@settlemint/dalp-cli 3.1.26-main.37150284587 → 3.1.26-main.37161096109

package/dist/dalp.js

@@ -41190,6 +41190,21 @@ function detectDalpRuntime() {
 function runtimeCredentials(runtime) {
   return runtime === "browser" ? "include" : "omit";
 }
+function refuseCrossOriginBrowserSession(runtime, baseUrl, usesApiKey) {
+  if (runtime !== "browser" || usesApiKey) {
+    return;
+  }
+  const browserOrigin = globalThis.window?.location?.origin;
+  const targetOrigin = new URL(baseUrl).origin;
+  if (browserOrigin === undefined || browserOrigin === targetOrigin) {
+    return;
+  }
+  throw createDalpSdkConfigurationError({
+    message: "DALP SDK: browser cookie sessions must use the application origin; mount createDalpProxy at /api.",
+    why: `The browser page is ${browserOrigin}, but the client targets ${targetOrigin}; host-only session cookies do not cross origins.`,
+    fix: "Set the browser client baseUrl to window.location.origin and mount createDalpProxy at /api on that origin."
+  });
+}
 var WHATWG_FETCH_POLYFILL_FLAG = "polyfill";
 function isBufferingFetch(fetchImpl) {
   return typeof fetchImpl === "function" && Reflect.get(fetchImpl, WHATWG_FETCH_POLYFILL_FLAG) === true;
@@ -41729,6 +41744,7 @@ function createTransport(options) {
   } else {
     apiKey = secret(apiKeyOption.trim());
   }
+  refuseCrossOriginBrowserSession(runtime, baseUrl, apiKey !== undefined);
   if (apiKey !== undefined) {
     refuseBundledApiKey(runtime);
   }
@@ -43401,7 +43417,7 @@ var data5 = JSON.parse('{"version":1,"entries":{"BAD_REQUEST":{"id":"DALP-0001",
 // ../sdk/package.json
 var package_default = {
   name: "@settlemint/dalp-sdk",
-  version: "3.1.26-main.37150284587",
+  version: "3.1.26-main.37161096109",
   private: false,
   description: "Fully typed SDK for the DALP tokenization platform API",
   homepage: "https://settlemint.com",
@@ -43425,6 +43441,11 @@ var package_default = {
   ],
   exports: {
     "./package.json": "./package.json",
+    "./server-proxy": {
+      types: "./dist/server-proxy.d.ts",
+      import: "./dist/server-proxy.js",
+      default: "./dist/server-proxy.js"
+    },
     "./runtime-exports": {
       types: "./dist/runtime-exports.d.ts",
       import: "./dist/runtime-exports.js",
@@ -43514,7 +43535,7 @@ var package_default = {
     "@better-auth/passkey": "1.7.7",
     "@domains/webhooks-contract": "workspace:*",
     "better-auth": "1.7.7",
-    "better-call": "1.4.0",
+    "better-call": "1.4.1",
     dnum: "2.17.0",
     standardwebhooks: "1.1.1",
     viem: "2.57.2"
@@ -100937,7 +100958,7 @@ async function runCommand(context, operation, errorContext = UNKNOWN_COMMAND_ERR
 // package.json
 var package_default2 = {
   name: "@settlemint/dalp-cli",
-  version: "3.1.26-main.37150284587",
+  version: "3.1.26-main.37161096109",
   private: false,
   description: "CLI for the Digital Asset Lifecycle Platform \u2014 manage tokens, identities, compliance, and more from the command line.",
   homepage: "https://settlemint.com",
@@ -102300,4 +102321,4 @@ if (false) {}
 // src/bin.ts
 await cli.serve();
 
-//# debugId=49632CB56F4E2C2F64756E2164756E21
+//# debugId=A9382F22C171974164756E2164756E21