@settlemint/dalp-sdk 3.1.19-main.36458349696 → 3.1.19-main.36472209091

package/README.md

@@ -35,10 +35,13 @@ mechanism, the acting-context headers (`organizationId`, `participant`,
 `If-None-Match` reuse, custom fetch injection, the settlement bound, and abort
 propagation.
 
-**An API key cannot reach a browser.** `createDalpClient` throws at
-construction when a key is passed with `runtime: "browser"`, rather than at the
-first request. A key carries the full authority of the identity it belongs to.
-In a browser the client authenticates with the session cookie instead.
+**An API key cannot reach a browser or an app.** `createDalpClient` and
+`createDalpAuthClient` throw at construction when a key is passed with
+`runtime: "browser"` or `runtime: "react-native"`, rather than at the first
+request. A key carries the
+full authority of the identity it belongs to, and anything bundled into a web
+page or an app ships to every user. There the client authenticates with the
+session cookie instead.
 
 ### Dispatch by route id
 
@@ -151,8 +154,9 @@ import { createDalpAuthClient } from "@settlemint/dalp-sdk/auth";
 
 The route surface already carries every auth REST route. `./auth` covers what a
 REST call cannot express: the session and cookie state machine, plugin actions
-that must run in the browser (`passkeyClient` drives the WebAuthn ceremony
-through `navigator.credentials`), and the access-control model that evaluates a
+that must run on the device (`passkeyClient` drives the WebAuthn ceremony
+through `navigator.credentials`, or through the `passkey` ceremony a React
+Native app passes), and the access-control model that evaluates a
 permission locally instead of round-tripping. It sits off the package root
 because it costs roughly 70 KiB of Better Auth that a consumer who only calls
 routes should not pay.
@@ -176,6 +180,37 @@ Every other auth route answers a request that carries a key with HTTP 403 and
 the code `API_KEY_NOT_SUPPORTED_ON_ROUTE`. Use a session cookie for those
 routes. The API key guide in the DALP API reference has the details.
 
+## React Native
+
+Supported: Expo SDK 57 (React Native 0.86, React 19.2), with `fetch` from
+`expo/fetch` passed to both clients. The SDK detects React Native from
+`navigator.product` and then keeps the session in its own cookie store, sends
+`credentials: "omit"`, refuses an API key, and sends the platform's origin as
+`Origin` on every call.
+
+```ts
+import { createCookieStoreFetch, createDalpClient, makeCookieStore } from "@settlemint/dalp-sdk";
+import { createDalpAuthClient } from "@settlemint/dalp-sdk/auth";
+import { fetch } from "expo/fetch";
+
+const cookieStore = makeCookieStore((await SecureStore.getItemAsync("dalp.session")) ?? "");
+const auth = await createDalpAuthClient({ url, cookieStore, fetch, passkey: ceremony });
+const dalp = createDalpClient({ baseUrl: url, fetch: createCookieStoreFetch(cookieStore, fetch) });
+```
+
+- React Native's built-in `fetch` works for calls but cannot read a stream; a
+  stream on it fails with `sdk.stream.UNREADABLE_BODY` before the request is
+  sent. Use `expo/fetch`.
+- React Native has no WebAuthn. Pass a `passkey` ceremony (`DalpPasskeyCeremony`:
+  `authenticate` and `register`, each taking the platform's options JSON and
+  returning the credential JSON) backed by a native passkey module.
+- Persist `cookieStore.header()` in secure storage yourself; the SDK holds it in
+  memory only.
+
+The SDK's tests run this wiring headless on the fetch and abort polyfills React
+Native ships and a model of `expo/fetch`. They do not run on Hermes, a
+simulator, or a device.
+
 ## Bundler and paymaster
 
 Use JSON-RPC 2.0 over `POST https://dalp.example.com/bundler/{chainId}` for
@@ -233,5 +268,5 @@ calls routes never pays for auth, TanStack Query, or webhook code.
 
 The integrator guide lives under Developer reference in the platform docs:
 install and credentials, calling routes, mutations and settlement, streaming,
-TanStack Query, server rendering in TanStack Start and Next.js, and the Effect
-surface.
+TanStack Query, server rendering in TanStack Start and Next.js, React Native,
+and the Effect surface.

package/dist/auth/client.d.ts

@@ -3,6 +3,8 @@ import type { DalpAuthSurface } from "../auth-surface.ts";
 import type { AuthGetApiKeyListResponse, AuthGetOrganizationListResponse, AuthPostApiKeyCreateData, AuthPostApiKeyCreateResponse, AuthPostApiKeyDeleteData, AuthPostApiKeyDeleteResponse, AuthPostOrganizationCreateData, AuthPostOrganizationCreateResponse, AuthPostOrganizationRemoveMemberData, AuthPostOrganizationRemoveMemberResponse, AuthPostRevokeOtherSessionsResponse, AuthPostRevokeSessionData, AuthPostRevokeSessionResponse, AuthPostTwoFactorDisableData, AuthPostTwoFactorDisableResponse, AuthPostTwoFactorEnableData, AuthPostTwoFactorEnableResponse, AuthPostTwoFactorVerifyBackupCodeData, AuthPostTwoFactorVerifyBackupCodeResponse, AuthPostTwoFactorVerifyTotpData, AuthPostTwoFactorVerifyTotpResponse, CreateOrganizationInvitationData, CreateOrganizationInvitationResponse, GetSessionResponse, ListUserSessionsResponse, Member, SetActiveOrganizationData, SetActiveOrganizationResponse } from "../generated/api-types.d.ts";
 import { Secret } from "../secret.ts";
 import type { CookieStoreShape } from "../transport/cookie-store.ts";
+import type { DalpRuntime } from "../runtime.ts";
+import type { DalpPasskeyCeremony } from "./native-passkey.ts";
 export interface DalpAuthClientConfig {
     readonly url: string;
     readonly apiKey?: string;
@@ -12,6 +14,8 @@ export interface DalpAuthClientConfig {
     readonly authSurface?: DalpAuthSurface;
     readonly headers?: Record<string, string>;
     readonly fetch?: DalpFetch;
+    readonly runtime?: DalpRuntime;
+    readonly passkey?: DalpPasskeyCeremony;
 }
 export interface DecodedDalpAuthClientConfig extends Omit<DalpAuthClientConfig, "apiKey" | "cookie"> {
     readonly apiKey?: Secret;

package/dist/auth/native-passkey.d.ts

@@ -0,0 +1,9 @@
+import { passkeyClient, type AuthenticationResponseJSON, type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialRequestOptionsJSON, type RegistrationResponseJSON } from "@better-auth/passkey/client";
+export interface DalpPasskeyCeremony {
+    readonly authenticate: (options: PublicKeyCredentialRequestOptionsJSON) => Promise<AuthenticationResponseJSON>;
+    readonly register: (options: PublicKeyCredentialCreationOptionsJSON) => Promise<RegistrationResponseJSON>;
+}
+type PasskeyClientPlugin = ReturnType<typeof passkeyClient>;
+/** @internal */
+export declare function ceremonyPasskeyClient(ceremony: DalpPasskeyCeremony): PasskeyClientPlugin;
+export {};

package/dist/auth.d.ts

@@ -3,4 +3,6 @@ export type { DalpAuthClient } from "./auth/live.ts";
 export { decodeDalpAuthClientConfig } from "./auth/client.ts";
 export type { DalpAuthSurface } from "./auth-surface.ts";
 export type { DalpAuthClientConfig, DalpCliAuthClient, DalpAuthError, DalpAuthOperation, DalpAuthResult, DalpOrganizationInvitation, DalpOrganizationInvitationsQuery, DalpOrganizationMember, DalpOrganizationMembersQuery, DecodedDalpAuthClientConfig, } from "./auth/client.ts";
+export type { DalpPasskeyCeremony } from "./auth/native-passkey.ts";
+export type { DalpRuntime } from "./runtime.ts";
 export type { WalletAuthEndpointPath } from "./auth/wallet-plugins.ts";

package/dist/auth.js

@@ -6,20 +6,22 @@ import {
   secret2,
   unwrapSecret,
   normalizeDalpBaseUrl,
+  detectDalpRuntime,
+  refuseBundledApiKey,
   STEP_UP_CHALLENGE_HEADER,
   STEP_UP_CHALLENGE_PATH,
   carriesWalletProof,
   stepUpChallengeRequest
-} from "./chunk-wp4269cm.js";
+} from "./chunk-4f4kjtt0.js";
 import {
   makeCookieStore2,
   createCookieStoreFetch2,
   SDK_USER_AGENT2
-} from "./chunk-3mxexapc.js";
+} from "./chunk-fwypx1xe.js";
 
 // src/auth/live.ts
 import { apiKeyClient } from "@better-auth/api-key/client";
-import { passkeyClient } from "@better-auth/passkey/client";
+import { passkeyClient as passkeyClient2 } from "@better-auth/passkey/client";
 import {
   createAuthClient as createBetterAuthClient
 } from "better-auth/client";
@@ -101,6 +103,21 @@ function optionalFetch(value) {
   }
   return value;
 }
+function optionalRuntime(value) {
+  if (value === undefined || value === "browser" || value === "server" || value === "react-native") {
+    return value;
+  }
+  throw new AuthConfigError("runtime", 'must be "browser", "server", or "react-native"');
+}
+function optionalPasskeyCeremony(value) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "object" || value === null || typeof Reflect.get(value, "authenticate") !== "function" || typeof Reflect.get(value, "register") !== "function") {
+    throw new AuthConfigError("passkey", "must expose authenticate and register");
+  }
+  return value;
+}
 function optionalCookieStore(value) {
   if (value === undefined) {
     return;
@@ -124,6 +141,8 @@ function decodeAuthConfig(input) {
   const authSurface = optionalAuthSurface(raw.authSurface);
   const headers = optionalHeaders(raw.headers);
   const configuredFetch = optionalFetch(raw.fetch);
+  const runtime = optionalRuntime(raw.runtime);
+  const passkey = optionalPasskeyCeremony(raw.passkey);
   return {
     url,
     ...apiKey === undefined ? {} : { apiKey: secret2(apiKey) },
@@ -132,7 +151,9 @@ function decodeAuthConfig(input) {
     ...organizationId === undefined ? {} : { organizationId },
     ...authSurface === undefined ? {} : { authSurface },
     ...headers === undefined ? {} : { headers },
-    ...configuredFetch === undefined ? {} : { fetch: configuredFetch }
+    ...configuredFetch === undefined ? {} : { fetch: configuredFetch },
+    ...runtime === undefined ? {} : { runtime },
+    ...passkey === undefined ? {} : { passkey }
   };
 }
 async function decodeDalpAuthClientConfig(input) {
@@ -141,8 +162,8 @@ async function decodeDalpAuthClientConfig(input) {
   } catch (error) {
     throw createDalpSdkConfigurationError2({
       message: "DALP SDK: auth client configuration is invalid.",
-      why: "The auth client received a malformed URL, credential, header map, fetch seam, or cookie store.",
-      fix: "Pass one credential source, an HTTP(S) URL, and valid fetch and cookie-store seams.",
+      why: "The auth client received a malformed URL, credential, header map, runtime, fetch seam, cookie store, or passkey ceremony.",
+      fix: "Pass one credential source, an HTTP(S) URL, a known runtime, and valid fetch, cookie-store, and passkey seams.",
       cause: error
     });
   }
@@ -191,6 +212,106 @@ function withInviteStepUp(fetchImpl, baseUrl) {
   };
 }
 
+// src/auth/native-passkey.ts
+import {
+  passkeyClient
+} from "@better-auth/passkey/client";
+var ceremonyFailed = (code, error) => ({
+  data: null,
+  error: {
+    code,
+    message: error instanceof Error ? error.message : "The passkey ceremony did not complete.",
+    status: 400,
+    statusText: "BAD_REQUEST"
+  }
+});
+function withExtensions(options, extensions) {
+  return options.extensions === undefined && extensions === undefined ? options : { ...options, extensions: { ...options.extensions, ...extensions } };
+}
+function ceremonyPasskeyClient(ceremony) {
+  const plugin = passkeyClient();
+  return {
+    ...plugin,
+    getActions: ($fetch, $store) => {
+      const signIn = async (opts, options) => {
+        const generated = await $fetch("/passkey/generate-authenticate-options", {
+          method: "GET",
+          throw: false
+        });
+        if (generated.data === null) {
+          return generated;
+        }
+        let response;
+        try {
+          response = await ceremony.authenticate(withExtensions(generated.data, opts?.extensions));
+        } catch (error) {
+          return ceremonyFailed("AUTH_CANCELLED", error);
+        }
+        const { clientExtensionResults, ...responseBody } = response;
+        try {
+          const verified = await $fetch("/passkey/verify-authentication", {
+            body: { response: responseBody },
+            ...opts?.fetchOptions,
+            ...options,
+            method: "POST",
+            throw: false
+          });
+          $store.notify("$listPasskeys");
+          $store.notify("$sessionSignal");
+          return opts?.returnWebAuthnResponse === true ? { ...verified, webauthn: { response, clientExtensionResults } } : verified;
+        } catch (error) {
+          return ceremonyFailed("AUTH_CANCELLED", error);
+        }
+      };
+      const addPasskey = async (opts, fetchOpts) => {
+        const generated = await $fetch("/passkey/generate-register-options", {
+          method: "GET",
+          query: {
+            ...opts?.authenticatorAttachment === undefined ? {} : { authenticatorAttachment: opts.authenticatorAttachment },
+            ...opts?.name === undefined || opts.name === "" ? {} : { name: opts.name },
+            ...opts?.context === undefined || opts.context === null ? {} : { context: opts.context }
+          },
+          throw: false
+        });
+        if (generated.data === null) {
+          return generated;
+        }
+        let response;
+        try {
+          response = await ceremony.register(withExtensions(generated.data, opts?.extensions));
+        } catch (error) {
+          return ceremonyFailed("REGISTRATION_CANCELLED", error);
+        }
+        const { clientExtensionResults, ...responseBody } = response;
+        try {
+          const verified = await $fetch("/passkey/verify-registration", {
+            ...opts?.fetchOptions,
+            ...fetchOpts,
+            body: {
+              response: responseBody,
+              name: opts?.name,
+              ...opts?.createSession === true ? { createSession: true } : {}
+            },
+            method: "POST",
+            throw: false
+          });
+          if (verified.data === null) {
+            return verified;
+          }
+          $store.notify("$listPasskeys");
+          if (verified.data.session !== undefined) {
+            $store.notify("$sessionSignal");
+          }
+          return opts?.returnWebAuthnResponse === true ? { ...verified, webauthn: { response, clientExtensionResults } } : verified;
+        } catch (error) {
+          return ceremonyFailed("UNKNOWN_ERROR", error);
+        }
+      };
+      return { signIn: { passkey: signIn }, passkey: { addPasskey }, $Infer: {} };
+    }
+  };
+}
+
 // src/auth/permissions.ts
 import { createAccessControl } from "better-auth/plugins/access";
 import { adminAc, defaultStatements as adminDefaultStatements } from "better-auth/plugins/admin/access";
@@ -330,11 +451,14 @@ var organizationPluginOptions = {
   roles: { owner: ownerRole, member: memberRole }
 };
 var reservedHeaders = new Set(["x-api-key", "authorization", "cookie"]);
-function authHeaders(config) {
+function authHeaders(config, runtime, baseUrl) {
   const headers = { "User-Agent": SDK_USER_AGENT2 };
+  if (runtime === "react-native") {
+    headers.origin = new URL(baseUrl).origin;
+  }
   for (const [name, value] of Object.entries(config.headers ?? {})) {
     if (!reservedHeaders.has(name.toLowerCase())) {
-      headers[name] = value;
+      headers[name.toLowerCase() === "origin" ? "origin" : name] = value;
     }
   }
   if (config.apiKey !== undefined) {
@@ -354,7 +478,7 @@ function createConfiguredBetterAuthClient(config, cookieStore) {
     inferAdditionalFields(),
     adminClient(adminPluginOptions),
     apiKeyClient(),
-    passkeyClient(),
+    config.passkey === undefined ? passkeyClient2() : ceremonyPasskeyClient(config.passkey),
     walletPincodeClient(),
     walletTwoFactorClient(),
     walletSecretCodesClient(),
@@ -363,12 +487,16 @@ function createConfiguredBetterAuthClient(config, cookieStore) {
     organizationClient(organizationPluginOptions)
   ];
   const baseUrl = normalizeDalpBaseUrl(config.url);
+  const runtime = config.runtime ?? detectDalpRuntime();
+  if (config.apiKey !== undefined) {
+    refuseBundledApiKey(runtime);
+  }
   return createBetterAuthClient({
     baseURL: `${baseUrl}/api/auth`,
     fetchOptions: {
-      headers: authHeaders(config),
+      headers: authHeaders(config, runtime, baseUrl),
       customFetchImpl: withInviteStepUp(createCookieStoreFetch2(cookieStore, config.fetch), baseUrl),
-      credentials: "include"
+      credentials: runtime === "react-native" ? "omit" : "include"
     },
     plugins
   });

package/dist/{chunk-wp4269cm.js → chunk-4f4kjtt0.js}

@@ -63,6 +63,35 @@ function normalizeDalpBaseUrl(url) {
   return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
 }
 
+// src/runtime.ts
+var REACT_NATIVE_NAVIGATOR_PRODUCT = "ReactNative";
+function detectDalpRuntime() {
+  if (Reflect.get(globalThis, "navigator") !== undefined && Reflect.get(navigator, "product") === REACT_NATIVE_NAVIGATOR_PRODUCT) {
+    return "react-native";
+  }
+  return globalThis.window === undefined ? "server" : "browser";
+}
+function runtimeCredentials(runtime) {
+  return runtime === "browser" ? "include" : "omit";
+}
+var WHATWG_FETCH_POLYFILL_FLAG = "polyfill";
+function isBufferingFetch(fetchImpl) {
+  return typeof fetchImpl === "function" && Reflect.get(fetchImpl, WHATWG_FETCH_POLYFILL_FLAG) === true;
+}
+function keepBufferingMarker(wrapped, wrapper) {
+  return isBufferingFetch(wrapped) ? Object.assign(wrapper, { [WHATWG_FETCH_POLYFILL_FLAG]: true }) : wrapper;
+}
+function refuseBundledApiKey(runtime) {
+  if (runtime === "server") {
+    return;
+  }
+  throw createDalpSdkConfigurationError2({
+    message: `DALP SDK: API keys are server/CLI-only credentials and cannot configure a ${runtime} client.`,
+    why: "An API key placed in a browser or app bundle ships the credential to every visitor or device.",
+    fix: "Keep the API key on the server or CLI process; browser and app clients authenticate with the session cookie."
+  });
+}
+
 // ../kernel/json/src/step-up-payload-text.ts
 var PROOF_FIELD = "walletVerification";
 var isAbsent = (value) => value === undefined || typeof value === "function" || typeof value === "symbol";
@@ -99,12 +128,12 @@ var canonicalText = (value, omitted = null) => {
 var stepUpPayloadText = (body) => canonicalText(body, PROOF_FIELD);
 
 // src/client/step-up-challenge.ts
+import { sha256, stringToBytes } from "viem/utils";
 var STEP_UP_CHALLENGE_HEADER = "X-Step-Up-Challenge";
 var WALLET_VERIFICATION_HEADER = "X-Wallet-Verification";
 var STEP_UP_CHALLENGE_PATH = "/api/v2/step-up-challenges";
 var PROOF_FIELD2 = "walletVerification";
-var HEX_RADIX = 16;
-var HEX_BYTE_WIDTH = 2;
+var HEX_PREFIX = "0x";
 function carriesWalletProof(body) {
   if (body === null || typeof body !== "object" || Array.isArray(body)) {
     return false;
@@ -113,9 +142,8 @@ function carriesWalletProof(body) {
   return proof !== null && proof !== undefined;
 }
 async function stepUpChallengeRequest(operation, target, body) {
-  const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(stepUpPayloadText(body)));
-  const payloadDigest = Array.from(new Uint8Array(digest), (byte) => byte.toString(HEX_RADIX).padStart(HEX_BYTE_WIDTH, "0")).join("");
+  const payloadDigest = sha256(stringToBytes(stepUpPayloadText(body))).slice(HEX_PREFIX.length);
   return { operation, target, payloadDigest };
 }
 
-export { DALP_AUTH_SURFACE_HEADER2, SECRET_REDACTION_MARKER2, Secret2, secret2, unwrapSecret, normalizeDalpBaseUrl, STEP_UP_CHALLENGE_HEADER, WALLET_VERIFICATION_HEADER, STEP_UP_CHALLENGE_PATH, carriesWalletProof, stepUpChallengeRequest };
+export { DALP_AUTH_SURFACE_HEADER2, SECRET_REDACTION_MARKER2, Secret2, secret2, unwrapSecret, normalizeDalpBaseUrl, detectDalpRuntime, runtimeCredentials, isBufferingFetch, keepBufferingMarker, refuseBundledApiKey, STEP_UP_CHALLENGE_HEADER, WALLET_VERIFICATION_HEADER, STEP_UP_CHALLENGE_PATH, carriesWalletProof, stepUpChallengeRequest };

package/dist/{chunk-3mxexapc.js → chunk-fwypx1xe.js}

@@ -1,3 +1,7 @@
+import {
+  keepBufferingMarker
+} from "./chunk-4f4kjtt0.js";
+
 // src/transport/cookie-store.ts
 var parseCookieHeader = (header) => {
   const cookies = new Map;
@@ -87,7 +91,7 @@ var splitCombinedSetCookie = (value) => {
   return cookies;
 };
 function createCookieStoreFetch2(cookieStore, fetchImpl = globalThis.fetch) {
-  return async (input, init) => {
+  const cookieStoreFetch = async (input, init) => {
     const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
     if (!cookieStore.isEmpty() && !headers.has("cookie")) {
       headers.set("cookie", cookieStore.header());
@@ -98,11 +102,12 @@ function createCookieStoreFetch2(cookieStore, fetchImpl = globalThis.fetch) {
     }
     return response;
   };
+  return keepBufferingMarker(fetchImpl, cookieStoreFetch);
 }
 // package.json
 var package_default = {
   name: "@settlemint/dalp-sdk",
-  version: "3.1.19-main.36458349696",
+  version: "3.1.19-main.36472209091",
   private: false,
   description: "Fully typed SDK for the DALP tokenization platform API",
   homepage: "https://settlemint.com",
@@ -229,10 +234,12 @@ var package_default = {
     "@tools/typescript-config": "workspace:*",
     "@tools/vitest-config": "workspace:*",
     "@types/bun": "1.4.2",
+    "abort-controller": "3.0.0",
     effect: "4.0.0-rc.117",
     publint: "0.3.24",
     typescript: "7.0.2",
     vitest: "5.0.1",
+    "whatwg-fetch": "3.6.20",
     zod: "4.6.5"
   },
   peerDependencies: {

package/dist/{chunk-te5m0f24.js → chunk-hgz10qvm.js}

@@ -4,7 +4,7 @@ import {
   sendRequest,
   createFetchExecutor,
   createTanstackFactories
-} from "./chunk-yr7kp37j.js";
+} from "./chunk-szp73yj8.js";
 import {
   buildProxy,
   findRoute

package/dist/{chunk-yr7kp37j.js → chunk-szp73yj8.js}

@@ -1,6 +1,5 @@
 import {
-  DalpSdkError2,
-  createDalpSdkConfigurationError2
+  DalpSdkError2
 } from "./chunk-k3ntysxx.js";
 import {
   DALP_AUTH_SURFACE_HEADER2,
@@ -8,12 +7,16 @@ import {
   secret2,
   unwrapSecret,
   normalizeDalpBaseUrl,
+  detectDalpRuntime,
+  runtimeCredentials,
+  isBufferingFetch,
+  refuseBundledApiKey,
   STEP_UP_CHALLENGE_HEADER,
   WALLET_VERIFICATION_HEADER,
   STEP_UP_CHALLENGE_PATH,
   carriesWalletProof,
   stepUpChallengeRequest
-} from "./chunk-wp4269cm.js";
+} from "./chunk-4f4kjtt0.js";
 
 // src/errors/find-current-error.ts
 var readProperty = (target, key) => Reflect.get(target, key);
@@ -142,6 +145,7 @@ var SDK_LOCAL_ERROR_CODES = new Set([
   "sdk.transport.UNVERIFIED_ERROR_CODE",
   "sdk.response.MALFORMED_SUCCESS",
   "sdk.stream.FAILED",
+  "sdk.stream.UNREADABLE_BODY",
   "sdk.scalar.BIG_DECIMAL_INVALID",
   "sdk.scalar.EVM_ADDRESS_INVALID",
   "sdk.scalar.ORGANIZATION_ID_INVALID",
@@ -519,10 +523,10 @@ async function captureSuccessfulGet(store, key, response) {
     store.delete(key);
     return response;
   }
-  const body = new Uint8Array(await response.arrayBuffer());
+  const body = await response.blob();
   const headers = new Headers(response.headers);
   headers.set("etag", etag);
-  if (body.byteLength <= CONDITIONAL_RESPONSE_MAX_BODY_BYTES) {
+  if (body.size <= CONDITIONAL_RESPONSE_MAX_BODY_BYTES) {
     remember(store, key, { body, etag, headers });
   }
   return new Response(body, {
@@ -570,7 +574,7 @@ function withConditionalRequests(base) {
       const retried = await base(requestWithoutIfNoneMatch(sent));
       return retried.status === 304 ? retried : captureSuccessfulGet(state.store, key, retried);
     }
-    return new Response(new Uint8Array(entry.body), { status: 200, statusText: "OK", headers: entry.headers });
+    return new Response(entry.body, { status: 200, statusText: "OK", headers: entry.headers });
   };
   return {
     fetch: decorated,
@@ -696,9 +700,9 @@ function preferDirective(timeoutMs) {
 }
 function createTransport(options) {
   const baseUrl = normalizeDalpBaseUrl(String(options.baseUrl));
-  const runtime = options.runtime ?? (globalThis.window === undefined ? "server" : "browser");
+  const runtime = options.runtime ?? detectDalpRuntime();
   const baseFetch = options.fetch ?? globalThis.fetch;
-  const transportFetch = runtime === "browser" ? baseFetch : withRequestBodyCompression(baseFetch);
+  const transportFetch = runtime === "server" ? withRequestBodyCompression(baseFetch) : baseFetch;
   const { apiKey: apiKeyOption } = options;
   let apiKey;
   if (apiKeyOption === undefined) {
@@ -708,12 +712,8 @@ function createTransport(options) {
   } else {
     apiKey = secret2(apiKeyOption.trim());
   }
-  if (runtime === "browser" && apiKey !== undefined) {
-    throw createDalpSdkConfigurationError2({
-      message: "DALP SDK: API keys are server/CLI-only credentials and cannot configure a browser client.",
-      why: "An API key placed in a browser client ships the credential to every visitor's bundle.",
-      fix: "Keep the API key on the server or CLI process; browser clients authenticate with the session cookie."
-    });
+  if (apiKey !== undefined) {
+    refuseBundledApiKey(runtime);
   }
   const sessionFetch = options.ssr === undefined ? transportFetch : createSsrFetch({
     allowedOrigins: options.ssr.allowedOrigins,
@@ -726,14 +726,18 @@ function createTransport(options) {
   if (options.authSurface !== undefined) {
     contextHeaders.set(DALP_AUTH_SURFACE_HEADER2, options.authSurface);
   }
+  if (runtime === "react-native") {
+    contextHeaders.set("Origin", new URL(baseUrl).origin);
+  }
   return {
     baseUrl,
     fetch: conditional.fetch,
     conditionalRequests: conditional.store,
-    credentials: runtime === "browser" ? "include" : "omit",
+    credentials: runtimeCredentials(runtime),
     apiKey,
     contextHeaders,
-    settlementTimeoutMs: options.settlementTimeoutMs
+    settlementTimeoutMs: options.settlementTimeoutMs,
+    streamsResponseBody: !isBufferingFetch(baseFetch)
   };
 }
 function callHeaders(transport, options) {
@@ -1332,6 +1336,21 @@ async function loadResponseDecoder() {
 // src/proxy/sse.ts
 var RESERVED_STREAM_FAILURE_EVENT2 = "effect/httpapi/stream/failure";
 var STREAM_FAILED_ERROR_CODE2 = "sdk.stream.FAILED";
+var STREAM_UNREADABLE_BODY_ERROR_CODE2 = "sdk.stream.UNREADABLE_BODY";
+function isReadableBody(body) {
+  return typeof body === "object" && body !== null && typeof Reflect.get(body, "getReader") === "function";
+}
+function unreadableBodyError(routeId) {
+  return makeDalpApiError2(new DalpSdkError2({
+    code: STREAM_UNREADABLE_BODY_ERROR_CODE2,
+    routeId,
+    category: "sdk.configuration",
+    retryable: false,
+    message: "The fetch this client uses cannot stream a response body.",
+    why: "React Native's built-in fetch resolves only after the whole response has arrived and exposes no `response.body`, so a stream never yields a frame.",
+    fix: 'Pass a streaming fetch as `fetch`; on React Native that is `fetch` from "expo/fetch", wrapped with the cookie store.'
+  }));
+}
 function parseFrame(raw) {
   try {
     return JSON.parse(raw.data);
@@ -1412,6 +1431,9 @@ async function* decodeEventStream2(body, decodeFrame, routeId) {
   }
 }
 async function* openEventStream(transport, route, routeId, input, options, signal, closed) {
+  if (!transport.streamsResponseBody) {
+    throw unreadableBodyError(routeId);
+  }
   const prepared = prepareRequest(transport, route, input, options);
   prepared.headers.set("Accept", "text/event-stream");
   const response = await transport.fetch(prepared.url, {
@@ -1424,13 +1446,16 @@ async function* openEventStream(transport, route, routeId, input, options, signa
   if (!response.ok) {
     await raiseResponseError(response, routeId);
   }
-  if (response.body === null) {
+  const { body, status } = response;
+  if (body === null) {
     return;
   }
+  if (!isReadableBody(body)) {
+    throw unreadableBodyError(routeId);
+  }
   const decoder = await loadResponseDecoder();
-  const { status } = response;
   try {
-    yield* decodeEventStream2(response.body, (frame) => decoder.decode(routeId, status, frame), routeId);
+    yield* decodeEventStream2(body, (frame) => decoder.decode(routeId, status, frame), routeId);
   } catch (error) {
     if (!closed.byConsumer) {
       throw error;
@@ -1564,4 +1589,4 @@ function createTanstackFactories(transport) {
   };
 }
 
-export { DalpApiError2, isDalpApiError2, findDalpSdkError2, makeDalpApiError2, isDalpErrorCode2, isDalpSdkLocalErrorCode2, isDalpApiErrorCode2, answeredByRoute, isDalpRouteError2, createDalpContextHeaders2, createTransport, MALFORMED_SUCCESS_ERROR_CODE2, RESERVED_STREAM_FAILURE_EVENT2, STREAM_FAILED_ERROR_CODE2, decodeEventStream2, streamRequest, sendRequest, createFetchExecutor, canonicalize2, queryKeyFor2, UI_SETTLEMENT_TIMEOUT_MS2, createTanstackFactories };
+export { DalpApiError2, isDalpApiError2, findDalpSdkError2, makeDalpApiError2, isDalpErrorCode2, isDalpSdkLocalErrorCode2, isDalpApiErrorCode2, answeredByRoute, isDalpRouteError2, createDalpContextHeaders2, createTransport, MALFORMED_SUCCESS_ERROR_CODE2, RESERVED_STREAM_FAILURE_EVENT2, STREAM_FAILED_ERROR_CODE2, STREAM_UNREADABLE_BODY_ERROR_CODE2, decodeEventStream2, streamRequest, sendRequest, createFetchExecutor, canonicalize2, queryKeyFor2, UI_SETTLEMENT_TIMEOUT_MS2, createTanstackFactories };

package/dist/effect.js

@@ -8,8 +8,8 @@ import {
   streamRequest,
   sendRequest,
   queryKeyFor2
-} from "./chunk-yr7kp37j.js";
-import"./chunk-wp4269cm.js";
+} from "./chunk-szp73yj8.js";
+import"./chunk-4f4kjtt0.js";
 import {
   buildProxy,
   findRoute

package/dist/errors/error-codes.d.ts

@@ -1,6 +1,6 @@
 import type { DalpErrorCode, DalpRouteErrorCode, DalpRouteId } from "../generated/api-types.d.ts";
 import { type DalpApiError } from "./api-error.ts";
-export type DalpSdkLocalErrorCode = "DALP_SDK_ERROR" | "sdk.transport.REQUEST_FAILED" | "sdk.transport.MALFORMED_RESPONSE" | "sdk.transport.UNPUBLISHED_ERROR_CODE" | "sdk.transport.UNVERIFIED_ERROR_CODE" | `sdk.transport.HTTP_${number}` | "sdk.response.MALFORMED_SUCCESS" | "sdk.stream.FAILED" | "sdk.scalar.BIG_DECIMAL_INVALID" | "sdk.scalar.EVM_ADDRESS_INVALID" | "sdk.scalar.ORGANIZATION_ID_INVALID" | "sdk.scalar.TOKEN_DECIMALS_INVALID";
+export type DalpSdkLocalErrorCode = "DALP_SDK_ERROR" | "sdk.transport.REQUEST_FAILED" | "sdk.transport.MALFORMED_RESPONSE" | "sdk.transport.UNPUBLISHED_ERROR_CODE" | "sdk.transport.UNVERIFIED_ERROR_CODE" | `sdk.transport.HTTP_${number}` | "sdk.response.MALFORMED_SUCCESS" | "sdk.stream.FAILED" | "sdk.stream.UNREADABLE_BODY" | "sdk.scalar.BIG_DECIMAL_INVALID" | "sdk.scalar.EVM_ADDRESS_INVALID" | "sdk.scalar.ORGANIZATION_ID_INVALID" | "sdk.scalar.TOKEN_DECIMALS_INVALID";
 export type DalpApiErrorCode = DalpErrorCode | DalpSdkLocalErrorCode;
 export declare const isDalpErrorCode: (code: string) => code is DalpErrorCode;
 export declare const isDalpSdkLocalErrorCode: (code: string) => code is DalpSdkLocalErrorCode;

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export type { DalpExecuteResult, DalpRequestParts, DalpRequestRouteKey, DalpRout
 export type { CompressionRequestInit } from "./client/request-compression.ts";
 export type { CreateDalpClientOptions, DalpClientContext, DalpSsrOptions } from "./client/factory.ts";
 export type { ConditionalRequestStore } from "./client/conditional-request.ts";
+export type { DalpRuntime } from "./runtime.ts";
 export { createCookieStoreFetch, makeCookieStore } from "./transport/cookie-store.ts";
 export type { CookieStoreShape } from "./transport/cookie-store.ts";
 export { SECRET_REDACTION_MARKER, Secret, secret } from "./secret.ts";
@@ -12,7 +13,7 @@ export type { SseEventDisposition, SseLifecycleFailureReason, SseLifecycleOption
 export { WEBHOOK_MANIFEST_VERSION } from "./webhook-events.ts";
 export type { Webhook } from "./webhook-events.ts";
 export type { CallOptions } from "./proxy/builder.ts";
-export { decodeEventStream, RESERVED_STREAM_FAILURE_EVENT, STREAM_FAILED_ERROR_CODE } from "./proxy/sse.ts";
+export { decodeEventStream, RESERVED_STREAM_FAILURE_EVENT, STREAM_FAILED_ERROR_CODE, STREAM_UNREADABLE_BODY_ERROR_CODE, } from "./proxy/sse.ts";
 export { MALFORMED_SUCCESS_ERROR_CODE } from "./proxy/response-decode.ts";
 export { createDalpSdkConfigurationError, DalpSdkError } from "./errors/sdk-error.ts";
 export { DalpApiError, findDalpSdkError, isDalpApiError, makeDalpApiError } from "./errors/api-error.ts";