@settlemint/dalp-sdk 3.1.26-main.37150284587 → 3.1.26-main.37154707747

package/dist/auth.js

@@ -5,19 +5,22 @@ import {
   DALP_AUTH_SURFACE_HEADER2,
   secret2,
   unwrapSecret,
-  normalizeDalpBaseUrl,
   detectDalpRuntime,
+  refuseCrossOriginBrowserSession,
   refuseBundledApiKey,
   STEP_UP_CHALLENGE_HEADER,
   STEP_UP_CHALLENGE_PATH,
   carriesWalletProof,
   stepUpChallengeRequest
-} from "./chunk-4f4kjtt0.js";
+} from "./chunk-hcpk89xj.js";
 import {
   makeCookieStore2,
   createCookieStoreFetch2,
   SDK_USER_AGENT2
-} from "./chunk-5f3vcf8j.js";
+} from "./chunk-06nb3sx9.js";
+import {
+  normalizeDalpBaseUrl
+} from "./chunk-h9e65x5z.js";
 
 // src/auth/live.ts
 import { apiKeyClient } from "@better-auth/api-key/client";
@@ -488,6 +491,7 @@ function createConfiguredBetterAuthClient(config, cookieStore) {
   ];
   const baseUrl = normalizeDalpBaseUrl(config.url);
   const runtime = config.runtime ?? detectDalpRuntime();
+  refuseCrossOriginBrowserSession(runtime, baseUrl, config.apiKey !== undefined);
   if (config.apiKey !== undefined) {
     refuseBundledApiKey(runtime);
   }

package/dist/{chunk-5f3vcf8j.js → chunk-06nb3sx9.js}

@@ -1,6 +1,6 @@
 import {
   keepBufferingMarker
-} from "./chunk-4f4kjtt0.js";
+} from "./chunk-hcpk89xj.js";
 
 // src/transport/cookie-store.ts
 var parseCookieHeader = (header) => {
@@ -107,7 +107,7 @@ function createCookieStoreFetch2(cookieStore, fetchImpl = globalThis.fetch) {
 // package.json
 var package_default = {
   name: "@settlemint/dalp-sdk",
-  version: "3.1.26-main.37150284587",
+  version: "3.1.26-main.37154707747",
   private: false,
   description: "Fully typed SDK for the DALP tokenization platform API",
   homepage: "https://settlemint.com",
@@ -131,6 +131,11 @@ var package_default = {
   ],
   exports: {
     "./package.json": "./package.json",
+    "./server-proxy": {
+      types: "./dist/server-proxy.d.ts",
+      import: "./dist/server-proxy.js",
+      default: "./dist/server-proxy.js"
+    },
     "./runtime-exports": {
       types: "./dist/runtime-exports.d.ts",
       import: "./dist/runtime-exports.js",
@@ -220,7 +225,7 @@ var package_default = {
     "@better-auth/passkey": "1.7.7",
     "@domains/webhooks-contract": "workspace:*",
     "better-auth": "1.7.7",
-    "better-call": "1.4.0",
+    "better-call": "1.4.1",
     dnum: "2.17.0",
     standardwebhooks: "1.1.1",
     viem: "2.57.2"

package/dist/{chunk-bnmpjm3n.js → chunk-bswka7ta.js}

@@ -6,9 +6,9 @@ import {
   Secret2,
   secret2,
   unwrapSecret,
-  normalizeDalpBaseUrl,
   detectDalpRuntime,
   runtimeCredentials,
+  refuseCrossOriginBrowserSession,
   isBufferingFetch,
   refuseBundledApiKey,
   STEP_UP_CHALLENGE_HEADER,
@@ -16,7 +16,10 @@ import {
   STEP_UP_CHALLENGE_PATH,
   carriesWalletProof,
   stepUpChallengeRequest
-} from "./chunk-4f4kjtt0.js";
+} from "./chunk-hcpk89xj.js";
+import {
+  normalizeDalpBaseUrl
+} from "./chunk-h9e65x5z.js";
 
 // src/errors/find-current-error.ts
 var readProperty = (target, key) => Reflect.get(target, key);
@@ -720,6 +723,7 @@ function createTransport(options) {
   } else {
     apiKey = secret2(apiKeyOption.trim());
   }
+  refuseCrossOriginBrowserSession(runtime, baseUrl, apiKey !== undefined);
   if (apiKey !== undefined) {
     refuseBundledApiKey(runtime);
   }

package/dist/{chunk-yc0yb9w4.js → chunk-e0zn3kpq.js}

@@ -4,7 +4,7 @@ import {
   sendRequest,
   createFetchExecutor,
   createTanstackFactories
-} from "./chunk-bnmpjm3n.js";
+} from "./chunk-bswka7ta.js";
 import {
   buildProxy,
   findRoute

package/dist/chunk-h9e65x5z.js

@@ -0,0 +1,28 @@
+import {
+  createDalpSdkConfigurationError2
+} from "./chunk-k3ntysxx.js";
+
+// src/url.ts
+function normalizeDalpBaseUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (error) {
+    throw createDalpSdkConfigurationError2({
+      message: `DALP SDK: invalid url "${url}". Provide a full URL including the protocol (e.g., "https://dalp.example.com").`,
+      why: "The SDK could not parse the configured DALP API URL.",
+      fix: 'Provide a full http:// or https:// URL, for example "https://dalp.example.com".',
+      cause: error
+    });
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw createDalpSdkConfigurationError2({
+      message: `DALP SDK: url must use https:// or http:// protocol, got "${parsed.protocol}".`,
+      why: `The SDK received a URL with the unsupported "${parsed.protocol}" protocol.`,
+      fix: 'Use a DALP API base URL that starts with "https://" or "http://".'
+    });
+  }
+  return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+}
+
+export { normalizeDalpBaseUrl };

package/dist/{chunk-4f4kjtt0.js → chunk-hcpk89xj.js}

@@ -40,29 +40,6 @@ var unwrapSecret = (value) => {
   return raw;
 };
 
-// src/url.ts
-function normalizeDalpBaseUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch (error) {
-    throw createDalpSdkConfigurationError2({
-      message: `DALP SDK: invalid url "${url}". Provide a full URL including the protocol (e.g., "https://dalp.example.com").`,
-      why: "The SDK could not parse the configured DALP API URL.",
-      fix: 'Provide a full http:// or https:// URL, for example "https://dalp.example.com".',
-      cause: error
-    });
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    throw createDalpSdkConfigurationError2({
-      message: `DALP SDK: url must use https:// or http:// protocol, got "${parsed.protocol}".`,
-      why: `The SDK received a URL with the unsupported "${parsed.protocol}" protocol.`,
-      fix: 'Use a DALP API base URL that starts with "https://" or "http://".'
-    });
-  }
-  return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
-}
-
 // src/runtime.ts
 var REACT_NATIVE_NAVIGATOR_PRODUCT = "ReactNative";
 function detectDalpRuntime() {
@@ -74,6 +51,21 @@ function detectDalpRuntime() {
 function runtimeCredentials(runtime) {
   return runtime === "browser" ? "include" : "omit";
 }
+function refuseCrossOriginBrowserSession(runtime, baseUrl, usesApiKey) {
+  if (runtime !== "browser" || usesApiKey) {
+    return;
+  }
+  const browserOrigin = globalThis.window?.location?.origin;
+  const targetOrigin = new URL(baseUrl).origin;
+  if (browserOrigin === undefined || browserOrigin === targetOrigin) {
+    return;
+  }
+  throw createDalpSdkConfigurationError2({
+    message: "DALP SDK: browser cookie sessions must use the application origin; mount createDalpProxy at /api.",
+    why: `The browser page is ${browserOrigin}, but the client targets ${targetOrigin}; host-only session cookies do not cross origins.`,
+    fix: "Set the browser client baseUrl to window.location.origin and mount createDalpProxy at /api on that origin."
+  });
+}
 var WHATWG_FETCH_POLYFILL_FLAG = "polyfill";
 function isBufferingFetch(fetchImpl) {
   return typeof fetchImpl === "function" && Reflect.get(fetchImpl, WHATWG_FETCH_POLYFILL_FLAG) === true;
@@ -146,4 +138,4 @@ async function stepUpChallengeRequest(operation, target, body) {
   return { operation, target, payloadDigest };
 }
 
-export { DALP_AUTH_SURFACE_HEADER2, SECRET_REDACTION_MARKER2, Secret2, secret2, unwrapSecret, normalizeDalpBaseUrl, detectDalpRuntime, runtimeCredentials, isBufferingFetch, keepBufferingMarker, refuseBundledApiKey, STEP_UP_CHALLENGE_HEADER, WALLET_VERIFICATION_HEADER, STEP_UP_CHALLENGE_PATH, carriesWalletProof, stepUpChallengeRequest };
+export { DALP_AUTH_SURFACE_HEADER2, SECRET_REDACTION_MARKER2, Secret2, secret2, unwrapSecret, detectDalpRuntime, runtimeCredentials, refuseCrossOriginBrowserSession, isBufferingFetch, keepBufferingMarker, refuseBundledApiKey, STEP_UP_CHALLENGE_HEADER, WALLET_VERIFICATION_HEADER, STEP_UP_CHALLENGE_PATH, carriesWalletProof, stepUpChallengeRequest };

package/dist/effect.js

@@ -8,12 +8,13 @@ import {
   streamRequest,
   sendRequest,
   queryKeyFor2
-} from "./chunk-bnmpjm3n.js";
-import"./chunk-4f4kjtt0.js";
+} from "./chunk-bswka7ta.js";
+import"./chunk-hcpk89xj.js";
 import {
   buildProxy,
   findRoute
 } from "./chunk-b03ycwb7.js";
+import"./chunk-h9e65x5z.js";
 
 // src/effect.ts
 import * as Effect from "effect/Effect";

package/dist/index.js

@@ -22,22 +22,23 @@ import {
   STREAM_FAILED_ERROR_CODE2,
   STREAM_UNREADABLE_BODY_ERROR_CODE2,
   decodeEventStream2
-} from "./chunk-bnmpjm3n.js";
+} from "./chunk-bswka7ta.js";
 import {
   DALP_AUTH_SURFACE_HEADER2,
   SECRET_REDACTION_MARKER2,
   Secret2,
   secret2
-} from "./chunk-4f4kjtt0.js";
+} from "./chunk-hcpk89xj.js";
 import {
   makeCookieStore2,
   createCookieStoreFetch2,
   SDK_VERSION2,
   SDK_USER_AGENT2
-} from "./chunk-5f3vcf8j.js";
+} from "./chunk-06nb3sx9.js";
 import {
   buildDalpClient
-} from "./chunk-yc0yb9w4.js";
+} from "./chunk-e0zn3kpq.js";
+import"./chunk-h9e65x5z.js";
 
 // src/proxy/client.ts
 function createDalpClient(options) {

package/dist/react-query.js

@@ -3,8 +3,9 @@ import {
   canonicalize2,
   queryKeyFor2,
   UI_SETTLEMENT_TIMEOUT_MS2
-} from "./chunk-bnmpjm3n.js";
-import"./chunk-4f4kjtt0.js";
+} from "./chunk-bswka7ta.js";
+import"./chunk-hcpk89xj.js";
+import"./chunk-h9e65x5z.js";
 export {
   UI_SETTLEMENT_TIMEOUT_MS2 as UI_SETTLEMENT_TIMEOUT_MS,
   canonicalize2 as canonicalize,