildUpgradeUrl = (\n  { redirectUrl, baseUrl = UPGRADE_APP_BASE_URL }: BuildUpgradeUrlParams = {},\n  client = getDefaultClient()\n): string => {\n  // The default return target is the current page, which only exists in the\n  // browser; fail loudly during SSR rather than dereferencing an absent window.\n  if (redirectUrl === undefined && typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('buildUpgradeUrl');\n  }\n\n  const resolvedRedirectUrl = redirectUrl ?? window.location.href;\n\n  // Validate the return target up front: the upgrade app only accepts an\n  // absolute https URL, so reject anything else (relative, http, other schemes)\n  // here rather than letting it be silently refused after navigation. `new URL`\n  // throws on non-absolute input, so the explicit check only guards the scheme.\n  const parsedRedirectUrl = new URL(resolvedRedirectUrl);\n\n  if (parsedRedirectUrl.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeRedirectUrlError(resolvedRedirectUrl);\n  }\n\n  // Validate the upgrade app origin before we ever load it in an iframe or\n  // navigate to it. The default is a trusted https app, but `baseUrl` is an\n  // override (custom deployments, forks, local QA), so enforce the https scheme\n  // to reject non-secure or dangerous schemes (`http:`, `javascript:`, `data:`)\n  // rather than mounting an untrusted origin. Any https host is allowed on\n  // purpose — customers self-host the upgrade app on their own domains.\n  const url = new URL(baseUrl);\n\n  if (url.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeBaseUrlError(baseUrl);\n  }\n\n  const { environmentId } = getCore(client);\n\n  url.searchParams.set(UPGRADE_ENVIRONMENT_ID_PARAM, environmentId);\n  url.searchParams.set(UPGRADE_REDIRECT_URL_PARAM, resolvedRedirectUrl);\n\n  return url.toString();\n};\n","import type { WalletAccount } from '@dynamic-labs-sdk/client';\n\n/**\n * Provider-key substring shared by every Dynamic embedded wallet that predates\n * Dynamic WaaS and can therefore be upgraded to it. A wallet account's\n * `walletProviderKey` is a composite backend value (e.g. `<provider>evm` /\n * `<provider>hdsolana` suffixed with `:embeddedWallet`); both the standard and\n * HD variants contain this marker, so matching it as a substring identifies all\n * of them. This is an opaque backend value, matched verbatim — not a user-facing\n * concept.\n */\nconst LEGACY_EMBEDDED_WALLET_PROVIDER_KEY = 'turnkey';\n\n/**\n * Returns whether a wallet account is a legacy Dynamic embedded wallet that\n * requires an upgrade to Dynamic WaaS.\n *\n * Shared predicate behind both the imperative {@link getWalletsRequiringUpgrade}\n * getter and the reactive `useWalletsRequiringUpgrade` hook, so the definition\n * of \"requires upgrade\" lives in exactly one place.\n *\n * @example\n * ```ts\n * const upgradeable = walletAccounts.filter(walletAccountRequiresUpgrade);\n * ```\n * @param walletAccount - The wallet account to test.\n * @returns True when the account is a legacy embedded wallet requiring an upgrade.\n * @see getWalletsRequiringUpgrade\n * @see hasWalletsRequiringUpgrade\n */\nexport const walletAccountRequiresUpgrade = (\n  walletAccount: WalletAccount\n): boolean =>\n  walletAccount.walletProviderKey.includes(\n    LEGACY_EMBEDDED_WALLET_PROVIDER_KEY\n  );\n","import {\n  type WalletAccount,\n  getDefaultClient,\n  getWalletAccounts,\n} from '@dynamic-labs-sdk/client';\n\nimport { walletAccountRequiresUpgrade } from '../walletAccountRequiresUpgrade';\n\n/**\n * Returns the current session's wallet accounts that are legacy Dynamic\n * embedded wallets requiring an upgrade to Dynamic WaaS.\n *\n * These are earlier-generation Dynamic embedded wallets that predate Dynamic\n * WaaS (the current TSS-MPC embedded wallet) and can be upgraded to it. Use this\n * when you need the accounts themselves — for example to render only the\n * upgrade entry points on those wallets. Already-upgraded Dynamic WaaS accounts\n * are never returned. For a simple boolean check, use\n * {@link hasWalletsRequiringUpgrade}.\n *\n * @example\n * ```ts\n * const walletsRequiringUpgrade = getWalletsRequiringUpgrade();\n * if (walletsRequiringUpgrade.length > 0) {\n *   promptUpgrade(walletsRequiringUpgrade);\n * }\n * ```\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The wallet accounts requiring an upgrade to Dynamic WaaS (empty when none).\n * @see hasWalletsRequiringUpgrade\n * @see startUpgradeRedirect\n */\nexport const getWalletsRequiringUpgrade = (\n  client = getDefaultClient()\n): WalletAccount[] =>\n  getWalletAccounts(client).filter(walletAccountRequiresUpgrade);\n","import { getDefaultClient, refreshAuth } from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_PARAM,\n  UPGRADE_STATUS_SUCCESS,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\n/**\n * Options for {@link consumeUpgradeRedirect}.\n *\n * @example\n * ```ts\n * // Browser: read the outcome from the current page.\n * await consumeUpgradeRedirect({ url: window.location.href });\n * ```\n * @see consumeUpgradeRedirect\n * @see startUpgradeRedirect\n */\nexport type ConsumeUpgradeRedirectParams = {\n  /**\n   * The return URL to read the upgrade outcome from. Pass the URL yourself so\n   * the flow works everywhere: in the browser pass `window.location.href`; in\n   * React Native pass the deep-link URL you received. This mirrors how social\n   * sign-in and device registration consume their redirects, and keeps the\n   * function free of any implicit `window` dependency.\n   */\n  url: string;\n};\n\n/**\n * Handles the return leg of the redirect upgrade path.\n *\n * The upgrade app sends the user back with the outcome in the\n * `dynamicWaasMigrationStatus` query param. Call this once on app load with the\n * return URL: it reads the param, and when it is present refreshes the session\n * on success (so the upgraded wallet appears). Returns the outcome, or `null`\n * when the URL carries no upgrade result — so callers can drive their own\n * toast/UI.\n *\n * You always pass the URL (`window.location.href` in the browser, the deep-link\n * URL in React Native), matching how social sign-in and device registration\n * consume their redirects. The function never touches browser history, so you\n * own clearing the param from your navigation state once you have the outcome.\n *\n * @example\n * ```ts\n * // Browser\n * const outcome = await consumeUpgradeRedirect({ url: window.location.href });\n * if (outcome?.status === 'error') showRetryToast();\n * ```\n * @example\n * ```ts\n * // React Native: pass the deep-link URL you received.\n * const outcome = await consumeUpgradeRedirect({ url: deepLinkUrl });\n * ```\n * @param params - Options.\n * @param params.url - Return URL to read the outcome from (e.g. `window.location.href`).\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the upgrade outcome, or `null` when there was no upgrade result to consume.\n * @see startUpgradeRedirect\n * @see subscribeToUpgradeCompletion\n */\nexport const consumeUpgradeRedirect = async (\n  { url }: ConsumeUpgradeRedirectParams,\n  client = getDefaultClient()\n): Promise<WalletUpgradeOutcome | null> => {\n  const status = new URL(url).searchParams.get(UPGRADE_STATUS_PARAM);\n\n  // The param is user-controlled, so only ever act on the two values the\n  // upgrade app emits and ignore anything else (including tampered values).\n  const isKnownStatus =\n    status === UPGRADE_STATUS_SUCCESS || status === UPGRADE_STATUS_ERROR;\n\n  if (!isKnownStatus) {\n    return null;\n  }\n\n  if (status === UPGRADE_STATUS_SUCCESS) {\n    await refreshAuth(client);\n\n    return { status: UPGRADE_STATUS_SUCCESS };\n  }\n\n  return { status: UPGRADE_STATUS_ERROR };\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n  refreshAuth,\n} from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_COMPLETE_MESSAGE_TYPE,\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_SUCCESS,\n  type UpgradeCompleteMessage,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\ntype SubscribeToUpgradeCompletionParams = {\n  /**\n   * Base URL of the upgrade app the message is expected from. Its origin is\n   * used to reject completion messages from any other window. Defaults to the\n   * production upgrade app; must match the URL the app is loaded from.\n   */\n  baseUrl?: string;\n  /**\n   * Called once with the outcome when the upgrade app reports completion. On\n   * success the session has already been refreshed by the time this runs.\n   */\n  onComplete: (outcome: WalletUpgradeOutcome) => void;\n  /**\n   * Called synchronously the moment a valid completion message is received,\n   * before the (async) success session refresh runs — so `onComplete` still\n   * fires after the refresh. Use it to treat the upgrade as already finished\n   * (e.g. so dismissing the surface during the refresh is not mistaken for a\n   * cancellation, or to show a \"finalizing\" state).\n   */\n  onReceived?: (outcome: WalletUpgradeOutcome) => void;\n};\n\n// Fully validate the incoming postMessage before acting on it: even though the\n// origin check already gates who can send, the payload shape is still untrusted\n// input, so we verify both the message type AND that `status` is one of the\n// known outcomes rather than trusting whatever `status` string arrives.\nconst isUpgradeCompleteMessage = (\n  data: unknown\n): data is UpgradeCompleteMessage =>\n  typeof data === 'object' &&\n  data !== null &&\n  'type' in data &&\n  (data as { type: unknown }).type === UPGRADE_COMPLETE_MESSAGE_TYPE &&\n  'status' in data &&\n  ((data as { status: unknown }).status === UPGRADE_STATUS_SUCCESS ||\n    (data as { status: unknown }).status === UPGRADE_STATUS_ERROR);\n\n/**\n * Subscribes to the upgrade app's completion signal for an embedded upgrade\n * (iframe or WebView).\n *\n * This is the DOM-agnostic primitive behind {@link openUpgradeIframe}: use it\n * directly when you mount the upgrade app yourself (e.g. a React Native\n * `WebView` or a custom iframe). It listens for the app's origin-checked\n * completion postMessage, refreshes the session on success, then invokes\n * `onComplete` with the outcome. Returns an unsubscribe function that detaches\n * the listener — always call it when your surface unmounts.\n *\n * @example\n * ```ts\n * const unsubscribe = subscribeToUpgradeCompletion({\n *   onComplete: ({ status }) => closeSheet(status),\n * });\n * // later, on unmount:\n * unsubscribe();\n * ```\n * @param params - Subscription options.\n * @param params.onComplete - Invoked once with the resolved outcome on completion.\n * @param [params.baseUrl] - Upgrade app base URL whose origin gates messages; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A function that removes the completion listener.\n * @throws {UnavailableInServerSideError} When called during SSR (no window to listen on).\n * @see openUpgradeIframe\n * @see buildUpgradeUrl\n */\nexport const subscribeToUpgradeCompletion = (\n  {\n    onComplete,\n    onReceived,\n    baseUrl = UPGRADE_APP_BASE_URL,\n  }: SubscribeToUpgradeCompletionParams,\n  client = getDefaultClient()\n): (() => void) => {\n  // The completion handshake relies on the browser's postMessage; there is no\n  // window to listen on during SSR.\n  if (typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('subscribeToUpgradeCompletion');\n  }\n\n  const expectedOrigin = new URL(baseUrl).origin;\n\n  const handleMessage = async (event: MessageEvent) => {\n    // Ignore messages from any other window so a random page cannot fake an\n    // upgrade result.\n    if (event.origin !== expectedOrigin) {\n      return;\n    }\n\n    if (!isUpgradeCompleteMessage(event.data)) {\n      return;\n    }\n\n    // Only the first valid completion is honored. Detach synchronously, before\n    // the async session refresh, so a duplicate message cannot trigger a second\n    // refresh or a second `onComplete` call.\n    window.removeEventListener('message', handleMessage);\n\n    let outcome: WalletUpgradeOutcome;\n    if (event.data.status === UPGRADE_STATUS_SUCCESS) {\n      outcome = { status: UPGRADE_STATUS_SUCCESS };\n    } else {\n      outcome = { status: UPGRADE_STATUS_ERROR };\n    }\n\n    // Signal receipt synchronously, before the async refresh below, so a\n    // consumer can lock in that the upgrade already finished — otherwise a\n    // surface dismissed during the refresh window would look like a cancel.\n    onReceived?.(outcome);\n\n    if (outcome.status === UPGRADE_STATUS_SUCCESS) {\n      // The upgrade already succeeded on the backend; refreshing the local\n      // session is best-effort. Swallow a refresh failure (it reconciles on the\n      // next auth refresh) so completion is always reported — otherwise, since\n      // this runs in an event handler with no caller to catch it, a rejected\n      // refresh would hang openUpgradeIframe's `completed` promise forever.\n      try {\n        await refreshAuth(client);\n      } catch {\n        // ignore: report success anyway, the refresh will reconcile later\n      }\n    }\n\n    onComplete(outcome);\n  };\n\n  window.addEventListener('message', handleMessage);\n\n  return () => window.removeEventListener('message', handleMessage);\n};\n"],"mappings":";;;;;;;;;ACEA,IAAa,6BAAb,cAAgDA,mCAAU;CAExD,YAAY,SAAiB;AAC3B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,4DAA4D;GAC3E,CAAC;;;;;;ACTN,IAAa,iCAAb,cAAoDC,mCAAU;CAE5D,YAAY,aAAqB;AAC/B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,gEAAgE;GAC/E,CAAC;;;;;;;;;;;;ACCN,MAAa,uBACX;;;;;;AAOF,MAAa,+BAA+B;;;;;;AAO5C,MAAa,6BAA6B;;;;AAK1C,MAAa,gCAAgC;;;;;AAM7C,MAAa,uBAAuB;;AAGpC,MAAa,yBAAyB;;AAGtC,MAAa,uBAAuB;;;;AC5BpC,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CvB,MAAa,mBACX,EAAE,aAAa,UAAU,yBAAgD,EAAE,EAC3E,yDAA2B,KAChB;AAGX,KAAI,gBAAgB,UAAa,OAAO,WAAW,YACjD,OAAM,IAAIC,sDAA6B,kBAAkB;CAG3D,MAAM,sBAAsB,eAAe,OAAO,SAAS;AAQ3D,KAF0B,IAAI,IAAI,oBAAoB,CAEhC,aAAa,eACjC,OAAM,IAAI,+BAA+B,oBAAoB;CAS/D,MAAM,MAAM,IAAI,IAAI,QAAQ;AAE5B,KAAI,IAAI,aAAa,eACnB,OAAM,IAAI,2BAA2B,QAAQ;CAG/C,MAAM,EAAE,6DAA0B,OAAO;AAEzC,KAAI,aAAa,IAAI,8BAA8B,cAAc;AACjE,KAAI,aAAa,IAAI,4BAA4B,oBAAoB;AAErE,QAAO,IAAI,UAAU;;;;;;;;;;;;;;ACxFvB,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;AAmB5C,MAAa,gCACX,kBAEA,cAAc,kBAAkB,SAC9B,oCACD;;;;;;;;;;;;;;;;;;;;;;;;;;;ACJH,MAAa,8BACX,yDAA2B,qDAET,OAAO,CAAC,OAAO,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BhE,MAAa,yBAAyB,OACpC,EAAE,OACF,yDAA2B,KACc;CACzC,MAAM,SAAS,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,qBAAqB;AAOlE,KAAI,EAFF,WAAW,0BAA0B,WAAW,sBAGhD,QAAO;AAGT,KAAI,WAAW,wBAAwB;AACrC,kDAAkB,OAAO;AAEzB,SAAO,EAAE,QAAQ,wBAAwB;;AAG3C,QAAO,EAAE,QAAQ,sBAAsB;;;;;AC1CzC,MAAM,4BACJ,SAEA,OAAO,SAAS,YAChB,SAAS,QACT,UAAU,QACT,KAA2B,SAAS,iCACrC,YAAY,SACV,KAA6B,WAAW,0BACvC,KAA6B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B7C,MAAa,gCACX,EACE,YACA,YACA,UAAU,wBAEZ,yDAA2B,KACV;AAGjB,KAAI,OAAO,WAAW,YACpB,OAAM,IAAIC,sDAA6B,+BAA+B;CAGxE,MAAM,iBAAiB,IAAI,IAAI,QAAQ,CAAC;CAExC,MAAM,gBAAgB,OAAO,UAAwB;AAGnD,MAAI,MAAM,WAAW,eACnB;AAGF,MAAI,CAAC,yBAAyB,MAAM,KAAK,CACvC;AAMF,SAAO,oBAAoB,WAAW,cAAc;EAEpD,IAAIC;AACJ,MAAI,MAAM,KAAK,WAAW,uBACxB,WAAU,EAAE,QAAQ,wBAAwB;MAE5C,WAAU,EAAE,QAAQ,sBAAsB;AAM5C,eAAa,QAAQ;AAErB,MAAI,QAAQ,WAAW,uBAMrB,KAAI;AACF,mDAAkB,OAAO;UACnB;AAKV,aAAW,QAAQ;;AAGrB,QAAO,iBAAiB,WAAW,cAAc;AAEjD,cAAa,OAAO,oBAAoB,WAAW,cAAc"}
+{"version":3,"file":"subscribeToUpgradeCompletion-CjqiLYs5.cjs","names":["BaseError","BaseError","UnavailableInServerSideError","UnavailableInServerSideError","outcome: WalletUpgradeOutcome"],"sources":["../package.json","../src/errors/InvalidUpgradeBaseUrlError.ts","../src/errors/InvalidUpgradeRedirectUrlError.ts","../src/upgradeAppContract.ts","../src/buildUpgradeUrl/buildUpgradeUrl.ts","../src/walletAccountRequiresUpgrade/walletAccountRequiresUpgrade.ts","../src/getWalletsRequiringUpgrade/getWalletsRequiringUpgrade.ts","../src/consumeUpgradeRedirect/consumeUpgradeRedirect.ts","../src/subscribeToUpgradeCompletion/subscribeToUpgradeCompletion.ts"],"sourcesContent":["","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeBaseUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(baseUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_base_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeBaseUrlError',\n      shortMessage: `Upgrade baseUrl must be an absolute https URL, received: ${baseUrl}`,\n    });\n  }\n}\n","import { BaseError } from '@dynamic-labs-sdk/client';\n\nexport class InvalidUpgradeRedirectUrlError extends BaseError {\n  // eslint-disable-next-line custom-rules/require-single-object-param\n  constructor(redirectUrl: string) {\n    super({\n      cause: null,\n      code: 'invalid_upgrade_redirect_url_error',\n      docsUrl: null,\n      name: 'InvalidUpgradeRedirectUrlError',\n      shortMessage: `Upgrade redirectUrl must be an absolute https URL, received: ${redirectUrl}`,\n    });\n  }\n}\n","// Contract shared with the standalone WaaS upgrade app\n// (dynamic-labs-oss/waas-migration). Every identifier below MUST stay\n// byte-for-byte identical to the ones the upgrade app reads/emits in its\n// `migrationConfig.ts`, otherwise the redirect round-trip and the iframe\n// postMessage handshake break silently.\n\n/**\n * Default base URL of the hosted WaaS upgrade app. Both upgrade paths point at\n * this origin and append `environmentId` + `redirectUrl` query params. Callers\n * can override it (e.g. to target a local or preview build during QA) via the\n * `baseUrl` option on the public functions.\n */\nexport const UPGRADE_APP_BASE_URL =\n  'https://waas-migration-dynamic-xyz.vercel.app';\n\n/**\n * Query param the upgrade app requires: which Dynamic environment to\n * authenticate the user against. Derived from the Dynamic client so callers\n * never pass it explicitly.\n */\nexport const UPGRADE_ENVIRONMENT_ID_PARAM = 'environmentId';\n\n/**\n * Query param the upgrade app requires: where to send the user (redirect flow)\n * or which origin it postMessages to (iframe flow) once the upgrade finishes.\n * The upgrade app rejects anything that is not an absolute https URL.\n */\nexport const UPGRADE_REDIRECT_URL_PARAM = 'redirectUrl';\n\n/**\n * postMessage `type` the upgrade app emits to its iframe parent on completion.\n */\nexport const UPGRADE_COMPLETE_MESSAGE_TYPE = 'dynamic-waas-migration:complete';\n\n/**\n * Query param the upgrade app appends to `redirectUrl` when it runs top-level\n * (redirect flow), carrying the outcome back to the app after navigation.\n */\nexport const UPGRADE_STATUS_PARAM = 'dynamicWaasMigrationStatus';\n\n/** Outcome value the upgrade app reports when the upgrade succeeded. */\nexport const UPGRADE_STATUS_SUCCESS = 'success';\n\n/** Outcome value the upgrade app reports when the upgrade failed. */\nexport const UPGRADE_STATUS_ERROR = 'error';\n\n/**\n * The outcome of a legacy embedded wallet upgrade attempt: `success` when the\n * wallet was upgraded to Dynamic WaaS, `error` when it failed. These are the\n * only two values the upgrade app ever reports, on both the redirect and the\n * iframe paths.\n *\n * @example\n * ```ts\n * const isSuccess = (status: WalletUpgradeStatus) => status === 'success';\n * ```\n * @see WalletUpgradeOutcome\n * @see consumeUpgradeRedirect\n */\nexport type WalletUpgradeStatus =\n  | typeof UPGRADE_STATUS_SUCCESS\n  | typeof UPGRADE_STATUS_ERROR;\n\n/**\n * The resolved result of an upgrade flow, carrying the reported\n * {@link WalletUpgradeStatus}. Returned by the redirect-result consumer and\n * handed to the iframe completion callback so callers can react (toast,\n * refetch, close a sheet, etc.).\n *\n * @example\n * ```ts\n * const onComplete = (outcome: WalletUpgradeOutcome) => {\n *   if (outcome.status === 'success') showSuccessToast();\n * };\n * ```\n * @see WalletUpgradeStatus\n * @see subscribeToUpgradeCompletion\n */\nexport type WalletUpgradeOutcome = {\n  status: WalletUpgradeStatus;\n};\n\n/**\n * Shape of the completion message the upgrade app posts to its parent window\n * in the iframe flow. Internal to the message handshake — consumers receive the\n * parsed {@link WalletUpgradeOutcome} instead.\n */\nexport type UpgradeCompleteMessage = {\n  status: WalletUpgradeStatus;\n  type: typeof UPGRADE_COMPLETE_MESSAGE_TYPE;\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n} from '@dynamic-labs-sdk/client';\nimport { getCore } from '@dynamic-labs-sdk/client/core';\n\nimport { InvalidUpgradeBaseUrlError } from '../errors/InvalidUpgradeBaseUrlError';\nimport { InvalidUpgradeRedirectUrlError } from '../errors/InvalidUpgradeRedirectUrlError';\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_ENVIRONMENT_ID_PARAM,\n  UPGRADE_REDIRECT_URL_PARAM,\n} from '../upgradeAppContract';\n\nconst HTTPS_PROTOCOL = 'https:';\n\ntype BuildUpgradeUrlParams = {\n  /**\n   * Base URL of the hosted upgrade app. Defaults to the production upgrade app;\n   * override it to target a local or preview build (e.g. during QA).\n   */\n  baseUrl?: string;\n  /**\n   * Absolute https URL the upgrade app returns to (redirect flow) or\n   * postMessages (iframe flow) on completion. Defaults to the current page\n   * (`window.location.href`). The upgrade app rejects any non-https URL.\n   */\n  redirectUrl?: string;\n};\n\n/**\n * Builds the URL that drives the hosted upgrade app for the client's Dynamic\n * environment and a return target.\n *\n * This is the low-level primitive behind every upgrade path: the redirect flow\n * navigates the top-level window to it, the iframe flow loads it as the iframe\n * `src`, and a React Native WebView can load it directly. The environment id is\n * read from the client, and `redirectUrl` defaults to the current page, so the\n * common call is zero-arg. Prefer {@link startUpgradeRedirect} or\n * {@link openUpgradeIframe} unless you are mounting the upgrade app yourself.\n *\n * @example\n * ```ts\n * const src = buildUpgradeUrl();\n * // or target a local upgrade app during QA:\n * const localSrc = buildUpgradeUrl({ baseUrl: 'https://localhost:3000' });\n * ```\n * @param [params] - Options for the generated URL.\n * @param [params.redirectUrl] - Absolute https return URL; defaults to `window.location.href`.\n * @param [params.baseUrl] - Upgrade app base URL; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The fully-qualified upgrade app URL to load.\n * @throws {InvalidUpgradeRedirectUrlError} When `redirectUrl` is not an absolute https URL.\n * @throws {InvalidUpgradeBaseUrlError} When `baseUrl` is not an absolute https URL.\n * @throws {UnavailableInServerSideError} When called during SSR without an explicit `redirectUrl`.\n * @see startUpgradeRedirect\n * @see openUpgradeIframe\n */\nexport const buildUpgradeUrl = (\n  { redirectUrl, baseUrl = UPGRADE_APP_BASE_URL }: BuildUpgradeUrlParams = {},\n  client = getDefaultClient()\n): string => {\n  // The default return target is the current page, which only exists in the\n  // browser; fail loudly during SSR rather than dereferencing an absent window.\n  if (redirectUrl === undefined && typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('buildUpgradeUrl');\n  }\n\n  const resolvedRedirectUrl = redirectUrl ?? window.location.href;\n\n  // Validate the return target up front: the upgrade app only accepts an\n  // absolute https URL, so reject anything else (relative, http, other schemes)\n  // here rather than letting it be silently refused after navigation. `new URL`\n  // throws on non-absolute input, so the explicit check only guards the scheme.\n  const parsedRedirectUrl = new URL(resolvedRedirectUrl);\n\n  if (parsedRedirectUrl.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeRedirectUrlError(resolvedRedirectUrl);\n  }\n\n  // Validate the upgrade app origin before we ever load it in an iframe or\n  // navigate to it. The default is a trusted https app, but `baseUrl` is an\n  // override (custom deployments, forks, local QA), so enforce the https scheme\n  // to reject non-secure or dangerous schemes (`http:`, `javascript:`, `data:`)\n  // rather than mounting an untrusted origin. Any https host is allowed on\n  // purpose — customers self-host the upgrade app on their own domains.\n  const url = new URL(baseUrl);\n\n  if (url.protocol !== HTTPS_PROTOCOL) {\n    throw new InvalidUpgradeBaseUrlError(baseUrl);\n  }\n\n  const { environmentId } = getCore(client);\n\n  url.searchParams.set(UPGRADE_ENVIRONMENT_ID_PARAM, environmentId);\n  url.searchParams.set(UPGRADE_REDIRECT_URL_PARAM, resolvedRedirectUrl);\n\n  return url.toString();\n};\n","import type { WalletAccount } from '@dynamic-labs-sdk/client';\n\n/**\n * Provider-key substring shared by every Dynamic embedded wallet that predates\n * Dynamic WaaS and can therefore be upgraded to it. A wallet account's\n * `walletProviderKey` is a composite backend value (e.g. `<provider>evm` /\n * `<provider>hdsolana` suffixed with `:embeddedWallet`); both the standard and\n * HD variants contain this marker, so matching it as a substring identifies all\n * of them. This is an opaque backend value, matched verbatim — not a user-facing\n * concept.\n */\nconst LEGACY_EMBEDDED_WALLET_PROVIDER_KEY = 'turnkey';\n\n/**\n * Returns whether a wallet account is a legacy Dynamic embedded wallet that\n * requires an upgrade to Dynamic WaaS.\n *\n * Shared predicate behind both the imperative {@link getWalletsRequiringUpgrade}\n * getter and the reactive `useWalletsRequiringUpgrade` hook, so the definition\n * of \"requires upgrade\" lives in exactly one place.\n *\n * @example\n * ```ts\n * const upgradeable = walletAccounts.filter(walletAccountRequiresUpgrade);\n * ```\n * @param walletAccount - The wallet account to test.\n * @returns True when the account is a legacy embedded wallet requiring an upgrade.\n * @see getWalletsRequiringUpgrade\n * @see hasWalletsRequiringUpgrade\n */\nexport const walletAccountRequiresUpgrade = (\n  walletAccount: WalletAccount\n): boolean =>\n  walletAccount.walletProviderKey.includes(\n    LEGACY_EMBEDDED_WALLET_PROVIDER_KEY\n  );\n","import {\n  type WalletAccount,\n  getDefaultClient,\n  getWalletAccounts,\n} from '@dynamic-labs-sdk/client';\n\nimport { walletAccountRequiresUpgrade } from '../walletAccountRequiresUpgrade';\n\n/**\n * Returns the current session's wallet accounts that are legacy Dynamic\n * embedded wallets requiring an upgrade to Dynamic WaaS.\n *\n * These are earlier-generation Dynamic embedded wallets that predate Dynamic\n * WaaS (the current TSS-MPC embedded wallet) and can be upgraded to it. Use this\n * when you need the accounts themselves — for example to render only the\n * upgrade entry points on those wallets. Already-upgraded Dynamic WaaS accounts\n * are never returned. For a simple boolean check, use\n * {@link hasWalletsRequiringUpgrade}.\n *\n * @example\n * ```ts\n * const walletsRequiringUpgrade = getWalletsRequiringUpgrade();\n * if (walletsRequiringUpgrade.length > 0) {\n *   promptUpgrade(walletsRequiringUpgrade);\n * }\n * ```\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The wallet accounts requiring an upgrade to Dynamic WaaS (empty when none).\n * @see hasWalletsRequiringUpgrade\n * @see startUpgradeRedirect\n */\nexport const getWalletsRequiringUpgrade = (\n  client = getDefaultClient()\n): WalletAccount[] =>\n  getWalletAccounts(client).filter(walletAccountRequiresUpgrade);\n","import { getDefaultClient, refreshAuth } from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_PARAM,\n  UPGRADE_STATUS_SUCCESS,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\n/**\n * Options for {@link consumeUpgradeRedirect}.\n *\n * @example\n * ```ts\n * // Browser: read the outcome from the current page.\n * await consumeUpgradeRedirect({ url: window.location.href });\n * ```\n * @see consumeUpgradeRedirect\n * @see startUpgradeRedirect\n */\nexport type ConsumeUpgradeRedirectParams = {\n  /**\n   * The return URL to read the upgrade outcome from. Pass the URL yourself so\n   * the flow works everywhere: in the browser pass `window.location.href`; in\n   * React Native pass the deep-link URL you received. This mirrors how social\n   * sign-in and device registration consume their redirects, and keeps the\n   * function free of any implicit `window` dependency.\n   */\n  url: string;\n};\n\n/**\n * Handles the return leg of the redirect upgrade path.\n *\n * The upgrade app sends the user back with the outcome in the\n * `dynamicWaasMigrationStatus` query param. Call this once on app load with the\n * return URL: it reads the param, and when it is present refreshes the session\n * on success (so the upgraded wallet appears). Returns the outcome, or `null`\n * when the URL carries no upgrade result — so callers can drive their own\n * toast/UI.\n *\n * You always pass the URL (`window.location.href` in the browser, the deep-link\n * URL in React Native), matching how social sign-in and device registration\n * consume their redirects. The function never touches browser history, so you\n * own clearing the param from your navigation state once you have the outcome.\n *\n * @example\n * ```ts\n * // Browser\n * const outcome = await consumeUpgradeRedirect({ url: window.location.href });\n * if (outcome?.status === 'error') showRetryToast();\n * ```\n * @example\n * ```ts\n * // React Native: pass the deep-link URL you received.\n * const outcome = await consumeUpgradeRedirect({ url: deepLinkUrl });\n * ```\n * @param params - Options.\n * @param params.url - Return URL to read the outcome from (e.g. `window.location.href`).\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise resolving to the upgrade outcome, or `null` when there was no upgrade result to consume.\n * @see startUpgradeRedirect\n * @see subscribeToUpgradeCompletion\n */\nexport const consumeUpgradeRedirect = async (\n  { url }: ConsumeUpgradeRedirectParams,\n  client = getDefaultClient()\n): Promise<WalletUpgradeOutcome | null> => {\n  const status = new URL(url).searchParams.get(UPGRADE_STATUS_PARAM);\n\n  // The param is user-controlled, so only ever act on the two values the\n  // upgrade app emits and ignore anything else (including tampered values).\n  const isKnownStatus =\n    status === UPGRADE_STATUS_SUCCESS || status === UPGRADE_STATUS_ERROR;\n\n  if (!isKnownStatus) {\n    return null;\n  }\n\n  if (status === UPGRADE_STATUS_SUCCESS) {\n    await refreshAuth(client);\n\n    return { status: UPGRADE_STATUS_SUCCESS };\n  }\n\n  return { status: UPGRADE_STATUS_ERROR };\n};\n","/* eslint-disable no-restricted-globals */\n\nimport {\n  UnavailableInServerSideError,\n  getDefaultClient,\n  refreshAuth,\n} from '@dynamic-labs-sdk/client';\n\nimport {\n  UPGRADE_APP_BASE_URL,\n  UPGRADE_COMPLETE_MESSAGE_TYPE,\n  UPGRADE_STATUS_ERROR,\n  UPGRADE_STATUS_SUCCESS,\n  type UpgradeCompleteMessage,\n  type WalletUpgradeOutcome,\n} from '../upgradeAppContract';\n\ntype SubscribeToUpgradeCompletionParams = {\n  /**\n   * Base URL of the upgrade app the message is expected from. Its origin is\n   * used to reject completion messages from any other window. Defaults to the\n   * production upgrade app; must match the URL the app is loaded from.\n   */\n  baseUrl?: string;\n  /**\n   * Called once with the outcome when the upgrade app reports completion. On\n   * success the session has already been refreshed by the time this runs.\n   */\n  onComplete: (outcome: WalletUpgradeOutcome) => void;\n  /**\n   * Called synchronously the moment a valid completion message is received,\n   * before the (async) success session refresh runs — so `onComplete` still\n   * fires after the refresh. Use it to treat the upgrade as already finished\n   * (e.g. so dismissing the surface during the refresh is not mistaken for a\n   * cancellation, or to show a \"finalizing\" state).\n   */\n  onReceived?: (outcome: WalletUpgradeOutcome) => void;\n};\n\n// Fully validate the incoming postMessage before acting on it: even though the\n// origin check already gates who can send, the payload shape is still untrusted\n// input, so we verify both the message type AND that `status` is one of the\n// known outcomes rather than trusting whatever `status` string arrives.\nconst isUpgradeCompleteMessage = (\n  data: unknown\n): data is UpgradeCompleteMessage =>\n  typeof data === 'object' &&\n  data !== null &&\n  'type' in data &&\n  (data as { type: unknown }).type === UPGRADE_COMPLETE_MESSAGE_TYPE &&\n  'status' in data &&\n  ((data as { status: unknown }).status === UPGRADE_STATUS_SUCCESS ||\n    (data as { status: unknown }).status === UPGRADE_STATUS_ERROR);\n\n/**\n * Subscribes to the upgrade app's completion signal for an embedded upgrade\n * (iframe or WebView).\n *\n * This is the DOM-agnostic primitive behind {@link openUpgradeIframe}: use it\n * directly when you mount the upgrade app yourself (e.g. a React Native\n * `WebView` or a custom iframe). It listens for the app's origin-checked\n * completion postMessage, refreshes the session on success, then invokes\n * `onComplete` with the outcome. Returns an unsubscribe function that detaches\n * the listener — always call it when your surface unmounts.\n *\n * @example\n * ```ts\n * const unsubscribe = subscribeToUpgradeCompletion({\n *   onComplete: ({ status }) => closeSheet(status),\n * });\n * // later, on unmount:\n * unsubscribe();\n * ```\n * @param params - Subscription options.\n * @param params.onComplete - Invoked once with the resolved outcome on completion.\n * @param [params.baseUrl] - Upgrade app base URL whose origin gates messages; defaults to the production app.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A function that removes the completion listener.\n * @throws {UnavailableInServerSideError} When called during SSR (no window to listen on).\n * @see openUpgradeIframe\n * @see buildUpgradeUrl\n */\nexport const subscribeToUpgradeCompletion = (\n  {\n    onComplete,\n    onReceived,\n    baseUrl = UPGRADE_APP_BASE_URL,\n  }: SubscribeToUpgradeCompletionParams,\n  client = getDefaultClient()\n): (() => void) => {\n  // The completion handshake relies on the browser's postMessage; there is no\n  // window to listen on during SSR.\n  if (typeof window === 'undefined') {\n    throw new UnavailableInServerSideError('subscribeToUpgradeCompletion');\n  }\n\n  const expectedOrigin = new URL(baseUrl).origin;\n\n  const handleMessage = async (event: MessageEvent) => {\n    // Ignore messages from any other window so a random page cannot fake an\n    // upgrade result.\n    if (event.origin !== expectedOrigin) {\n      return;\n    }\n\n    if (!isUpgradeCompleteMessage(event.data)) {\n      return;\n    }\n\n    // Only the first valid completion is honored. Detach synchronously, before\n    // the async session refresh, so a duplicate message cannot trigger a second\n    // refresh or a second `onComplete` call.\n    window.removeEventListener('message', handleMessage);\n\n    let outcome: WalletUpgradeOutcome;\n    if (event.data.status === UPGRADE_STATUS_SUCCESS) {\n      outcome = { status: UPGRADE_STATUS_SUCCESS };\n    } else {\n      outcome = { status: UPGRADE_STATUS_ERROR };\n    }\n\n    // Signal receipt synchronously, before the async refresh below, so a\n    // consumer can lock in that the upgrade already finished — otherwise a\n    // surface dismissed during the refresh window would look like a cancel.\n    onReceived?.(outcome);\n\n    if (outcome.status === UPGRADE_STATUS_SUCCESS) {\n      // The upgrade already succeeded on the backend; refreshing the local\n      // session is best-effort. Swallow a refresh failure (it reconciles on the\n      // next auth refresh) so completion is always reported — otherwise, since\n      // this runs in an event handler with no caller to catch it, a rejected\n      // refresh would hang openUpgradeIframe's `completed` promise forever.\n      try {\n        await refreshAuth(client);\n      } catch {\n        // ignore: report success anyway, the refresh will reconcile later\n      }\n    }\n\n    onComplete(outcome);\n  };\n\n  window.addEventListener('message', handleMessage);\n\n  return () => window.removeEventListener('message', handleMessage);\n};\n"],"mappings":";;;;;;;;;ACEA,IAAa,6BAAb,cAAgDA,mCAAU;CAExD,YAAY,SAAiB;AAC3B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,4DAA4D;GAC3E,CAAC;;;;;;ACTN,IAAa,iCAAb,cAAoDC,mCAAU;CAE5D,YAAY,aAAqB;AAC/B,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc,gEAAgE;GAC/E,CAAC;;;;;;;;;;;;ACCN,MAAa,uBACX;;;;;;AAOF,MAAa,+BAA+B;;;;;;AAO5C,MAAa,6BAA6B;;;;AAK1C,MAAa,gCAAgC;;;;;AAM7C,MAAa,uBAAuB;;AAGpC,MAAa,yBAAyB;;AAGtC,MAAa,uBAAuB;;;;AC5BpC,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CvB,MAAa,mBACX,EAAE,aAAa,UAAU,yBAAgD,EAAE,EAC3E,yDAA2B,KAChB;AAGX,KAAI,gBAAgB,UAAa,OAAO,WAAW,YACjD,OAAM,IAAIC,sDAA6B,kBAAkB;CAG3D,MAAM,sBAAsB,eAAe,OAAO,SAAS;AAQ3D,KAF0B,IAAI,IAAI,oBAAoB,CAEhC,aAAa,eACjC,OAAM,IAAI,+BAA+B,oBAAoB;CAS/D,MAAM,MAAM,IAAI,IAAI,QAAQ;AAE5B,KAAI,IAAI,aAAa,eACnB,OAAM,IAAI,2BAA2B,QAAQ;CAG/C,MAAM,EAAE,6DAA0B,OAAO;AAEzC,KAAI,aAAa,IAAI,8BAA8B,cAAc;AACjE,KAAI,aAAa,IAAI,4BAA4B,oBAAoB;AAErE,QAAO,IAAI,UAAU;;;;;;;;;;;;;;ACxFvB,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;AAmB5C,MAAa,gCACX,kBAEA,cAAc,kBAAkB,SAC9B,oCACD;;;;;;;;;;;;;;;;;;;;;;;;;;;ACJH,MAAa,8BACX,yDAA2B,qDAET,OAAO,CAAC,OAAO,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BhE,MAAa,yBAAyB,OACpC,EAAE,OACF,yDAA2B,KACc;CACzC,MAAM,SAAS,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,qBAAqB;AAOlE,KAAI,EAFF,WAAW,0BAA0B,WAAW,sBAGhD,QAAO;AAGT,KAAI,WAAW,wBAAwB;AACrC,kDAAkB,OAAO;AAEzB,SAAO,EAAE,QAAQ,wBAAwB;;AAG3C,QAAO,EAAE,QAAQ,sBAAsB;;;;;AC1CzC,MAAM,4BACJ,SAEA,OAAO,SAAS,YAChB,SAAS,QACT,UAAU,QACT,KAA2B,SAAS,iCACrC,YAAY,SACV,KAA6B,WAAW,0BACvC,KAA6B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B7C,MAAa,gCACX,EACE,YACA,YACA,UAAU,wBAEZ,yDAA2B,KACV;AAGjB,KAAI,OAAO,WAAW,YACpB,OAAM,IAAIC,sDAA6B,+BAA+B;CAGxE,MAAM,iBAAiB,IAAI,IAAI,QAAQ,CAAC;CAExC,MAAM,gBAAgB,OAAO,UAAwB;AAGnD,MAAI,MAAM,WAAW,eACnB;AAGF,MAAI,CAAC,yBAAyB,MAAM,KAAK,CACvC;AAMF,SAAO,oBAAoB,WAAW,cAAc;EAEpD,IAAIC;AACJ,MAAI,MAAM,KAAK,WAAW,uBACxB,WAAU,EAAE,QAAQ,wBAAwB;MAE5C,WAAU,EAAE,QAAQ,sBAAsB;AAM5C,eAAa,QAAQ;AAErB,MAAI,QAAQ,WAAW,uBAMrB,KAAI;AACF,mDAAkB,OAAO;UACnB;AAKV,aAAW,QAAQ;;AAGrB,QAAO,iBAAiB,WAAW,cAAc;AAEjD,cAAa,OAAO,oBAAoB,WAAW,cAAc"}