@dynamic-labs-wallet/node 1.0.104 → 1.0.106

package/index.cjs

@@ -2256,6 +2256,106 @@ const revokeDelegation = async (client, { walletId })=>{
     }
 };
 
+const ERROR_MISSING_AUTHENTICATE_SCOPE = 'Environment API token is missing the waas.authenticate scope, which delegated gas sponsorship requires.';
+const ERROR_MISSING_SERVER_AUTH_JWT = 'waas/authenticate returned no JWT';
+const ERROR_SERVER_AUTH_EXCHANGE_FAILED = 'Server-auth token exchange failed';
+// Keyed by client instance, not environmentId, so a process serving several
+// environments never hands one environment's JWT to another's client. A WeakMap
+// rather than a field keeps DelegatedWalletClient's public type unchanged and
+// lets the entry die with the client. The value is the in-flight promise, not
+// the resolved client, so concurrent first calls share a single exchange.
+const serverAuthClients = new WeakMap();
+const statusOf = (error)=>{
+    var _candidate_response;
+    const candidate = error;
+    var _candidate_response_status;
+    return (_candidate_response_status = candidate == null ? void 0 : (_candidate_response = candidate.response) == null ? void 0 : _candidate_response.status) != null ? _candidate_response_status : candidate == null ? void 0 : candidate.status;
+};
+// Server body if there is one, transport message ("connect ECONNREFUSED") if there isn't.
+const detailOf = (error)=>{
+    var _error_response;
+    const data = error == null ? void 0 : (_error_response = error.response) == null ? void 0 : _error_response.data;
+    var _error_message;
+    const fallback = (_error_message = error == null ? void 0 : error.message) != null ? _error_message : 'Unknown error';
+    if (typeof data === 'string') {
+        return data || fallback;
+    }
+    var _data_error, _ref;
+    return (_ref = (_data_error = data == null ? void 0 : data.error) != null ? _data_error : data == null ? void 0 : data.message) != null ? _ref : fallback;
+};
+const mint = async (client)=>{
+    var _response_data_encodedJwts, _response_data;
+    let response;
+    try {
+        response = await client.createApiClient().authenticateApiToken({
+            environmentId: client.environmentId
+        });
+    } catch (error) {
+        // The axios error never escapes, on any status — its config carries the
+        // bearer token. Only status and the server's message are re-thrown.
+        // 403 gets a named scope: redcoast only says "Insufficient scope permissions".
+        const status = statusOf(error);
+        if (status === 403) {
+            throw new Error(ERROR_MISSING_AUTHENTICATE_SCOPE);
+        }
+        const statusStr = status ? ` (${status})` : '';
+        const message = `${ERROR_SERVER_AUTH_EXCHANGE_FAILED}${statusStr}: ${detailOf(error)}`;
+        throw Object.assign(new Error(message), {
+            status
+        });
+    }
+    const jwt = response == null ? void 0 : (_response_data = response.data) == null ? void 0 : (_response_data_encodedJwts = _response_data.encodedJwts) == null ? void 0 : _response_data_encodedJwts.minifiedJwt;
+    if (!jwt) {
+        throw new Error(ERROR_MISSING_SERVER_AUTH_JWT);
+    }
+    return client.createApiClient({
+        authToken: jwt
+    });
+};
+const authenticate = (client)=>{
+    const cached = serverAuthClients.get(client);
+    if (cached) {
+        return cached;
+    }
+    const pending = mint(client);
+    serverAuthClients.set(client, pending);
+    // A rejected exchange must not stay cached, or every later call replays the
+    // same failure instead of retrying. Callers await `pending` themselves, so
+    // this handler exists only to evict.
+    void pending.catch(()=>{
+        if (serverAuthClients.get(client) === pending) {
+            serverAuthClients.delete(client);
+        }
+    });
+    return pending;
+};
+/**
+ * Runs `fn` against an API client authenticated as a server-auth principal for
+ * this environment, exchanging the delegated client's environment API token at
+ * `waas/authenticate` on first use and caching the result per client instance.
+ *
+ * `fn` may be invoked twice: the JWT expires and can be revoked server-side, so
+ * rather than tracking its lifetime the first call that comes back 401 re-mints
+ * and retries once. Pass a `fn` that tolerates that retry.
+ */ const withDelegatedServerAuth = async (client, fn)=>{
+    const pending = authenticate(client);
+    const apiClient = await pending;
+    try {
+        return await fn(apiClient);
+    } catch (error) {
+        if (statusOf(error) !== 401) {
+            throw error;
+        }
+        // Only evict the entry this call actually used. A concurrent 401 may have
+        // already replaced it, and dropping that fresh one would start yet another
+        // exchange for every caller in the burst.
+        if (serverAuthClients.get(client) === pending) {
+            serverAuthClients.delete(client);
+        }
+        return fn(await authenticate(client));
+    }
+};
+
 function decryptAesGcm(key, ivB64, ctB64, tagB64) {
     const iv = Buffer.from(ivB64, 'base64url');
     const ciphertext = Buffer.from(ctB64, 'base64url');
@@ -2565,6 +2665,7 @@ exports.revokeDelegation = revokeDelegation;
 exports.signSessionMessage = signSessionMessage;
 exports.stringToBytes = stringToBytes;
 exports.stripHexPrefix = stripHexPrefix;
+exports.withDelegatedServerAuth = withDelegatedServerAuth;
 Object.keys(core).forEach(function (k) {
   if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
     enumerable: true,

package/index.esm.js

@@ -2255,6 +2255,106 @@ const revokeDelegation = async (client, { walletId })=>{
     }
 };
 
+const ERROR_MISSING_AUTHENTICATE_SCOPE = 'Environment API token is missing the waas.authenticate scope, which delegated gas sponsorship requires.';
+const ERROR_MISSING_SERVER_AUTH_JWT = 'waas/authenticate returned no JWT';
+const ERROR_SERVER_AUTH_EXCHANGE_FAILED = 'Server-auth token exchange failed';
+// Keyed by client instance, not environmentId, so a process serving several
+// environments never hands one environment's JWT to another's client. A WeakMap
+// rather than a field keeps DelegatedWalletClient's public type unchanged and
+// lets the entry die with the client. The value is the in-flight promise, not
+// the resolved client, so concurrent first calls share a single exchange.
+const serverAuthClients = new WeakMap();
+const statusOf = (error)=>{
+    var _candidate_response;
+    const candidate = error;
+    var _candidate_response_status;
+    return (_candidate_response_status = candidate == null ? void 0 : (_candidate_response = candidate.response) == null ? void 0 : _candidate_response.status) != null ? _candidate_response_status : candidate == null ? void 0 : candidate.status;
+};
+// Server body if there is one, transport message ("connect ECONNREFUSED") if there isn't.
+const detailOf = (error)=>{
+    var _error_response;
+    const data = error == null ? void 0 : (_error_response = error.response) == null ? void 0 : _error_response.data;
+    var _error_message;
+    const fallback = (_error_message = error == null ? void 0 : error.message) != null ? _error_message : 'Unknown error';
+    if (typeof data === 'string') {
+        return data || fallback;
+    }
+    var _data_error, _ref;
+    return (_ref = (_data_error = data == null ? void 0 : data.error) != null ? _data_error : data == null ? void 0 : data.message) != null ? _ref : fallback;
+};
+const mint = async (client)=>{
+    var _response_data_encodedJwts, _response_data;
+    let response;
+    try {
+        response = await client.createApiClient().authenticateApiToken({
+            environmentId: client.environmentId
+        });
+    } catch (error) {
+        // The axios error never escapes, on any status — its config carries the
+        // bearer token. Only status and the server's message are re-thrown.
+        // 403 gets a named scope: redcoast only says "Insufficient scope permissions".
+        const status = statusOf(error);
+        if (status === 403) {
+            throw new Error(ERROR_MISSING_AUTHENTICATE_SCOPE);
+        }
+        const statusStr = status ? ` (${status})` : '';
+        const message = `${ERROR_SERVER_AUTH_EXCHANGE_FAILED}${statusStr}: ${detailOf(error)}`;
+        throw Object.assign(new Error(message), {
+            status
+        });
+    }
+    const jwt = response == null ? void 0 : (_response_data = response.data) == null ? void 0 : (_response_data_encodedJwts = _response_data.encodedJwts) == null ? void 0 : _response_data_encodedJwts.minifiedJwt;
+    if (!jwt) {
+        throw new Error(ERROR_MISSING_SERVER_AUTH_JWT);
+    }
+    return client.createApiClient({
+        authToken: jwt
+    });
+};
+const authenticate = (client)=>{
+    const cached = serverAuthClients.get(client);
+    if (cached) {
+        return cached;
+    }
+    const pending = mint(client);
+    serverAuthClients.set(client, pending);
+    // A rejected exchange must not stay cached, or every later call replays the
+    // same failure instead of retrying. Callers await `pending` themselves, so
+    // this handler exists only to evict.
+    void pending.catch(()=>{
+        if (serverAuthClients.get(client) === pending) {
+            serverAuthClients.delete(client);
+        }
+    });
+    return pending;
+};
+/**
+ * Runs `fn` against an API client authenticated as a server-auth principal for
+ * this environment, exchanging the delegated client's environment API token at
+ * `waas/authenticate` on first use and caching the result per client instance.
+ *
+ * `fn` may be invoked twice: the JWT expires and can be revoked server-side, so
+ * rather than tracking its lifetime the first call that comes back 401 re-mints
+ * and retries once. Pass a `fn` that tolerates that retry.
+ */ const withDelegatedServerAuth = async (client, fn)=>{
+    const pending = authenticate(client);
+    const apiClient = await pending;
+    try {
+        return await fn(apiClient);
+    } catch (error) {
+        if (statusOf(error) !== 401) {
+            throw error;
+        }
+        // Only evict the entry this call actually used. A concurrent 401 may have
+        // already replaced it, and dropping that fresh one would start yet another
+        // exchange for every caller in the burst.
+        if (serverAuthClients.get(client) === pending) {
+            serverAuthClients.delete(client);
+        }
+        return fn(await authenticate(client));
+    }
+};
+
 function decryptAesGcm(key, ivB64, ctB64, tagB64) {
     const iv = Buffer.from(ivB64, 'base64url');
     const ciphertext = Buffer.from(ctB64, 'base64url');
@@ -2524,4 +2624,4 @@ const asAuthError = async (error, operation)=>{
     };
 }
 
-export { DynamicWalletClient, base64ToBytes, bytesToBase64, createAuthClient, createDelegatedWalletClient, createLogError, decryptDelegatedWebhookData, delegatedSignMessage, ensureBase64Padding, formatEvmMessage, formatMessage, generateSessionKeyPair, getExternalServerKeyShareBackupInfo, getMPCSignatureScheme, getMPCSigner, isHexString, logError, mergeUniqueKeyShares, parseIndexMapDerivationPath, retryPromise, revokeDelegation, signSessionMessage, stringToBytes, stripHexPrefix };
+export { DynamicWalletClient, base64ToBytes, bytesToBase64, createAuthClient, createDelegatedWalletClient, createLogError, decryptDelegatedWebhookData, delegatedSignMessage, ensureBase64Padding, formatEvmMessage, formatMessage, generateSessionKeyPair, getExternalServerKeyShareBackupInfo, getMPCSignatureScheme, getMPCSigner, isHexString, logError, mergeUniqueKeyShares, parseIndexMapDerivationPath, retryPromise, revokeDelegation, signSessionMessage, stringToBytes, stripHexPrefix, withDelegatedServerAuth };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dynamic-labs-wallet/node",
-  "version": "1.0.104",
+  "version": "1.0.106",
   "license": "Licensed under the Dynamic Labs, Inc. Terms Of Service (https://www.dynamic.xyz/terms-conditions)",
   "type": "module",
   "dependencies": {
-    "@dynamic-labs-wallet/core": "1.0.104",
+    "@dynamic-labs-wallet/core": "1.0.106",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
-    "@dynamic-labs-wallet/primitives": "1.0.104",
+    "@dynamic-labs-wallet/primitives": "1.0.106",
     "@dynamic-labs/logger": "^5.0.0",
     "@dynamic-labs/sdk-api-core": "^0.0.1093",
     "uuid": "11.1.0",

package/src/delegatedClient/index.d.ts

@@ -2,6 +2,7 @@ export { createDelegatedWalletClient } from './createDelegatedClient.js';
 export type { DelegatedWalletClient, DelegatedClientConfig } from './createDelegatedClient.js';
 export { delegatedSignMessage } from './modules/sign.js';
 export { revokeDelegation } from './modules/revokeDelegation.js';
+export { withDelegatedServerAuth } from './modules/serverAuth.js';
 export { decryptDelegatedWebhookData } from './modules/decryptWebhookData.js';
 export type { EncryptedDelegatedPayload } from './modules/decryptWebhookData.js';
 //# sourceMappingURL=index.d.ts.map

package/src/delegatedClient/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegatedClient/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,YAAY,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegatedClient/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,YAAY,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC"}

package/src/delegatedClient/modules/serverAuth.d.ts

@@ -0,0 +1,16 @@
+import type { DynamicApiClient } from '@dynamic-labs-wallet/core';
+import type { DelegatedWalletClient } from '../createDelegatedClient.js';
+export declare const ERROR_MISSING_AUTHENTICATE_SCOPE = "Environment API token is missing the waas.authenticate scope, which delegated gas sponsorship requires.";
+export declare const ERROR_MISSING_SERVER_AUTH_JWT = "waas/authenticate returned no JWT";
+export declare const ERROR_SERVER_AUTH_EXCHANGE_FAILED = "Server-auth token exchange failed";
+/**
+ * Runs `fn` against an API client authenticated as a server-auth principal for
+ * this environment, exchanging the delegated client's environment API token at
+ * `waas/authenticate` on first use and caching the result per client instance.
+ *
+ * `fn` may be invoked twice: the JWT expires and can be revoked server-side, so
+ * rather than tracking its lifetime the first call that comes back 401 re-mints
+ * and retries once. Pass a `fn` that tolerates that retry.
+ */
+export declare const withDelegatedServerAuth: <T>(client: DelegatedWalletClient, fn: (apiClient: DynamicApiClient) => Promise<T>) => Promise<T>;
+//# sourceMappingURL=serverAuth.d.ts.map

package/src/delegatedClient/modules/serverAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverAuth.d.ts","sourceRoot":"","sources":["../../../src/delegatedClient/modules/serverAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,eAAO,MAAM,gCAAgC,4GAC8D,CAAC;AAE5G,eAAO,MAAM,6BAA6B,sCAAsC,CAAC;AAEjF,eAAO,MAAM,iCAAiC,sCAAsC,CAAC;AA6ErF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAU,CAAC,UACrC,qBAAqB,MACzB,CAAC,SAAS,EAAE,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,KAC9C,OAAO,CAAC,CAAC,CAoBX,CAAC"}

package/src/index.d.ts

@@ -9,7 +9,7 @@ export * from './types.js';
 export * from './utils.js';
 export { generateSessionKeyPair, signSessionMessage } from './sessionKeys.js';
 export * from './mpc/index.js';
-export { createDelegatedWalletClient, delegatedSignMessage, revokeDelegation, decryptDelegatedWebhookData, } from './delegatedClient/index.js';
+export { createDelegatedWalletClient, delegatedSignMessage, revokeDelegation, decryptDelegatedWebhookData, withDelegatedServerAuth, } from './delegatedClient/index.js';
 export type { DelegatedWalletClient, DelegatedClientConfig, EncryptedDelegatedPayload, } from './delegatedClient/index.js';
 export { createAuthClient } from './authClient.js';
 export type { AuthResult, CreateAuthClientOptions, DynamicAuthClient } from './authClient.js';

package/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../packages/src/index.ts"],"names":[],"mappings":"AACA,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG/F,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG1F,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../packages/src/index.ts"],"names":[],"mappings":"AACA,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG/F,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG1F,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}