@dynamic-labs-sdk/client 1.13.0 → 1.14.0

package/dist/{InvalidParamError-BeCPhfVz.esm.js → InvalidParamError-DZjc7Tjc.esm.js}

@@ -2,7 +2,7 @@ import { AuthStorageEnum, Configuration, JwtVerifiedCredentialFormatEnum, SDKApi
 
 //#region package.json
 var name = "@dynamic-labs-sdk/client";
-var version = "1.13.0";
+var version = "1.14.0";
 var dependencies = {
 	"@dynamic-labs-sdk/assert-package-version": "workspace:*",
 	"@dynamic-labs-wallet/browser-wallet-client": "1.0.39",
@@ -151,1474 +151,1464 @@ const randomString = ({ chars = DEFAULT_CHARS, length }) => {
 };
 
 //#endregion
-//#region src/modules/auth/extractSessionId/extractSessionId.ts
+//#region src/modules/auth/getElevatedAccessToken/getElevatedAccessToken.ts
 /**
-* Extracts the session ID (`sid` claim) from a JWT token string.
+* Gets an elevated access token by scope.
 *
-* Decodes the base64url-encoded payload segment of the token and reads the
-* `sid` field. This is used to correlate instrumentation events with the
-* authenticated session, without ever forwarding the full token.
+* This function retrieves an elevated access token that contains the specified scope.
+* Expired tokens are automatically filtered out.
 *
-* Returns `null` when no token is present, when the token is malformed, or
-* when the payload does not contain a `sid` claim.
+* By default, if the token has `singleUse: true`, it will be automatically
+* consumed (removed from state) after retrieval. Pass `consume: false` to
+* check for token existence without consuming it.
+*
+* @param params - The parameters object.
+* @param params.scope - The scope to match (e.g., 'wallet:export').
+* @param params.consume - Whether to consume single-use tokens (default: true).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The elevated access token if found and not expired, or undefined if not found or expired.
+*
+* @example
+* ```typescript
+* // Retrieve and consume (default)
+* const token = getElevatedAccessToken({ scope: 'wallet:export' });
+*
+* // Check existence without consuming
+* const token = getElevatedAccessToken({ scope: 'credential:unlink', consume: false });
+* ```
 * @notInstrumented
 */
-const extractSessionId = (token) => {
-	try {
-		const payload = token.split(".")[1];
-		return JSON.parse(atob(payload)).sid ?? null;
-	} catch {
-		return null;
+const getElevatedAccessToken = ({ consume = true, scope }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const now = /* @__PURE__ */ new Date();
+	const elevatedAccessTokens = core.state.get().elevatedAccessTokens || [];
+	const validTokens = elevatedAccessTokens.filter((token$1) => !token$1.expiresAt || token$1.expiresAt > now);
+	if (validTokens.length !== elevatedAccessTokens.length) core.state.set({ elevatedAccessTokens: validTokens });
+	const token = validTokens.find((token$1) => token$1.scopes.includes(scope));
+	if (!token) return;
+	if (consume && token.singleUse) {
+		const updatedTokens = validTokens.filter((t) => t !== token);
+		core.state.set({ elevatedAccessTokens: updatedTokens });
 	}
+	return token.token;
 };
 
 //#endregion
-//#region src/utils/getOperatingSystem/getOperatingSystem.ts
-/**
-* Detects the operating system from `navigator.userAgent` for web environments.
-*
-* The React Native bundler (Metro) resolves `getOperatingSystem.native.ts`
-* instead when building for React Native, which uses `Platform.OS` directly.
-*
-* Falls back to `'unknown'` when `navigator` is unavailable (SSR, service
-* workers) or when the user-agent string doesn't match a known OS pattern.
-* @notInstrumented
-*/
-const getOperatingSystem = () => {
-	try {
-		const ua = navigator.userAgent;
-		if (/iPhone|iPad|iPod/.test(ua)) return "ios";
-		if (/Android/.test(ua)) return "android";
-		if (/Windows/.test(ua)) return "windows";
-		if (/Macintosh|Mac OS X/.test(ua)) return "macos";
-		if (/Linux/.test(ua)) return "linux";
-		return "unknown";
-	} catch {
-		return "unknown";
+//#region src/errors/ValueMustBeDefinedError.ts
+var ValueMustBeDefinedError = class extends BaseError {
+	constructor(message) {
+		super({
+			cause: null,
+			code: "value_must_be_defined_error",
+			docsUrl: null,
+			name: "ValueMustBeDefined",
+			shortMessage: message
+		});
 	}
 };
 
 //#endregion
-//#region src/utils/getPlatform/getPlatform.ts
+//#region src/utils/assertDefined/assertDefined.ts
 /**
-* Returns the platform the SDK is running on.
+* Asserts that a value is not null or undefined, throwing an error if it is.
+* This function acts as a type guard, narrowing the type to exclude null and undefined.
 *
-* This is the web implementation — the React Native bundler resolves
-* `getPlatform.native.ts` instead when building for React Native, which
-* returns `'react-native'`.
-* @notInstrumented
+* @template T - The type of the value being checked
+* @param value - The value to check for null or undefined
+* @param message - The error message to throw if the value is null or undefined
+* @throws Throws an error with the provided message if value is null or undefined
+* @example
+* ```typescript
+* const maybeString: string | null = getValue();
+* assertDefined(maybeString, 'String value is required');
+* // maybeString is now typed as string (null is excluded)
+* ```
 */
-const getPlatform = () => "web";
+function assertDefined(value, message) {
+	if (value === null || value === void 0) throw new ValueMustBeDefinedError(message);
+}
 
 //#endregion
-//#region src/utils/getUserAgent/getUserAgent.ts
+//#region src/modules/projectSettings/isCookieEnabled/isCookieEnabled.ts
 /**
-* Returns the browser's `navigator.userAgent` string for inclusion in
-* instrumentation events.
-*
-* Falls back to an empty string in environments where `navigator` is not
-* available (e.g., Node.js SSR, service workers) so that callers never need
-* to guard against undefined.
+* Returns true if the client is using Dynamic cookies or a BYO JWT cookie.
 * @notInstrumented
 */
-const getUserAgent = () => {
-	try {
-		return navigator.userAgent;
-	} catch {
-		return "";
-	}
+const isCookieEnabled = (client) => {
+	assertDefined(client.projectSettings, "Project settings are not defined");
+	const securitySettings = client.projectSettings.security;
+	if (!securitySettings) return false;
+	const dynamicCookiesEnabled = (securitySettings.auth?.storage || []).includes(AuthStorageEnum.Cookie);
+	const byoJwtCookieEnabled = Boolean(securitySettings.externalAuth?.cookieName);
+	return dynamicCookiesEnabled || byoJwtCookieEnabled;
 };
 
 //#endregion
-//#region src/services/instrumentation/constants.ts
-/**
-* Default key-based PII scrubber list, lowercased and matched against the
-* lowercased object key.
-*
-* Two complementary mechanisms cover credential leakage:
-*
-* 1. Explicit keys listed here — matched exactly (case-insensitive). Use this
-*    for keys that don't end in a generic credential suffix (e.g. `mnemonic`,
-*    `seed`, `verificationCode`, `keyShare`).
-* 2. Suffix matching in {@link scrubParameters} for the credential suffixes
-*    enumerated by {@link PII_KEY_SUFFIXES} — catches any field whose name
-*    ends in `token` or `jwt` (e.g. `mfaToken`, `minifiedJwt`, `accessToken`,
-*    `idToken`, `captchaToken`, …) without needing to enumerate them here.
-*/
-const DEFAULT_PII_FIELDS = [
-	"password",
-	"token",
-	"secret",
-	"privateKey",
-	"privateJwk",
-	"mnemonic",
-	"seed",
-	"keyShare",
-	"keyShares",
-	"email",
-	"phone",
-	"ssn",
-	"address",
-	"authorization",
-	"verificationCode",
-	"recoveryCodes",
-	"codeVerifier",
-	"pkce",
-	"bearer",
-	"apiKey"
-];
-/**
-* Lowercased suffixes used by {@link scrubParameters} to match credential-like
-* keys without enumerating every variant (e.g. `mfaToken`, `accessToken`,
-* `refreshToken`, `legacyToken`, `minifiedJwt`). Only suffixes that are
-* unambiguously credentials belong here — `key` (matches `publicKey`) and
-* `code` (matches `countryCode`) are too broad and must not be added.
-*/
-const PII_KEY_SUFFIXES = ["token", "jwt"];
-const REDACTED_VALUE = "[REDACTED]";
-const MAX_STRING_LENGTH = 500;
-const TRUNCATED_SUFFIX = "...[truncated]";
-/**
-* Label prefix for binary data placeholders. The full placeholder includes the
-* byte length, e.g. `[Binary:16 bytes]`, so consumers can gauge data size
-* without the actual bytes appearing in logs.
-*/
-const BINARY_LABEL = "Binary";
-/**
-* Placeholder emitted when a circular reference is detected in the value tree.
-* Using a named constant makes it easy to search for or filter in downstream
-* log tooling.
-*/
-const CIRCULAR_VALUE = "[Circular]";
+//#region src/modules/sessionKeys/getSessionKeys/getSessionKeys.ts
+/** @notInstrumented */
+const getSessionKeys = (client) => {
+	const publicKey = getCore(client).state.get().sessionKeys;
+	if (!publicKey) return;
+	return { publicKey };
+};
 
 //#endregion
-//#region src/services/instrumentation/scrubParameters/scrubParameters.ts
-/**
-* Returns true when `key` should be redacted based on the configured PII
-* field list. A key matches when its lowercased form either equals one of
-* `piiFieldsLower` exactly, or ends in one of the curated credential
-* suffixes in {@link PII_KEY_SUFFIXES} (currently `token` and `jwt`). The
-* suffix check is what catches `mfaToken`, `minifiedJwt`, `accessToken`,
-* etc. without needing every variant enumerated explicitly.
-*/
-const keyMatchesPiiField = ({ keyLower, piiFieldsLower }) => {
-	if (piiFieldsLower.includes(keyLower)) return true;
-	return PII_KEY_SUFFIXES.some((suffix) => keyLower.endsWith(suffix));
+//#region src/errors/APIError/APIError.ts
+var APIError = class APIError extends BaseError {
+	status;
+	constructor(message, code, status) {
+		super({
+			cause: null,
+			code,
+			docsUrl: null,
+			name: "APIError",
+			shortMessage: message
+		});
+		this.status = status;
+	}
+	static async fromResponse(response) {
+		try {
+			const errorBody = await response.clone().json();
+			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") {
+				const errorCode = "code" in errorBody && typeof errorBody.code === "string" ? errorBody.code : "unknown_error";
+				return new APIError(errorBody.error, errorCode, response.status);
+			}
+			return null;
+		} catch {
+			return null;
+		}
+	}
 };
-const scrubString = ({ key, piiFieldsLower, redactAll, value }) => {
-	if (keyMatchesPiiField({
-		keyLower: key.toLowerCase(),
-		piiFieldsLower
-	})) return REDACTED_VALUE;
-	if (redactAll) return REDACTED_VALUE;
-	if (value.length > MAX_STRING_LENGTH) return value.slice(0, MAX_STRING_LENGTH) + TRUNCATED_SUFFIX;
-	return value;
+
+//#endregion
+//#region src/errors/InvalidExternalAuthError.ts
+var InvalidExternalAuthError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "invalid_external_auth_error",
+			docsUrl: "https://www.dynamic.xyz/docs/external-auth/third-party-auth-overview",
+			name: "InvalidExternalAuthError",
+			shortMessage: "Error authenticating with external JWT"
+		});
+	}
 };
-const scrubArray = ({ context, value }) => {
-	if (context.visited.has(value)) return [CIRCULAR_VALUE];
-	context.visited.add(value);
-	const result = value.map((item, index) => scrubValue({
-		context,
-		key: String(index),
-		value: item
-	}));
-	context.visited.delete(value);
-	return result;
-};
-const scrubObject = ({ context, value }) => {
-	if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
-	context.visited.add(value);
-	const result = Object.create(null);
-	for (const key of Object.keys(value)) result[key] = scrubValue({
-		context,
-		key,
-		value: value[key]
-	});
-	context.visited.delete(value);
-	return result;
+
+//#endregion
+//#region src/errors/LinkCredentialError.ts
+var LinkCredentialError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "link_credential_error",
+			docsUrl: null,
+			name: "LinkCredentialError",
+			shortMessage: "The credential you are trying to link is associated with another account and cannot be reassigned."
+		});
+	}
 };
-const scrubValue = ({ context, key, value }) => {
-	if (value === null || value === void 0) return value;
-	if (value instanceof Uint8Array) return `[${BINARY_LABEL}:${value.byteLength} bytes]`;
-	if (keyMatchesPiiField({
-		keyLower: key.toLowerCase(),
-		piiFieldsLower: context.piiFieldsLower
-	})) return REDACTED_VALUE;
-	if (typeof value === "string") return scrubString({
-		key,
-		piiFieldsLower: context.piiFieldsLower,
-		redactAll: context.redactAll,
-		value
-	});
-	if (Array.isArray(value)) return scrubArray({
-		context,
-		value
-	});
-	if (value instanceof Set) {
-		if (context.visited.has(value)) return [CIRCULAR_VALUE];
-		context.visited.add(value);
-		const setResult = scrubArray({
-			context,
-			value: [...value]
+
+//#endregion
+//#region src/errors/MfaInvalidOtpError.ts
+var MfaInvalidOtpError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "mfa_invalid_otp_error",
+			docsUrl: null,
+			name: "MfaInvalidOtpError",
+			shortMessage: "Invalid OTP"
 		});
-		context.visited.delete(value);
-		return setResult;
 	}
-	if (value instanceof Map) {
-		if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
-		context.visited.add(value);
-		const asObject = Object.create(null);
-		for (const [k, v] of value.entries()) asObject[String(k)] = v;
-		const mapResult = scrubObject({
-			context,
-			value: asObject
+};
+
+//#endregion
+//#region src/errors/MfaRateLimitedError.ts
+var MfaRateLimitedError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "mfa_rate_limited_error",
+			docsUrl: null,
+			name: "MfaRateLimitedError",
+			shortMessage: "Rate limited"
 		});
-		context.visited.delete(value);
-		return mapResult;
 	}
-	if (value instanceof WeakMap) return "[WeakMap]";
-	if (value instanceof WeakSet) return "[WeakSet]";
-	if (value instanceof Date) return value.toISOString();
-	if (value instanceof Error) return `[Error: ${value.message}]`;
-	if (typeof value === "object") return scrubObject({
-		context,
-		value
-	});
-	return value;
 };
-/** @notInstrumented */
-const scrubParameters = ({ piiFields, redactAll, value }) => {
-	return scrubObject({
-		context: {
-			piiFieldsLower: piiFields.map((field) => field.toLowerCase()),
-			redactAll,
-			visited: /* @__PURE__ */ new WeakSet()
-		},
-		value
-	});
+
+//#endregion
+//#region src/errors/SandboxMaximumThresholdReachedError.ts
+var SandboxMaximumThresholdReachedError = class extends BaseError {
+	constructor({ cause }) {
+		super({
+			cause,
+			code: "sandbox_maximum_threshold_reached_error",
+			docsUrl: "https://www.dynamic.xyz/docs/developer-dashboard/sandbox-vs-live#sandbox-vs-live",
+			name: "SandboxMaximumThresholdReachedError",
+			shortMessage: "Your sandbox environment has reached the maximum MAU. Please use a live environment for production traffic."
+		});
+	}
 };
 
 //#endregion
-//#region src/services/instrumentation/instrumentFunction/extractParams/extractParams.ts
+//#region src/modules/apiClient/utils/clientErrorMapper/clientErrorMapper.ts
 /**
-* Normalises the raw positional arguments of an instrumented function call
-* into a flat `Record<string, unknown>` suitable for structured logging.
-*
-* ## Why this is needed
+* Default error mapper for the client that handles common API error codes.
 *
-* Instrumented functions are wrapped with `(...args: unknown[])`, so their
-* parameters arrive as an array. Logging a raw array loses the semantic names
-* of each argument. This function recovers a named representation:
+* This mapper transforms specific API error codes into more specific error types:
+* - `mfa_invalid_code` → `MfaInvalidOtpError`
+* - `mfa_rate_limited` → `MfaRateLimitedError`
 *
-* - **No arguments** → `{}`
-* - **Single plain-object argument** → that object is returned as-is, because
-*   SDK functions follow the single-object-parameter convention, so the object
-*   already carries named keys (`{ amount, to }`, etc.).
-* - **Everything else** (multiple args, a single primitive, a single array) →
-*   each value is indexed as `arg0`, `arg1`, …
+* @param error - The error to be mapped
+* @returns A transformed error if the error code matches a known pattern, or null if no transformation is needed
 *
-* ## Why arrays are NOT treated as plain objects
+* @example
+* ```typescript
+* // This will be automatically applied to all API errors
+* const apiClient = createApiClient({}, client);
 *
-* `typeof [] === 'object'` and `[] !== null`, so without the `Array.isArray`
-* guard a single-array argument would be returned as-is. That would produce
-* an object with numeric string keys (`{ '0': ..., '1': ... }`), which is
-* misleading and inconsistent with how multi-arg calls are handled. Instead,
-* arrays fall through to the indexed `arg0` path.
+* // The clientErrorMapper will automatically convert mfa_invalid_code errors
+* // to MfaInvalidOtpError instances
+* ```
 * @notInstrumented
 */
-const extractParams = (args) => {
-	if (args.length === 0) return {};
-	if (args.length === 1 && typeof args[0] === "object" && args[0] !== null && !Array.isArray(args[0])) return args[0];
-	const result = {};
-	for (let i = 0; i < args.length; i++) result[`arg${i}`] = args[i];
-	return result;
+const clientErrorMapper = (error) => {
+	if (error instanceof APIError) {
+		if (error.code === "mfa_invalid_code") return new MfaInvalidOtpError({ cause: error });
+		if (error.code === "mfa_rate_limited") return new MfaRateLimitedError({ cause: error });
+		if (error.code === "invalid_external_auth") return new InvalidExternalAuthError({ cause: error });
+		if (error.code === "sandbox_maximum_threshold_reached") return new SandboxMaximumThresholdReachedError({ cause: error });
+		if (error.code === "merge_accounts_invalid" || error.code === "reassign_wallet_error") return new LinkCredentialError({ cause: error });
+	}
+	return null;
 };
 
 //#endregion
-//#region src/services/instrumentation/instrumentFunction/scrubResolvedValue/scrubResolvedValue.ts
+//#region src/modules/apiClient/utils/convertToApiErrorMiddleware/convertToApiErrorMiddleware.ts
 /**
-* Scrubs a resolved return value of any type before logging it.
-* Routes through `scrubParameters` by wrapping the value so that strings,
-* arrays, Dates, Errors, and all other types are handled identically to
-* nested object fields.
+* Creates middleware that converts HTTP error responses to APIError instances
+* and optionally applies custom error mappers to transform them into specific error types.
+*
+* @param options.errorMappers - Array of error mappers to apply to API errors
+* @returns A middleware function that handles error conversion and mapping
 * @notInstrumented
 */
-const scrubResolvedValue = ({ piiFields, redactAll, value }) => scrubParameters({
-	piiFields,
-	redactAll,
-	value: { result: value }
-}).result;
+const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: async (context) => {
+	if (context.response.status >= 400) {
+		const apiError = await APIError.fromResponse(context.response);
+		if (apiError) {
+			let errorToThrow = apiError;
+			for (const mapper of errorMappers) {
+				const newError = mapper(apiError);
+				if (newError) {
+					errorToThrow = newError;
+					break;
+				}
+			}
+			throw errorToThrow;
+		}
+	}
+	return context.response;
+} });
 
 //#endregion
-//#region src/services/instrumentation/instrumentFunction/instrumentFunction.ts
-const serializeError = (error) => {
-	if (error instanceof Error) return {
-		message: error.message,
-		name: error.name,
-		stack: error.stack
-	};
+//#region src/utils/getNonce/getNonce.ts
+/**
+* Returns a nonce for wallet ownership verification.
+*
+* Pops the first nonce from the prefetched pool. When the pool is running low
+* (≤1 remaining after pop) a background refetch is triggered. If the pool is
+* empty, nonces are fetched on-demand before returning.
+* @notInstrumented
+*/
+const getNonce = async (client) => {
+	const core = getCore(client);
+	const pool = core.state.get().prefetchedNonces;
+	if (pool.length > 0) {
+		const [nonce, ...remaining] = pool;
+		core.state.set({ prefetchedNonces: remaining });
+		if (remaining.length <= 1) fetchAndStoreNonces(client);
+		return nonce;
+	}
+	await fetchAndStoreNonces(client);
+	return getNonce(client);
+};
+
+//#endregion
+//#region src/modules/deviceRegistration/getDeviceSigner/getDeviceSigner.ts
+/** @notInstrumented */
+const getDeviceSigner = async (client) => {
+	const { deviceSigner, keychain } = getCore(client);
+	/**
+	* If the device signer is available, it should handle the device signing.
+	* This is used for mobile devices with secure enclave.
+	*/
+	if (deviceSigner) return deviceSigner;
+	const keyName = "device";
+	if (!await keychain.getPublicKey(keyName)) await keychain.generateKey(keyName);
 	return {
-		message: String(error),
-		name: "UnknownError"
+		getPublicKey: () => keychain.getPublicKey(keyName),
+		sign: (payload) => keychain.sign(keyName, payload)
 	};
 };
-/**
-* Wraps a function so that each invocation emits a structured
-* `FunctionInstrumentationEvent` at three lifecycle points:
-*
-* - **started** — immediately before the function body executes, with the
-*   PII-scrubbed call parameters.
-* - **resolved** — after the function (or its returned Promise) settles
-*   successfully, with the PII-scrubbed return value.
-* - **rejected** — if the function throws synchronously or its returned
-*   Promise rejects.
-*
-* The original return value (or thrown error) is always forwarded to the
-* caller unchanged — instrumentation is purely observational.
-*
-* ## Usage
-*
-* ```ts
-* const transfer = instrumentFunction({
-*   fn: rawTransfer,
-*   functionName: 'transfer',
-*   getCore: () => core,
-* });
-*
-* // When called, three events are emitted automatically:
-* await transfer({ amount: 1, to: '0xabc' });
-* ```
-*
-* ## How functions are wrapped
-*
-* `instrumentFunction` is not called manually in application code. Instead,
-* the esbuild instrumentation plugin (`tools/instrumentation-plugin`) injects
-* it at build time: any exported function annotated with `@instrumented` in its
-* JSDoc is automatically wrapped by the plugin during the build step.
-* The plugin strips the original `export`, renames the function, and re-exports
-* it under the original name via `instrumentFunction(...)` — so the public API
-* is unchanged and no call sites need to be updated.
-*
-* ## Opting out
-*
-* Instrumentation is skipped entirely when:
-* - `getCore()` returns `undefined` (SDK not initialised), or
-* - `core.instrumentation.config.enabled` is `false`.
-*
-* In both cases the original function is called directly with no overhead.
-*
-* ## PII scrubbing
-*
-* All string values whose key appears in `piiFields` are replaced with
-* `"[redacted]"` before events are emitted. Pass `redactAll: true` to redact
-* every field, regardless of key name.
-* @notInstrumented
-*/
-const instrumentFunction = ({ fn, functionName, getCore: getCore$1, redactAll }) => {
-	const wrapped = (...args) => {
-		const core = getCore$1();
-		if (!core) return fn(...args);
-		if (!core.instrumentation.config.enabled) return fn(...args);
-		const instrumentation = core.instrumentation;
-		const state = core.state.get();
-		const baseEvent = {
-			environmentId: core.environmentId,
-			functionName,
-			operatingSystem: getOperatingSystem(),
-			parameters: scrubParameters({
-				piiFields: instrumentation.config.piiFields,
-				redactAll,
-				value: extractParams(args)
-			}),
-			platform: getPlatform(),
-			registeredExtensionKeys: Array.from(core.extensions),
-			sdkSessionId: core.sdkSessionId,
-			sdkVersion: core.version,
-			status: "info",
-			tokenSessionId: state.token ? extractSessionId(state.token) : null,
-			userAgent: getUserAgent(),
-			userId: state.user?.id ?? null
-		};
-		instrumentation.logFunction({
-			...baseEvent,
-			phase: "started",
-			timestamp: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		try {
-			const result = fn(...args);
-			if (result instanceof Promise) return result.then((value) => {
-				instrumentation.logFunction({
-					...baseEvent,
-					phase: "resolved",
-					resolvedValue: scrubResolvedValue({
-						piiFields: instrumentation.config.piiFields,
-						redactAll,
-						value
-					}),
-					timestamp: (/* @__PURE__ */ new Date()).toISOString()
-				});
-				return value;
-			}).catch((error) => {
-				instrumentation.logFunction({
-					...baseEvent,
-					phase: "rejected",
-					rejectedError: serializeError(error),
-					timestamp: (/* @__PURE__ */ new Date()).toISOString()
-				});
-				throw error;
-			});
-			instrumentation.logFunction({
-				...baseEvent,
-				phase: "resolved",
-				resolvedValue: scrubResolvedValue({
-					piiFields: instrumentation.config.piiFields,
-					redactAll,
-					value: result
-				}),
-				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			});
-			return result;
-		} catch (error) {
-			instrumentation.logFunction({
-				...baseEvent,
-				phase: "rejected",
-				rejectedError: serializeError(error),
-				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			});
-			throw error;
-		}
+
+//#endregion
+//#region src/modules/deviceRegistration/getHeadersForNonceSignedByDeviceSigners/getHeadersForNonceSignedByDeviceSigners.ts
+/** @notInstrumented */
+const getHeadersForNonceSignedByDeviceSigners = async (client) => {
+	const { projectSettings } = client;
+	assertDefined(projectSettings, "Project settings not found");
+	/**
+	* For cookie based environments, the device registration is handled
+	* by settings the cookie in the browser.
+	* Then we dont need to provide the headers
+	*/
+	if (isCookieEnabled(client)) return {};
+	const deviceSigner = await getDeviceSigner(client);
+	const nonce = await getNonce(client);
+	const signedNonce = await deviceSigner.sign(nonce);
+	const publicKey = await deviceSigner.getPublicKey();
+	return {
+		"x-dynamic-device-nonce": nonce,
+		"x-dynamic-device-publickey": publicKey,
+		"x-dynamic-device-signed-nonce": signedNonce
 	};
-	return wrapped;
 };
 
 //#endregion
-//#region src/modules/auth/getElevatedAccessToken/getElevatedAccessToken.ts
-/**
-* Gets an elevated access token by scope.
-*
-* This function retrieves an elevated access token that contains the specified scope.
-* Expired tokens are automatically filtered out.
-*
-* By default, if the token has `singleUse: true`, it will be automatically
-* consumed (removed from state) after retrieval. Pass `consume: false` to
-* check for token existence without consuming it.
-*
-* @param params - The parameters object.
-* @param params.scope - The scope to match (e.g., 'wallet:export').
-* @param params.consume - Whether to consume single-use tokens (default: true).
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The elevated access token if found and not expired, or undefined if not found or expired.
-*
-* @example
-* ```typescript
-* // Retrieve and consume (default)
-* const token = getElevatedAccessToken({ scope: 'wallet:export' });
-*
-* // Check existence without consuming
-* const token = getElevatedAccessToken({ scope: 'credential:unlink', consume: false });
-* ```
-* @notInstrumented
-*/
-const getElevatedAccessToken = ({ consume = true, scope }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const now = /* @__PURE__ */ new Date();
-	const elevatedAccessTokens = core.state.get().elevatedAccessTokens || [];
-	const validTokens = elevatedAccessTokens.filter((token$1) => !token$1.expiresAt || token$1.expiresAt > now);
-	if (validTokens.length !== elevatedAccessTokens.length) core.state.set({ elevatedAccessTokens: validTokens });
-	const token = validTokens.find((token$1) => token$1.scopes.includes(scope));
-	if (!token) return;
-	if (consume && token.singleUse) {
-		const updatedTokens = validTokens.filter((t) => t !== token);
-		core.state.set({ elevatedAccessTokens: updatedTokens });
-	}
-	return token.token;
-};
-const __getElevatedAccessToken_impl = getElevatedAccessToken;
-const __getElevatedAccessToken_wrapped = instrumentFunction({
-	fn: __getElevatedAccessToken_impl,
-	functionName: "getElevatedAccessToken",
-	getCore: () => {
-		try {
-			return getCore(getDefaultClient());
-		} catch {
-			return;
+//#region src/modules/apiClient/utils/deviceSignatureHeadersMiddleware/createDeviceSignatureHeadersMiddleware.ts
+/** @notInstrumented */
+const createDeviceSignatureHeadersMiddleware = (client) => {
+	return { pre: async (context) => {
+		/**
+		* The signed nonce is not required for cookie based environments.
+		*/
+		if (isDeviceNonceSignatureRequiredForUrl(context.url) && !isCookieEnabled(client)) {
+			const deviceSignerHeaders = await getHeadersForNonceSignedByDeviceSigners(client);
+			return {
+				init: {
+					...context.init,
+					headers: {
+						...context.init.headers,
+						...deviceSignerHeaders
+					}
+				},
+				url: context.url
+			};
 		}
-	}
-});
+	} };
+};
 
 //#endregion
-//#region src/errors/ValueMustBeDefinedError.ts
-var ValueMustBeDefinedError = class extends BaseError {
-	constructor(message) {
+//#region src/errors/UnauthorizedError.ts
+var UnauthorizedError = class extends BaseError {
+	constructor({ cause }) {
 		super({
-			cause: null,
-			code: "value_must_be_defined_error",
+			cause,
+			code: "unauthorized_error",
 			docsUrl: null,
-			name: "ValueMustBeDefined",
-			shortMessage: message
+			name: "UnauthorizedError",
+			shortMessage: "Unauthorized"
 		});
 	}
 };
 
 //#endregion
-//#region src/utils/assertDefined/assertDefined.ts
-/**
-* Asserts that a value is not null or undefined, throwing an error if it is.
-* This function acts as a type guard, narrowing the type to exclude null and undefined.
-*
-* @template T - The type of the value being checked
-* @param value - The value to check for null or undefined
-* @param message - The error message to throw if the value is null or undefined
-* @throws Throws an error with the provided message if value is null or undefined
-* @example
-* ```typescript
-* const maybeString: string | null = getValue();
-* assertDefined(maybeString, 'String value is required');
-* // maybeString is now typed as string (null is excluded)
-* ```
-*/
-function assertDefined(value, message) {
-	if (value === null || value === void 0) throw new ValueMustBeDefinedError(message);
-}
+//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
+/** @notInstrumented */
+const createUnauthorizedMiddleware = () => ({ post: async (context) => {
+	if (context.response.status === 401) {
+		let cause = null;
+		try {
+			const errorBody = await context.response.clone().json();
+			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
+		} catch {}
+		throw new UnauthorizedError({ cause });
+	}
+	return context.response;
+} });
 
 //#endregion
-//#region src/modules/projectSettings/isCookieEnabled/isCookieEnabled.ts
+//#region src/modules/apiClient/createApiClient.ts
 /**
-* Returns true if the client is using Dynamic cookies or a BYO JWT cookie.
+* Returns a new instance of the SDK API client.
+*
+* This is not meant for storing, as it is very light we can create it whenever needed.
 * @notInstrumented
 */
-const isCookieEnabled = (client) => {
-	assertDefined(client.projectSettings, "Project settings are not defined");
-	const securitySettings = client.projectSettings.security;
-	if (!securitySettings) return false;
-	const dynamicCookiesEnabled = (securitySettings.auth?.storage || []).includes(AuthStorageEnum.Cookie);
-	const byoJwtCookieEnabled = Boolean(securitySettings.externalAuth?.cookieName);
-	return dynamicCookiesEnabled || byoJwtCookieEnabled;
-};
-
-//#endregion
-//#region src/modules/sessionKeys/getSessionKeys/getSessionKeys.ts
-/** @notInstrumented */
-const getSessionKeys = (client) => {
-	const publicKey = getCore(client).state.get().sessionKeys;
-	if (!publicKey) return;
-	return { publicKey };
-};
-
-//#endregion
-//#region src/errors/APIError/APIError.ts
-var APIError = class APIError extends BaseError {
-	status;
-	constructor(message, code, status) {
-		super({
-			cause: null,
-			code,
-			docsUrl: null,
-			name: "APIError",
-			shortMessage: message
-		});
-		this.status = status;
-	}
-	static async fromResponse(response) {
-		try {
-			const errorBody = await response.clone().json();
-			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") {
-				const errorCode = "code" in errorBody && typeof errorBody.code === "string" ? errorBody.code : "unknown_error";
-				return new APIError(errorBody.error, errorCode, response.status);
-			}
-			return null;
-		} catch {
-			return null;
+const createApiClient = (options = {}, client) => {
+	const core = getCore(client);
+	const coreState = core.state.get();
+	const settings = {
+		basePath: core.apiBaseUrl,
+		headers: {
+			"Content-Type": "application/json",
+			[DYNAMIC_API_VERSION_HEADER]: `API/${DYNAMIC_SDK_API_VERSION}`,
+			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
+			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
+			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
+			...core.getApiHeaders(),
+			...options.headers
 		}
+	};
+	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
+	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
+	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
+	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
+	if (options.elevatedAccessTokenScope) {
+		const elevatedToken = getElevatedAccessToken({ scope: options.elevatedAccessTokenScope }, client);
+		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
 	}
+	const sessionPublicKey = getSessionKeys(client)?.publicKey;
+	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
+	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
+	return new SDKApi(new Configuration({
+		...settings,
+		fetchApi: core.fetch,
+		middleware: [
+			createDeviceSignatureHeadersMiddleware(client),
+			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
+			createUnauthorizedMiddleware()
+		]
+	}));
 };
 
 //#endregion
-//#region src/errors/InvalidExternalAuthError.ts
-var InvalidExternalAuthError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "invalid_external_auth_error",
-			docsUrl: "https://www.dynamic.xyz/docs/external-auth/third-party-auth-overview",
-			name: "InvalidExternalAuthError",
-			shortMessage: "Error authenticating with external JWT"
-		});
-	}
-};
-
-//#endregion
-//#region src/errors/LinkCredentialError.ts
-var LinkCredentialError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "link_credential_error",
-			docsUrl: null,
-			name: "LinkCredentialError",
-			shortMessage: "The credential you are trying to link is associated with another account and cannot be reassigned."
-		});
-	}
-};
-
-//#endregion
-//#region src/errors/MfaInvalidOtpError.ts
-var MfaInvalidOtpError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "mfa_invalid_otp_error",
-			docsUrl: null,
-			name: "MfaInvalidOtpError",
-			shortMessage: "Invalid OTP"
+//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
+/**
+* Fetches a batch of nonces from the API.
+*
+* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
+* redirect). On iOS, a network request (like fetching a nonce) between a user
+* action and a deeplink call will break the gesture chain, causing iOS to
+* silently ignore the deeplink. By prefetching nonces ahead of time,
+* `getNonce` can return synchronously from cache and the deeplink fires
+* without an interrupting network round-trip.
+*
+* New nonces are **appended** to the existing pool so that unconsumed entries
+* are not discarded by a background refetch.
+*
+* Concurrent refills are coalesced behind a single in-flight promise so that
+* simultaneous callers share one `GET /nonces` round-trip instead of each
+* issuing their own (which would inflate the pool and hammer the backend).
+* @notInstrumented
+*/
+const fetchAndStoreNonces = async (client) => {
+	const core = getCore(client);
+	const inFlight = core.state.get().nonceFetchInFlight;
+	if (inFlight) return inFlight;
+	const { environmentId } = core;
+	const apiClient = createApiClient({}, client);
+	const fetchPromise = (async () => {
+		const { nonces } = await apiClient.getNonces({
+			count: NONCE_POOL_SIZE,
+			environmentId
 		});
-	}
-};
-
-//#endregion
-//#region src/errors/MfaRateLimitedError.ts
-var MfaRateLimitedError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "mfa_rate_limited_error",
-			docsUrl: null,
-			name: "MfaRateLimitedError",
-			shortMessage: "Rate limited"
+		const existing = core.state.get().prefetchedNonces;
+		core.state.set({
+			prefetchedNonces: [...existing, ...nonces],
+			prefetchedNoncesExpiration: Date.now() + NONCE_POOL_EXPIRATION_TIME
 		});
-	}
+	})().finally(() => {
+		core.state.set({ nonceFetchInFlight: null });
+	});
+	core.state.set({ nonceFetchInFlight: fetchPromise });
+	return fetchPromise;
 };
 
 //#endregion
-//#region src/errors/SandboxMaximumThresholdReachedError.ts
-var SandboxMaximumThresholdReachedError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "sandbox_maximum_threshold_reached_error",
-			docsUrl: "https://www.dynamic.xyz/docs/developer-dashboard/sandbox-vs-live#sandbox-vs-live",
-			name: "SandboxMaximumThresholdReachedError",
-			shortMessage: "Your sandbox environment has reached the maximum MAU. Please use a live environment for production traffic."
-		});
-	}
+//#region src/utils/setCookie/setCookie.ts
+/**
+* Sefelly sets the cookie in the browser.
+* @notInstrumented
+*/
+const setCookie = (cookie) => {
+	document.cookie = cookie;
 };
 
 //#endregion
-//#region src/modules/apiClient/utils/clientErrorMapper/clientErrorMapper.ts
+//#region src/modules/clientEvents/clientEvents.ts
 /**
-* Default error mapper for the client that handles common API error codes.
+* Adds an event listener for Dynamic client events.
 *
-* This mapper transforms specific API error codes into more specific error types:
-* - `mfa_invalid_code` → `MfaInvalidOtpError`
-* - `mfa_rate_limited` → `MfaRateLimitedError`
+* This function allows you to listen for various events emitted by the Dynamic client,
+* such as authentication state changes, wallet connections, and more.
 *
-* @param error - The error to be mapped
-* @returns A transformed error if the error code matches a known pattern, or null if no transformation is needed
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A function that can be called to remove the listener.
+* @notInstrumented
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
+*/
+const onEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.on(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
+/**
+* Removes an event listener from Dynamic client events.
 *
-* @example
-* ```typescript
-* // This will be automatically applied to all API errors
-* const apiClient = createApiClient({}, client);
+* This function unsubscribes a previously registered event listener
+* from the specified Dynamic client event.
 *
-* // The clientErrorMapper will automatically convert mfa_invalid_code errors
-* // to MfaInvalidOtpError instances
-* ```
+* @param params.event - The event name to remove the listener from.
+* @param params.listener - The callback function to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @notInstrumented
 */
-const clientErrorMapper = (error) => {
-	if (error instanceof APIError) {
-		if (error.code === "mfa_invalid_code") return new MfaInvalidOtpError({ cause: error });
-		if (error.code === "mfa_rate_limited") return new MfaRateLimitedError({ cause: error });
-		if (error.code === "invalid_external_auth") return new InvalidExternalAuthError({ cause: error });
-		if (error.code === "sandbox_maximum_threshold_reached") return new SandboxMaximumThresholdReachedError({ cause: error });
-		if (error.code === "merge_accounts_invalid" || error.code === "reassign_wallet_error") return new LinkCredentialError({ cause: error });
-	}
-	return null;
+const offEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.off(event, listener);
 };
-
-//#endregion
-//#region src/modules/apiClient/utils/convertToApiErrorMiddleware/convertToApiErrorMiddleware.ts
 /**
-* Creates middleware that converts HTTP error responses to APIError instances
-* and optionally applies custom error mappers to transform them into specific error types.
+* Adds a one-time event listener for Dynamic client events.
 *
-* @param options.errorMappers - Array of error mappers to apply to API errors
-* @returns A middleware function that handles error conversion and mapping
+* This function listens for an event that will automatically remove itself
+* after being triggered once.
+*
+* @param params.event - The event name to listen for.
+* @param params.listener - The callback function to execute when the event is fired.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A function that can be called to remove the listener before it fires.
 * @notInstrumented
+* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const createConvertToApiErrorMiddleware = ({ errorMappers = [] }) => ({ post: async (context) => {
-	if (context.response.status >= 400) {
-		const apiError = await APIError.fromResponse(context.response);
-		if (apiError) {
-			let errorToThrow = apiError;
-			for (const mapper of errorMappers) {
-				const newError = mapper(apiError);
-				if (newError) {
-					errorToThrow = newError;
-					break;
-				}
-			}
-			throw errorToThrow;
-		}
-	}
-	return context.response;
-} });
-
-//#endregion
-//#region src/utils/getNonce/getNonce.ts
+const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.once(event, listener);
+	return () => {
+		eventEmitter.off(event, listener);
+	};
+};
 /**
-* Returns a nonce for wallet ownership verification.
+* Emits a Dynamic client event.
 *
-* Pops the first nonce from the prefetched pool. When the pool is running low
-* (≤1 remaining after pop) a background refetch is triggered. If the pool is
-* empty, nonces are fetched on-demand before returning.
+* This function triggers an event that will be received by all registered
+* listeners for the specified event type.
+*
+* @param params.event - The event name to emit.
+* @param params.args - The arguments to pass to event listeners.
+* @param client - The Dynamic client instance.
 * @notInstrumented
 */
-const getNonce = async (client) => {
-	const core = getCore(client);
-	const pool = core.state.get().prefetchedNonces;
-	if (pool.length > 0) {
-		const [nonce, ...remaining] = pool;
-		core.state.set({ prefetchedNonces: remaining });
-		if (remaining.length <= 1) fetchAndStoreNonces(client);
-		return nonce;
-	}
-	await fetchAndStoreNonces(client);
-	return getNonce(client);
+const emitEvent = ({ event, args }, client) => {
+	const { eventEmitter } = getCore(client);
+	eventEmitter.emit(event, args);
 };
 
 //#endregion
-//#region src/modules/deviceRegistration/getDeviceSigner/getDeviceSigner.ts
-/** @notInstrumented */
-const getDeviceSigner = async (client) => {
-	const { deviceSigner, keychain } = getCore(client);
-	/**
-	* If the device signer is available, it should handle the device signing.
-	* This is used for mobile devices with secure enclave.
-	*/
-	if (deviceSigner) return deviceSigner;
-	const keyName = "device";
-	if (!await keychain.getPublicKey(keyName)) await keychain.generateKey(keyName);
-	return {
-		getPublicKey: () => keychain.getPublicKey(keyName),
-		sign: (payload) => keychain.sign(keyName, payload)
-	};
+//#region src/errors/InvalidWalletProviderKeyError.ts
+var InvalidWalletProviderKeyError = class extends BaseError {
+	constructor(value) {
+		super({
+			cause: null,
+			code: "invalid_wallet_provider_key",
+			docsUrl: null,
+			name: "InvalidWalletProviderKeyError",
+			shortMessage: `Invalid wallet provider key: ${value}. Key must be in the format of <normalizedWalletNameWithChain>:<walletProviderType>[:<suffix>]`
+		});
+	}
 };
 
 //#endregion
-//#region src/modules/deviceRegistration/getHeadersForNonceSignedByDeviceSigners/getHeadersForNonceSignedByDeviceSigners.ts
+//#region src/modules/wallets/walletProvider/splitWalletProviderKey/splitWalletProviderKey.ts
 /** @notInstrumented */
-const getHeadersForNonceSignedByDeviceSigners = async (client) => {
-	const { projectSettings } = client;
-	assertDefined(projectSettings, "Project settings not found");
-	/**
-	* For cookie based environments, the device registration is handled
-	* by settings the cookie in the browser.
-	* Then we dont need to provide the headers
-	*/
-	if (isCookieEnabled(client)) return {};
-	const deviceSigner = await getDeviceSigner(client);
-	const nonce = await getNonce(client);
-	const signedNonce = await deviceSigner.sign(nonce);
-	const publicKey = await deviceSigner.getPublicKey();
+const splitWalletProviderKey = (walletProviderKey) => {
+	const [normalizedWalletNameWithChain, walletProviderType, suffix, ...rest] = walletProviderKey.split(":");
+	if (!normalizedWalletNameWithChain || !Object.values(WalletProviderEnum).includes(walletProviderType) || rest.length > 0) throw new InvalidWalletProviderKeyError(walletProviderKey);
 	return {
-		"x-dynamic-device-nonce": nonce,
-		"x-dynamic-device-publickey": publicKey,
-		"x-dynamic-device-signed-nonce": signedNonce
+		normalizedWalletNameWithChain,
+		suffix,
+		walletProviderType
 	};
 };
 
 //#endregion
-//#region src/modules/apiClient/utils/deviceSignatureHeadersMiddleware/createDeviceSignatureHeadersMiddleware.ts
+//#region src/modules/wallets/utils/normalizeAddress/normalizeAddress.ts
 /** @notInstrumented */
-const createDeviceSignatureHeadersMiddleware = (client) => {
-	return { pre: async (context) => {
-		/**
-		* The signed nonce is not required for cookie based environments.
-		*/
-		if (isDeviceNonceSignatureRequiredForUrl(context.url) && !isCookieEnabled(client)) {
-			const deviceSignerHeaders = await getHeadersForNonceSignedByDeviceSigners(client);
-			return {
-				init: {
-					...context.init,
-					headers: {
-						...context.init.headers,
-						...deviceSignerHeaders
-					}
-				},
-				url: context.url
-			};
-		}
-	} };
+const normalizeAddress = ({ address, chain }) => {
+	let normalizedAddress = address;
+	if (normalizedAddress?.startsWith("0x")) normalizedAddress = normalizedAddress.slice(2);
+	normalizedAddress = ["EVM", "FLOW"].includes(chain) ? normalizedAddress?.toLowerCase() : normalizedAddress;
+	return normalizedAddress;
 };
 
 //#endregion
-//#region src/errors/UnauthorizedError.ts
-var UnauthorizedError = class extends BaseError {
-	constructor({ cause }) {
-		super({
-			cause,
-			code: "unauthorized_error",
-			docsUrl: null,
-			name: "UnauthorizedError",
-			shortMessage: "Unauthorized"
-		});
-	}
+//#region src/modules/wallets/utils/formatWalletAccountId/formatWalletAccountId.ts
+/** @notInstrumented */
+const formatWalletAccountId = ({ address, chain, walletProviderKey }) => {
+	const { normalizedWalletNameWithChain } = splitWalletProviderKey(walletProviderKey);
+	return `${normalizedWalletNameWithChain}:${normalizeAddress({
+		address,
+		chain
+	})}`;
 };
 
 //#endregion
-//#region src/modules/apiClient/utils/unauthorizedMiddleware/createUnauthorizedMiddleware.ts
+//#region src/modules/wallets/utils/convertUnverifiedWalletAccountToWalletAccount/convertUnverifiedWalletAccountToWalletAccount.ts
 /** @notInstrumented */
-const createUnauthorizedMiddleware = () => ({ post: async (context) => {
-	if (context.response.status === 401) {
-		let cause = null;
-		try {
-			const errorBody = await context.response.clone().json();
-			if (errorBody && "error" in errorBody && typeof errorBody.error === "string") cause = new Error(errorBody.error);
-		} catch {}
-		throw new UnauthorizedError({ cause });
+const convertUnverifiedWalletAccountToWalletAccount = ({ unverifiedWalletAccount }) => ({
+	address: unverifiedWalletAccount.address,
+	addressesWithTypes: unverifiedWalletAccount.addressesWithTypes,
+	chain: unverifiedWalletAccount.chain,
+	id: formatWalletAccountId({
+		address: unverifiedWalletAccount.address,
+		chain: unverifiedWalletAccount.chain,
+		walletProviderKey: unverifiedWalletAccount.walletProviderKey
+	}),
+	lastSelectedAt: unverifiedWalletAccount.lastSelectedAt,
+	verifiedCredentialId: null,
+	walletProviderKey: unverifiedWalletAccount.walletProviderKey
+});
+
+//#endregion
+//#region src/modules/wallets/constants.ts
+const CHAINS_INFO_MAP = {
+	ALEO: {
+		apiChainName: "aleo",
+		blockchainName: "Aleo",
+		verifiedCredentialChainName: "aleo"
+	},
+	ALGO: {
+		apiChainName: "algo",
+		blockchainName: "Algorand",
+		verifiedCredentialChainName: "algorand"
+	},
+	APTOS: {
+		apiChainName: "aptos",
+		blockchainName: "Aptos",
+		verifiedCredentialChainName: "aptos"
+	},
+	BTC: {
+		apiChainName: "bitcoin",
+		blockchainName: "Bitcoin",
+		legacyWalletBookAliases: ["btc"],
+		verifiedCredentialChainName: "bip122"
+	},
+	COSMOS: {
+		apiChainName: "cosmos",
+		blockchainName: "Cosmos",
+		verifiedCredentialChainName: "cosmos"
+	},
+	ECLIPSE: {
+		apiChainName: "eclipse",
+		blockchainName: "Eclipse",
+		verifiedCredentialChainName: "eclipse"
+	},
+	EVM: {
+		apiChainName: "evm",
+		blockchainName: "Ethereum",
+		verifiedCredentialChainName: "eip155"
+	},
+	FLOW: {
+		apiChainName: "flow",
+		blockchainName: "Flow",
+		verifiedCredentialChainName: "flow"
+	},
+	MIDNIGHT: {
+		apiChainName: "midnight",
+		blockchainName: "Midnight",
+		verifiedCredentialChainName: "midnight"
+	},
+	SOL: {
+		apiChainName: "solana",
+		blockchainName: "Solana",
+		legacyWalletBookAliases: ["sol"],
+		verifiedCredentialChainName: "solana",
+		waasChainNameOverride: "SVM"
+	},
+	SPARK: {
+		apiChainName: "spark",
+		blockchainName: "Spark",
+		verifiedCredentialChainName: "spark"
+	},
+	STARK: {
+		apiChainName: "starknet",
+		blockchainName: "Starknet",
+		legacyWalletBookAliases: ["stark"],
+		verifiedCredentialChainName: "starknet"
+	},
+	STELLAR: {
+		apiChainName: "stellar",
+		blockchainName: "Stellar",
+		verifiedCredentialChainName: "stellar"
+	},
+	SUI: {
+		apiChainName: "sui",
+		blockchainName: "Sui",
+		verifiedCredentialChainName: "sui"
+	},
+	TEMPO: {
+		apiChainName: "tempo",
+		blockchainName: "Tempo",
+		verifiedCredentialChainName: "tempo"
+	},
+	TON: {
+		apiChainName: "ton",
+		blockchainName: "TON",
+		verifiedCredentialChainName: "ton"
+	},
+	TRON: {
+		apiChainName: "tron",
+		blockchainName: "Tron",
+		verifiedCredentialChainName: "tron"
 	}
-	return context.response;
-} });
+};
 
 //#endregion
-//#region src/modules/apiClient/createApiClient.ts
-/**
-* Returns a new instance of the SDK API client.
-*
-* This is not meant for storing, as it is very light we can create it whenever needed.
+//#region src/utils/getChainFromVerifiedCredentialChain/getChainFromVerifiedCredentialChain.ts
+/** @notInstrumented */
+const getChainFromVerifiedCredentialChain = (verifiedCredentialChain) => {
+	const chain = Object.keys(CHAINS_INFO_MAP).find((chain$1) => CHAINS_INFO_MAP[chain$1].verifiedCredentialChainName === verifiedCredentialChain);
+	assertDefined(chain, `Unknown chain: ${verifiedCredentialChain}`);
+	return chain;
+};
+
+//#endregion
+//#region src/modules/wallets/utils/normalizeWalletNameWithChain/normalizeWalletNameWithChain.ts
+/**
+* Format the raw wallet name and chain to get the value we can use for
+* verified credentials' `walletName` field.
 * @notInstrumented
 */
-const createApiClient = (options = {}, client) => {
-	const core = getCore(client);
-	const coreState = core.state.get();
-	const settings = {
-		basePath: core.apiBaseUrl,
-		headers: {
-			"Content-Type": "application/json",
-			[DYNAMIC_API_VERSION_HEADER]: `API/${DYNAMIC_SDK_API_VERSION}`,
-			[DYNAMIC_REQUEST_ID_HEADER]: randomString({ length: 50 }),
-			[DYNAMIC_SDK_SESSION_ID_HEADER]: core.sdkSessionId,
-			[DYNAMIC_SDK_VERSION_HEADER]: `${CLIENT_SDK_NAME}/${version}`,
-			...core.getApiHeaders(),
-			...options.headers
-		}
-	};
-	if (core.metadata?.universalLink) settings.headers["Origin"] = core.metadata.universalLink;
-	if (client.token) settings.headers.Authorization = `Bearer ${client.token}`;
-	if (client.projectSettings && isCookieEnabled(client)) settings.credentials = "include";
-	if (options.includeMfaToken && coreState.mfaToken) settings.headers[MFA_TOKEN_HEADER] = coreState.mfaToken;
-	if (options.elevatedAccessTokenScope) {
-		const elevatedToken = __getElevatedAccessToken_wrapped({ scope: options.elevatedAccessTokenScope }, client);
-		if (elevatedToken) settings.headers[ELEVATED_ACCESS_TOKEN_HEADER] = elevatedToken;
-	}
-	const sessionPublicKey = getSessionKeys(client)?.publicKey;
-	const isSessionPublicKeyHeaderPresent = settings.headers[SESSION_PUBLIC_KEY_HEADER] !== void 0;
-	if (sessionPublicKey && !isSessionPublicKeyHeaderPresent) settings.headers[SESSION_PUBLIC_KEY_HEADER] = sessionPublicKey;
-	return new SDKApi(new Configuration({
-		...settings,
-		fetchApi: core.fetch,
-		middleware: [
-			createDeviceSignatureHeadersMiddleware(client),
-			createConvertToApiErrorMiddleware({ errorMappers: [...options.errorMappers || [], clientErrorMapper] }),
-			createUnauthorizedMiddleware()
-		]
-	}));
+const normalizeWalletNameWithChain = ({ displayName, chain }) => {
+	const sanitizedWalletName = displayName.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+	const chainLowered = chain.toLocaleLowerCase();
+	if (sanitizedWalletName.endsWith(chainLowered)) return sanitizedWalletName;
+	return `${sanitizedWalletName}${chainLowered}`;
 };
 
 //#endregion
-//#region src/utils/getNonce/fetchAndStoreNonces/fetchAndStoreNonces.ts
+//#region src/modules/wallets/utils/formatWalletProviderKey/formatWalletProviderKey.ts
 /**
-* Fetches a batch of nonces from the API.
-*
-* Prefetching is critical for iOS deep link wallet providers (e.g. Phantom
-* redirect). On iOS, a network request (like fetching a nonce) between a user
-* action and a deeplink call will break the gesture chain, causing iOS to
-* silently ignore the deeplink. By prefetching nonces ahead of time,
-* `getNonce` can return synchronously from cache and the deeplink fires
-* without an interrupting network round-trip.
+* Assembles the wallet provider key from the wallet name, chain, and wallet provider type.
 *
-* New nonces are **appended** to the existing pool so that unconsumed entries
-* are not discarded by a background refetch.
+* The suffix is optional and can be used to add a uniquely identifying string to the key, which
+* might be necessary for some wallet providers (like Wallet Connect).
 *
-* Concurrent refills are coalesced behind a single in-flight promise so that
-* simultaneous callers share one `GET /nonces` round-trip instead of each
-* issuing their own (which would inflate the pool and hammer the backend).
+* IMPORTANT: Do NOT add a suffix unless absolutely necessary, as it will cause the wallet account
+* to not be able to find its wallet provider when connecting to a new device (it won't be possible
+* to determine the full key just from the Verified Credential data).
 * @notInstrumented
 */
-const fetchAndStoreNonces = async (client) => {
-	const core = getCore(client);
-	const inFlight = core.state.get().nonceFetchInFlight;
-	if (inFlight) return inFlight;
-	const { environmentId } = core;
-	const apiClient = createApiClient({}, client);
-	const fetchPromise = (async () => {
-		const { nonces } = await apiClient.getNonces({
-			count: NONCE_POOL_SIZE,
-			environmentId
-		});
-		const existing = core.state.get().prefetchedNonces;
-		core.state.set({
-			prefetchedNonces: [...existing, ...nonces],
-			prefetchedNoncesExpiration: Date.now() + NONCE_POOL_EXPIRATION_TIME
-		});
-	})().finally(() => {
-		core.state.set({ nonceFetchInFlight: null });
+const formatWalletProviderKey = ({ suffix, chain, displayName, walletProviderType }) => {
+	return `${normalizeWalletNameWithChain({
+		chain,
+		displayName
+	})}:${walletProviderType}${suffix ? `:${suffix}` : ""}`;
+};
+
+//#endregion
+//#region src/modules/wallets/walletProvider/walletProviderKeyMap/getWalletProviderKeyFromVerifiedCredential/getWalletProviderKeyFromVerifiedCredential.ts
+/** @notInstrumented */
+const getWalletProviderKeyFromVerifiedCredential = ({ verifiedCredential }, client) => {
+	const { walletProviderKeyMap } = getCore(client).state.get();
+	const storedWalletProviderKey = walletProviderKeyMap[verifiedCredential.id];
+	if (storedWalletProviderKey) return { walletProviderKey: storedWalletProviderKey };
+	/**
+	* We fallback to comprising the wallet provider key from walletName and walletProvider.
+	*
+	* Some wallet provider types (like Wallet Connect) also use a special suffix for their wallet provider
+	* keys, so this won't be enough for them.
+	* Therefore, for those specific wallet providers, the wallet account will remain without a wallet provider
+	* and will require reconnection.
+	* Read walletProvider.types.ts for more info.
+	*/
+	assertDefined(verifiedCredential.walletName, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing walletName`);
+	assertDefined(verifiedCredential.walletProvider, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing walletProvider`);
+	assertDefined(verifiedCredential.chain, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing chain`);
+	return { walletProviderKey: formatWalletProviderKey({
+		chain: getChainFromVerifiedCredentialChain(verifiedCredential.chain),
+		displayName: verifiedCredential.walletName,
+		walletProviderType: verifiedCredential.walletProvider
+	}) };
+};
+
+//#endregion
+//#region src/modules/wallets/utils/convertVerifiedCredentialToWalletAccount/convertVerifiedCredentialToWalletAccount.ts
+/** @notInstrumented */
+const convertVerifiedCredentialToWalletAccount = ({ verifiedCredential }, client) => {
+	assertDefined(verifiedCredential.address, "Missing address in verified credential");
+	assertDefined(verifiedCredential.chain, "Missing chain in verified credential");
+	const chain = getChainFromVerifiedCredentialChain(verifiedCredential.chain);
+	const { walletProviderKey } = getWalletProviderKeyFromVerifiedCredential({ verifiedCredential }, client);
+	const walletAccountId = formatWalletAccountId({
+		address: verifiedCredential.address,
+		chain,
+		walletProviderKey
 	});
-	core.state.set({ nonceFetchInFlight: fetchPromise });
-	return fetchPromise;
+	return {
+		address: verifiedCredential.address,
+		addressesWithTypes: verifiedCredential.walletAdditionalAddresses,
+		chain,
+		hardwareWalletVendor: verifiedCredential.walletProperties?.hardwareWallet,
+		id: walletAccountId,
+		lastSelectedAt: verifiedCredential.lastSelectedAt ?? null,
+		verifiedCredentialId: verifiedCredential.id,
+		walletProviderKey
+	};
 };
 
 //#endregion
-//#region src/utils/setCookie/setCookie.ts
-/**
-* Sefelly sets the cookie in the browser.
-* @notInstrumented
-*/
-const setCookie = (cookie) => {
-	document.cookie = cookie;
+//#region src/modules/wallets/getWalletAccounts/getWalletAccountsFromState/getWalletAccountsFromState.ts
+/** @notInstrumented */
+const getWalletAccountsFromState = ({ unverifiedWalletAccounts, user }, client) => {
+	const walletAccountsMap = /* @__PURE__ */ new Map();
+	/**
+	* Handle the unverified wallet accounts before the user verified credentials
+	* so the later verified wallet accounts can override the unverified wallet accounts
+	*/
+	unverifiedWalletAccounts.forEach((unverifiedWalletAccount) => {
+		const walletAccount = convertUnverifiedWalletAccountToWalletAccount({ unverifiedWalletAccount });
+		walletAccountsMap.set(walletAccount.id, walletAccount);
+	});
+	(user?.verifiedCredentials ?? []).filter((verified) => verified.format === JwtVerifiedCredentialFormatEnum.Blockchain).forEach((verifiedWalletAccount) => {
+		try {
+			const walletAccount = convertVerifiedCredentialToWalletAccount({ verifiedCredential: verifiedWalletAccount }, client);
+			walletAccountsMap.set(walletAccount.id, walletAccount);
+		} catch (error) {
+			/**
+			* A verified credential can be missing the data required to resolve its
+			* wallet provider (e.g. a legacy credential without a walletName). Skip
+			* it instead of throwing so a single unconvertible credential does not
+			* abort the whole mapping — which, during client initialization, would
+			* otherwise fail init and leave the app stuck loading. The wallet stays
+			* absent until the user reconnects it.
+			*/
+			getCore(client).logger.debug(`Skipping verified credential ${verifiedWalletAccount.id}: unable to convert to wallet account`, error);
+		}
+	});
+	return Array.from(walletAccountsMap.values());
 };
 
 //#endregion
-//#region src/modules/clientEvents/clientEvents.ts
+//#region src/modules/wallets/getWalletAccounts/getWalletAccounts.ts
 /**
-* Adds an event listener for Dynamic client events.
+* Retrieves all wallet accounts associated with the current session.
 *
-* This function allows you to listen for various events emitted by the Dynamic client,
-* such as authentication state changes, wallet connections, and more.
+* This function returns both verified and unverified wallet accounts,
+* combining data from user credentials and local unverified accounts.
+* You can differentiate between verified and unverified wallet accounts by
+* checking the `verifiedCredentialId` property.
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener.
+* @returns An array of wallet accounts associated with the session.
 * @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
+* @hook Exposed as a hook so consumers get the reactive list of wallet accounts.
 */
-const onEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.on(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
-	};
+const getWalletAccounts = (client = getDefaultClient()) => {
+	const { unverifiedWalletAccounts, user } = getCore(client).state.get();
+	return getWalletAccountsFromState({
+		unverifiedWalletAccounts,
+		user
+	}, client);
+};
+
+//#endregion
+//#region src/errors/NoWalletProviderFoundError.ts
+var NoWalletProviderFoundError = class extends BaseError {
+	constructor({ walletProviderKey }) {
+		super({
+			cause: null,
+			code: "no_wallet_provider_found_error",
+			docsUrl: null,
+			name: "NoWalletProviderFoundError",
+			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+		});
+	}
 };
+
+//#endregion
+//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
 /**
-* Removes an event listener from Dynamic client events.
-*
-* This function unsubscribes a previously registered event listener
-* from the specified Dynamic client event.
+* Creates a service accessor function that manages service instantiation and caching.
+* The returned function will either retrieve an existing service from the registry or
+* create a new one using the provided builder function.
 *
-* @param params.event - The event name to remove the listener from.
-* @param params.listener - The callback function to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @template - The type of service to be created/accessed
+* @param key - Unique identifier for the service in the registry
+* @param builder - Function that creates the service instance when called with a DynamicClient
 * @notInstrumented
 */
-const offEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.off(event, listener);
+const createRuntimeServiceAccessKey = (key, builder) => (client) => {
+	const { runtimeServices } = getCore(client);
+	const currentService = runtimeServices.getByKey(key);
+	if (currentService) return currentService;
+	const service = builder(client);
+	runtimeServices.register(key, service);
+	return service;
 };
-/**
-* Adds a one-time event listener for Dynamic client events.
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/createWalletProviderRegistry/createWalletProviderRegistry.ts
+/**
+* Creates a new wallet provider registry that manages wallet providers with priority-based registration.
 *
-* This function listens for an event that will automatically remove itself
-* after being triggered once.
+* @returns The wallet provider registry instance
 *
-* @param params.event - The event name to listen for.
-* @param params.listener - The callback function to execute when the event is fired.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A function that can be called to remove the listener before it fires.
+* @example
+* ```typescript
+* const registry = createWalletProviderRegistry();
+*
+* registry.register({
+*   priority: WalletProviderPriority.WALLET_SDK,
+*   walletProvider: myWalletProvider
+* });
+*
+* const provider = registry.getByKey('my-wallet-key');
+* const providers = registry.listProviders();
+* ```
 * @notInstrumented
-* @hook Event listeners are error-prone to wire up by hand with useEffect.
 */
-const onceEvent = ({ event, listener }, client = getDefaultClient()) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.once(event, listener);
-	return () => {
-		eventEmitter.off(event, listener);
+const createWalletProviderRegistry = (client) => {
+	const registry = /* @__PURE__ */ new Map();
+	return {
+		getByKey: (key) => registry.get(key)?.walletProvider,
+		listProviderEntries: () => Array.from(registry.values()),
+		listProviders: () => Array.from(registry.values()).map((v) => v.walletProvider),
+		register: (args) => {
+			const existingEntry = registry.get(args.walletProvider.key);
+			if (existingEntry) {
+				if (existingEntry.priority < args.priority) {
+					registry.set(args.walletProvider.key, args);
+					emitEvent({
+						args: { walletProviderKey: args.walletProvider.key },
+						event: "walletProviderChanged"
+					}, client);
+				}
+			} else {
+				registry.set(args.walletProvider.key, args);
+				emitEvent({
+					args: { walletProvider: args.walletProvider },
+					event: "walletProviderRegistered"
+				}, client);
+				emitEvent({
+					args: { walletProviderKey: args.walletProvider.key },
+					event: "walletProviderChanged"
+				}, client);
+			}
+		},
+		unregister: (key) => {
+			registry.delete(key);
+			emitEvent({
+				args: { walletProviderKey: key },
+				event: "walletProviderUnregistered"
+			}, client);
+		}
 	};
 };
+
+//#endregion
+//#region src/modules/wallets/walletProviderRegistry/getWalletProviderRegistry/getWalletProviderRegistry.ts
 /**
-* Emits a Dynamic client event.
+* This function provides access to a shared instance of the wallet provider registry.
 *
-* This function triggers an event that will be received by all registered
-* listeners for the specified event type.
+* It ensures that the same registry instance is used throughout the client to maintaining
+* consistency of registered wallet providers across different parts of the codebase.
 *
-* @param params.event - The event name to emit.
-* @param params.args - The arguments to pass to event listeners.
-* @param client - The Dynamic client instance.
-* @notInstrumented
+* @returns The wallet provider registry instance
+*
+* @example
+* ```typescript
+* // Get the registry instance
+* const registry = getWalletProviderRegistry();
+*
+* // Register a wallet provider
+* registry.register({
+*   priority: WalletProviderPriority.WALLET_SDK,
+*   walletProvider: myWalletProvider
+* });
+*
+* // Retrieve a specific provider
+* const provider = registry.getByKey('metamaskevm');
+* ```
 */
-const emitEvent = ({ event, args }, client) => {
-	const { eventEmitter } = getCore(client);
-	eventEmitter.emit(event, args);
-};
+const getWalletProviderRegistry = createRuntimeServiceAccessKey("walletProviderRegistry", (client) => createWalletProviderRegistry(client));
 
 //#endregion
-//#region src/errors/InvalidWalletProviderKeyError.ts
-var InvalidWalletProviderKeyError = class extends BaseError {
-	constructor(value) {
-		super({
-			cause: null,
-			code: "invalid_wallet_provider_key",
-			docsUrl: null,
-			name: "InvalidWalletProviderKeyError",
-			shortMessage: `Invalid wallet provider key: ${value}. Key must be in the format of <normalizedWalletNameWithChain>:<walletProviderType>[:<suffix>]`
-		});
-	}
-};
+//#region src/modules/wallets/walletProviderRegistry/walletProviderRegistry.types.ts
+let WalletProviderPriority = /* @__PURE__ */ function(WalletProviderPriority$1) {
+	/**
+	* Highest priority should be used by wallet providers that implement
+	* the most reliable wallet integration.
+	* example: The SDK provided by the wallet provider.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SDK"] = 100] = "WALLET_SDK";
+	/**
+	* Medium priority should be used by wallet providers that implement
+	* a wallet integration via some reliable standard.
+	* example: A wallet provider that uses EIP6963 announcement.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SELF_ANNOUNCEMENT_STANDARD"] = 50] = "WALLET_SELF_ANNOUNCEMENT_STANDARD";
+	/**
+	* Low priority should be used by wallet providers that implement
+	* a wallet integration on a less reliable standard.
+	* example: A wallet provider that uses window.ethereum, where the
+	* window key can be overridden by other extensions.
+	*/
+	WalletProviderPriority$1[WalletProviderPriority$1["WINDOW_INJECT"] = 20] = "WINDOW_INJECT";
+	return WalletProviderPriority$1;
+}({});
 
 //#endregion
-//#region src/modules/wallets/walletProvider/splitWalletProviderKey/splitWalletProviderKey.ts
+//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
 /** @notInstrumented */
-const splitWalletProviderKey = (walletProviderKey) => {
-	const [normalizedWalletNameWithChain, walletProviderType, suffix, ...rest] = walletProviderKey.split(":");
-	if (!normalizedWalletNameWithChain || !Object.values(WalletProviderEnum).includes(walletProviderType) || rest.length > 0) throw new InvalidWalletProviderKeyError(walletProviderKey);
-	return {
-		normalizedWalletNameWithChain,
-		suffix,
-		walletProviderType
-	};
+const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
+	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
+	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
+	return walletProvider;
 };
 
 //#endregion
-//#region src/modules/wallets/utils/normalizeAddress/normalizeAddress.ts
-/** @notInstrumented */
-const normalizeAddress = ({ address, chain }) => {
-	let normalizedAddress = address;
-	if (normalizedAddress?.startsWith("0x")) normalizedAddress = normalizedAddress.slice(2);
-	normalizedAddress = ["EVM", "FLOW"].includes(chain) ? normalizedAddress?.toLowerCase() : normalizedAddress;
-	return normalizedAddress;
+//#region src/modules/auth/consts.ts
+const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
+
+//#endregion
+//#region src/modules/auth/extractSessionId/extractSessionId.ts
+/**
+* Extracts the session ID (`sid` claim) from a JWT token string.
+*
+* Decodes the base64url-encoded payload segment of the token and reads the
+* `sid` field. This is used to correlate instrumentation events with the
+* authenticated session, without ever forwarding the full token.
+*
+* Returns `null` when no token is present, when the token is malformed, or
+* when the payload does not contain a `sid` claim.
+* @notInstrumented
+*/
+const extractSessionId = (token) => {
+	try {
+		const payload = token.split(".")[1];
+		return JSON.parse(atob(payload)).sid ?? null;
+	} catch {
+		return null;
+	}
 };
 
 //#endregion
-//#region src/modules/wallets/utils/formatWalletAccountId/formatWalletAccountId.ts
-/** @notInstrumented */
-const formatWalletAccountId = ({ address, chain, walletProviderKey }) => {
-	const { normalizedWalletNameWithChain } = splitWalletProviderKey(walletProviderKey);
-	return `${normalizedWalletNameWithChain}:${normalizeAddress({
-		address,
-		chain
-	})}`;
+//#region src/utils/getOperatingSystem/getOperatingSystem.ts
+/**
+* Detects the operating system from `navigator.userAgent` for web environments.
+*
+* The React Native bundler (Metro) resolves `getOperatingSystem.native.ts`
+* instead when building for React Native, which uses `Platform.OS` directly.
+*
+* Falls back to `'unknown'` when `navigator` is unavailable (SSR, service
+* workers) or when the user-agent string doesn't match a known OS pattern.
+* @notInstrumented
+*/
+const getOperatingSystem = () => {
+	try {
+		const ua = navigator.userAgent;
+		if (/iPhone|iPad|iPod/.test(ua)) return "ios";
+		if (/Android/.test(ua)) return "android";
+		if (/Windows/.test(ua)) return "windows";
+		if (/Macintosh|Mac OS X/.test(ua)) return "macos";
+		if (/Linux/.test(ua)) return "linux";
+		return "unknown";
+	} catch {
+		return "unknown";
+	}
 };
 
 //#endregion
-//#region src/modules/wallets/utils/convertUnverifiedWalletAccountToWalletAccount/convertUnverifiedWalletAccountToWalletAccount.ts
-/** @notInstrumented */
-const convertUnverifiedWalletAccountToWalletAccount = ({ unverifiedWalletAccount }) => ({
-	address: unverifiedWalletAccount.address,
-	addressesWithTypes: unverifiedWalletAccount.addressesWithTypes,
-	chain: unverifiedWalletAccount.chain,
-	id: formatWalletAccountId({
-		address: unverifiedWalletAccount.address,
-		chain: unverifiedWalletAccount.chain,
-		walletProviderKey: unverifiedWalletAccount.walletProviderKey
-	}),
-	lastSelectedAt: unverifiedWalletAccount.lastSelectedAt,
-	verifiedCredentialId: null,
-	walletProviderKey: unverifiedWalletAccount.walletProviderKey
-});
+//#region src/utils/getPlatform/getPlatform.ts
+/**
+* Returns the platform the SDK is running on.
+*
+* This is the web implementation — the React Native bundler resolves
+* `getPlatform.native.ts` instead when building for React Native, which
+* returns `'react-native'`.
+* @notInstrumented
+*/
+const getPlatform = () => "web";
 
 //#endregion
-//#region src/modules/wallets/constants.ts
-const CHAINS_INFO_MAP = {
-	ALEO: {
-		apiChainName: "aleo",
-		blockchainName: "Aleo",
-		verifiedCredentialChainName: "aleo"
-	},
-	ALGO: {
-		apiChainName: "algo",
-		blockchainName: "Algorand",
-		verifiedCredentialChainName: "algorand"
-	},
-	APTOS: {
-		apiChainName: "aptos",
-		blockchainName: "Aptos",
-		verifiedCredentialChainName: "aptos"
-	},
-	BTC: {
-		apiChainName: "bitcoin",
-		blockchainName: "Bitcoin",
-		legacyWalletBookAliases: ["btc"],
-		verifiedCredentialChainName: "bip122"
-	},
-	COSMOS: {
-		apiChainName: "cosmos",
-		blockchainName: "Cosmos",
-		verifiedCredentialChainName: "cosmos"
-	},
-	ECLIPSE: {
-		apiChainName: "eclipse",
-		blockchainName: "Eclipse",
-		verifiedCredentialChainName: "eclipse"
-	},
-	EVM: {
-		apiChainName: "evm",
-		blockchainName: "Ethereum",
-		verifiedCredentialChainName: "eip155"
-	},
-	FLOW: {
-		apiChainName: "flow",
-		blockchainName: "Flow",
-		verifiedCredentialChainName: "flow"
-	},
-	MIDNIGHT: {
-		apiChainName: "midnight",
-		blockchainName: "Midnight",
-		verifiedCredentialChainName: "midnight"
-	},
-	SOL: {
-		apiChainName: "solana",
-		blockchainName: "Solana",
-		legacyWalletBookAliases: ["sol"],
-		verifiedCredentialChainName: "solana",
-		waasChainNameOverride: "SVM"
-	},
-	SPARK: {
-		apiChainName: "spark",
-		blockchainName: "Spark",
-		verifiedCredentialChainName: "spark"
-	},
-	STARK: {
-		apiChainName: "starknet",
-		blockchainName: "Starknet",
-		legacyWalletBookAliases: ["stark"],
-		verifiedCredentialChainName: "starknet"
-	},
-	STELLAR: {
-		apiChainName: "stellar",
-		blockchainName: "Stellar",
-		verifiedCredentialChainName: "stellar"
-	},
-	SUI: {
-		apiChainName: "sui",
-		blockchainName: "Sui",
-		verifiedCredentialChainName: "sui"
-	},
-	TEMPO: {
-		apiChainName: "tempo",
-		blockchainName: "Tempo",
-		verifiedCredentialChainName: "tempo"
-	},
-	TON: {
-		apiChainName: "ton",
-		blockchainName: "TON",
-		verifiedCredentialChainName: "ton"
-	},
-	TRON: {
-		apiChainName: "tron",
-		blockchainName: "Tron",
-		verifiedCredentialChainName: "tron"
-	}
-};
-
-//#endregion
-//#region src/utils/getChainFromVerifiedCredentialChain/getChainFromVerifiedCredentialChain.ts
-/** @notInstrumented */
-const getChainFromVerifiedCredentialChain = (verifiedCredentialChain) => {
-	const chain = Object.keys(CHAINS_INFO_MAP).find((chain$1) => CHAINS_INFO_MAP[chain$1].verifiedCredentialChainName === verifiedCredentialChain);
-	assertDefined(chain, `Unknown chain: ${verifiedCredentialChain}`);
-	return chain;
-};
-
-//#endregion
-//#region src/modules/wallets/utils/normalizeWalletNameWithChain/normalizeWalletNameWithChain.ts
+//#region src/utils/getUserAgent/getUserAgent.ts
 /**
-* Format the raw wallet name and chain to get the value we can use for
-* verified credentials' `walletName` field.
+* Returns the browser's `navigator.userAgent` string for inclusion in
+* instrumentation events.
+*
+* Falls back to an empty string in environments where `navigator` is not
+* available (e.g., Node.js SSR, service workers) so that callers never need
+* to guard against undefined.
 * @notInstrumented
 */
-const normalizeWalletNameWithChain = ({ displayName, chain }) => {
-	const sanitizedWalletName = displayName.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
-	const chainLowered = chain.toLocaleLowerCase();
-	if (sanitizedWalletName.endsWith(chainLowered)) return sanitizedWalletName;
-	return `${sanitizedWalletName}${chainLowered}`;
+const getUserAgent = () => {
+	try {
+		return navigator.userAgent;
+	} catch {
+		return "";
+	}
 };
 
 //#endregion
-//#region src/modules/wallets/utils/formatWalletProviderKey/formatWalletProviderKey.ts
+//#region src/services/instrumentation/constants.ts
 /**
-* Assembles the wallet provider key from the wallet name, chain, and wallet provider type.
+* Default key-based PII scrubber list, lowercased and matched against the
+* lowercased object key.
 *
-* The suffix is optional and can be used to add a uniquely identifying string to the key, which
-* might be necessary for some wallet providers (like Wallet Connect).
+* Two complementary mechanisms cover credential leakage:
 *
-* IMPORTANT: Do NOT add a suffix unless absolutely necessary, as it will cause the wallet account
-* to not be able to find its wallet provider when connecting to a new device (it won't be possible
-* to determine the full key just from the Verified Credential data).
-* @notInstrumented
+* 1. Explicit keys listed here — matched exactly (case-insensitive). Use this
+*    for keys that don't end in a generic credential suffix (e.g. `mnemonic`,
+*    `seed`, `verificationCode`, `keyShare`).
+* 2. Suffix matching in {@link scrubParameters} for the credential suffixes
+*    enumerated by {@link PII_KEY_SUFFIXES} — catches any field whose name
+*    ends in `token` or `jwt` (e.g. `mfaToken`, `minifiedJwt`, `accessToken`,
+*    `idToken`, `captchaToken`, …) without needing to enumerate them here.
 */
-const formatWalletProviderKey = ({ suffix, chain, displayName, walletProviderType }) => {
-	return `${normalizeWalletNameWithChain({
-		chain,
-		displayName
-	})}:${walletProviderType}${suffix ? `:${suffix}` : ""}`;
-};
+const DEFAULT_PII_FIELDS = [
+	"password",
+	"token",
+	"secret",
+	"privateKey",
+	"privateJwk",
+	"mnemonic",
+	"seed",
+	"keyShare",
+	"keyShares",
+	"email",
+	"phone",
+	"ssn",
+	"address",
+	"authorization",
+	"verificationCode",
+	"recoveryCodes",
+	"codeVerifier",
+	"pkce",
+	"bearer",
+	"apiKey",
+	"alias",
+	"publicIdentifier"
+];
+/**
+* Lowercased suffixes used by {@link scrubParameters} to match credential-like
+* keys without enumerating every variant (e.g. `mfaToken`, `accessToken`,
+* `refreshToken`, `legacyToken`, `minifiedJwt`). Only suffixes that are
+* unambiguously credentials belong here — `key` (matches `publicKey`) and
+* `code` (matches `countryCode`) are too broad and must not be added.
+*/
+const PII_KEY_SUFFIXES = ["token", "jwt"];
+const REDACTED_VALUE = "[REDACTED]";
+const MAX_STRING_LENGTH = 500;
+const TRUNCATED_SUFFIX = "...[truncated]";
+/**
+* Label prefix for binary data placeholders. The full placeholder includes the
+* byte length, e.g. `[Binary:16 bytes]`, so consumers can gauge data size
+* without the actual bytes appearing in logs.
+*/
+const BINARY_LABEL = "Binary";
+/**
+* Placeholder emitted when a circular reference is detected in the value tree.
+* Using a named constant makes it easy to search for or filter in downstream
+* log tooling.
+*/
+const CIRCULAR_VALUE = "[Circular]";
 
 //#endregion
-//#region src/modules/wallets/walletProvider/walletProviderKeyMap/getWalletProviderKeyFromVerifiedCredential/getWalletProviderKeyFromVerifiedCredential.ts
-/** @notInstrumented */
-const getWalletProviderKeyFromVerifiedCredential = ({ verifiedCredential }, client) => {
-	const { walletProviderKeyMap } = getCore(client).state.get();
-	const storedWalletProviderKey = walletProviderKeyMap[verifiedCredential.id];
-	if (storedWalletProviderKey) return { walletProviderKey: storedWalletProviderKey };
-	/**
-	* We fallback to comprising the wallet provider key from walletName and walletProvider.
-	*
-	* Some wallet provider types (like Wallet Connect) also use a special suffix for their wallet provider
-	* keys, so this won't be enough for them.
-	* Therefore, for those specific wallet providers, the wallet account will remain without a wallet provider
-	* and will require reconnection.
-	* Read walletProvider.types.ts for more info.
-	*/
-	assertDefined(verifiedCredential.walletName, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing walletName`);
-	assertDefined(verifiedCredential.walletProvider, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing walletProvider`);
-	assertDefined(verifiedCredential.chain, `Failed to get wallet provider for verified credential with ID ${verifiedCredential.id}: missing chain`);
-	return { walletProviderKey: formatWalletProviderKey({
-		chain: getChainFromVerifiedCredentialChain(verifiedCredential.chain),
-		displayName: verifiedCredential.walletName,
-		walletProviderType: verifiedCredential.walletProvider
-	}) };
+//#region src/services/instrumentation/scrubParameters/scrubParameters.ts
+/**
+* Returns true when `key` should be redacted based on the configured PII
+* field list. A key matches when its lowercased form either equals one of
+* `piiFieldsLower` exactly, or ends in one of the curated credential
+* suffixes in {@link PII_KEY_SUFFIXES} (currently `token` and `jwt`). The
+* suffix check is what catches `mfaToken`, `minifiedJwt`, `accessToken`,
+* etc. without needing every variant enumerated explicitly.
+*/
+const keyMatchesPiiField = ({ keyLower, piiFieldsLower }) => {
+	if (piiFieldsLower.includes(keyLower)) return true;
+	return PII_KEY_SUFFIXES.some((suffix) => keyLower.endsWith(suffix));
 };
-
-//#endregion
-//#region src/modules/wallets/utils/convertVerifiedCredentialToWalletAccount/convertVerifiedCredentialToWalletAccount.ts
-/** @notInstrumented */
-const convertVerifiedCredentialToWalletAccount = ({ verifiedCredential }, client) => {
-	assertDefined(verifiedCredential.address, "Missing address in verified credential");
-	assertDefined(verifiedCredential.chain, "Missing chain in verified credential");
-	const chain = getChainFromVerifiedCredentialChain(verifiedCredential.chain);
-	const { walletProviderKey } = getWalletProviderKeyFromVerifiedCredential({ verifiedCredential }, client);
-	const walletAccountId = formatWalletAccountId({
-		address: verifiedCredential.address,
-		chain,
-		walletProviderKey
+const scrubString = ({ key, piiFieldsLower, redactAll, value }) => {
+	if (keyMatchesPiiField({
+		keyLower: key.toLowerCase(),
+		piiFieldsLower
+	})) return REDACTED_VALUE;
+	if (redactAll) return REDACTED_VALUE;
+	if (value.length > MAX_STRING_LENGTH) return value.slice(0, MAX_STRING_LENGTH) + TRUNCATED_SUFFIX;
+	return value;
+};
+const scrubArray = ({ context, value }) => {
+	if (context.visited.has(value)) return [CIRCULAR_VALUE];
+	context.visited.add(value);
+	const result = value.map((item, index) => scrubValue({
+		context,
+		key: String(index),
+		value: item
+	}));
+	context.visited.delete(value);
+	return result;
+};
+const scrubObject = ({ context, value }) => {
+	if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
+	context.visited.add(value);
+	const result = Object.create(null);
+	for (const key of Object.keys(value)) result[key] = scrubValue({
+		context,
+		key,
+		value: value[key]
 	});
-	return {
-		address: verifiedCredential.address,
-		addressesWithTypes: verifiedCredential.walletAdditionalAddresses,
-		chain,
-		hardwareWalletVendor: verifiedCredential.walletProperties?.hardwareWallet,
-		id: walletAccountId,
-		lastSelectedAt: verifiedCredential.lastSelectedAt ?? null,
-		verifiedCredentialId: verifiedCredential.id,
-		walletProviderKey
-	};
+	context.visited.delete(value);
+	return result;
 };
-
-//#endregion
-//#region src/modules/wallets/getWalletAccounts/getWalletAccountsFromState/getWalletAccountsFromState.ts
-/** @notInstrumented */
-const getWalletAccountsFromState = ({ unverifiedWalletAccounts, user }, client) => {
-	const walletAccountsMap = /* @__PURE__ */ new Map();
-	/**
-	* Handle the unverified wallet accounts before the user verified credentials
-	* so the later verified wallet accounts can override the unverified wallet accounts
-	*/
-	unverifiedWalletAccounts.forEach((unverifiedWalletAccount) => {
-		const walletAccount = convertUnverifiedWalletAccountToWalletAccount({ unverifiedWalletAccount });
-		walletAccountsMap.set(walletAccount.id, walletAccount);
+const scrubValue = ({ context, key, value }) => {
+	if (value === null || value === void 0) return value;
+	if (value instanceof Uint8Array) return `[${BINARY_LABEL}:${value.byteLength} bytes]`;
+	if (keyMatchesPiiField({
+		keyLower: key.toLowerCase(),
+		piiFieldsLower: context.piiFieldsLower
+	})) return REDACTED_VALUE;
+	if (typeof value === "string") return scrubString({
+		key,
+		piiFieldsLower: context.piiFieldsLower,
+		redactAll: context.redactAll,
+		value
 	});
-	(user?.verifiedCredentials ?? []).filter((verified) => verified.format === JwtVerifiedCredentialFormatEnum.Blockchain).forEach((verifiedWalletAccount) => {
-		try {
-			const walletAccount = convertVerifiedCredentialToWalletAccount({ verifiedCredential: verifiedWalletAccount }, client);
-			walletAccountsMap.set(walletAccount.id, walletAccount);
-		} catch (error) {
-			/**
-			* A verified credential can be missing the data required to resolve its
-			* wallet provider (e.g. a legacy credential without a walletName). Skip
-			* it instead of throwing so a single unconvertible credential does not
-			* abort the whole mapping — which, during client initialization, would
-			* otherwise fail init and leave the app stuck loading. The wallet stays
-			* absent until the user reconnects it.
-			*/
-			getCore(client).logger.debug(`Skipping verified credential ${verifiedWalletAccount.id}: unable to convert to wallet account`, error);
-		}
+	if (Array.isArray(value)) return scrubArray({
+		context,
+		value
 	});
-	return Array.from(walletAccountsMap.values());
-};
-
-//#endregion
-//#region src/modules/wallets/getWalletAccounts/getWalletAccounts.ts
-/**
-* Retrieves all wallet accounts associated with the current session.
-*
-* This function returns both verified and unverified wallet accounts,
-* combining data from user credentials and local unverified accounts.
-* You can differentiate between verified and unverified wallet accounts by
-* checking the `verifiedCredentialId` property.
-*
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns An array of wallet accounts associated with the session.
-* @notInstrumented
-* @hook Exposed as a hook so consumers get the reactive list of wallet accounts.
-*/
-const getWalletAccounts = (client = getDefaultClient()) => {
-	const { unverifiedWalletAccounts, user } = getCore(client).state.get();
-	return getWalletAccountsFromState({
-		unverifiedWalletAccounts,
-		user
-	}, client);
-};
-
-//#endregion
-//#region src/errors/NoWalletProviderFoundError.ts
-var NoWalletProviderFoundError = class extends BaseError {
-	constructor({ walletProviderKey }) {
-		super({
-			cause: null,
-			code: "no_wallet_provider_found_error",
-			docsUrl: null,
-			name: "NoWalletProviderFoundError",
-			shortMessage: `No wallet provider found with key: ${walletProviderKey}`
+	if (value instanceof Set) {
+		if (context.visited.has(value)) return [CIRCULAR_VALUE];
+		context.visited.add(value);
+		const setResult = scrubArray({
+			context,
+			value: [...value]
+		});
+		context.visited.delete(value);
+		return setResult;
+	}
+	if (value instanceof Map) {
+		if (context.visited.has(value)) return { [CIRCULAR_VALUE]: true };
+		context.visited.add(value);
+		const asObject = Object.create(null);
+		for (const [k, v] of value.entries()) asObject[String(k)] = v;
+		const mapResult = scrubObject({
+			context,
+			value: asObject
 		});
+		context.visited.delete(value);
+		return mapResult;
 	}
+	if (value instanceof WeakMap) return "[WeakMap]";
+	if (value instanceof WeakSet) return "[WeakSet]";
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Error) return `[Error: ${value.message}]`;
+	if (typeof value === "object") return scrubObject({
+		context,
+		value
+	});
+	return value;
+};
+/** @notInstrumented */
+const scrubParameters = ({ piiFields, redactAll, value }) => {
+	return scrubObject({
+		context: {
+			piiFieldsLower: piiFields.map((field) => field.toLowerCase()),
+			redactAll,
+			visited: /* @__PURE__ */ new WeakSet()
+		},
+		value
+	});
 };
 
 //#endregion
-//#region src/services/runtimeServices/createRuntimeServiceAccessKey/createRuntimeServiceAccessKey.ts
+//#region src/services/instrumentation/instrumentFunction/extractParams/extractParams.ts
 /**
-* Creates a service accessor function that manages service instantiation and caching.
-* The returned function will either retrieve an existing service from the registry or
-* create a new one using the provided builder function.
+* Normalises the raw positional arguments of an instrumented function call
+* into a flat `Record<string, unknown>` suitable for structured logging.
 *
-* @template - The type of service to be created/accessed
-* @param key - Unique identifier for the service in the registry
-* @param builder - Function that creates the service instance when called with a DynamicClient
-* @notInstrumented
-*/
-const createRuntimeServiceAccessKey = (key, builder) => (client) => {
-	const { runtimeServices } = getCore(client);
-	const currentService = runtimeServices.getByKey(key);
-	if (currentService) return currentService;
-	const service = builder(client);
-	runtimeServices.register(key, service);
-	return service;
+* ## Why this is needed
+*
+* Instrumented functions are wrapped with `(...args: unknown[])`, so their
+* parameters arrive as an array. Logging a raw array loses the semantic names
+* of each argument. This function recovers a named representation:
+*
+* - **No arguments** → `{}`
+* - **Single plain-object argument** → that object is returned as-is, because
+*   SDK functions follow the single-object-parameter convention, so the object
+*   already carries named keys (`{ amount, to }`, etc.).
+* - **Everything else** (multiple args, a single primitive, a single array) →
+*   each value is indexed as `arg0`, `arg1`, …
+*
+* ## Why arrays are NOT treated as plain objects
+*
+* `typeof [] === 'object'` and `[] !== null`, so without the `Array.isArray`
+* guard a single-array argument would be returned as-is. That would produce
+* an object with numeric string keys (`{ '0': ..., '1': ... }`), which is
+* misleading and inconsistent with how multi-arg calls are handled. Instead,
+* arrays fall through to the indexed `arg0` path.
+* @notInstrumented
+*/
+const extractParams = (args) => {
+	if (args.length === 0) return {};
+	if (args.length === 1 && typeof args[0] === "object" && args[0] !== null && !Array.isArray(args[0])) return args[0];
+	const result = {};
+	for (let i = 0; i < args.length; i++) result[`arg${i}`] = args[i];
+	return result;
 };
 
 //#endregion
-//#region src/modules/wallets/walletProviderRegistry/createWalletProviderRegistry/createWalletProviderRegistry.ts
+//#region src/services/instrumentation/instrumentFunction/scrubResolvedValue/scrubResolvedValue.ts
 /**
-* Creates a new wallet provider registry that manages wallet providers with priority-based registration.
-*
-* @returns The wallet provider registry instance
-*
-* @example
-* ```typescript
-* const registry = createWalletProviderRegistry();
-*
-* registry.register({
-*   priority: WalletProviderPriority.WALLET_SDK,
-*   walletProvider: myWalletProvider
-* });
-*
-* const provider = registry.getByKey('my-wallet-key');
-* const providers = registry.listProviders();
-* ```
+* Scrubs a resolved return value of any type before logging it.
+* Routes through `scrubParameters` by wrapping the value so that strings,
+* arrays, Dates, Errors, and all other types are handled identically to
+* nested object fields.
 * @notInstrumented
 */
-const createWalletProviderRegistry = (client) => {
-	const registry = /* @__PURE__ */ new Map();
+const scrubResolvedValue = ({ piiFields, redactAll, value }) => scrubParameters({
+	piiFields,
+	redactAll,
+	value: { result: value }
+}).result;
+
+//#endregion
+//#region src/services/instrumentation/instrumentFunction/instrumentFunction.ts
+const serializeError = (error) => {
+	if (error instanceof Error) return {
+		message: error.message,
+		name: error.name,
+		stack: error.stack
+	};
 	return {
-		getByKey: (key) => registry.get(key)?.walletProvider,
-		listProviderEntries: () => Array.from(registry.values()),
-		listProviders: () => Array.from(registry.values()).map((v) => v.walletProvider),
-		register: (args) => {
-			const existingEntry = registry.get(args.walletProvider.key);
-			if (existingEntry) {
-				if (existingEntry.priority < args.priority) {
-					registry.set(args.walletProvider.key, args);
-					emitEvent({
-						args: { walletProviderKey: args.walletProvider.key },
-						event: "walletProviderChanged"
-					}, client);
-				}
-			} else {
-				registry.set(args.walletProvider.key, args);
-				emitEvent({
-					args: { walletProvider: args.walletProvider },
-					event: "walletProviderRegistered"
-				}, client);
-				emitEvent({
-					args: { walletProviderKey: args.walletProvider.key },
-					event: "walletProviderChanged"
-				}, client);
-			}
-		},
-		unregister: (key) => {
-			registry.delete(key);
-			emitEvent({
-				args: { walletProviderKey: key },
-				event: "walletProviderUnregistered"
-			}, client);
-		}
+		message: String(error),
+		name: "UnknownError"
 	};
 };
-
-//#endregion
-//#region src/modules/wallets/walletProviderRegistry/getWalletProviderRegistry/getWalletProviderRegistry.ts
 /**
-* This function provides access to a shared instance of the wallet provider registry.
+* Wraps a function so that each invocation emits a structured
+* `FunctionInstrumentationEvent` at three lifecycle points:
 *
-* It ensures that the same registry instance is used throughout the client to maintaining
-* consistency of registered wallet providers across different parts of the codebase.
+* - **started** — immediately before the function body executes, with the
+*   PII-scrubbed call parameters.
+* - **resolved** — after the function (or its returned Promise) settles
+*   successfully, with the PII-scrubbed return value.
+* - **rejected** — if the function throws synchronously or its returned
+*   Promise rejects.
 *
-* @returns The wallet provider registry instance
+* The original return value (or thrown error) is always forwarded to the
+* caller unchanged — instrumentation is purely observational.
 *
-* @example
-* ```typescript
-* // Get the registry instance
-* const registry = getWalletProviderRegistry();
+* ## Usage
 *
-* // Register a wallet provider
-* registry.register({
-*   priority: WalletProviderPriority.WALLET_SDK,
-*   walletProvider: myWalletProvider
+* ```ts
+* const transfer = instrumentFunction({
+*   fn: rawTransfer,
+*   functionName: 'transfer',
+*   getCore: () => core,
 * });
 *
-* // Retrieve a specific provider
-* const provider = registry.getByKey('metamaskevm');
+* // When called, three events are emitted automatically:
+* await transfer({ amount: 1, to: '0xabc' });
 * ```
+*
+* ## How functions are wrapped
+*
+* `instrumentFunction` is not called manually in application code. Instead,
+* the esbuild instrumentation plugin (`tools/instrumentation-plugin`) injects
+* it at build time: any exported function annotated with `@instrumented` in its
+* JSDoc is automatically wrapped by the plugin during the build step.
+* The plugin strips the original `export`, renames the function, and re-exports
+* it under the original name via `instrumentFunction(...)` — so the public API
+* is unchanged and no call sites need to be updated.
+*
+* ## Opting out
+*
+* Instrumentation is skipped entirely when:
+* - `getCore()` returns `undefined` (SDK not initialised), or
+* - `core.instrumentation.config.enabled` is `false`.
+*
+* In both cases the original function is called directly with no overhead.
+*
+* ## PII scrubbing
+*
+* All string values whose key appears in `piiFields` are replaced with
+* `"[redacted]"` before events are emitted. Pass `redactAll: true` to redact
+* every field, regardless of key name.
+* @notInstrumented
 */
-const getWalletProviderRegistry = createRuntimeServiceAccessKey("walletProviderRegistry", (client) => createWalletProviderRegistry(client));
-
-//#endregion
-//#region src/modules/wallets/walletProviderRegistry/walletProviderRegistry.types.ts
-let WalletProviderPriority = /* @__PURE__ */ function(WalletProviderPriority$1) {
-	/**
-	* Highest priority should be used by wallet providers that implement
-	* the most reliable wallet integration.
-	* example: The SDK provided by the wallet provider.
-	*/
-	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SDK"] = 100] = "WALLET_SDK";
-	/**
-	* Medium priority should be used by wallet providers that implement
-	* a wallet integration via some reliable standard.
-	* example: A wallet provider that uses EIP6963 announcement.
-	*/
-	WalletProviderPriority$1[WalletProviderPriority$1["WALLET_SELF_ANNOUNCEMENT_STANDARD"] = 50] = "WALLET_SELF_ANNOUNCEMENT_STANDARD";
-	/**
-	* Low priority should be used by wallet providers that implement
-	* a wallet integration on a less reliable standard.
-	* example: A wallet provider that uses window.ethereum, where the
-	* window key can be overridden by other extensions.
-	*/
-	WalletProviderPriority$1[WalletProviderPriority$1["WINDOW_INJECT"] = 20] = "WINDOW_INJECT";
-	return WalletProviderPriority$1;
-}({});
-
-//#endregion
-//#region src/modules/wallets/utils/getWalletProviderFromWalletAccount/getWalletProviderFromWalletAccount.ts
-/** @notInstrumented */
-const getWalletProviderFromWalletAccount = ({ walletAccount }, client) => {
-	const walletProvider = getWalletProviderRegistry(client).getByKey(walletAccount.walletProviderKey);
-	if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey: walletAccount.walletProviderKey });
-	return walletProvider;
+const instrumentFunction = ({ fn, functionName, getCore: getCore$1, redactAll }) => {
+	const wrapped = (...args) => {
+		const core = getCore$1();
+		if (!core) return fn(...args);
+		if (!core.instrumentation.config.enabled) return fn(...args);
+		const instrumentation = core.instrumentation;
+		const state = core.state.get();
+		const baseEvent = {
+			environmentId: core.environmentId,
+			functionName,
+			operatingSystem: getOperatingSystem(),
+			parameters: scrubParameters({
+				piiFields: instrumentation.config.piiFields,
+				redactAll,
+				value: extractParams(args)
+			}),
+			platform: getPlatform(),
+			registeredExtensionKeys: Array.from(core.extensions),
+			sdkSessionId: core.sdkSessionId,
+			sdkVersion: core.version,
+			status: "info",
+			tokenSessionId: state.token ? extractSessionId(state.token) : null,
+			userAgent: getUserAgent(),
+			userId: state.user?.id ?? null
+		};
+		instrumentation.logFunction({
+			...baseEvent,
+			phase: "started",
+			timestamp: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		try {
+			const result = fn(...args);
+			if (result instanceof Promise) return result.then((value) => {
+				instrumentation.logFunction({
+					...baseEvent,
+					phase: "resolved",
+					resolvedValue: scrubResolvedValue({
+						piiFields: instrumentation.config.piiFields,
+						redactAll,
+						value
+					}),
+					timestamp: (/* @__PURE__ */ new Date()).toISOString()
+				});
+				return value;
+			}).catch((error) => {
+				instrumentation.logFunction({
+					...baseEvent,
+					phase: "rejected",
+					rejectedError: serializeError(error),
+					timestamp: (/* @__PURE__ */ new Date()).toISOString()
+				});
+				throw error;
+			});
+			instrumentation.logFunction({
+				...baseEvent,
+				phase: "resolved",
+				resolvedValue: scrubResolvedValue({
+					piiFields: instrumentation.config.piiFields,
+					redactAll,
+					value: result
+				}),
+				timestamp: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return result;
+		} catch (error) {
+			instrumentation.logFunction({
+				...baseEvent,
+				phase: "rejected",
+				rejectedError: serializeError(error),
+				timestamp: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			throw error;
+		}
+	};
+	return wrapped;
 };
 
-//#endregion
-//#region src/modules/auth/consts.ts
-const DYNAMIC_AUTH_COOKIE_NAME = "DYNAMIC_JWT_TOKEN";
-
 //#endregion
 //#region src/constants.ts
 const SDK_API_CORE_VERSION = dependencies["@dynamic-labs/sdk-api-core"];
@@ -1674,5 +1664,5 @@ var InvalidParamError = class extends BaseError {
 };
 
 //#endregion
-export { getOperatingSystem as $, fetchAndStoreNonces as A, LinkCredentialError as B, splitWalletProviderKey as C, onEvent as D, offEvent as E, getDeviceSigner as F, assertDefined as G, APIError as H, getNonce as I, instrumentFunction as J, ValueMustBeDefinedError as K, SandboxMaximumThresholdReachedError as L, UnauthorizedError as M, createDeviceSignatureHeadersMiddleware as N, onceEvent as O, getHeadersForNonceSignedByDeviceSigners as P, getPlatform as Q, MfaRateLimitedError as R, normalizeAddress as S, emitEvent as T, getSessionKeys as U, InvalidExternalAuthError as V, isCookieEnabled as W, DEFAULT_PII_FIELDS as X, scrubParameters as Y, getUserAgent as Z, formatWalletProviderKey as _, DYNAMIC_WAAS_METADATA as a, getDefaultClient as at, CHAINS_INFO_MAP as b, SDK_API_CORE_VERSION as c, BaseError as ct, WalletProviderPriority as d, version as dt, extractSessionId as et, getWalletProviderRegistry as f, getWalletAccountsFromState as g, getWalletAccounts as h, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as i, NONCE_POOL_SIZE as it, createApiClient as j, setCookie as k, DYNAMIC_AUTH_COOKIE_NAME as l, getCore as lt, NoWalletProviderFoundError as m, isWaasWalletProvider as n, CLIENT_SDK_NAME as nt, isUserMissingMfaAuth as o, setDefaultClient as ot, createRuntimeServiceAccessKey as p, __getElevatedAccessToken_wrapped as q, DEFAULT_WAAS_BASE_API_URL as r, DYNAMIC_SDK_API_VERSION as rt, DYNAMIC_ICONIC_SPRITE_URL as s, ClientNotFoundError as st, InvalidParamError as t, randomString as tt, getWalletProviderFromWalletAccount as u, name as ut, normalizeWalletNameWithChain as v, InvalidWalletProviderKeyError as w, formatWalletAccountId as x, getChainFromVerifiedCredentialChain as y, MfaInvalidOtpError as z };
-//# sourceMappingURL=InvalidParamError-BeCPhfVz.esm.js.map
+export { ValueMustBeDefinedError as $, splitWalletProviderKey as A, createDeviceSignatureHeadersMiddleware as B, getWalletAccountsFromState as C, CHAINS_INFO_MAP as D, getChainFromVerifiedCredentialChain as E, onceEvent as F, MfaRateLimitedError as G, getDeviceSigner as H, setCookie as I, InvalidExternalAuthError as J, MfaInvalidOtpError as K, fetchAndStoreNonces as L, emitEvent as M, offEvent as N, formatWalletAccountId as O, onEvent as P, assertDefined as Q, createApiClient as R, getWalletAccounts as S, normalizeWalletNameWithChain as T, getNonce as U, getHeadersForNonceSignedByDeviceSigners as V, SandboxMaximumThresholdReachedError as W, getSessionKeys as X, APIError as Y, isCookieEnabled as Z, getWalletProviderFromWalletAccount as _, DYNAMIC_WAAS_METADATA as a, getDefaultClient as at, createRuntimeServiceAccessKey as b, SDK_API_CORE_VERSION as c, BaseError as ct, DEFAULT_PII_FIELDS as d, version as dt, getElevatedAccessToken as et, getUserAgent as f, DYNAMIC_AUTH_COOKIE_NAME as g, extractSessionId as h, DEFAULT_WAAS_BASE_MPC_RELAY_API_URL as i, NONCE_POOL_SIZE as it, InvalidWalletProviderKeyError as j, normalizeAddress as k, instrumentFunction as l, getCore as lt, getOperatingSystem as m, isWaasWalletProvider as n, CLIENT_SDK_NAME as nt, isUserMissingMfaAuth as o, setDefaultClient as ot, getPlatform as p, LinkCredentialError as q, DEFAULT_WAAS_BASE_API_URL as r, DYNAMIC_SDK_API_VERSION as rt, DYNAMIC_ICONIC_SPRITE_URL as s, ClientNotFoundError as st, InvalidParamError as t, randomString as tt, scrubParameters as u, name as ut, WalletProviderPriority as v, formatWalletProviderKey as w, NoWalletProviderFoundError as x, getWalletProviderRegistry as y, UnauthorizedError as z };
+//# sourceMappingURL=InvalidParamError-DZjc7Tjc.esm.js.map