@dynamic-labs/sdk-react-core 5.8.1 → 5.9.1

package/CHANGELOG.md

@@ -1,4 +1,24 @@
 
+### [5.9.1](https://github.com/dynamic-labs/dynamic-auth/compare/v5.9.0...v5.9.1) (2026-09-18)
+
+
+### Bug Fixes
+
+* **sdk-react-core:** sanitize interpolated values in theme stylesheet builder ([#12416](https://github.com/dynamic-labs/dynamic-auth/issues/12416)) ([f256c08](https://github.com/dynamic-labs/dynamic-auth/commit/f256c08209b7818292a7d4d76793c592bd0ca2a0))
+* **webview-controller:** route MetaMask connector storage through native secure storage ([#12304](https://github.com/dynamic-labs/dynamic-auth/issues/12304)) ([627a483](https://github.com/dynamic-labs/dynamic-auth/commit/627a4839a8071d2b2eed1ef6536cd3ecfc833000)), closes [dynamic-labs-oss/public-wallet-connectors#189](https://github.com/dynamic-labs-oss/public-wallet-connectors/issues/189)
+
+## [5.9.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.8.1...v5.9.0) (2026-09-16)
+
+
+### Features
+
+* **sdk-react-core:** gate business account mutations behind step-up auth ([#12410](https://github.com/dynamic-labs/dynamic-auth/issues/12410)) ([d394719](https://github.com/dynamic-labs/dynamic-auth/commit/d3947198f9f84debccdd3ae4a4321f56b24467fb))
+
+
+### Bug Fixes
+
+* prefer dashboard-saved RPC urls when mapping viem chains ([#12404](https://github.com/dynamic-labs/dynamic-auth/issues/12404)) ([dfe75b4](https://github.com/dynamic-labs/dynamic-auth/commit/dfe75b4193cff46b0fa0ef014f8b040587a0667e))
+
 ### [5.8.1](https://github.com/dynamic-labs/dynamic-auth/compare/v5.8.0...v5.8.1) (2026-09-15)
 
 

package/package.cjs

@@ -3,11 +3,11 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.8.1";
+var version = "5.9.1";
 var dependencies = {
-	"@dynamic-labs/sdk-api-core": "0.32.0",
-	"@dynamic-labs-sdk/client": "1.31.2",
-	"@dynamic-labs-wallet/browser-wallet-client": "1.0.118",
+	"@dynamic-labs/sdk-api-core": "0.40.0",
+	"@dynamic-labs-sdk/client": "1.33.3",
+	"@dynamic-labs-wallet/browser-wallet-client": "1.1.10",
 	"@dynamic-labs-wallet/forward-mpc-client": "1.0.2",
 	"@hcaptcha/react-hcaptcha": "1.4.4",
 	"@marsidev/react-turnstile": "1.5.2",

package/package.js

@@ -1,9 +1,9 @@
 'use client'
-var version = "5.8.1";
+var version = "5.9.1";
 var dependencies = {
-	"@dynamic-labs/sdk-api-core": "0.32.0",
-	"@dynamic-labs-sdk/client": "1.31.2",
-	"@dynamic-labs-wallet/browser-wallet-client": "1.0.118",
+	"@dynamic-labs/sdk-api-core": "0.40.0",
+	"@dynamic-labs-sdk/client": "1.33.3",
+	"@dynamic-labs-wallet/browser-wallet-client": "1.1.10",
 	"@dynamic-labs-wallet/forward-mpc-client": "1.0.2",
 	"@hcaptcha/react-hcaptcha": "1.4.4",
 	"@marsidev/react-turnstile": "1.5.2",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dynamic-labs/sdk-react-core",
-  "version": "5.8.1",
+  "version": "5.9.1",
   "dependencies": {
-    "@dynamic-labs/sdk-api-core": "0.32.0",
-    "@dynamic-labs-sdk/client": "1.31.2",
-    "@dynamic-labs-wallet/browser-wallet-client": "1.0.118",
+    "@dynamic-labs/sdk-api-core": "0.40.0",
+    "@dynamic-labs-sdk/client": "1.33.3",
+    "@dynamic-labs-wallet/browser-wallet-client": "1.1.10",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.2",
     "@hcaptcha/react-hcaptcha": "1.4.4",
     "@marsidev/react-turnstile": "1.5.2",
@@ -18,17 +18,17 @@
     "react-i18next": "13.5.0",
     "react-international-phone": "4.5.0",
     "yup": "0.32.11",
-    "@dynamic-labs/assert-package-version": "5.8.1",
-    "@dynamic-labs/iconic": "5.8.1",
-    "@dynamic-labs/locale": "5.8.1",
-    "@dynamic-labs/logger": "5.8.1",
-    "@dynamic-labs/multi-wallet": "5.8.1",
-    "@dynamic-labs/rpc-providers": "5.8.1",
-    "@dynamic-labs/store": "5.8.1",
-    "@dynamic-labs/types": "5.8.1",
-    "@dynamic-labs/utils": "5.8.1",
-    "@dynamic-labs/wallet-book": "5.8.1",
-    "@dynamic-labs/wallet-connector-core": "5.8.1",
+    "@dynamic-labs/assert-package-version": "5.9.1",
+    "@dynamic-labs/iconic": "5.9.1",
+    "@dynamic-labs/locale": "5.9.1",
+    "@dynamic-labs/logger": "5.9.1",
+    "@dynamic-labs/multi-wallet": "5.9.1",
+    "@dynamic-labs/rpc-providers": "5.9.1",
+    "@dynamic-labs/store": "5.9.1",
+    "@dynamic-labs/types": "5.9.1",
+    "@dynamic-labs/utils": "5.9.1",
+    "@dynamic-labs/wallet-book": "5.9.1",
+    "@dynamic-labs/wallet-connector-core": "5.9.1",
     "eventemitter3": "5.0.1"
   },
   "devDependencies": {

package/src/lib/context/ThemeContext/utils/stylesheetBuilder/stylesheetBuilder.cjs

@@ -48,6 +48,14 @@ const findOrCreateStyleTag = (nonce) => {
     styleTag.dataset.source = 'dynamic-theme';
     return styleTag;
 };
+// Characters outside this set could break out of a CSS declaration
+// (e.g. `;`, `}`, `\` escapes, comments) when interpolated into the
+// generated theme stylesheet. `/` (modern alpha syntax) and `_`
+// (custom-property names) are safe: comments need `*` which is excluded
+const SAFE_CSS_VALUE_PATTERN = /^[a-zA-Z0-9#(),.%_/\s+-]+$/;
+const isSafeCssValue = (value) => value !== undefined &&
+    value !== '' &&
+    (typeof value === 'number' || SAFE_CSS_VALUE_PATTERN.test(value));
 const buildStylesheet = (theme) => {
     const { customColor, brandStyle } = theme;
     const footerBackgroundColor = brandStyle === 'bold' ? customColor : undefined;
@@ -61,7 +69,7 @@ const buildStylesheet = (theme) => {
     return `@layer dynamic-project-environment-theme {
   #dynamic-widget, #dynamic-modal, .dynamic-shadow-dom {
     ${cssAttributes
-        .filter(([, value]) => value !== undefined && value !== '')
+        .filter(([, value]) => isSafeCssValue(value))
         .map(([key, value]) => `${key}: ${value};`)
         .join('\n    ')}
   }

package/src/lib/context/ThemeContext/utils/stylesheetBuilder/stylesheetBuilder.js

@@ -44,6 +44,14 @@ const findOrCreateStyleTag = (nonce) => {
     styleTag.dataset.source = 'dynamic-theme';
     return styleTag;
 };
+// Characters outside this set could break out of a CSS declaration
+// (e.g. `;`, `}`, `\` escapes, comments) when interpolated into the
+// generated theme stylesheet. `/` (modern alpha syntax) and `_`
+// (custom-property names) are safe: comments need `*` which is excluded
+const SAFE_CSS_VALUE_PATTERN = /^[a-zA-Z0-9#(),.%_/\s+-]+$/;
+const isSafeCssValue = (value) => value !== undefined &&
+    value !== '' &&
+    (typeof value === 'number' || SAFE_CSS_VALUE_PATTERN.test(value));
 const buildStylesheet = (theme) => {
     const { customColor, brandStyle } = theme;
     const footerBackgroundColor = brandStyle === 'bold' ? customColor : undefined;
@@ -57,7 +65,7 @@ const buildStylesheet = (theme) => {
     return `@layer dynamic-project-environment-theme {
   #dynamic-widget, #dynamic-modal, .dynamic-shadow-dom {
     ${cssAttributes
-        .filter(([, value]) => value !== undefined && value !== '')
+        .filter(([, value]) => isSafeCssValue(value))
         .map(([key, value]) => `${key}: ${value};`)
         .join('\n    ')}
   }

package/src/lib/utils/hooks/useBusinessAccounts/useBusinessAccounts.cjs

@@ -6,9 +6,9 @@ Object.defineProperty(exports, '__esModule', { value: true });
 var _tslib = require('../../../../../_virtual/_tslib.cjs');
 var React = require('react');
 var waas = require('@dynamic-labs-sdk/client/waas');
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
 var client = require('../../../client/client.cjs');
 require('@dynamic-labs-sdk/client/core');
-require('@dynamic-labs/sdk-api-core');
 require('@dynamic-labs-sdk/client');
 require('../../../config/ApiEndpoint.cjs');
 require('@dynamic-labs/iconic');
@@ -33,6 +33,7 @@ require('../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.cjs');
 require('../../../events/dynamicEvents.cjs');
 var useProjectSettings = require('../../../client/extension/projectSettings/useProjectSettings/useProjectSettings.cjs');
 var useDynamicWaas = require('../useDynamicWaas/useDynamicWaas.cjs');
+var useStepUpAuthentication = require('../useStepUpAuthentication/useStepUpAuthentication.cjs');
 
 const NO_WAAS_CHAIN_ERROR = 'No enabled WaaS chain found for business account operations';
 const NO_CONNECTOR_ERROR = 'WaaS wallet connector not found';
@@ -40,6 +41,7 @@ const useBusinessAccounts = () => {
     const { getWaasWalletConnector } = useDynamicWaas.useDynamicWaas();
     const projectSettings = useProjectSettings.useProjectSettings();
     const dynamicClient = client.useDynamicClient();
+    const { isStepUpRequired, promptStepUpAuth } = useStepUpAuthentication.useStepUpAuthentication();
     const enabledChainNames = React.useMemo(() => {
         var _a, _b;
         return ((_b = (_a = projectSettings === null || projectSettings === void 0 ? void 0 : projectSettings.sdk.embeddedWallets) === null || _a === void 0 ? void 0 : _a.chainConfigurations) !== null && _b !== void 0 ? _b : [])
@@ -64,6 +66,23 @@ const useBusinessAccounts = () => {
         }
         return connector.getWaasWalletClient();
     }), [defaultChainName, getWaasWalletConnector]);
+    // Forces the step-up auth popup for every scope that still lacks a valid
+    // elevated token, so mutating business account calls always carry one.
+    // Returns whether a prompt ran, so connector-based callers can rebuild the
+    // cached iframe client after a session rotation.
+    const ensureStepUpAuth = React.useCallback((scopes) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
+        const requiredScopes = [];
+        for (const scope of scopes) {
+            if (yield isStepUpRequired({ scope })) {
+                requiredScopes.push(scope);
+            }
+        }
+        if (requiredScopes.length === 0) {
+            return false;
+        }
+        yield promptStepUpAuth({ requestedScopes: requiredScopes });
+        return true;
+    }), [isStepUpRequired, promptStepUpAuth]);
     const createBusinessAccount = React.useCallback((...args_1) => _tslib.__awaiter(void 0, [...args_1], void 0, function* (input = {}) {
         const client = yield getBusinessClient();
         return client.businessAccounts.createBusinessAccount({ request: input });
@@ -76,36 +95,59 @@ const useBusinessAccounts = () => {
         const client = yield getBusinessClient();
         return client.businessAccounts.getBusinessAccount({ businessAccountId });
     }), [getBusinessClient]);
-    const addBusinessAccountMember = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
-        const client = yield getBusinessClient();
-        return client.businessAccounts.addMember(input);
-    }), [getBusinessClient]);
+    const addBusinessAccountMember = React.useCallback((_a) => _tslib.__awaiter(void 0, [_a], void 0, function* ({ businessAccountId, userId, identifier, identifierType, role, }) {
+        yield ensureStepUpAuth([sdkApiCore.TokenScope.BusinessAccountmemberadd]);
+        return waas.addBusinessAccountMember({
+            businessAccountId,
+            role,
+            targetIdentity: { identifier, identifierType, userId },
+        }, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
     const addWalletToBusinessAccount = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
-        const client = yield getBusinessClient();
-        return client.businessAccounts.addWalletToBusinessAccount(input);
-    }), [getBusinessClient]);
+        yield ensureStepUpAuth([sdkApiCore.TokenScope.BusinessAccountlinkWallet]);
+        return waas.addWalletToBusinessAccount(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
     // Adds a signer via the SSE reshare ceremony on the wallet's chain connector.
     // Mints the new signer's share set and seeds it to client-keyshare-service.
-    const addBusinessAccountSigner = React.useCallback((_a) => _tslib.__awaiter(void 0, [_a], void 0, function* ({ accountAddress, walletId, chainName, businessAccountId, targetSignerIdentity, signerType, password, targetSignerPassword, }) {
+    const addBusinessAccountSigner = React.useCallback((_b) => _tslib.__awaiter(void 0, [_b], void 0, function* ({ accountAddress, walletId, chainName, businessAccountId, targetSignerIdentity, signerType, password, targetSignerPassword, }) {
         const connector = getWaasWalletConnector(chainName);
         if (!connector) {
             throw new Error(NO_CONNECTOR_ERROR);
         }
+        if (!businessAccountId && !walletId) {
+            throw new Error('addBusinessAccountSigner requires a walletId when no businessAccountId is provided');
+        }
         // No account yet: find-or-create the per-wallet business account first
         // (idempotent — converts the personal wallet, seating its owner as the
         // first signer, or returns the existing one if already linked), then
-        // reshare the new signer into it.
+        // reshare the new signer into it. That path also needs the link_wallet
+        // elevation, so request both scopes in a single step-up prompt.
+        const requiredScopes = businessAccountId
+            ? [sdkApiCore.TokenScope.BusinessAccountsigneradd]
+            : [
+                sdkApiCore.TokenScope.BusinessAccountsigneradd,
+                sdkApiCore.TokenScope.BusinessAccountlinkWallet,
+            ];
+        const prompted = yield ensureStepUpAuth(requiredScopes);
         let resolvedBusinessAccountId = businessAccountId;
         if (!resolvedBusinessAccountId) {
             if (!walletId) {
                 throw new Error('addBusinessAccountSigner requires a walletId when no businessAccountId is provided');
             }
-            const account = yield addWalletToBusinessAccount({ walletId });
+            const account = yield waas.addWalletToBusinessAccount({ walletId }, dynamicClient);
+            if (waas.isBusinessAccountActionRequired(account)) {
+                throw new Error(`addBusinessAccountSigner requires approval: ${account.reason}`);
+            }
             resolvedBusinessAccountId = account.id;
         }
         if (!resolvedBusinessAccountId) {
             throw new Error('addBusinessAccountSigner could not resolve a businessAccountId');
         }
+        // Step-up reauth can rotate the session, so drop the cached iframe
+        // client and let it re-auth with the fresh token before the reshare.
+        if (prompted) {
+            yield connector.getWaasWalletClient(undefined, { forceRebuild: true });
+        }
         return connector.addSignerViaReshare({
             accountAddress,
             businessAccountId: resolvedBusinessAccountId,
@@ -115,8 +157,8 @@ const useBusinessAccounts = () => {
             targetSignerPassword,
             walletId,
         });
-    }), [addWalletToBusinessAccount, getWaasWalletConnector]);
-    const createWalletForBusinessAccount = React.useCallback((_b) => _tslib.__awaiter(void 0, [_b], void 0, function* ({ businessAccountId, chainName, thresholdSignatureScheme, password, }) {
+    }), [dynamicClient, ensureStepUpAuth, getWaasWalletConnector]);
+    const createWalletForBusinessAccount = React.useCallback((_c) => _tslib.__awaiter(void 0, [_c], void 0, function* ({ businessAccountId, chainName, thresholdSignatureScheme, password, }) {
         const chain = chainName !== null && chainName !== void 0 ? chainName : defaultChainName;
         if (!chain) {
             throw new Error(NO_WAAS_CHAIN_ERROR);
@@ -135,13 +177,26 @@ const useBusinessAccounts = () => {
         const client = yield getBusinessClient();
         return client.getWallets();
     }), [getBusinessClient]);
-    const removeBusinessAccountMember = React.useCallback((_c) => _tslib.__awaiter(void 0, [_c], void 0, function* ({ businessAccountId, userId }) {
+    const removeBusinessAccountMember = React.useCallback((_d) => _tslib.__awaiter(void 0, [_d], void 0, function* ({ businessAccountId, userId }) {
+        yield ensureStepUpAuth([sdkApiCore.TokenScope.BusinessAccountmemberremove]);
         return waas.removeBusinessAccountMember({ businessAccountId, userId }, dynamicClient);
-    }), [dynamicClient]);
-    const updateBusinessAccountMemberRole = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () { return waas.updateBusinessAccountMemberRole(input, dynamicClient); }), [dynamicClient]);
-    const transferBusinessAccountOwnership = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () { return waas.transferBusinessAccountOwnership(input, dynamicClient); }), [dynamicClient]);
-    const removeBusinessAccountWallet = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () { return waas.removeBusinessAccountWallet(input, dynamicClient); }), [dynamicClient]);
-    const removeBusinessAccountSigner = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () { return waas.removeBusinessAccountSigner(input, dynamicClient); }), [dynamicClient]);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const updateBusinessAccountMemberRole = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([sdkApiCore.TokenScope.BusinessAccountmemberroleupdate]);
+        return waas.updateBusinessAccountMemberRole(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const transferBusinessAccountOwnership = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([sdkApiCore.TokenScope.BusinessAccounttransferOwnership]);
+        return waas.transferBusinessAccountOwnership(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const removeBusinessAccountWallet = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([sdkApiCore.TokenScope.BusinessAccountwalletremove]);
+        return waas.removeBusinessAccountWallet(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const removeBusinessAccountSigner = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([sdkApiCore.TokenScope.BusinessAccountsignerremove]);
+        return waas.removeBusinessAccountSigner(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
     const updateBusinessAccount = React.useCallback((input) => _tslib.__awaiter(void 0, void 0, void 0, function* () { return waas.updateBusinessAccount(input, dynamicClient); }), [dynamicClient]);
     return {
         addBusinessAccountMember,

package/src/lib/utils/hooks/useBusinessAccounts/useBusinessAccounts.d.ts

@@ -68,11 +68,11 @@ export type AddBusinessAccountSignerInput = {
     targetSignerPassword?: string;
 };
 export declare const useBusinessAccounts: () => {
-    addBusinessAccountMember: (input: AddBusinessAccountMemberInput) => Promise<any>;
+    addBusinessAccountMember: ({ businessAccountId, userId, identifier, identifierType, role, }: AddBusinessAccountMemberInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountActionRequired | import("@dynamic-labs-sdk/client/waas").BusinessAccountMember>;
     addBusinessAccountSigner: ({ accountAddress, walletId, chainName, businessAccountId, targetSignerIdentity, signerType, password, targetSignerPassword, }: AddBusinessAccountSignerInput) => Promise<{
         shareSetId: string;
-    }>;
-    addWalletToBusinessAccount: (input: AddWalletToBusinessAccountInput) => Promise<any>;
+    } | import("@dynamic-labs-wallet/core").BusinessAccountActionRequired>;
+    addWalletToBusinessAccount: (input: AddWalletToBusinessAccountInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountActionRequired | import("@dynamic-labs-sdk/client/waas").BusinessAccountDetail>;
     createBusinessAccount: (input?: CreateBusinessAccountInput) => Promise<any>;
     createWalletForBusinessAccount: ({ businessAccountId, chainName, thresholdSignatureScheme, password, }: CreateWalletForBusinessAccountInput) => Promise<{
         accountAddress: string;
@@ -84,10 +84,10 @@ export declare const useBusinessAccounts: () => {
     getBusinessAccount: (businessAccountId: string) => Promise<any>;
     listBusinessAccounts: (input?: ListBusinessAccountsInput) => Promise<any>;
     listMyWalletAccounts: () => Promise<any>;
-    removeBusinessAccountMember: ({ businessAccountId, userId }: RemoveBusinessAccountMemberInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountMember>;
-    removeBusinessAccountSigner: (input: RemoveBusinessAccountSignerInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountSigner>;
-    removeBusinessAccountWallet: (input: RemoveBusinessAccountWalletInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountDetail>;
-    transferBusinessAccountOwnership: (input: TransferBusinessAccountOwnershipInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountDetail>;
+    removeBusinessAccountMember: ({ businessAccountId, userId }: RemoveBusinessAccountMemberInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountActionRequired | import("@dynamic-labs-sdk/client/waas").BusinessAccountMember>;
+    removeBusinessAccountSigner: (input: RemoveBusinessAccountSignerInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountActionRequired | import("@dynamic-labs-sdk/client/waas").BusinessAccountSigner>;
+    removeBusinessAccountWallet: (input: RemoveBusinessAccountWalletInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountActionRequired | import("@dynamic-labs-sdk/client/waas").BusinessAccountDetail>;
+    transferBusinessAccountOwnership: (input: TransferBusinessAccountOwnershipInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountActionRequired | import("@dynamic-labs-sdk/client/waas").BusinessAccountDetail>;
     updateBusinessAccount: (input: UpdateBusinessAccountInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccount>;
-    updateBusinessAccountMemberRole: (input: UpdateBusinessAccountMemberRoleInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountMember>;
+    updateBusinessAccountMemberRole: (input: UpdateBusinessAccountMemberRoleInput) => Promise<import("@dynamic-labs-sdk/client/waas").BusinessAccountActionRequired | import("@dynamic-labs-sdk/client/waas").BusinessAccountMember>;
 };

package/src/lib/utils/hooks/useBusinessAccounts/useBusinessAccounts.js

@@ -1,10 +1,10 @@
 'use client'
 import { __awaiter } from '../../../../../_virtual/_tslib.js';
 import { useMemo, useCallback } from 'react';
-import { removeBusinessAccountMember, updateBusinessAccountMemberRole, transferBusinessAccountOwnership, removeBusinessAccountWallet, removeBusinessAccountSigner, updateBusinessAccount } from '@dynamic-labs-sdk/client/waas';
+import { addBusinessAccountMember, addWalletToBusinessAccount, isBusinessAccountActionRequired, removeBusinessAccountMember, updateBusinessAccountMemberRole, transferBusinessAccountOwnership, removeBusinessAccountWallet, removeBusinessAccountSigner, updateBusinessAccount } from '@dynamic-labs-sdk/client/waas';
+import { TokenScope } from '@dynamic-labs/sdk-api-core';
 import { useDynamicClient } from '../../../client/client.js';
 import '@dynamic-labs-sdk/client/core';
-import '@dynamic-labs/sdk-api-core';
 import '@dynamic-labs-sdk/client';
 import '../../../config/ApiEndpoint.js';
 import '@dynamic-labs/iconic';
@@ -29,6 +29,7 @@ import '../../functions/getWaasAddressTypeLabel/getWaasAddressTypeLabel.js';
 import '../../../events/dynamicEvents.js';
 import { useProjectSettings } from '../../../client/extension/projectSettings/useProjectSettings/useProjectSettings.js';
 import { useDynamicWaas } from '../useDynamicWaas/useDynamicWaas.js';
+import { useStepUpAuthentication } from '../useStepUpAuthentication/useStepUpAuthentication.js';
 
 const NO_WAAS_CHAIN_ERROR = 'No enabled WaaS chain found for business account operations';
 const NO_CONNECTOR_ERROR = 'WaaS wallet connector not found';
@@ -36,6 +37,7 @@ const useBusinessAccounts = () => {
     const { getWaasWalletConnector } = useDynamicWaas();
     const projectSettings = useProjectSettings();
     const dynamicClient = useDynamicClient();
+    const { isStepUpRequired, promptStepUpAuth } = useStepUpAuthentication();
     const enabledChainNames = useMemo(() => {
         var _a, _b;
         return ((_b = (_a = projectSettings === null || projectSettings === void 0 ? void 0 : projectSettings.sdk.embeddedWallets) === null || _a === void 0 ? void 0 : _a.chainConfigurations) !== null && _b !== void 0 ? _b : [])
@@ -60,6 +62,23 @@ const useBusinessAccounts = () => {
         }
         return connector.getWaasWalletClient();
     }), [defaultChainName, getWaasWalletConnector]);
+    // Forces the step-up auth popup for every scope that still lacks a valid
+    // elevated token, so mutating business account calls always carry one.
+    // Returns whether a prompt ran, so connector-based callers can rebuild the
+    // cached iframe client after a session rotation.
+    const ensureStepUpAuth = useCallback((scopes) => __awaiter(void 0, void 0, void 0, function* () {
+        const requiredScopes = [];
+        for (const scope of scopes) {
+            if (yield isStepUpRequired({ scope })) {
+                requiredScopes.push(scope);
+            }
+        }
+        if (requiredScopes.length === 0) {
+            return false;
+        }
+        yield promptStepUpAuth({ requestedScopes: requiredScopes });
+        return true;
+    }), [isStepUpRequired, promptStepUpAuth]);
     const createBusinessAccount = useCallback((...args_1) => __awaiter(void 0, [...args_1], void 0, function* (input = {}) {
         const client = yield getBusinessClient();
         return client.businessAccounts.createBusinessAccount({ request: input });
@@ -72,36 +91,59 @@ const useBusinessAccounts = () => {
         const client = yield getBusinessClient();
         return client.businessAccounts.getBusinessAccount({ businessAccountId });
     }), [getBusinessClient]);
-    const addBusinessAccountMember = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () {
-        const client = yield getBusinessClient();
-        return client.businessAccounts.addMember(input);
-    }), [getBusinessClient]);
-    const addWalletToBusinessAccount = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () {
-        const client = yield getBusinessClient();
-        return client.businessAccounts.addWalletToBusinessAccount(input);
-    }), [getBusinessClient]);
+    const addBusinessAccountMember$1 = useCallback((_a) => __awaiter(void 0, [_a], void 0, function* ({ businessAccountId, userId, identifier, identifierType, role, }) {
+        yield ensureStepUpAuth([TokenScope.BusinessAccountmemberadd]);
+        return addBusinessAccountMember({
+            businessAccountId,
+            role,
+            targetIdentity: { identifier, identifierType, userId },
+        }, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const addWalletToBusinessAccount$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([TokenScope.BusinessAccountlinkWallet]);
+        return addWalletToBusinessAccount(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
     // Adds a signer via the SSE reshare ceremony on the wallet's chain connector.
     // Mints the new signer's share set and seeds it to client-keyshare-service.
-    const addBusinessAccountSigner = useCallback((_a) => __awaiter(void 0, [_a], void 0, function* ({ accountAddress, walletId, chainName, businessAccountId, targetSignerIdentity, signerType, password, targetSignerPassword, }) {
+    const addBusinessAccountSigner = useCallback((_b) => __awaiter(void 0, [_b], void 0, function* ({ accountAddress, walletId, chainName, businessAccountId, targetSignerIdentity, signerType, password, targetSignerPassword, }) {
         const connector = getWaasWalletConnector(chainName);
         if (!connector) {
             throw new Error(NO_CONNECTOR_ERROR);
         }
+        if (!businessAccountId && !walletId) {
+            throw new Error('addBusinessAccountSigner requires a walletId when no businessAccountId is provided');
+        }
         // No account yet: find-or-create the per-wallet business account first
         // (idempotent — converts the personal wallet, seating its owner as the
         // first signer, or returns the existing one if already linked), then
-        // reshare the new signer into it.
+        // reshare the new signer into it. That path also needs the link_wallet
+        // elevation, so request both scopes in a single step-up prompt.
+        const requiredScopes = businessAccountId
+            ? [TokenScope.BusinessAccountsigneradd]
+            : [
+                TokenScope.BusinessAccountsigneradd,
+                TokenScope.BusinessAccountlinkWallet,
+            ];
+        const prompted = yield ensureStepUpAuth(requiredScopes);
         let resolvedBusinessAccountId = businessAccountId;
         if (!resolvedBusinessAccountId) {
             if (!walletId) {
                 throw new Error('addBusinessAccountSigner requires a walletId when no businessAccountId is provided');
             }
-            const account = yield addWalletToBusinessAccount({ walletId });
+            const account = yield addWalletToBusinessAccount({ walletId }, dynamicClient);
+            if (isBusinessAccountActionRequired(account)) {
+                throw new Error(`addBusinessAccountSigner requires approval: ${account.reason}`);
+            }
             resolvedBusinessAccountId = account.id;
         }
         if (!resolvedBusinessAccountId) {
             throw new Error('addBusinessAccountSigner could not resolve a businessAccountId');
         }
+        // Step-up reauth can rotate the session, so drop the cached iframe
+        // client and let it re-auth with the fresh token before the reshare.
+        if (prompted) {
+            yield connector.getWaasWalletClient(undefined, { forceRebuild: true });
+        }
         return connector.addSignerViaReshare({
             accountAddress,
             businessAccountId: resolvedBusinessAccountId,
@@ -111,8 +153,8 @@ const useBusinessAccounts = () => {
             targetSignerPassword,
             walletId,
         });
-    }), [addWalletToBusinessAccount, getWaasWalletConnector]);
-    const createWalletForBusinessAccount = useCallback((_b) => __awaiter(void 0, [_b], void 0, function* ({ businessAccountId, chainName, thresholdSignatureScheme, password, }) {
+    }), [dynamicClient, ensureStepUpAuth, getWaasWalletConnector]);
+    const createWalletForBusinessAccount = useCallback((_c) => __awaiter(void 0, [_c], void 0, function* ({ businessAccountId, chainName, thresholdSignatureScheme, password, }) {
         const chain = chainName !== null && chainName !== void 0 ? chainName : defaultChainName;
         if (!chain) {
             throw new Error(NO_WAAS_CHAIN_ERROR);
@@ -131,18 +173,31 @@ const useBusinessAccounts = () => {
         const client = yield getBusinessClient();
         return client.getWallets();
     }), [getBusinessClient]);
-    const removeBusinessAccountMember$1 = useCallback((_c) => __awaiter(void 0, [_c], void 0, function* ({ businessAccountId, userId }) {
+    const removeBusinessAccountMember$1 = useCallback((_d) => __awaiter(void 0, [_d], void 0, function* ({ businessAccountId, userId }) {
+        yield ensureStepUpAuth([TokenScope.BusinessAccountmemberremove]);
         return removeBusinessAccountMember({ businessAccountId, userId }, dynamicClient);
-    }), [dynamicClient]);
-    const updateBusinessAccountMemberRole$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () { return updateBusinessAccountMemberRole(input, dynamicClient); }), [dynamicClient]);
-    const transferBusinessAccountOwnership$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () { return transferBusinessAccountOwnership(input, dynamicClient); }), [dynamicClient]);
-    const removeBusinessAccountWallet$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () { return removeBusinessAccountWallet(input, dynamicClient); }), [dynamicClient]);
-    const removeBusinessAccountSigner$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () { return removeBusinessAccountSigner(input, dynamicClient); }), [dynamicClient]);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const updateBusinessAccountMemberRole$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([TokenScope.BusinessAccountmemberroleupdate]);
+        return updateBusinessAccountMemberRole(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const transferBusinessAccountOwnership$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([TokenScope.BusinessAccounttransferOwnership]);
+        return transferBusinessAccountOwnership(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const removeBusinessAccountWallet$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([TokenScope.BusinessAccountwalletremove]);
+        return removeBusinessAccountWallet(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
+    const removeBusinessAccountSigner$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () {
+        yield ensureStepUpAuth([TokenScope.BusinessAccountsignerremove]);
+        return removeBusinessAccountSigner(input, dynamicClient);
+    }), [dynamicClient, ensureStepUpAuth]);
     const updateBusinessAccount$1 = useCallback((input) => __awaiter(void 0, void 0, void 0, function* () { return updateBusinessAccount(input, dynamicClient); }), [dynamicClient]);
     return {
-        addBusinessAccountMember,
+        addBusinessAccountMember: addBusinessAccountMember$1,
         addBusinessAccountSigner,
-        addWalletToBusinessAccount,
+        addWalletToBusinessAccount: addWalletToBusinessAccount$1,
         createBusinessAccount,
         createWalletForBusinessAccount,
         defaultChainName,