@dynamic-labs-wallet/browser-wallet-client 1.0.63 → 1.0.65

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/index.cjs +30 -0
  2. package/index.esm.js +30 -0
  3. package/package.json +2 -2
  4. package/src/client/iframeManager/IframeManager.d.ts.map +1 -1
  5. package/src/client/iframeManager/resolveIframeDomain.d.ts +10 -0
  6. package/src/client/iframeManager/resolveIframeDomain.d.ts.map +1 -1
package/index.cjs CHANGED
@@ -476,6 +476,31 @@ const createIframeWaasSDKContainer = ()=>{
476
476
  };
477
477
  };
478
478
 
479
+ /**
480
+ * Cookie-mode isolation guard: the key-share iframe must never share an origin
481
+ * with the embedding page — a same-origin parent can read the iframe's DOM and
482
+ * storage directly, collapsing the boundary that keeps client key shares out of
483
+ * reach of host-page XSS. This only happens when the app itself is served from
484
+ * the cookie hostname (e.g. a reverse proxy routing both the app and Dynamic's
485
+ * API through one hostname), so refuse to boot instead of running without the
486
+ * boundary. No-op off-web (React Native), where no location/DOM access exists.
487
+ */ const assertIframeOriginIsolated = (iframeDomain)=>{
488
+ var _globalThis_location;
489
+ const hostOrigin = (_globalThis_location = globalThis.location) == null ? void 0 : _globalThis_location.origin;
490
+ if (!hostOrigin) {
491
+ return;
492
+ }
493
+ let iframeOrigin;
494
+ try {
495
+ iframeOrigin = new URL(iframeDomain).origin;
496
+ } catch (e) {
497
+ // Malformed baseApiUrl surfaces as a clearer iframe load failure later.
498
+ return;
499
+ }
500
+ if (iframeOrigin === hostOrigin) {
501
+ throw new Error(`Cookie auth misconfiguration: the wallet iframe origin (${iframeOrigin}) is the same as the host page origin. ` + 'The cookie domain must be a dedicated hostname CNAMEd to Dynamic (e.g. auth.example.com) that never serves ' + 'your application — a same-origin setup would let the host page read the wallet key-share storage.');
502
+ }
503
+ };
479
504
  /**
480
505
  * Resolve the wallet iframe domain from the API base URL: the
481
506
  * environment-mapped Dynamic domain, or `baseApiUrl` itself in cookie auth
@@ -1406,6 +1431,11 @@ class IframeManager {
1406
1431
  baseApiUrl,
1407
1432
  authMode: this.authMode
1408
1433
  });
1434
+ // Cookie mode serves the iframe from the customer's cookie hostname; refuse
1435
+ // to boot if that origin is the embedding page's own origin (see the guard).
1436
+ if (this.authMode === core.AuthMode.COOKIE && this.iframeDomain) {
1437
+ assertIframeOriginIsolated(this.iframeDomain);
1438
+ }
1409
1439
  // Fallback warmup: only saves connection setup when the host constructs
1410
1440
  // the client ahead of use. Hosts should call `preconnectWaasIframe` at
1411
1441
  // auth-flow start for real runway. No-op on React Native.
package/index.esm.js CHANGED
@@ -475,6 +475,31 @@ const createIframeWaasSDKContainer = ()=>{
475
475
  };
476
476
  };
477
477
 
478
+ /**
479
+ * Cookie-mode isolation guard: the key-share iframe must never share an origin
480
+ * with the embedding page — a same-origin parent can read the iframe's DOM and
481
+ * storage directly, collapsing the boundary that keeps client key shares out of
482
+ * reach of host-page XSS. This only happens when the app itself is served from
483
+ * the cookie hostname (e.g. a reverse proxy routing both the app and Dynamic's
484
+ * API through one hostname), so refuse to boot instead of running without the
485
+ * boundary. No-op off-web (React Native), where no location/DOM access exists.
486
+ */ const assertIframeOriginIsolated = (iframeDomain)=>{
487
+ var _globalThis_location;
488
+ const hostOrigin = (_globalThis_location = globalThis.location) == null ? void 0 : _globalThis_location.origin;
489
+ if (!hostOrigin) {
490
+ return;
491
+ }
492
+ let iframeOrigin;
493
+ try {
494
+ iframeOrigin = new URL(iframeDomain).origin;
495
+ } catch (e) {
496
+ // Malformed baseApiUrl surfaces as a clearer iframe load failure later.
497
+ return;
498
+ }
499
+ if (iframeOrigin === hostOrigin) {
500
+ throw new Error(`Cookie auth misconfiguration: the wallet iframe origin (${iframeOrigin}) is the same as the host page origin. ` + 'The cookie domain must be a dedicated hostname CNAMEd to Dynamic (e.g. auth.example.com) that never serves ' + 'your application — a same-origin setup would let the host page read the wallet key-share storage.');
501
+ }
502
+ };
478
503
  /**
479
504
  * Resolve the wallet iframe domain from the API base URL: the
480
505
  * environment-mapped Dynamic domain, or `baseApiUrl` itself in cookie auth
@@ -1405,6 +1430,11 @@ class IframeManager {
1405
1430
  baseApiUrl,
1406
1431
  authMode: this.authMode
1407
1432
  });
1433
+ // Cookie mode serves the iframe from the customer's cookie hostname; refuse
1434
+ // to boot if that origin is the embedding page's own origin (see the guard).
1435
+ if (this.authMode === AuthMode.COOKIE && this.iframeDomain) {
1436
+ assertIframeOriginIsolated(this.iframeDomain);
1437
+ }
1408
1438
  // Fallback warmup: only saves connection setup when the host constructs
1409
1439
  // the client ahead of use. Hosts should call `preconnectWaasIframe` at
1410
1440
  // auth-flow start for real runway. No-op on React Native.
package/package.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "name": "@dynamic-labs-wallet/browser-wallet-client",
3
- "version": "1.0.63",
3
+ "version": "1.0.65",
4
4
  "license": "MIT",
5
5
  "type": "module",
6
6
  "dependencies": {
7
- "@dynamic-labs-wallet/core": "1.0.63",
7
+ "@dynamic-labs-wallet/core": "1.0.65",
8
8
  "@dynamic-labs/logger": "^4.81.0",
9
9
  "@dynamic-labs/message-transport": "^4.81.0"
10
10
  },
package/src/client/iframeManager/IframeManager.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"IframeManager.d.ts","sourceRoot":"","sources":["../../../src/client/iframeManager/IframeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,KAAK,sBAAsB,EAK3B,KAAK,qBAAqB,EAG1B,KAAK,oBAAoB,EAEzB,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAOL,KAAK,iCAAiC,EACtC,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAuC9E,qBAAa,aAAa;IACxB,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,MAAM,wCAAU;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAQ;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAQ;IACnC,aAAa,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAMhD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,gBAAgB,EAAE,iCAAiC,GAAG,IAAI,CAAQ;IAC5E,SAAS,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAQ;IACnE;;oDAEgD;IAChD,OAAO,CAAC,aAAa,CAA6B;IAClD;;oDAEgD;IAChD,OAAO,CAAC,2BAA2B,CAA6B;IAChE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA8B;IAC9D,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;IAChC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAS;IACzC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAK;IACtC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAK;IAEpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAQ;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IAC9C,8BAA8B,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1D,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAiC;IACtE;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACjE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC;;;;;OAKG;IACI,uBAAuB,EAAE,OAAO,CAAC;IACxC;;;;OAIG;IACH,SAAS,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;OAIG;IACH,SAAS,CAAC,2BAA2B,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1E;;;OAGG;IACH,SAAS,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAC7C,IAAI,CAAC,qBAAqB,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,CAAC,CACrH,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAM;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAO;IAC3D,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,gBAAgB,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAyB;IAChE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA6B;IAC7D,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,CAAS;gBAGlC,EACE,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,QAA0B,EAC1B,SAAS,EACT,KAAK,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,GACxB,EAAE;QACD,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,QAAQ,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,8BAA8B,CAAC,EAAE,MAAM,CAAC;QACxC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7C;;;WAGG;QACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC;;;;WAIG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;;;WAKG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B;;;;;WAKG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,EACD,eAAe,CAAC,EAAE;QAChB,aAAa,CAAC,EAAE,oBAAoB,CAAC;QACrC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACxD,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;QAChD,cAAc,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7C;IAkDH;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAuBxB,UAAU;IAShB;;;OAGG;IACH,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9C;;;OAGG;YACW,+BAA+B;IAS7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,0BAA0B;IA2BlC,wFAAwF;IACxF,OAAO,CAAC,yBAAyB;IAiCjC;;OAEG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;OAQG;IACH,OAAO,CAAC,2BAA2B;IAyCnC;;OAEG;cACa,0BAA0B;IAoD1C;;;;;;;OAOG;YACW,aAAa;IAkE3B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAsClC;;;;OAIG;YACW,wBAAwB;IAatC;;OAEG;YACW,uBAAuB;IAQrC;;OAEG;YACW,uBAAuB;IAOrC;;OAEG;YACW,0BAA0B;IAOxC;;OAEG;YACW,wBAAwB;IAWtC;;OAEG;YACW,aAAa;IAY3B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAgBnC;uFACmF;IACnF,OAAO,CAAC,oBAAoB;IAK5B;sFACkF;IAClF,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAKrC;mFAC+E;IAC/E,OAAO,CAAC,sBAAsB;YAQhB,UAAU;IA4CxB,OAAO,CAAC,iCAAiC;IA0FzC,OAAO,CAAC,gBAAgB;IAWxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAgG9B;;;;;;;;OAQG;IACG,mCAAmC,CAAC,EAAE,SAAS,EAAE,EAAE;QAAE,SAAS,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC;QAC5F,MAAM,EAAE,iBAAiB,CAAC;QAC1B,aAAa,EAAE,oBAAoB,CAAC;QACpC,OAAO,EAAE,MAAM,IAAI,CAAC;KACrB,CAAC;IAqCF;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,8BAA8B;IA+CtC;;;;;;;;;;;OAWG;IACG,oCAAoC,CAAC,EAAE,gBAAgB,EAAE,EAAE;QAAE,gBAAgB,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC;QAChH,aAAa,EAAE,oBAAoB,CAAC;QACpC,OAAO,EAAE,MAAM,IAAI,CAAC;KACrB,CAAC;IAqCW,OAAO;CAoCrB"}
1
+ {"version":3,"file":"IframeManager.d.ts","sourceRoot":"","sources":["../../../src/client/iframeManager/IframeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,KAAK,sBAAsB,EAK3B,KAAK,qBAAqB,EAG1B,KAAK,oBAAoB,EAEzB,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAOL,KAAK,iCAAiC,EACtC,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAuC9E,qBAAa,aAAa;IACxB,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,MAAM,wCAAU;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAQ;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAQ;IACnC,aAAa,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAMhD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,gBAAgB,EAAE,iCAAiC,GAAG,IAAI,CAAQ;IAC5E,SAAS,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAQ;IACnE;;oDAEgD;IAChD,OAAO,CAAC,aAAa,CAA6B;IAClD;;oDAEgD;IAChD,OAAO,CAAC,2BAA2B,CAA6B;IAChE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA8B;IAC9D,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;IAChC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAS;IACzC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAK;IACtC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAK;IAEpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAQ;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IAC9C,8BAA8B,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1D,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAiC;IACtE;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACjE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC;;;;;OAKG;IACI,uBAAuB,EAAE,OAAO,CAAC;IACxC;;;;OAIG;IACH,SAAS,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;OAIG;IACH,SAAS,CAAC,2BAA2B,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1E;;;OAGG;IACH,SAAS,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAC7C,IAAI,CAAC,qBAAqB,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,CAAC,CACrH,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAM;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAO;IAC3D,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,gBAAgB,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAyB;IAChE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA6B;IAC7D,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,CAAS;gBAGlC,EACE,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,QAA0B,EAC1B,SAAS,EACT,KAAK,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,GACxB,EAAE;QACD,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,QAAQ,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,8BAA8B,CAAC,EAAE,MAAM,CAAC;QACxC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7C;;;WAGG;QACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC;;;;WAIG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;;;WAKG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B;;;;;WAKG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,EACD,eAAe,CAAC,EAAE;QAChB,aAAa,CAAC,EAAE,oBAAoB,CAAC;QACrC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACxD,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;QAChD,cAAc,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7C;IAwDH;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAuBxB,UAAU;IAShB;;;OAGG;IACH,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9C;;;OAGG;YACW,+BAA+B;IAS7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,0BAA0B;IA2BlC,wFAAwF;IACxF,OAAO,CAAC,yBAAyB;IAiCjC;;OAEG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;OAQG;IACH,OAAO,CAAC,2BAA2B;IAyCnC;;OAEG;cACa,0BAA0B;IAoD1C;;;;;;;OAOG;YACW,aAAa;IAkE3B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAsClC;;;;OAIG;YACW,wBAAwB;IAatC;;OAEG;YACW,uBAAuB;IAQrC;;OAEG;YACW,uBAAuB;IAOrC;;OAEG;YACW,0BAA0B;IAOxC;;OAEG;YACW,wBAAwB;IAWtC;;OAEG;YACW,aAAa;IAY3B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAgBnC;uFACmF;IACnF,OAAO,CAAC,oBAAoB;IAK5B;sFACkF;IAClF,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAKrC;mFAC+E;IAC/E,OAAO,CAAC,sBAAsB;YAQhB,UAAU;IA4CxB,OAAO,CAAC,iCAAiC;IA0FzC,OAAO,CAAC,gBAAgB;IAWxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAgG9B;;;;;;;;OAQG;IACG,mCAAmC,CAAC,EAAE,SAAS,EAAE,EAAE;QAAE,SAAS,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC;QAC5F,MAAM,EAAE,iBAAiB,CAAC;QAC1B,aAAa,EAAE,oBAAoB,CAAC;QACpC,OAAO,EAAE,MAAM,IAAI,CAAC;KACrB,CAAC;IAqCF;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,8BAA8B;IA+CtC;;;;;;;;;;;OAWG;IACG,oCAAoC,CAAC,EAAE,gBAAgB,EAAE,EAAE;QAAE,gBAAgB,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC;QAChH,aAAa,EAAE,oBAAoB,CAAC;QACpC,OAAO,EAAE,MAAM,IAAI,CAAC;KACrB,CAAC;IAqCW,OAAO;CAoCrB"}
package/src/client/iframeManager/resolveIframeDomain.d.ts CHANGED
@@ -1,4 +1,14 @@
1
1
  import { AuthMode } from '@dynamic-labs-wallet/core';
2
+ /**
3
+ * Cookie-mode isolation guard: the key-share iframe must never share an origin
4
+ * with the embedding page — a same-origin parent can read the iframe's DOM and
5
+ * storage directly, collapsing the boundary that keeps client key shares out of
6
+ * reach of host-page XSS. This only happens when the app itself is served from
7
+ * the cookie hostname (e.g. a reverse proxy routing both the app and Dynamic's
8
+ * API through one hostname), so refuse to boot instead of running without the
9
+ * boundary. No-op off-web (React Native), where no location/DOM access exists.
10
+ */
11
+ export declare const assertIframeOriginIsolated: (iframeDomain: string) => void;
2
12
  /**
3
13
  * Resolve the wallet iframe domain from the API base URL: the
4
14
  * environment-mapped Dynamic domain, or `baseApiUrl` itself in cookie auth
package/src/client/iframeManager/resolveIframeDomain.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"resolveIframeDomain.d.ts","sourceRoot":"","sources":["../../../src/client/iframeManager/resolveIframeDomain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA4C,MAAM,2BAA2B,CAAC;AAE/F;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,8BAG7B;IACD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;CACpB,KAAG,MAAM,GAAG,IAKZ,CAAC"}
1
+ {"version":3,"file":"resolveIframeDomain.d.ts","sourceRoot":"","sources":["../../../src/client/iframeManager/resolveIframeDomain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA4C,MAAM,2BAA2B,CAAC;AAE/F;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,iBAAkB,MAAM,KAAG,IAmBjE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,8BAG7B;IACD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;CACpB,KAAG,MAAM,GAAG,IAKZ,CAAC"}