@dynamic-labs-wallet/core 1.1.34 → 1.1.35

package/index.cjs

@@ -1279,6 +1279,155 @@ const getElapsedTime = (startTime)=>{
     };
 };
 
+/**
+ * Thrown when sign-and-broadcast answers 413: the request body is over the server's 640kb limit,
+ * which multiple large messages plus calldata can reach.
+ */ class SignAndBroadcastRequestTooLargeError extends Error {
+    constructor(){
+        super('The sign-and-broadcast request is too large. Send less calldata or fewer fee attempts.');
+        this.name = 'SignAndBroadcastRequestTooLargeError';
+    }
+}
+
+class WalletApiError extends Error {
+    constructor(status, message, code){
+        super(message);
+        this.name = 'WalletApiError';
+        this.status = status;
+        this.code = code;
+    }
+}
+const getResponseRecord = (error)=>{
+    var _error_response;
+    const data = (_error_response = error.response) == null ? void 0 : _error_response.data;
+    return data && typeof data === 'object' ? data : undefined;
+};
+// The Key Share Service returns its machine-readable cause under `error_code`; other
+// backends use `code` or a bare `error`. Exported for callers that must skip handleAxiosError's own logging.
+const extractServerErrorCode = (error)=>{
+    const record = getResponseRecord(error);
+    const candidates = [
+        record == null ? void 0 : record['code'],
+        record == null ? void 0 : record['error_code'],
+        record == null ? void 0 : record['error']
+    ];
+    return candidates.find((value)=>typeof value === 'string');
+};
+const INTERNAL_SERVER_ERROR_MESSAGE = 'Internal server error';
+/**
+ * `status` for a request that never received an HTTP response at all — the
+ * client lost connectivity, the request was aborted, DNS/TLS failed, or CORS
+ * blocked it. 0 matches the XHR/`fetch` convention for "no response".
+ *
+ * This used to be reported as `500 Internal server error`, which made a
+ * client-side network failure indistinguishable from a backend fault: the
+ * "Backend 500s" monitor counted 1,395 events on a day when the API returned
+ * only 33 real 5xx responses.
+ */ const NETWORK_ERROR_STATUS = 0;
+const NETWORK_ERROR_CODE = 'NETWORK_ERROR';
+const NETWORK_ERROR_MESSAGE = 'Network error - no response received';
+const STATUS_MESSAGES = {
+    400: 'Invalid request',
+    403: 'Forbidden',
+    422: 'Unprocessable content',
+    429: 'Rate limited',
+    500: INTERNAL_SERVER_ERROR_MESSAGE
+};
+const MISSING_AUTH_MESSAGE = 'Authorization header or cookie missing';
+// A 401 can mean the request carried no credentials, or carried credentials the
+// backend rejected — the two need different messages. The Authorization header
+// is readable so we can confirm its presence; the auth cookie is httpOnly, so we
+// can only report whether cookie mode was enabled (`withCredentials`), not that a
+// cookie was actually attached.
+const getRequestCredentials = (error)=>{
+    var _error_config, _error_config1;
+    const requestHeaders = (_error_config = error.config) == null ? void 0 : _error_config.headers;
+    var _requestHeaders_Authorization;
+    const hasAuthorizationHeader = Boolean((_requestHeaders_Authorization = requestHeaders == null ? void 0 : requestHeaders['Authorization']) != null ? _requestHeaders_Authorization : requestHeaders == null ? void 0 : requestHeaders['authorization']);
+    const usesCookieAuth = Boolean((_error_config1 = error.config) == null ? void 0 : _error_config1.withCredentials);
+    return {
+        hasAuthorizationHeader,
+        usesCookieAuth
+    };
+};
+const resolveUnauthorizedMessage = (error)=>{
+    const { hasAuthorizationHeader, usesCookieAuth } = getRequestCredentials(error);
+    if (!hasAuthorizationHeader && !usesCookieAuth) {
+        return MISSING_AUTH_MESSAGE;
+    }
+    const credentialDescriptions = [];
+    if (hasAuthorizationHeader) {
+        credentialDescriptions.push('Authorization header present');
+    }
+    if (usesCookieAuth) {
+        credentialDescriptions.push('withCredentials enabled (cookie auth)');
+    }
+    return `Unauthorized (${credentialDescriptions.join(', ')})`;
+};
+const resolveStatusMessage = (status, error)=>{
+    if (status === 401) {
+        return resolveUnauthorizedMessage(error);
+    }
+    if (status && STATUS_MESSAGES[status]) {
+        return STATUS_MESSAGES[status];
+    }
+    return undefined;
+};
+const handleAxiosError = (error, message, context, /**
+   * Optional severity hint from the caller, for failures the caller knows are
+   * expected (e.g. a business-rule rejection). It can only *lower* severity to
+   * `warn` — a caller must not be able to escalate, and a genuine 5xx has to
+   * stay at `error` regardless of what the call site believes.
+   *
+   * Without this the hint that `logError` accepts was silently discarded for
+   * every AxiosError, which is the most common error type in the SDK.
+   */ options)=>{
+    var _error_config, _error_config1, _error_response, _error_response1, _error_response2;
+    const requestUrl = (_error_config = error.config) == null ? void 0 : _error_config.url;
+    const requestBaseUrl = (_error_config1 = error.config) == null ? void 0 : _error_config1.baseURL;
+    // The HTTP status MUST NOT be logged as a top-level `status` field: Datadog
+    // reserves `status` for the log level and its remapper turns a numeric value
+    // into `info`, silently burying every 4xx/5xx we emit here. `http.status_code`
+    // is Datadog's standard attribute, so the level survives and these logs join
+    // against edge/CDN logs on the same field.
+    const logPayload = _extends({
+        message,
+        error: (_error_response = error.response) == null ? void 0 : _error_response.data,
+        http: {
+            status_code: (_error_response1 = error.response) == null ? void 0 : _error_response1.status
+        }
+    }, requestBaseUrl && {
+        requestBaseUrl
+    }, requestUrl && {
+        requestUrl
+    }, {
+        context
+    });
+    const status = (_error_response2 = error.response) == null ? void 0 : _error_response2.status;
+    // A 429 (Too Many Requests) is a transient rate-limit signal, not a code or
+    // logic failure — and a request that never got a response is a client-side
+    // connectivity problem, not a server fault. Both are logged at `warn` so they
+    // don't pollute error dashboards or trigger PagerDuty. The 429 case covers
+    // both Cloudflare WAF blocks and application-level rate limiting.
+    const inferredLevel = status === 429 || status === undefined ? 'warn' : 'error';
+    // A 5xx is a server fault: no call site is entitled to downgrade it, however
+    // expected it believes the failure to be. The hint only applies below 500.
+    const isServerFault = status !== undefined && status >= 500;
+    const logLevel = (options == null ? void 0 : options.level) === 'warn' && !isServerFault ? 'warn' : inferredLevel;
+    Logger[logLevel]('[DynamicWaasWalletClient] Axios error: ', logPayload);
+    // No response at all: report it as such rather than laundering it into a 500.
+    if (status === undefined) {
+        throw new WalletApiError(NETWORK_ERROR_STATUS, NETWORK_ERROR_MESSAGE, NETWORK_ERROR_CODE);
+    }
+    var _resolveStatusMessage;
+    // Preserve the real status. Collapsing every unmapped code to 500 made a 404
+    // (backup not found) and a 504 (gateway timeout) both surface as
+    // "Internal server error", so neither the caller nor a monitor could tell a
+    // missing resource from an outage.
+    const resolvedMessage = (_resolveStatusMessage = resolveStatusMessage(status, error)) != null ? _resolveStatusMessage : `Request failed with status ${status}`;
+    throw new WalletApiError(status, resolvedMessage, extractServerErrorCode(error));
+};
+
 const getRequiredExternalKeyShareId = (ks)=>{
     if (!ks.externalKeyShareId) {
         throw new Error(`Missing externalKeyShareId for key share (id: ${ks.id}, keygenId: ${ks.keygenId})`);
@@ -1293,7 +1442,7 @@ const getRequiredExternalKeyShareId = (ks)=>{
  * before it is posted and surfaces in Datadog exactly as the recovery path does.
  */ const assertDynamicLocationsHaveExternalKeyShareId = (locations)=>locations.filter((location)=>location.location === BackupLocation.DYNAMIC).forEach((location)=>getRequiredExternalKeyShareId(location));
 
-var version = "1.1.34";
+var version = "1.1.35";
 
 /**
  * Reads the Authorization header off an axios request config, which stores
@@ -1458,6 +1607,29 @@ const createWalletAccountRequestBody = ({ chainName, clientKeygenIds, thresholdS
         businessAccountId
     } : {});
 };
+const MAX_SERVER_MESSAGE_LENGTH = 200;
+/**
+ * A rejected sign-and-broadcast as a `WalletApiError` that names the server's reason and code, since the generic status text says nothing about which check failed. A failure with no response (timeout, no connection) passes through.
+ *
+ * @param error - What the request threw.
+ */ const toSignAndBroadcastApiError = (error)=>{
+    if (!axios.isAxiosError(error) || !error.response) {
+        return error;
+    }
+    const { status, data } = error.response;
+    const code = extractServerErrorCode(error);
+    const record = data && typeof data === 'object' ? data : undefined;
+    const serverMessage = [
+        record == null ? void 0 : record['error'],
+        record == null ? void 0 : record['message']
+    ].find((candidate)=>typeof candidate === 'string' && candidate.length > 0 && candidate !== code);
+    const detail = [
+        serverMessage == null ? void 0 : serverMessage.slice(0, MAX_SERVER_MESSAGE_LENGTH),
+        code && `code: ${code}`
+    ].filter(Boolean).join(', ');
+    const suffix = detail ? ` (${detail})` : '';
+    return new WalletApiError(status, `Sign and broadcast failed with status ${status}${suffix}`, code);
+};
 class DynamicApiClient extends BaseClient {
     async getBackupRelayToken({ traceContext }) {
         const { data } = await this.apiClient.get(`${this.waasRoutePrefix}/keyShares/backup/token`, {
@@ -1586,6 +1758,74 @@ class DynamicApiClient extends BaseClient {
             traceContext
         });
     }
+    /**
+   * Starts a sign-and-broadcast: Dynamic opens one signing room per message, you sign in each, and Dynamic then sends the transaction. The signature never comes back.
+   *
+   * @param params.walletId - The wallet that signs.
+   * @param params.shareSetId - Which of the wallet's key sets to use. Defaults to its active one.
+   * @param params.messages - The transaction once per fee attempt, in fee order, as the bytes to sign (RLP hex on EVM, message bytes on Solana). Not hashed.
+   * @param params.contexts - What each message does in readable form (chain, recipient, amount), one per message in the same order. Dynamic checks each against the wallet and its policies.
+   * @param params.broadcastOptions - Solana send settings: other required signers' signatures, and skipping the pre-send dry run.
+   * @param params.isFormatted - `true` if each message is already a hash. `false` for a serialized transaction.
+   * @param params.requestedCertainty - How sure to be before calling it confirmed: `fast`, `safe` or `final`, or `chain:` plus a chain-specific value. Defaults to `safe`.
+   * @param params.externalReference - Your own label, returned on every event. Not unique.
+   * @param params.roomIds - Signing rooms you already opened, one per message. Send all or none; Dynamic opens them when omitted.
+   * @param params.approvalQuorum - Approvers' consent for a governed wallet, sent on the retry after `intent_required`.
+   * @param params.idempotencyKey - Makes a retry safe: the same key replays the stored answer instead of sending twice.
+   * @param params.dynamicRequestId - Id of this one request, to match client and server logs.
+   * @param params.traceContext - Ties this call's logs to the server's, across retries. Created when omitted.
+   * @param params.mfaToken - Proof of the user's multi-factor check, when the wallet needs one.
+   * @param params.elevatedAccessToken - Proof of a recent re-login, when the wallet needs one.
+   * @param params.onError - Called with the failure's message, never the raw error.
+   * @returns The transaction record: its id, its status, and the signing rooms while signing is pending.
+   * @throws SignAndBroadcastRequestTooLargeError when the body is over the server limit.
+   * @throws SigningConsentRequiredError when a governed wallet needs approvers' consent first.
+   * @throws WalletApiError when the server rejects it, with its reason and code.
+   */ async signAndBroadcast({ dynamicRequestId, walletId, shareSetId, contexts, broadcastOptions, messages, isFormatted, requestedCertainty, externalReference, roomIds, approvalQuorum, idempotencyKey, onError, mfaToken, elevatedAccessToken, traceContext }) {
+        try {
+            return await requestJson({
+                apiClient: this.apiClient,
+                dynamicRequestId,
+                idempotencyKey,
+                endpoint: `${this.waasRoutePrefix}/${walletId}/transactions/signAndBroadcast`,
+                body: _extends({
+                    messages,
+                    contexts
+                }, broadcastOptions ? {
+                    broadcastOptions
+                } : {}, {
+                    isFormatted
+                }, requestedCertainty ? {
+                    requestedCertainty
+                } : {}, externalReference ? {
+                    externalReference
+                } : {}, roomIds ? {
+                    roomIds
+                } : {}, approvalQuorum ? {
+                    approvalQuorum
+                } : {}, shareSetId ? {
+                    shareSetId
+                } : {}),
+                timeoutMs: 20000,
+                timeoutMessage: 'Sign and broadcast timed out',
+                onError,
+                mfaToken,
+                elevatedAccessToken,
+                traceContext
+            });
+        } catch (error) {
+            const response = error.response;
+            if ((response == null ? void 0 : response.status) === 413) {
+                throw new SignAndBroadcastRequestTooLargeError();
+            }
+            // A governed wallet with nothing signed yet answers 422 intent_required, as plain signing's stream does.
+            const intentRequired = (response == null ? void 0 : response.status) === 422 ? asIntentRequiredFrom422Body(response.data) : undefined;
+            if (intentRequired) {
+                throw new SigningConsentRequiredError(intentRequired);
+            }
+            throw toSignAndBroadcastApiError(error);
+        }
+    }
     async refreshWalletAccountShares({ dynamicRequestId, walletId, shareSetId, onError, onCeremonyComplete, mfaToken, elevatedAccessToken, traceContext }) {
         return createEventStreamPromise({
             apiClient: this.apiClient,
@@ -2837,143 +3077,37 @@ const prepareRawMessageSigningPayload = (chainName, message)=>{
     return typeof formatted === 'string' ? formatted : Buffer.from(formatted).toString('hex');
 };
 
-class WalletApiError extends Error {
-    constructor(status, message, code){
-        super(message);
-        this.name = 'WalletApiError';
-        this.status = status;
-        this.code = code;
+/** Returns the context as plain JSON, with each bigint (which `JSON.stringify` throws on) turned into a string. */ const toJsonSafeContext = (context)=>{
+    try {
+        return JSON.parse(JSON.stringify(context, (_key, value)=>typeof value === 'bigint' ? String(value) : value));
+    } catch (error) {
+        throw new Error(`Could not serialize the signing context: ${error instanceof Error ? error.message : String(error)}`, {
+            cause: error
+        });
     }
-}
-const getResponseRecord = (error)=>{
-    var _error_response;
-    const data = (_error_response = error.response) == null ? void 0 : _error_response.data;
-    return data && typeof data === 'object' ? data : undefined;
-};
-// The Key Share Service returns its machine-readable cause under `error_code`; other
-// backends use `code` or a bare `error`. Exported for callers that must skip handleAxiosError's own logging.
-const extractServerErrorCode = (error)=>{
-    const record = getResponseRecord(error);
-    const candidates = [
-        record == null ? void 0 : record['code'],
-        record == null ? void 0 : record['error_code'],
-        record == null ? void 0 : record['error']
-    ];
-    return candidates.find((value)=>typeof value === 'string');
 };
-const INTERNAL_SERVER_ERROR_MESSAGE = 'Internal server error';
+
 /**
- * `status` for a request that never received an HTTP response at all — the
- * client lost connectivity, the request was aborted, DNS/TLS failed, or CORS
- * blocked it. 0 matches the XHR/`fetch` convention for "no response".
- *
- * This used to be reported as `500 Internal server error`, which made a
- * client-side network failure indistinguishable from a backend fault: the
- * "Backend 500s" monitor counted 1,395 events on a day when the API returned
- * only 33 real 5xx responses.
- */ const NETWORK_ERROR_STATUS = 0;
-const NETWORK_ERROR_CODE = 'NETWORK_ERROR';
-const NETWORK_ERROR_MESSAGE = 'Network error - no response received';
-const STATUS_MESSAGES = {
-    400: 'Invalid request',
-    403: 'Forbidden',
-    422: 'Unprocessable content',
-    429: 'Rate limited',
-    500: INTERNAL_SERVER_ERROR_MESSAGE
-};
-const MISSING_AUTH_MESSAGE = 'Authorization header or cookie missing';
-// A 401 can mean the request carried no credentials, or carried credentials the
-// backend rejected — the two need different messages. The Authorization header
-// is readable so we can confirm its presence; the auth cookie is httpOnly, so we
-// can only report whether cookie mode was enabled (`withCredentials`), not that a
-// cookie was actually attached.
-const getRequestCredentials = (error)=>{
-    var _error_config, _error_config1;
-    const requestHeaders = (_error_config = error.config) == null ? void 0 : _error_config.headers;
-    var _requestHeaders_Authorization;
-    const hasAuthorizationHeader = Boolean((_requestHeaders_Authorization = requestHeaders == null ? void 0 : requestHeaders['Authorization']) != null ? _requestHeaders_Authorization : requestHeaders == null ? void 0 : requestHeaders['authorization']);
-    const usesCookieAuth = Boolean((_error_config1 = error.config) == null ? void 0 : _error_config1.withCredentials);
-    return {
-        hasAuthorizationHeader,
-        usesCookieAuth
-    };
-};
-const resolveUnauthorizedMessage = (error)=>{
-    const { hasAuthorizationHeader, usesCookieAuth } = getRequestCredentials(error);
-    if (!hasAuthorizationHeader && !usesCookieAuth) {
-        return MISSING_AUTH_MESSAGE;
-    }
-    const credentialDescriptions = [];
-    if (hasAuthorizationHeader) {
-        credentialDescriptions.push('Authorization header present');
-    }
-    if (usesCookieAuth) {
-        credentialDescriptions.push('withCredentials enabled (cookie auth)');
-    }
-    return `Unauthorized (${credentialDescriptions.join(', ')})`;
-};
-const resolveStatusMessage = (status, error)=>{
-    if (status === 401) {
-        return resolveUnauthorizedMessage(error);
-    }
-    if (status && STATUS_MESSAGES[status]) {
-        return STATUS_MESSAGES[status];
-    }
-    return undefined;
-};
-const handleAxiosError = (error, message, context, /**
-   * Optional severity hint from the caller, for failures the caller knows are
-   * expected (e.g. a business-rule rejection). It can only *lower* severity to
-   * `warn` — a caller must not be able to escalate, and a genuine 5xx has to
-   * stay at `error` regardless of what the call site believes.
-   *
-   * Without this the hint that `logError` accepts was silently discarded for
-   * every AxiosError, which is the most common error type in the SDK.
-   */ options)=>{
-    var _error_config, _error_config1, _error_response, _error_response1, _error_response2;
-    const requestUrl = (_error_config = error.config) == null ? void 0 : _error_config.url;
-    const requestBaseUrl = (_error_config1 = error.config) == null ? void 0 : _error_config1.baseURL;
-    // The HTTP status MUST NOT be logged as a top-level `status` field: Datadog
-    // reserves `status` for the log level and its remapper turns a numeric value
-    // into `info`, silently burying every 4xx/5xx we emit here. `http.status_code`
-    // is Datadog's standard attribute, so the level survives and these logs join
-    // against edge/CDN logs on the same field.
-    const logPayload = _extends({
-        message,
-        error: (_error_response = error.response) == null ? void 0 : _error_response.data,
-        http: {
-            status_code: (_error_response1 = error.response) == null ? void 0 : _error_response1.status
-        }
-    }, requestBaseUrl && {
-        requestBaseUrl
-    }, requestUrl && {
-        requestUrl
-    }, {
-        context
+ * Returns a trace context that always has an id, so a retrying operation can hand the same one to each attempt.
+ * The id is 32 lowercase hex characters, a valid W3C trace id the server can continue.
+ */ const withTraceId = (traceContext)=>{
+    var _traceContext_traceId, _traceContext_startTime;
+    return _extends({}, traceContext, {
+        traceId: (_traceContext_traceId = traceContext == null ? void 0 : traceContext.traceId) != null ? _traceContext_traceId : uuid.v4().replaceAll('-', ''),
+        startTime: (_traceContext_startTime = traceContext == null ? void 0 : traceContext.startTime) != null ? _traceContext_startTime : Date.now()
     });
-    const status = (_error_response2 = error.response) == null ? void 0 : _error_response2.status;
-    // A 429 (Too Many Requests) is a transient rate-limit signal, not a code or
-    // logic failure — and a request that never got a response is a client-side
-    // connectivity problem, not a server fault. Both are logged at `warn` so they
-    // don't pollute error dashboards or trigger PagerDuty. The 429 case covers
-    // both Cloudflare WAF blocks and application-level rate limiting.
-    const inferredLevel = status === 429 || status === undefined ? 'warn' : 'error';
-    // A 5xx is a server fault: no call site is entitled to downgrade it, however
-    // expected it believes the failure to be. The hint only applies below 500.
-    const isServerFault = status !== undefined && status >= 500;
-    const logLevel = (options == null ? void 0 : options.level) === 'warn' && !isServerFault ? 'warn' : inferredLevel;
-    Logger[logLevel]('[DynamicWaasWalletClient] Axios error: ', logPayload);
-    // No response at all: report it as such rather than laundering it into a 500.
-    if (status === undefined) {
-        throw new WalletApiError(NETWORK_ERROR_STATUS, NETWORK_ERROR_MESSAGE, NETWORK_ERROR_CODE);
-    }
-    var _resolveStatusMessage;
-    // Preserve the real status. Collapsing every unmapped code to 500 made a 404
-    // (backup not found) and a 504 (gateway timeout) both surface as
-    // "Internal server error", so neither the caller nor a monitor could tell a
-    // missing resource from an outage.
-    const resolvedMessage = (_resolveStatusMessage = resolveStatusMessage(status, error)) != null ? _resolveStatusMessage : `Request failed with status ${status}`;
-    throw new WalletApiError(status, resolvedMessage, extractServerErrorCode(error));
+};
+
+/** The ids a caller can quote to support so one failed attempt can be found in client and server logs. */ /** Sets `traceId` and `requestId` on a thrown error so apps can quote them, keeping any id already set. */ const attachRequestIds = (error, { traceId, requestId })=>{
+    var _target, _target1;
+    if (!error || typeof error !== 'object' || !Object.isExtensible(error)) {
+        return;
+    }
+    const target = error;
+    var _traceId;
+    (_traceId = (_target = target).traceId) != null ? _traceId : _target.traceId = traceId;
+    var _requestId;
+    (_requestId = (_target1 = target).requestId) != null ? _requestId : _target1.requestId = requestId;
 };
 
 Object.defineProperty(exports, "SigningAlgorithm", {
@@ -3069,6 +3203,7 @@ exports.RELAY_APP_ID_HEADER = RELAY_APP_ID_HEADER;
 exports.SDK_NAMESPACE = SDK_NAMESPACE;
 exports.SERVER_SDK_ROUTE_PREFIX = SERVER_SDK_ROUTE_PREFIX;
 exports.SOLANA_RPC_URL = SOLANA_RPC_URL;
+exports.SignAndBroadcastRequestTooLargeError = SignAndBroadcastRequestTooLargeError;
 exports.SigningConsentRequiredError = SigningConsentRequiredError;
 exports.SuccessEventType = SuccessEventType;
 exports.ThresholdSignatureScheme = ThresholdSignatureScheme;
@@ -3077,6 +3212,7 @@ exports.WalletApiError = WalletApiError;
 exports.WalletOperation = WalletOperation;
 exports.WalletReadyState = WalletReadyState;
 exports.assertDynamicLocationsHaveExternalKeyShareId = assertDynamicLocationsHaveExternalKeyShareId;
+exports.attachRequestIds = attachRequestIds;
 exports.buildForwardMpcEnclaveUrl = buildForwardMpcEnclaveUrl;
 exports.chain = chain;
 exports.chainEnumToVerifiedCredentialName = chainEnumToVerifiedCredentialName;
@@ -3107,4 +3243,6 @@ exports.prepareRawMessageSigningPayload = prepareRawMessageSigningPayload;
 exports.sanitizeBusinessAccountSignedIntent = sanitizeBusinessAccountSignedIntent;
 exports.serializeError = serializeError;
 exports.serializeMessageForForwardMPC = serializeMessageForForwardMPC;
+exports.toJsonSafeContext = toJsonSafeContext;
 exports.verifiedCredentialNameToChainEnum = verifiedCredentialNameToChainEnum;
+exports.withTraceId = withTraceId;