@dynamic-labs-sdk/react-native-embedded-wallet-export 0.0.0 → 1.12.0

package/README.md

@@ -0,0 +1,116 @@
+# @dynamic-labs-sdk/react-native-embedded-wallet-export
+
+Secure private-key export for Dynamic WaaS embedded wallets on **React Native**.
+
+The export ceremony runs inside a visible, screenshot-protected native WebView
+overlay. The private key is rendered entirely within the WebView's sandboxed
+document — it is **never** sent across the bridge, so the host application's
+JavaScript cannot read, log, or screenshot it. This is the intentional security
+boundary: the developer integrating the SDK cannot access the raw key.
+
+## Installation
+
+```bash
+pnpm add @dynamic-labs-sdk/react-native-embedded-wallet-export
+```
+
+Requires `@dynamic-labs-sdk/client` (configured for React Native) and a React
+Native host that links the `DynamicClientWebView` native module shipped with the
+client package.
+
+## Usage
+
+Mount `<ExportPrivateKey />` to present the export overlay; unmount it to
+dismiss. The component owns the overlay's lifecycle.
+
+```tsx
+import { ExportPrivateKey } from '@dynamic-labs-sdk/react-native-embedded-wallet-export';
+import { getWalletAccounts } from '@dynamic-labs-sdk/client';
+import { isWaasWalletAccount } from '@dynamic-labs-sdk/client/waas';
+import { useState } from 'react';
+import { Button, View } from 'react-native';
+
+function ExportScreen() {
+  const [revealing, setRevealing] = useState(false);
+  const walletAccount = getWalletAccounts()[0];
+
+  if (!walletAccount || !isWaasWalletAccount({ walletAccount })) return null;
+
+  return (
+    <View>
+      <Button title="Reveal private key" onPress={() => setRevealing(true)} />
+      {revealing && (
+        <ExportPrivateKey
+          walletAccount={walletAccount}
+          onError={(error) => {
+            // Log a non-sensitive representation only — never the raw error,
+            // which could carry key material or stack traces.
+            const errorType = error instanceof Error ? error.name : typeof error;
+            console.warn('Private key export failed', { errorType });
+            setRevealing(false);
+          }}
+        />
+      )}
+    </View>
+  );
+}
+```
+
+### Showing a loading state
+
+`ExportPrivateKey` is a minimal primitive: it renders the secure box plus the
+native overlay and signals readiness via `onComplete` (fired once the key is
+displayed). The loading UI is yours to style — render your own spinner and hide
+it on `onComplete`. The native overlay is transparent while it loads, so a
+spinner placed behind it shows through during the wait.
+
+```tsx
+import { ActivityIndicator, StyleSheet, View } from 'react-native';
+import { useState } from 'react';
+
+function ExportWithSpinner({ walletAccount }) {
+  const [loading, setLoading] = useState(true);
+
+  return (
+    <View style={{ position: 'relative' }}>
+      <ExportPrivateKey
+        walletAccount={walletAccount}
+        onComplete={() => setLoading(false)}
+        onError={() => setLoading(false)}
+      />
+      {loading && (
+        <View
+          pointerEvents="none"
+          style={[
+            StyleSheet.absoluteFillObject,
+            { alignItems: 'center', justifyContent: 'center' },
+          ]}
+        >
+          <ActivityIndicator size="large" />
+        </View>
+      )}
+    </View>
+  );
+}
+```
+
+`pointerEvents="none"` keeps the spinner from intercepting taps meant for the
+native key WebView (e.g. its copy button).
+
+### Props
+
+| Prop            | Type                       | Description                                                       |
+| --------------- | -------------------------- | ----------------------------------------------------------------- |
+| `walletAccount` | `WalletAccount`            | The WaaS wallet account whose private key is exported. Required.  |
+| `password`      | `string`                   | Optional password to decrypt the private key.                     |
+| `onComplete`    | `() => void`               | Called once the key is displayed in the overlay. No key material. |
+| `onError`       | `(error: unknown) => void` | Called on export failure. The error never contains key material.  |
+
+## Security
+
+- The key is displayed only inside the native WebView overlay and never crosses
+  the JS bridge.
+- The overlay enables screenshot/recording protection and disables web
+  inspection.
+- Unmounting the component tears the overlay down, so the displayed key cannot
+  outlive the screen that requested it.

package/dist/ExportPrivateKey/ExportPrivateKey.d.ts

@@ -0,0 +1,26 @@
+import type { FC } from 'react';
+import type { ExportPrivateKeyProps } from './ExportPrivateKey.types';
+/**
+ * Renders a secure private-key export box for a WaaS wallet account on React
+ * Native. The key is rendered inside a `react-native-webview` that fills the
+ * box — the same split the web SDK uses (host renders the chrome, the
+ * cross-origin document renders only the key). Because it is a normal RN view,
+ * it scrolls, clips and positions like any view; no native overlay or manual
+ * window positioning is involved. The key is rendered inside the WebView and
+ * never crosses the bridge, so the host app's JS cannot read, log, or
+ * screenshot it. On Android, window-level screenshot/recording protection is
+ * enabled while the component is mounted.
+ *
+ * Place it inside your own modal/card and add your own close button — unmounting
+ * tears the WebView down. Size/position it with the `style` prop.
+ *
+ * @example
+ * ```tsx
+ * <Modal visible={revealing} onRequestClose={() => setRevealing(false)}>
+ *   <ExportPrivateKey walletAccount={walletAccount} onError={setError} />
+ *   <Button title="I'm Done" onPress={() => setRevealing(false)} />
+ * </Modal>
+ * ```
+ */
+export declare const ExportPrivateKey: FC<ExportPrivateKeyProps>;
+//# sourceMappingURL=ExportPrivateKey.d.ts.map

package/dist/ExportPrivateKey/ExportPrivateKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExportPrivateKey.d.ts","sourceRoot":"","sources":["../../src/ExportPrivateKey/ExportPrivateKey.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAUhC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CA6GtD,CAAC"}

package/dist/ExportPrivateKey/ExportPrivateKey.types.d.ts

@@ -0,0 +1,33 @@
+import type { WalletAccount } from '@dynamic-labs-sdk/client';
+import type { StyleProp, ViewStyle } from 'react-native';
+/**
+ * Props for the {@link ExportPrivateKey} component.
+ *
+ * The component owns the export view's lifecycle: the key is shown while the
+ * component is mounted and torn down on unmount. The private key is rendered
+ * entirely inside the `react-native-webview` and never reaches this (or any)
+ * host JS layer.
+ */
+export type ExportPrivateKeyProps = {
+    /**
+     * Called once the export ceremony has completed and the key is displayed in
+     * the WebView. Receives no key material.
+     */
+    onComplete?: () => void;
+    /**
+     * Called if the export fails (load failure, step-up MFA failure, etc.). The
+     * error never contains key material.
+     */
+    onError?: (error: unknown) => void;
+    /** Optional password to decrypt the private key. */
+    password?: string;
+    /**
+     * Style for the box that hosts the key display (size, border, background).
+     * The WebView fills this box, so its dimensions control the display size.
+     * Defaults to a minimal white box with a min height; add your own chrome.
+     */
+    style?: StyleProp<ViewStyle>;
+    /** The WaaS wallet account whose private key is exported. */
+    walletAccount: WalletAccount;
+};
+//# sourceMappingURL=ExportPrivateKey.types.d.ts.map

package/dist/ExportPrivateKey/ExportPrivateKey.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExportPrivateKey.types.d.ts","sourceRoot":"","sources":["../../src/ExportPrivateKey/ExportPrivateKey.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,aAAa,EAAE,aAAa,CAAC;CAC9B,CAAC"}

package/dist/createWebViewWaasContainer/createWebViewWaasContainer.d.ts

@@ -0,0 +1,54 @@
+import type { WaasSDKContainer } from '@dynamic-labs-sdk/client/waas/core';
+import type { RefObject } from 'react';
+import type WebView from 'react-native-webview';
+/**
+ * JS injected into the hosted export page before its own scripts run. The page
+ * is written for the browser iframe transport: it reaches the SDK host via
+ * `window.parent.postMessage` and listens with `window.addEventListener
+ * ('message', ...)`. In a top-level WebView `window.parent === window`, so we
+ * override `window.postMessage` to forward the page's outbound payload to React
+ * Native through `window.ReactNativeWebView.postMessage`. The reverse direction
+ * (host -> page) is delivered by `sendMessage` injecting a synthetic
+ * `MessageEvent`, so no inbound wiring is needed here. Mirrors the native
+ * `BRIDGE_USER_SCRIPT` in the client package's DynamicWebViewHost.
+ */
+export declare const WAAS_EXPORT_BRIDGE_SHIM = "\n(function () {\n  if (window.__dynamicBridgeInstalled) { return; }\n  window.__dynamicBridgeInstalled = true;\n  var post = function (data) {\n    try {\n      var json = typeof data === 'string' ? data : JSON.stringify(data);\n      window.ReactNativeWebView.postMessage(json);\n    } catch (e) {}\n  };\n  try {\n    Object.defineProperty(window, 'postMessage', {\n      configurable: true,\n      writable: true,\n      value: function (data, targetOrigin, transfer) { post(data); }\n    });\n  } catch (e) {\n    try { window.postMessage = function (d) { post(d); }; } catch (_) {}\n  }\n})();\ntrue;\n";
+/**
+ * Parameters for {@link createWebViewWaasContainer}.
+ */
+export type CreateWebViewWaasContainerParams = {
+    /**
+     * Sets the URL the hosted `<WebView>` should load. An empty string unmounts
+     * it (used by `destroy`). The component renders the WebView from this state.
+     */
+    setUrl: (url: string) => void;
+    /** Ref to the rendered `react-native-webview` instance. */
+    webViewRef: RefObject<WebView | null>;
+};
+/**
+ * A {@link WaasSDKContainer} bound to a `react-native-webview`, plus the event
+ * sinks the host component wires into the WebView's `onMessage`/`onError`.
+ */
+export type WebViewWaasContainer = {
+    /** The container handed to `exportWaasPrivateKeyToContainer`. */
+    container: WaasSDKContainer;
+    /** Feed a `<WebView>` load/HTTP error into the container's onError handlers. */
+    handleWebViewError: (error: unknown) => void;
+    /** Feed a raw `<WebView>` onMessage payload into the container's handlers. */
+    handleWebViewMessage: (raw: string) => void;
+};
+/**
+ * Creates a `WaasSDKContainer` backed by a `react-native-webview` rendered in
+ * the normal RN view tree (so it scrolls, clips, and positions like any view —
+ * no native overlay or manual window positioning). The private key is rendered
+ * inside the WebView's sandboxed document and never crosses the bridge; only
+ * the WaaS transport protocol messages do.
+ *
+ * The returned `container` is passed to `exportWaasPrivateKeyToContainer`; the
+ * `handleWebView*` sinks are wired into the WebView's `onMessage`/`onError` by
+ * the host component.
+ *
+ * @not-instrumented
+ */
+export declare const createWebViewWaasContainer: ({ setUrl, webViewRef, }: CreateWebViewWaasContainerParams) => WebViewWaasContainer;
+//# sourceMappingURL=createWebViewWaasContainer.d.ts.map

package/dist/createWebViewWaasContainer/createWebViewWaasContainer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWebViewWaasContainer.d.ts","sourceRoot":"","sources":["../../src/createWebViewWaasContainer/createWebViewWaasContainer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,qmBAqBnC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,iEAAiE;IACjE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,4BAGpC,gCAAgC,KAAG,oBAiFrC,CAAC"}

package/dist/exports/index.d.ts

@@ -0,0 +1,3 @@
+export { ExportPrivateKey } from '../ExportPrivateKey/ExportPrivateKey';
+export type { ExportPrivateKeyProps } from '../ExportPrivateKey/ExportPrivateKey.types';
+//# sourceMappingURL=index.d.ts.map

package/dist/exports/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/exports/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,YAAY,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC"}

package/dist/index.cjs

@@ -0,0 +1,252 @@
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
+let _dynamic_labs_sdk_client = require("@dynamic-labs-sdk/client");
+let _dynamic_labs_sdk_client_core = require("@dynamic-labs-sdk/client/core");
+let _dynamic_labs_sdk_client_waas_core = require("@dynamic-labs-sdk/client/waas/core");
+let react = require("react");
+let react_native = require("react-native");
+let react_native_webview = require("react-native-webview");
+react_native_webview = __toESM(react_native_webview);
+let react_jsx_runtime = require("react/jsx-runtime");
+
+//#region package.json
+var name = "@dynamic-labs-sdk/react-native-embedded-wallet-export";
+var version = "1.12.0";
+
+//#endregion
+//#region src/createWebViewWaasContainer/createWebViewWaasContainer.ts
+/**
+* JS injected into the hosted export page before its own scripts run. The page
+* is written for the browser iframe transport: it reaches the SDK host via
+* `window.parent.postMessage` and listens with `window.addEventListener
+* ('message', ...)`. In a top-level WebView `window.parent === window`, so we
+* override `window.postMessage` to forward the page's outbound payload to React
+* Native through `window.ReactNativeWebView.postMessage`. The reverse direction
+* (host -> page) is delivered by `sendMessage` injecting a synthetic
+* `MessageEvent`, so no inbound wiring is needed here. Mirrors the native
+* `BRIDGE_USER_SCRIPT` in the client package's DynamicWebViewHost.
+*/
+const WAAS_EXPORT_BRIDGE_SHIM = `
+(function () {
+  if (window.__dynamicBridgeInstalled) { return; }
+  window.__dynamicBridgeInstalled = true;
+  var post = function (data) {
+    try {
+      var json = typeof data === 'string' ? data : JSON.stringify(data);
+      window.ReactNativeWebView.postMessage(json);
+    } catch (e) {}
+  };
+  try {
+    Object.defineProperty(window, 'postMessage', {
+      configurable: true,
+      writable: true,
+      value: function (data, targetOrigin, transfer) { post(data); }
+    });
+  } catch (e) {
+    try { window.postMessage = function (d) { post(d); }; } catch (_) {}
+  }
+})();
+true;
+`;
+/**
+* Creates a `WaasSDKContainer` backed by a `react-native-webview` rendered in
+* the normal RN view tree (so it scrolls, clips, and positions like any view —
+* no native overlay or manual window positioning). The private key is rendered
+* inside the WebView's sandboxed document and never crosses the bridge; only
+* the WaaS transport protocol messages do.
+*
+* The returned `container` is passed to `exportWaasPrivateKeyToContainer`; the
+* `handleWebView*` sinks are wired into the WebView's `onMessage`/`onError` by
+* the host component.
+*
+* @not-instrumented
+*/
+const createWebViewWaasContainer = ({ setUrl, webViewRef }) => {
+	const messageHandlers = [];
+	const errorHandlers = [];
+	let destroyed = false;
+	return {
+		container: {
+			destroy() {
+				if (destroyed) return;
+				destroyed = true;
+				messageHandlers.length = 0;
+				errorHandlers.length = 0;
+				setUrl("");
+			},
+			isAlive: () => !destroyed,
+			onError(handler) {
+				errorHandlers.push(handler);
+				return () => {
+					const index = errorHandlers.indexOf(handler);
+					if (index !== -1) errorHandlers.splice(index, 1);
+				};
+			},
+			onMessage(handler) {
+				messageHandlers.push(handler);
+				return () => {
+					const index = messageHandlers.indexOf(handler);
+					if (index !== -1) messageHandlers.splice(index, 1);
+				};
+			},
+			sendMessage(data) {
+				const payload = JSON.stringify(data);
+				webViewRef.current?.injectJavaScript(`window.dispatchEvent(new MessageEvent('message',{data:${payload},origin:window.location.origin}));true;`);
+			},
+			async setUrl(url) {
+				setUrl(url);
+			}
+		},
+		handleWebViewError(error) {
+			if (destroyed) return;
+			for (const handler of errorHandlers) handler(error);
+		},
+		handleWebViewMessage(raw) {
+			if (destroyed) return;
+			let data;
+			try {
+				data = JSON.parse(raw);
+			} catch {
+				data = raw;
+			}
+			for (const handler of messageHandlers) handler(data);
+		}
+	};
+};
+
+//#endregion
+//#region src/ExportPrivateKey/ExportPrivateKey.tsx
+/**
+* Renders a secure private-key export box for a WaaS wallet account on React
+* Native. The key is rendered inside a `react-native-webview` that fills the
+* box — the same split the web SDK uses (host renders the chrome, the
+* cross-origin document renders only the key). Because it is a normal RN view,
+* it scrolls, clips and positions like any view; no native overlay or manual
+* window positioning is involved. The key is rendered inside the WebView and
+* never crosses the bridge, so the host app's JS cannot read, log, or
+* screenshot it. On Android, window-level screenshot/recording protection is
+* enabled while the component is mounted.
+*
+* Place it inside your own modal/card and add your own close button — unmounting
+* tears the WebView down. Size/position it with the `style` prop.
+*
+* @example
+* ```tsx
+* <Modal visible={revealing} onRequestClose={() => setRevealing(false)}>
+*   <ExportPrivateKey walletAccount={walletAccount} onError={setError} />
+*   <Button title="I'm Done" onPress={() => setRevealing(false)} />
+* </Modal>
+* ```
+*/
+const ExportPrivateKey = ({ walletAccount, password, onComplete, onError, style }) => {
+	const webViewRef = (0, react.useRef)(null);
+	const [url, setUrl] = (0, react.useState)(null);
+	const onCompleteRef = (0, react.useRef)(onComplete);
+	onCompleteRef.current = onComplete;
+	const onErrorRef = (0, react.useRef)(onError);
+	onErrorRef.current = onError;
+	const passwordRef = (0, react.useRef)(password);
+	passwordRef.current = password;
+	const connectorRef = (0, react.useRef)(null);
+	if (connectorRef.current === null) connectorRef.current = createWebViewWaasContainer({
+		setUrl: (next) => setUrl(next || null),
+		webViewRef
+	});
+	const { container, handleWebViewMessage, handleWebViewError } = connectorRef.current;
+	const aliveRef = (0, react.useRef)(true);
+	const startedRef = (0, react.useRef)(false);
+	(0, react.useEffect)(() => {
+		if (startedRef.current) return;
+		startedRef.current = true;
+		(0, _dynamic_labs_sdk_client_core.setScreenshotProtection)({ enabled: true });
+		(0, _dynamic_labs_sdk_client_waas_core.exportWaasPrivateKeyToContainer)({
+			container,
+			password: passwordRef.current,
+			walletAccount
+		}, (0, _dynamic_labs_sdk_client.getDefaultClient)()).then(() => {
+			if (aliveRef.current) onCompleteRef.current?.();
+		}).catch((error) => {
+			if (aliveRef.current) onErrorRef.current?.(error);
+		});
+		return () => {
+			aliveRef.current = false;
+			container.destroy();
+			(0, _dynamic_labs_sdk_client_core.setScreenshotProtection)({ enabled: false });
+		};
+	}, []);
+	const expectedOrigin = (0, react.useMemo)(() => {
+		if (!url) return null;
+		try {
+			return new URL(url).origin;
+		} catch {
+			return null;
+		}
+	}, [url]);
+	return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_native.View, {
+		style: [styles.box, style],
+		children: url && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_native_webview.default, {
+			ref: webViewRef,
+			source: { uri: url },
+			injectedJavaScriptBeforeContentLoaded: WAAS_EXPORT_BRIDGE_SHIM,
+			onMessage: (event) => handleWebViewMessage(event.nativeEvent.data),
+			onError: (event) => handleWebViewError(event.nativeEvent),
+			onHttpError: (event) => handleWebViewError(event.nativeEvent),
+			originWhitelist: expectedOrigin ? [expectedOrigin] : [],
+			onShouldStartLoadWithRequest: (request) => {
+				if (!expectedOrigin) return true;
+				try {
+					return new URL(request.url).origin === expectedOrigin;
+				} catch {
+					return false;
+				}
+			},
+			incognito: true,
+			style: styles.webView
+		})
+	});
+};
+const styles = react_native.StyleSheet.create({
+	box: {
+		backgroundColor: "#FFFFFF",
+		minHeight: 88,
+		overflow: "hidden"
+	},
+	webView: {
+		backgroundColor: "transparent",
+		flex: 1
+	}
+});
+
+//#endregion
+//#region src/exports/index.ts
+(0, _dynamic_labs_sdk_assert_package_version.assertPackageVersion)(name, version);
+
+//#endregion
+exports.ExportPrivateKey = ExportPrivateKey;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["messageHandlers: Array<(data: unknown) => void>","errorHandlers: Array<(error: unknown) => void>","data: unknown","ExportPrivateKey: FC<ExportPrivateKeyProps>","View","WebView","StyleSheet","packageName","packageVersion"],"sources":["../package.json","../src/createWebViewWaasContainer/createWebViewWaasContainer.ts","../src/ExportPrivateKey/ExportPrivateKey.tsx","../src/exports/index.ts"],"sourcesContent":["","import type { WaasSDKContainer } from '@dynamic-labs-sdk/client/waas/core';\nimport type { RefObject } from 'react';\nimport type WebView from 'react-native-webview';\n\n/**\n * JS injected into the hosted export page before its own scripts run. The page\n * is written for the browser iframe transport: it reaches the SDK host via\n * `window.parent.postMessage` and listens with `window.addEventListener\n * ('message', ...)`. In a top-level WebView `window.parent === window`, so we\n * override `window.postMessage` to forward the page's outbound payload to React\n * Native through `window.ReactNativeWebView.postMessage`. The reverse direction\n * (host -> page) is delivered by `sendMessage` injecting a synthetic\n * `MessageEvent`, so no inbound wiring is needed here. Mirrors the native\n * `BRIDGE_USER_SCRIPT` in the client package's DynamicWebViewHost.\n */\nexport const WAAS_EXPORT_BRIDGE_SHIM = `\n(function () {\n  if (window.__dynamicBridgeInstalled) { return; }\n  window.__dynamicBridgeInstalled = true;\n  var post = function (data) {\n    try {\n      var json = typeof data === 'string' ? data : JSON.stringify(data);\n      window.ReactNativeWebView.postMessage(json);\n    } catch (e) {}\n  };\n  try {\n    Object.defineProperty(window, 'postMessage', {\n      configurable: true,\n      writable: true,\n      value: function (data, targetOrigin, transfer) { post(data); }\n    });\n  } catch (e) {\n    try { window.postMessage = function (d) { post(d); }; } catch (_) {}\n  }\n})();\ntrue;\n`;\n\n/**\n * Parameters for {@link createWebViewWaasContainer}.\n */\nexport type CreateWebViewWaasContainerParams = {\n  /**\n   * Sets the URL the hosted `<WebView>` should load. An empty string unmounts\n   * it (used by `destroy`). The component renders the WebView from this state.\n   */\n  setUrl: (url: string) => void;\n  /** Ref to the rendered `react-native-webview` instance. */\n  webViewRef: RefObject<WebView | null>;\n};\n\n/**\n * A {@link WaasSDKContainer} bound to a `react-native-webview`, plus the event\n * sinks the host component wires into the WebView's `onMessage`/`onError`.\n */\nexport type WebViewWaasContainer = {\n  /** The container handed to `exportWaasPrivateKeyToContainer`. */\n  container: WaasSDKContainer;\n  /** Feed a `<WebView>` load/HTTP error into the container's onError handlers. */\n  handleWebViewError: (error: unknown) => void;\n  /** Feed a raw `<WebView>` onMessage payload into the container's handlers. */\n  handleWebViewMessage: (raw: string) => void;\n};\n\n/**\n * Creates a `WaasSDKContainer` backed by a `react-native-webview` rendered in\n * the normal RN view tree (so it scrolls, clips, and positions like any view —\n * no native overlay or manual window positioning). The private key is rendered\n * inside the WebView's sandboxed document and never crosses the bridge; only\n * the WaaS transport protocol messages do.\n *\n * The returned `container` is passed to `exportWaasPrivateKeyToContainer`; the\n * `handleWebView*` sinks are wired into the WebView's `onMessage`/`onError` by\n * the host component.\n *\n * @not-instrumented\n */\nexport const createWebViewWaasContainer = ({\n  setUrl,\n  webViewRef,\n}: CreateWebViewWaasContainerParams): WebViewWaasContainer => {\n  // IframeManager registers more than one onMessage handler on the same\n  // container (handshake wait + transport forwarding), so we fan out to all.\n  const messageHandlers: Array<(data: unknown) => void> = [];\n  const errorHandlers: Array<(error: unknown) => void> = [];\n  let destroyed = false;\n\n  const container: WaasSDKContainer = {\n    destroy() {\n      if (destroyed) return;\n      destroyed = true;\n      messageHandlers.length = 0;\n      errorHandlers.length = 0;\n      // Unmount the WebView so the displayed key cannot outlive the container.\n      setUrl('');\n    },\n\n    isAlive: () => !destroyed,\n\n    // Signature is dictated by the upstream WaasSDKContainer interface.\n    // eslint-disable-next-line custom-rules/require-single-object-param\n    onError(handler: (error: unknown) => void) {\n      errorHandlers.push(handler);\n      return () => {\n        const index = errorHandlers.indexOf(handler);\n        if (index !== -1) errorHandlers.splice(index, 1);\n      };\n    },\n\n    // Signature is dictated by the upstream WaasSDKContainer interface.\n    // eslint-disable-next-line custom-rules/require-single-object-param\n    onMessage(handler: (data: unknown) => void) {\n      messageHandlers.push(handler);\n      return () => {\n        const index = messageHandlers.indexOf(handler);\n        if (index !== -1) messageHandlers.splice(index, 1);\n      };\n    },\n\n    sendMessage(data: Record<string, unknown>) {\n      // Deliver host -> page as a synthetic 'message' event — the shape the\n      // page expects from window.parent.postMessage in a browser iframe.\n      const payload = JSON.stringify(data);\n      webViewRef.current?.injectJavaScript(\n        `window.dispatchEvent(new MessageEvent('message',{data:${payload},origin:window.location.origin}));true;`\n      );\n    },\n\n    // Signature is dictated by the upstream WaasSDKContainer interface.\n    // eslint-disable-next-line custom-rules/require-single-object-param\n    async setUrl(url: string) {\n      setUrl(url);\n    },\n  };\n\n  return {\n    container,\n\n    handleWebViewError(error: unknown) {\n      if (destroyed) return;\n      for (const handler of errorHandlers) handler(error);\n    },\n\n    // Single positional arg matches the WebView onMessage event sink shape.\n    // eslint-disable-next-line custom-rules/require-single-object-param\n    handleWebViewMessage(raw: string) {\n      if (destroyed) return;\n      // The WaaS transport posts BOTH objects (JSON) and plain strings (e.g. the\n      // `iframe-ready-<instanceId>` handshake). Deliver parsed JSON when possible,\n      // otherwise the raw string — mirroring browser postMessage semantics, where\n      // a string stays a string and an object stays an object. Discarding non-JSON\n      // here would drop the handshake and hang the export until timeout.\n      let data: unknown;\n      try {\n        data = JSON.parse(raw);\n      } catch {\n        data = raw;\n      }\n      for (const handler of messageHandlers) handler(data);\n    },\n  };\n};\n","import { getDefaultClient } from '@dynamic-labs-sdk/client';\nimport { setScreenshotProtection } from '@dynamic-labs-sdk/client/core';\nimport { exportWaasPrivateKeyToContainer } from '@dynamic-labs-sdk/client/waas/core';\nimport type { FC } from 'react';\nimport { useEffect, useMemo, useRef, useState } from 'react';\nimport { StyleSheet, View } from 'react-native';\nimport WebView from 'react-native-webview';\n\nimport {\n  WAAS_EXPORT_BRIDGE_SHIM,\n  createWebViewWaasContainer,\n} from '../createWebViewWaasContainer/createWebViewWaasContainer';\nimport type { WebViewWaasContainer } from '../createWebViewWaasContainer/createWebViewWaasContainer';\nimport type { ExportPrivateKeyProps } from './ExportPrivateKey.types';\n\n/**\n * Renders a secure private-key export box for a WaaS wallet account on React\n * Native. The key is rendered inside a `react-native-webview` that fills the\n * box — the same split the web SDK uses (host renders the chrome, the\n * cross-origin document renders only the key). Because it is a normal RN view,\n * it scrolls, clips and positions like any view; no native overlay or manual\n * window positioning is involved. The key is rendered inside the WebView and\n * never crosses the bridge, so the host app's JS cannot read, log, or\n * screenshot it. On Android, window-level screenshot/recording protection is\n * enabled while the component is mounted.\n *\n * Place it inside your own modal/card and add your own close button — unmounting\n * tears the WebView down. Size/position it with the `style` prop.\n *\n * @example\n * ```tsx\n * <Modal visible={revealing} onRequestClose={() => setRevealing(false)}>\n *   <ExportPrivateKey walletAccount={walletAccount} onError={setError} />\n *   <Button title=\"I'm Done\" onPress={() => setRevealing(false)} />\n * </Modal>\n * ```\n */\nexport const ExportPrivateKey: FC<ExportPrivateKeyProps> = ({\n  walletAccount,\n  password,\n  onComplete,\n  onError,\n  style,\n}) => {\n  const webViewRef = useRef<WebView | null>(null);\n  const [url, setUrl] = useState<string | null>(null);\n\n  // Hold callbacks + options in refs so re-renders don't restart the export.\n  const onCompleteRef = useRef(onComplete);\n  onCompleteRef.current = onComplete;\n  const onErrorRef = useRef(onError);\n  onErrorRef.current = onError;\n  const passwordRef = useRef(password);\n  passwordRef.current = password;\n\n  // The container handed to the SDK plus the sinks wired into the WebView. It\n  // holds mutable state (handler arrays, destroyed flag), so it must be created\n  // exactly once and stay stable for the component's lifetime — useRef, not\n  // useMemo (which React may discard and recompute). setUrl drives whether (and\n  // what) the WebView renders.\n  const connectorRef = useRef<WebViewWaasContainer | null>(null);\n  if (connectorRef.current === null) {\n    connectorRef.current = createWebViewWaasContainer({\n      setUrl: (next: string) => setUrl(next || null),\n      webViewRef,\n    });\n  }\n  const { container, handleWebViewMessage, handleWebViewError } =\n    connectorRef.current;\n\n  const aliveRef = useRef(true);\n  const startedRef = useRef(false);\n\n  useEffect(() => {\n    // One-shot: the export ceremony runs once.\n    if (startedRef.current) return;\n    startedRef.current = true;\n\n    // Window-level screenshot/recording protection while the key is visible\n    // (Android FLAG_SECURE; no-op on iOS).\n    setScreenshotProtection({ enabled: true });\n\n    exportWaasPrivateKeyToContainer(\n      {\n        container,\n        password: passwordRef.current,\n        walletAccount,\n      },\n      // Internal API takes the client explicitly; the component defaults it.\n      getDefaultClient()\n    )\n      .then(() => {\n        if (aliveRef.current) onCompleteRef.current?.();\n      })\n      .catch((error: unknown) => {\n        if (aliveRef.current) onErrorRef.current?.(error);\n      });\n\n    return () => {\n      // Unmounting tears down the WebView + container and clears screenshot\n      // protection so the displayed key cannot outlive the screen.\n      aliveRef.current = false;\n      container.destroy();\n      setScreenshotProtection({ enabled: false });\n    };\n    // Effect intentionally runs once; inputs are captured in refs above.\n  }, []);\n\n  // Pin the WebView to the export URL's origin (navigation off it is blocked).\n  const expectedOrigin = useMemo(() => {\n    if (!url) return null;\n    try {\n      return new URL(url).origin;\n    } catch {\n      return null;\n    }\n  }, [url]);\n\n  return (\n    <View style={[styles.box, style]}>\n      {url && (\n        <WebView\n          ref={webViewRef}\n          source={{ uri: url }}\n          injectedJavaScriptBeforeContentLoaded={WAAS_EXPORT_BRIDGE_SHIM}\n          onMessage={(event) => handleWebViewMessage(event.nativeEvent.data)}\n          onError={(event) => handleWebViewError(event.nativeEvent)}\n          onHttpError={(event) => handleWebViewError(event.nativeEvent)}\n          originWhitelist={expectedOrigin ? [expectedOrigin] : []}\n          onShouldStartLoadWithRequest={(request) => {\n            if (!expectedOrigin) return true;\n            // Exact-origin match — a prefix check would let look-alike hosts\n            // (e.g. https://export.example.com.evil.com) through.\n            try {\n              return new URL(request.url).origin === expectedOrigin;\n            } catch {\n              return false;\n            }\n          }}\n          // A fresh, isolated, ephemeral store per export.\n          incognito\n          style={styles.webView}\n        />\n      )}\n    </View>\n  );\n};\n\nconst styles = StyleSheet.create({\n  // Minimal default so the component stays \"headless\" — the host owns the\n  // chrome (border, radius, etc.) via the `style` prop. We only keep an opaque\n  // background, a min height so the box is measurable before the host sizes it,\n  // and clipping for the WebView.\n  box: {\n    backgroundColor: '#FFFFFF',\n    minHeight: 88,\n    overflow: 'hidden',\n  },\n  webView: {\n    backgroundColor: 'transparent',\n    flex: 1,\n  },\n});\n","import { assertPackageVersion } from '@dynamic-labs-sdk/assert-package-version';\n\nimport {\n  name as packageName,\n  version as packageVersion,\n} from '../../package.json';\nassertPackageVersion(packageName, packageVersion);\n\nexport { ExportPrivateKey } from '../ExportPrivateKey/ExportPrivateKey';\nexport type { ExportPrivateKeyProps } from '../ExportPrivateKey/ExportPrivateKey.types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACeA,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DvC,MAAa,8BAA8B,EACzC,QACA,iBAC4D;CAG5D,MAAMA,kBAAkD,EAAE;CAC1D,MAAMC,gBAAiD,EAAE;CACzD,IAAI,YAAY;AAkDhB,QAAO;EACL,WAjDkC;GAClC,UAAU;AACR,QAAI,UAAW;AACf,gBAAY;AACZ,oBAAgB,SAAS;AACzB,kBAAc,SAAS;AAEvB,WAAO,GAAG;;GAGZ,eAAe,CAAC;GAIhB,QAAQ,SAAmC;AACzC,kBAAc,KAAK,QAAQ;AAC3B,iBAAa;KACX,MAAM,QAAQ,cAAc,QAAQ,QAAQ;AAC5C,SAAI,UAAU,GAAI,eAAc,OAAO,OAAO,EAAE;;;GAMpD,UAAU,SAAkC;AAC1C,oBAAgB,KAAK,QAAQ;AAC7B,iBAAa;KACX,MAAM,QAAQ,gBAAgB,QAAQ,QAAQ;AAC9C,SAAI,UAAU,GAAI,iBAAgB,OAAO,OAAO,EAAE;;;GAItD,YAAY,MAA+B;IAGzC,MAAM,UAAU,KAAK,UAAU,KAAK;AACpC,eAAW,SAAS,iBAClB,yDAAyD,QAAQ,yCAClE;;GAKH,MAAM,OAAO,KAAa;AACxB,WAAO,IAAI;;GAEd;EAKC,mBAAmB,OAAgB;AACjC,OAAI,UAAW;AACf,QAAK,MAAM,WAAW,cAAe,SAAQ,MAAM;;EAKrD,qBAAqB,KAAa;AAChC,OAAI,UAAW;GAMf,IAAIC;AACJ,OAAI;AACF,WAAO,KAAK,MAAM,IAAI;WAChB;AACN,WAAO;;AAET,QAAK,MAAM,WAAW,gBAAiB,SAAQ,KAAK;;EAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3HH,MAAaC,oBAA+C,EAC1D,eACA,UACA,YACA,SACA,YACI;CACJ,MAAM,+BAAoC,KAAK;CAC/C,MAAM,CAAC,KAAK,8BAAkC,KAAK;CAGnD,MAAM,kCAAuB,WAAW;AACxC,eAAc,UAAU;CACxB,MAAM,+BAAoB,QAAQ;AAClC,YAAW,UAAU;CACrB,MAAM,gCAAqB,SAAS;AACpC,aAAY,UAAU;CAOtB,MAAM,iCAAmD,KAAK;AAC9D,KAAI,aAAa,YAAY,KAC3B,cAAa,UAAU,2BAA2B;EAChD,SAAS,SAAiB,OAAO,QAAQ,KAAK;EAC9C;EACD,CAAC;CAEJ,MAAM,EAAE,WAAW,sBAAsB,uBACvC,aAAa;CAEf,MAAM,6BAAkB,KAAK;CAC7B,MAAM,+BAAoB,MAAM;AAEhC,4BAAgB;AAEd,MAAI,WAAW,QAAS;AACxB,aAAW,UAAU;AAIrB,6DAAwB,EAAE,SAAS,MAAM,CAAC;AAE1C,0EACE;GACE;GACA,UAAU,YAAY;GACtB;GACD,kDAEiB,CACnB,CACE,WAAW;AACV,OAAI,SAAS,QAAS,eAAc,WAAW;IAC/C,CACD,OAAO,UAAmB;AACzB,OAAI,SAAS,QAAS,YAAW,UAAU,MAAM;IACjD;AAEJ,eAAa;AAGX,YAAS,UAAU;AACnB,aAAU,SAAS;AACnB,8DAAwB,EAAE,SAAS,OAAO,CAAC;;IAG5C,EAAE,CAAC;CAGN,MAAM,0CAA+B;AACnC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAO,IAAI,IAAI,IAAI,CAAC;UACd;AACN,UAAO;;IAER,CAAC,IAAI,CAAC;AAET,QACE,2CAACC;EAAK,OAAO,CAAC,OAAO,KAAK,MAAM;YAC7B,OACC,2CAACC;GACC,KAAK;GACL,QAAQ,EAAE,KAAK,KAAK;GACpB,uCAAuC;GACvC,YAAY,UAAU,qBAAqB,MAAM,YAAY,KAAK;GAClE,UAAU,UAAU,mBAAmB,MAAM,YAAY;GACzD,cAAc,UAAU,mBAAmB,MAAM,YAAY;GAC7D,iBAAiB,iBAAiB,CAAC,eAAe,GAAG,EAAE;GACvD,+BAA+B,YAAY;AACzC,QAAI,CAAC,eAAgB,QAAO;AAG5B,QAAI;AACF,YAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW;YACjC;AACN,YAAO;;;GAIX;GACA,OAAO,OAAO;IACd;GAEC;;AAIX,MAAM,SAASC,wBAAW,OAAO;CAK/B,KAAK;EACH,iBAAiB;EACjB,WAAW;EACX,UAAU;EACX;CACD,SAAS;EACP,iBAAiB;EACjB,MAAM;EACP;CACF,CAAC;;;;mEC5JmBC,MAAaC,QAAe"}